Step 1: Figure out what happened or is happening

If possible, you want to figure out as much about the attack as possible so that you can respond accordingly. If an attacker is transferring files from your computer to another device, for example, you want to disconnect your device from the Internet ASAP.

That said, most home users do not have the technical skills to properly analyze and understand exactly what the nature of a particular attack may be — unless, of course, the attack is overt in nature (see Chapter 12).

Gather as much information as you can about

• What happened
• What information systems and databases were hit
• What could a criminal or other mischievous party do with the stolen material
• What data and programs have been affected
• Who, besides yourself, may face risks because of the breach (this includes any potential implications for your employer)
• What other parties (if any) need to be notified ASAP of the breach

Do not spend a lot of time on this step — you need to take action, not just document — but the more information that you do have, the greater the chances that you will be able to prevent another similar attack in the future.

Step 2: Contain the attack

Cut off the attacker by isolating the attacker from the compromised devices. Containing may entail:

• Terminating all network connectivity ASAP: To terminate network connectivity for all devices on a network, turn off your router by unplugging it. (Note: If you’re in a business setting, this step is usually not possible.)
• Unplugging any Ethernet cables: Understand, however, that a network-borne attack may have already spread to other devices on the network. If so, disconnect the network from the Internet and disconnect each device from your network until it is scanned for security problems.
• Turning off Wi-Fi on the infected device: Again, a network-borne attack may have already spread to other devices on the network. If so, disconnect the network from the Internet and disconnect each device from your network by turning off Wi-Fi at the router and any access points, not just on the infected computer.
• Turning off cellular data: In other words, put your device into airplane mode.
• Turning off Bluetooth and NFC: Bluetooth and NFC are both wireless communication technologies that work with devices that are in close physical proximity to one another. All such communications should be blocked if there is a possibility of infections spreading or hackers jumping from device to device.
• Unplugging USB drives and other removable drives from the system: Note: The drives may contain malware, so do not attach them to any other systems.
• Revoking any access rights that the attacker is exploiting: If you have a shared device and the attacker is using an account other than yours to which the attacker somehow gained authorized access, temporarily set that account to have no rights to do anything.

If, for some reason, you need Internet access from your device in order to get help cleaning it up, turn off all other devices on your network, to prevent any attacks from spreading over the network to your device. Keep in mind that such a scenario is far from ideal. You want to cut off the infected device from the rest of the world, not just sever the connections between it and your other devices.

Step 3: Terminate and eliminate the attack

Containing an attack (see preceding section) is not the same thing as terminating and eliminating an attack. Malware that was present on the infected device is still present after disconnecting the device from the Internet, for example, as are any vulnerabilities that a remote hacker or malware may have exploited in order to take control of your device. So, after containing the attack, it is important to clean up the system.

The following sections describe some steps to follow at this point:

Restart the system and run an updated security scan

For Windows computers, after you have cleaned the system, restart it in Safe Mode with networking using the procedure described above (but selecting Safe Mode with Networking rather than Safe Mode), run the security software, download all updates, and run the security software scan again. If there are no updates, then you do not need to rerun the security software.

If you are using a Mac, Safe Boot already included networking so there is no reason to repeat the scan. Install all relevant updates and patches. If any of your software has not been updated to its latest version and may contain vulnerabilities, fix this during the cleanup.

If you have the time to do so, run the security software full scan again after you have installed all the updates. There are several reasons for doing so, including the fact that you want it to check your system using its own most-up-to-date information on malware and other threats, as well as the fact that you want its heuristic analysis engine to have a baseline of what the system looks like with its latest updates.

Erase all potentially problematic System Restore points

System Restore is a useful tool, but it can also be dangerous. If a system creates a restore point when malware is running on a device, for example, restoring to that point will likely restore the malware! After cleaning up a system, therefore, be sure to erase all system restore points that may have been created when your system was compromised. If you are unsure if a restore point may be problematic, erase it. For most users, this means that it may be good to erase all system restore points. To do this:

1. Click the Start menu.
2. Click Control Panel.
3. Click All Control Panel Items.
4. Click Recovery.
5. Click Configure System Restore.
6. Follow the prompts to delete the relevant system restore points.

Restore modified settings

Some attackers and malware may modify various settings on your device. What page you see when you start your web browser — for example, your web browser home page — is one common item that malware commonly changes. It is important to change the browser page back to a safe page as the malware’s starting page might lead to a page that reinstalls malware or performs some other nefarious task. The following sections walk you through the process for each browser.

When using the phone or tablet versions of the browsers described in the following sections, the process will differ slightly, but should be simply discernable based on the instructions.

Rebuild the system

Sometimes it is easier, instead of following the aforementioned processes, to simply rebuild a system from scratch. In fact, because of the risk of security software missing some problem, or of user mistakes when performing the security cleanup, many experts recommend that, whenever possible, one should rebuild a system entirely after a breach.

Even if you plan to rebuild a system in response to a breach, it is still wise to run a security software scan prior to doing so as there are some rare forms of malware that can persist even after a restore (such as BIOS reprogramming malware, certain boot sector viruses, and so on), and to scan all devices on the same network as the compromised device at the time of the compromise or afterwards, so as to ensure that nothing bad can propagate back to the newly restored device.

Paying ransoms

If you have proper backups, you can remove ransomware the same way that you remove other malware. If any data gets lost in the process, you can restore it from backups.

If you have been hit with over ransomware and do not have proper backups, however, you may face a difficult decision. Obviously, it is not in the common interest for you to pay a ransom to a criminal in order get your data back, but in some cases, if your data is important to you, that may be the route that you need to go. In many cases, criminals will not even give you your data back if you do pay the ransom — so, by paying a ransom, you may not only waste money, but still suffer a permanent loss of your data. You will need to decide if you want to take that chance. (Hopefully, the information in the preceding few sentences will serve as a strong motivator for readers to back up proactively as discussed in the chapter on backups, rather than to rely on paying ransoms as a possible method of addressing ransomware attacks.)

The best defense for home users against the impact of ransomware is to back up and keep the backups disconnected from anything else!

Before paying a ransom, consult an information security expert and a lawyer.

Learning for the future

It is important to learn from breaches. If you can figure out what went wrong, and how a hacker managed to get into your systems (either directly or by using malware), you can institute de facto policies and procedures for yourself to prevent future such compromises. A cybersecurity professional may be able to help you vis-à-vis doing so.

Reason the notice was sent

Multiple types of data breaches lead to organizations sending notifications. Not all of them represent the same level of risk to you, however. Notifications may be sent when a company has

• Knowledge that an unencrypted database containing personal information was definitely stolen
• Knowledge that an encrypted database containing personal information was definitely stolen
• Detected unauthorized activity on a computing device housing your information
• Detected unauthorized activity on a computing device, but not the one that houses your information (but on one connected to the same or logically connected network)
• Detected the theft of credit or debit card numbers as can occur with a skimming device or the hacking of a point-of-sale credit card processing device
• Discovered that there were, or may have been, improperly discarded computers, hard drives, or other storage media or paper-based information
• Discovered that there was, or may have been, improperly distributed information, such as sensitive information sent to the wrong parties, unencrypted email sent to authorized parties, and so on

In all these cases, action may be warranted. But if a company notifies you that an unencrypted database of passwords including yours was stolen, the need to act is more urgent than if it detects unauthorized activity on a system on the same network as another machine containing only an encrypted version of your password.

Scams

Criminals see when a breach receives significant attention and often leverage the breach for their own nefarious purposes. One common technique is for crooks to send bogus emails impersonating the breached party. Those emails contain instructions for setting up credit monitoring or filing a claim for monetary compensation for the pain and inconvenience suffered due to the breach. Of course, the links in such messages point to phishing sites, sites that install malware, and other destinations to which you do not want to go.

Criminals also act quickly. In February 2015, for example, Better Business Bureaus across the United States started reporting complaints of emails impersonating Anthem, Inc., less than one day after the health insurance company announced that it had suffered a breach.

Passwords

One of the types of breaches most commonly reported in the mass media involves the theft of password databases. Modern password authentication systems are designed to provide some protection in case of a breach. Passwords are usually stored in a hashed format, meaning that they are stored with one-way encryption. When you enter your password during an attempt to log in, what you type is hashed and then compared with the relevant hash value stored in the password database. As such, your actual password is not stored anywhere and is not present in the password database. If a hacker steals a password database, therefore, the hacker does not immediately obtain your password.

At least that is how things are supposed to work.

In reality, however, not all authentication systems are implemented perfectly; hashed password databases have multiple exploitable weaknesses, some of which can help criminals decipher passwords even when they’re hashed. For example, if a criminal looks at the database and sees that the hashed password for many people is the same, it is likely to be a common password (maybe even “password”), which often can be cracked quickly. There are defenses against such attacks, but many authentication systems do not use them.

As such, if you are notified by a company that it has been breached and that an encrypted version of your password was stolen, you should probably reset the password. You don’t need to panic, though. In most cases, your password was likely protected by the hashing (unless you selected a common, weak password, which, of course, you should not have). If, for some reason, you have reused the compromised password on other sites that you don’t want have unauthorized parties to log in as you, you should reset your password there as well and don’t reuse the new password this time!

Keep in mind that every so often hash functions are rendered obsolete and vulnerable. So, if a party is using outdated software, the hashed versions of passwords may be far less secure than necessary.

Payment card information

If your credit card information or debit card information may have been compromised, take the following measures:

• Leverage credit monitoring services. Breached firms often give those people potentially affected by the relevant breaches a free year or two of credit monitoring. While one should never rely on such services to provide full protection against identity theft, using such services does have benefit. Being that the cost to you is only a few minutes of time to set up an account, you should probably do so.
• Monitor your credit reports. If you see any new accounts that you did not open, immediately contact the party involved. Remember, when it comes to fraud, the earlier that you report a problem, the less aggravation you are likely to suffer from it.
• Set up text alerts. If your card issuer offers the capability to set up text alerts, use the feature. That way, you’ll be notified when charges are made and can act quickly if something appears to be amiss.
• Check your monthly statements. Make sure that you continue to receive your account’s statements as you did before and that they are not being misdirected to someone else.
• Switch to e-statements. If possible, set up your account to receive electronic monthly statements rather than physical statements and make sure that you receive an email and/or text message when each and every statement is issued. Of course, be sure to properly protect the email account and smartphone to which such messages are sent.

Government-issued documents

If your passport, driver’s license, or other government-issued identity document has been compromised, you should contact the agency that issued the relevant document and ask how you should proceed. Document everything that you’re told, including details as to who told you what, and when they did so. Keep a log of all calls that you make and what transpired on those calls.

You should also check online on the agency’s website to see whether it offers instructions for such scenarios. In some cases, agencies will advise you to replace the document, which may necessitate a physical visit to an agency office. In other cases, the agency will advise you to do nothing, but will tag your account so that if the document is used for identification at other government agencies, those checking the ID will know to be extra vigilant (which, in itself, might be a reason to replace the document so that you do not encounter any extra aggravation when using it as ID).

School or employer-issued documents

If your school or employer ID information is compromised, you should immediately notify the issuer. Not only could the compromised information be used to social engineer your school or employer, but it may potentially be used to obtain sensitive information about you from either one, or to otherwise get you into trouble.

Social media accounts

If any of your social media accounts is compromised, immediately contact the relevant social media provider. All major platforms have mechanisms to address stolen accounts because all major platforms have had to deal with stolen accounts numerous times. Keep in mind that you may be asked to provide government ID to prove your identity as part of the account recovery process.

In such a situation, it is also often a good idea to warn people with whom you are connected on the compromised social media platform of the potential misuse of your account. If you make fully public posts on the platform housing the compromised account, you may wish to notify the public at large.

You can notify people via your non-compromised social media accounts that the compromised account has been compromised, so that if the party that took over the accounts attempts to perpetrate a scam using the account (such as by posting some request for money or the like), fewer people will fall prey. You can also use email, texting, or the phone to contact individual parties who may be put at risk.