2023_roundup.jpg

HackCheck 2023 Cybersecurity Roundup - Worst Year So Far?

In these past few years, with breach incidents & associated costs surpassing previous years, taking precautions and staying safe should be at the top of the list of users caring for their privacy and security. Choosing a secure password for your accounts is the first line of defense against cyber-attacks and risks of getting hacked, as Securing passwords helps you to keep your personal data and financial information.

Weak passwords increase the risk of brute force and exploitation of your personal data, which can lead to phishing attacks, and identity theft once the bad actors can get a hold of your personal information such as your name, email, phone number, address and other sensitive data. At the end of the day choosing secure passwords for your accounts gives you peace of mind and saves you time and money in the long run by preventing cyber-crimes. 

In this article, we are going through a password guideline, on how to choose and store secure passwords to keep your online identity and data safe.

## What Makes a Password Secure?
We should first cover what methods hackers use to get access to your data or password and then try to choose a password that protects us from these methods. A secure password is one that protects us from these methods that hackers use to gain access to our accounts. 

### Brute Force
Brute force is the act of guessing the password repeatedly. In this method the password is cracked by trying every possible combination of characters (not always "every possible" combination though). It requires a lot of computational power and noticeable time. However, as the computers’ availability improves, this methos is more practical to hackers. 

Brute force remains the most used method to steal your credentials. It's estimated to [account for 80% of all data breaches](https://www.strongdm.com/blog/brute-force-attack#:~:text=5%25%20of%20all%20data%20breaches,force%20or%20lost%2Fstolen%20credentials.)

**How to stay secure from Brute Force?**
1. **Avoid using common passwords**
2.  **A password with at least 12 characters**, containing uppercase letters and lowercase letters, numbers and symbols. makes it substantially harder to guess, even impossible to a degree.
3.  **Use Multi-factor authentication**, This adds a layer of security. SMS authentication is not the safest 2fa option as it can be prone to specific attacks such as sim-swap.

### Dictionary Attacks
In this method, there is a pre-built list of words and phrases that are common in passwords and the hacker tries them as the password until the correct password is found.

**How to stay secure from Dictionary Attacks?**
1. **Avoid reusing passwords**. Reused passwords might eventually end up in the dictionaries that hackers use.
2. **Avoid using common passwords**. Common passwords make up to 10% of all breached passwords, so you are at much higher risk if you use these passwords.
3. **Use random phrases as password**, you can use a password manager to store those passwords.

### Social Engineering
Social engineering is the act of using techniques to talk you into revealing specific information such as passwords. Social Engineering remains **the most used method** that hackers use to gain access to your account, it is accounted for [90% of all data breach incidents](https://www.spiceworks.com/it-security/cyber-risk-management/articles/social-engineering-still-rampant/#:~:text=is%20widely%20undercounted.-,Hackers%20leverage%20social%20engineering%20in%20as%20much%20as%2090%25%20of,were%20caused%20by%20social%20engineering.).

**How to stay secure from Social Engineering?**
1. **Be cautious about unsolicited phone calls and emails**
2. **never share your password with anyone whose identity is not verified.** Companies, services, and websites usually never ask for your password. So be extra cautious about sharing your password or other sensitive information with anyone.
3. **Use Multi-factor authentication**, This adds a layer of security. SMS authentication is not the safest 2fa option as it can be prone to specific attacks such as sim-swap.

### Password Reuse
This method is used for people who use one password for multiple accounts, as soon as one password is cracked other accounts aren’t safe anymore and can get hacked easily.

**How to stay secure?**
1. **Use a different password every time**. Use password managers to keep those passwords.

## How to Choose Secure Passwords
Now that we have covered the most frequently used methods hackers use to gain access to your password, we should be able to make a general guideline on how to choose and store a secure & strong password.

A secure password is one that follows these standards:
1. **It is more than 12 characters with numbers, uppercase letters, and symbols**, an 8 character password which was deemed secure a few years ago, can be cracked more easily now. You can use password vault/generators to generate these passwords.
2. **It is not a common password**. Common passwords are usually names, dates of birth, places, etc.
3. **It is not breached or used previously**. You can check if your passwords are in a previous data breach by using [HackCheck data breach search engine](https://hackcheck.io/).
4. **You have a multi-factor authentication set up.** We do not recommend using SMS as your ONLY multi-factor authentication, as it is vulnerable to attacks itself.

After following these guidelines, you have a secure password which is very hard to compromise. But doing so comes at a downside of having to remember/store the password. 

## How to Store a Secure Password
Password Vaults like [Bitwarden](https://bitwarden.com/) help you generate and store your passwords and access them on any device you need. Cloud password managers are also prone to data breaches (although they are encrypted), so if you don't look for multi device password managers, we suggest **offline password managers**, such as [KeepassXC](https://keepassxc.org/).

There is another kind of "password managers" that do not actually store your password, rather generate it on the fly based on your username, secret phrase and domain. You no longer must store the password which reduced the risk greatly (either locally or on the cloud) but comes with the downside of being dependent on the app itself. [Spectre](https://spectre.app/) is one of those type of "password managers". 

To summarize,
1. Use [Bitwarden](https://bitwarden.com/) for cloud-based password manager to sync your password accross devices (encrypted with your master password)
2. Use [KeepassXC](https://keepassxc.org/) for locally kept passwords for a more secure experience
3. Use [Spectre](https://spectre.app/) to eliminate the need of storing your passwords

PasswordGuidelines.jpeg

PasswordGuidelines_thumb.jpg

Password Guidelines: Creating Secure Passwords

Upon visiting HackCheck today, you'll be met with the new version of the website. It took us a long time to add these features, iron out the bugs make a better interface for you, our users, and make it stand out. This new version has been in development since early 2023 and we spent countless hours and a large number of commits into making it what it is now.

There are quite a large number of big additions to HackCheck v2, which we'll cover below.

## Introducing Breach Monitors
Searching your data in data breach search engines has been a core part of HackCheck, but what's better than that? Proactive monitoring!
You can now set up a "Breach Monitor" for your sensitive data or domain and we will continuously scan data breaches and email you ASAP if that cursed day of finding your data in a breach comes. You can monitor all kinds of data such as usernames, passwords, emails, etc.

Breach Monitors are now available as an add-on for your plans or standalone products (you can own multiple).
![breach_monitors.jpg](https://blog.hackcheck.io/uploads/Screen_Shot_2024_01_01_at_6_26_34_PM_0d694338e9.png)

## Bulk Search
You can now ditch a single asset per search and use the new addition to the dashboard, bulk searches. This new feature operates exactly the same as your normal search, but you can search multiple assets at once.
Once you submit your data, it will usually take only a few seconds, if any of your data was found in the search the results will be downloadable as a JSON or TSV file.
![bulk_search.jpg](https://blog.hackcheck.io/uploads/bulk_search_6956d668f3.jpg)

## Streamlined Plans
HackCheck is used to a lot of plans ... too many. Plans are now streamlined, combining API access into normal plans, resulting in four unique plans including **the free plan**. You can now get what you need from HackCheck plans, without compromising anything.
If you want a custom plan specific to your need (e.g. you only need a certain feature, you want a more freeing API rate limited) you can now contact us directly from the plans section of the dashboard, and we'll get right back to you!

## Improvements
While this was it all for features, it's still ongoing! There are loads of small additions and improvements:
- Additional Query Options
- Result Exporting
- Improved Search Speeds
- A clearer invoice page, to see what you are exactly getting
- A more complete payment page
- Blogs! Just like the one you are reading right now

HackCheck will continue to strive to bring you the best tool for your cybersecurity needs, stay tuned for more updates coming very soon.

Best Regards,
HackCheck Team


banner.png

HackCheck V2 - Whats New?

On Tuesday, February 27th, a cybercriminal using the alias KryptonZambie shared a link on the BreachForums hacking forum which contains 9GB of leaked data of Cutout.pro, an AI-based website. The data that has been breached is about 9GB and it contains 41.4 million records related to 20 million users leaked, however, the real number of victim users is not specifically clear.

![breach Forums cutout pro](https://blog.hackcheck.io/uploads/cutoutpro_dfd3d21553.png)

The leaked information includes:
- User ID
- Email address
- User IP
- Mobile phone number
- Profile picture
- API access key
- Account creation date,
- Password (Hashed)
- salt used in hashing
- user type 
- account status
- requested images or videos.

HackCheck has quickly indexed these records, allowing you to check if your data is included in the leaked records by using HackCheck’s Data breach search engine dashboard.

Image editing apps Vivid App and AYAYA's accounts were also in the open database as Cutout.pro releases both service providers on its website as its customers.

Cutout.Pro is an AI-based platform that offers visual services like removing backgrounds and editing pictures for several purposes. This website was founded in 2018 and since then businesses and individuals have been using it. The company behind this website, Describli, is a software development company based in Hong Kong that specializes in software solutions for graphic designs.

Although it is not clear how Cutout.pro data was breached, according to the Cybernews team an ElasticSearch instance was not appropriately configured, allowing anyone to perform CRUD (Create, Read, Update, Delete) operations. This open ElasticSearch instance gave attackers a chance to carry out a denial of service (DoS) attack. Cybercriminals could have ended up using the open ElasticSearch instance as an initial access point to enter the database.

The leaked data can cause several problems for the users as people might have uploaded their private images of them on this platform. It can also lead to confidence loss for businesses that have been using this platform for their customers, leading to [an ever-increasing cost of data breaches](https://hackcheck.io/blog/hack-check-2023-roundup-worst-year-so-far).

It's advised for users to change their passwords, as the passwords were MD5 hashes, which are easier to crack with today's technology. Consider creating[ a strong, and unique password](https://hackcheck.io/blog/password-guidelines-creating-secure-passwords) to avoid further issues. Users also should change their passwords on other online platforms in which they've used the same credentials and be cautious about phishing emails.


cutout-thumb.png

AI Platform, Cutout.pro, data breach exposed 20 million records

There are many reasons why data breaches happen, but nearly 86% of data breaches involve stolen credentials (mostly through phishing) and it has become evident that users need more than just a password to secure their accounts. Adding another layer of security, 2 factor authentication, on top of a password helps you mitigates the risk of unwanted access. In this article, we'll go through what is 2 Factor authentication, and what are the best applications you can download & use.

## How does 2 Factor Authentication Work
When using 2 factor authentication, a password is no longer the only thing that is needed to get access to the data and even if your password is revealed in any way, no one can access your information. This works by requesting you to enter a random code each time you log in (or try to access/modify your data) and the code is obtained through a specific way (SMS, email, Authenticator apps) and is usually fast expiring.

Your password, even if you pay enough attention to choosing a complex and strong password, can get into the hands of malicious actors through various means, such as a phishing attack or brute force attack. Two-factor authentication mitigates some risks by requiring users to authenticate by means other than a password.

## Different Types of 2 Factor Authentication
Two Factor Authentication can be in several types. In some cases, the second authentication is also a PIN or password, it can also be an answer to a security question of which you're the only one who is aware. Sometimes it's a code or link that you receive the in form of a text message on the number that you've previously added to your account or in an email to make sure that it's you. Considering the sensitivity and confidentiality of the data, the second authentication can also involve biometrics such as fingerprint, facial ID, and retina scans.
The most usual type of 2FA Authentication, aside from SMS and Email, is software token authentication. 


## 2 Factor Authentication Applications
There are many 2 factor authentication apps available for download for different OS/Browsers, but we'll go through some of the best free applications available, whether you are using Apple devices, Android phones, Windows, or just want a browser extension.


### 2FAS
![2fas.jpg](https://blog.hackcheck.io/uploads/2fas_ffa082e6b6.jpg)
2fas is an open-source free 2 factor authentication app that excels at its job. It's an offline application and doesn't store any of your data on any server. 2fas also has browser extensions which helps you with faster access. It also provides you with the option to sync your data across devices (of the same OS).

Website: [https://2fas.com/](https://2fas.com/)



### Authenticator App by 2Stable
![2stable.jpg](https://blog.hackcheck.io/uploads/2stable_a1648cd375.jpg)
Authenticator App by 2Stable is another application on the option. It's available for Apple devices and you can sync your two factor authentication data across Mac, iPhone, and iPad. It's free as long as you're using it on only two devices and no more. It also offers fascinating options such as biometric authentication, a sync and backup option, and full encryption. You can find it on the App Store and Mac App Store, and the browser extension is also available.

Website: [Authenticator App](https://authenticator.2stable.com/)



### Authy
![authy.jpg](https://blog.hackcheck.io/uploads/authy_bafa346b68.jpg)
Twilio Authy is available for both Android and IOS users. The first thing about this app is the fact that it is a cross-platform app and it supports Windows, Android, and Apple devices all at the same time and you can even use it on your Apple watch. The only downside to Twilio Authy is that you need a phone number to create an account. You can also secure your application with an extra password to enter it.

Website: [Twilio Authy](https://authy.com/)


### Duo
![duo.jpg](https://blog.hackcheck.io/uploads/duo_d5f84d153a.jpg)
Duo is a more enterprise-friendly App on this list, and it offers multi-factor authentication. There is a free version available and doesn't have an explicit limit. They offer plans to add more users to your account as a solution. The free version supports up to 10 users. This application has a simple design which makes it easy to use. Duo offers multiple authentication controls, including push notifications, biometrics, and passcodes to the user. You can download it both in the Apple Ptore for IOS and Google Play for android devices.

Website: [Duo](https://duo.com/)


### Google Authenticator
![google_auth.jpg](https://blog.hackcheck.io/uploads/google_auth_4167bab844.jpg)
Google Authenticator is the easiest one to use, and the most basic authenticator app. Google Authenticator is a two-factor authentication application that is free and easy to use but some options are missing such Apple Watch app. You can sync your data with Google Cloud, so you won't lose any data if you lose your phone, or uninstall the app. It also offers quick access to Google Drive across many platforms. As an Android user, if you want something simple that gets the work done, Google Authenticator is your app of choice.



Recent articlefalse