WEBVTT 1 00:00:00.080 --> 00:00:04.080 So picture this. You're selling your old car, right, You 2 00:00:04.120 --> 00:00:06.320 take some photos, and you're smart, you blur out the 3 00:00:06.360 --> 00:00:09.960 license plate before posting them online. Privacy sorted, you'd think so, 4 00:00:10.000 --> 00:00:13.960 wouldn't you. Yeah, but maybe maybe not as much as 5 00:00:13.960 --> 00:00:18.920 you think. Welcome to the deep dive. Today. We're looking 6 00:00:18.960 --> 00:00:21.960 into the kind of surprising ways our digital footprints, even 7 00:00:22.000 --> 00:00:24.559 those tiny details, can expose us. 8 00:00:24.600 --> 00:00:26.320 It's a really interesting area. 9 00:00:26.199 --> 00:00:28.839 Definitely, and this is really for you if you're curious 10 00:00:28.839 --> 00:00:31.480 about staying safer online but you don't want to get 11 00:00:31.519 --> 00:00:34.439 totally bogged down in complex tech talk. We'll unpack how 12 00:00:34.479 --> 00:00:38.359 attackers use these vulnerabilities and crucially, what you can actually do. 13 00:00:38.600 --> 00:00:41.479 And we're drawing on some really solid material today, particularly 14 00:00:41.479 --> 00:00:44.880 that guide, An Ethical Guide to cyber Anonymity. Lots of 15 00:00:44.880 --> 00:00:46.640 practical insights there, exactly. 16 00:00:46.679 --> 00:00:49.799 It's a great starting point. So what's interesting straight away 17 00:00:49.920 --> 00:00:52.479 is that gap, isn't it between how private we think 18 00:00:52.479 --> 00:00:54.240 we are online and the reality. 19 00:00:54.359 --> 00:00:57.399 Yeah, how much is actually being revealed, often without us 20 00:00:57.439 --> 00:01:01.039 even knowing. The tech we use is just well, it's 21 00:01:01.079 --> 00:01:03.840 more transparent than we often realize. Our goal today is 22 00:01:03.880 --> 00:01:05.959 to kind of bridge that understanding gap for you. 23 00:01:06.280 --> 00:01:09.120 Right, So here's the plan for today's deep dive. We 24 00:01:09.159 --> 00:01:11.200 want to get a clear picture of the different types 25 00:01:11.239 --> 00:01:14.840 of information that can cause privacy headaches. We'll look at 26 00:01:14.840 --> 00:01:19.400 how attackers piece together seemingly random bits of data like 27 00:01:19.719 --> 00:01:20.879 digital detective work. 28 00:01:20.920 --> 00:01:22.319 Almost that's a good way to put it. 29 00:01:22.480 --> 00:01:26.280 And most importantly, we'll focus on practical, straightforward steps you 30 00:01:26.319 --> 00:01:29.319 can take to boost your cyber anonymity. We'll be using 31 00:01:29.400 --> 00:01:33.400 insights from the material, looking at everything from hidden info 32 00:01:33.439 --> 00:01:34.480 and photos metadata. 33 00:01:34.519 --> 00:01:38.200 We'll talk about that, Yeah, the car photo example again exactly. 34 00:01:38.000 --> 00:01:40.000 All the way to other risks on public Wi Fi 35 00:01:40.120 --> 00:01:44.120 and some honestly surprisingly simple tools that can help. We're 36 00:01:44.159 --> 00:01:48.480 aiming for those aha moments, you know, where you get 37 00:01:48.519 --> 00:01:51.920 why these things matter and how to take back some control. 38 00:01:51.680 --> 00:01:54.480 And looking at the bigger picture. It really comes down 39 00:01:54.480 --> 00:01:58.359 to realizing that information is power in the digital world. 40 00:01:58.480 --> 00:02:00.879 The more aware you are of what you're sharing, the 41 00:02:00.959 --> 00:02:03.879 better you can manage that power precisely. And that's just 42 00:02:03.879 --> 00:02:06.239 becoming more and more critical, isn't it as our lives 43 00:02:06.280 --> 00:02:08.280 move increasingly online, for sure. 44 00:02:08.479 --> 00:02:10.520 And to help us sort through all this, we've got 45 00:02:10.560 --> 00:02:13.199 an expert with us who can really connect the dots. 46 00:02:13.199 --> 00:02:16.080 See that bigger picture and explain it all clearly. 47 00:02:16.159 --> 00:02:17.159 Well, I'll certainly try. 48 00:02:17.360 --> 00:02:20.280 They'll help us focus on what's really important, why it 49 00:02:20.360 --> 00:02:23.719 matters for your security online, and you know, stop us 50 00:02:23.719 --> 00:02:24.800 getting lost in the weeds. 51 00:02:25.080 --> 00:02:27.759 It really raises a key question, doesn't it. With so 52 00:02:27.919 --> 00:02:30.400 much data flying around, how do you figure out what's 53 00:02:30.439 --> 00:02:34.879 a real risk and what should you prioritize to stay safe. 54 00:02:35.000 --> 00:02:36.439 That's what we hope to clarify. 55 00:02:36.520 --> 00:02:38.919 Okay, before we jump into the details, here's something interesting. 56 00:02:39.039 --> 00:02:42.039 Just by visiting a website you don't click anything dodgy, 57 00:02:42.159 --> 00:02:45.919 don't download a thing, that site can still often figure 58 00:02:45.919 --> 00:02:48.120 out quite a bit about your device. 59 00:02:47.840 --> 00:02:49.520 Mm hmm, things like like it's. 60 00:02:49.439 --> 00:02:54.120 Model, the operating system, your IP address, your online address basically, 61 00:02:54.479 --> 00:02:57.000 and maybe even a rough idea of your location. It 62 00:02:57.120 --> 00:03:00.240 just shows how much we can reveal without even trying. 63 00:03:00.479 --> 00:03:04.039 And what's fascinating or maybe a bit scary, is how 64 00:03:04.080 --> 00:03:08.199 often this data collection happens automatically behind the scenes. It 65 00:03:08.280 --> 00:03:12.520 highlights this sort of information imbalance between us as users 66 00:03:12.639 --> 00:03:14.319 and the online services we use. 67 00:03:14.439 --> 00:03:17.039 Definitely, okay, so let's break down the actual types of 68 00:03:17.080 --> 00:03:20.439 information that can cause problems the resources group them usefully. 69 00:03:20.520 --> 00:03:24.080 First up, personal information, the obvious. 70 00:03:23.639 --> 00:03:25.479 Stuff, right your name, address. 71 00:03:25.319 --> 00:03:29.919 Contact details, birthday, email, maybe even bank details, standard stuff. 72 00:03:29.639 --> 00:03:32.199 And then there's sensitive information, and this carries a much 73 00:03:32.240 --> 00:03:34.199 higher risk if it gets out exactly. 74 00:03:34.240 --> 00:03:37.800 We're talking criminal records, health info, biometric data like fingerprint, 75 00:03:37.840 --> 00:03:41.919 sexual orientation, even things like union membership. The key difference 76 00:03:42.000 --> 00:03:46.000 is the potential for direct harm, right discrimination, financial loss. 77 00:03:46.159 --> 00:03:49.639 That's a crucial distinction. Any personal data leak is bad, 78 00:03:49.759 --> 00:03:53.479 but sensitive info getting out can have immediate, serious consequences. 79 00:03:53.840 --> 00:03:56.680 And it's not just that really sensitive stuff. There's this 80 00:03:56.800 --> 00:04:02.680 broader category personally identifiable information PII. We might think PII 81 00:04:02.800 --> 00:04:05.159 is just named address, but it's actually a lot broader. 82 00:04:05.800 --> 00:04:08.280 And what's tricky is how easily PII can leak out 83 00:04:08.319 --> 00:04:10.919 on social media. We might share stuff thinking it's just 84 00:04:11.199 --> 00:04:12.199 within our closed. 85 00:04:11.919 --> 00:04:15.120 Circle, but those circles aren't always that close online, are they. 86 00:04:15.159 --> 00:04:17.120 Things can spread exactly. 87 00:04:16.920 --> 00:04:19.639 And sometimes we reveal PII totally by accident. 88 00:04:19.920 --> 00:04:24.079 Social media really blurs those lines between private and potentially public. 89 00:04:24.399 --> 00:04:27.240 Info shared with a small group can easily get amplified 90 00:04:27.360 --> 00:04:31.120 way beyond what you intended. You really need to be mindful. 91 00:04:30.639 --> 00:04:36.399 So to make this really concrete, the material mentions a website, 92 00:04:35.720 --> 00:04:39.959 Let me, it's hetps dot www dot device info dot me. 93 00:04:40.480 --> 00:04:42.120 If you go there, you can actually see what your 94 00:04:42.120 --> 00:04:43.519 own browser is broadcasting. 95 00:04:43.600 --> 00:04:44.519 It's quite eye opening. 96 00:04:44.600 --> 00:04:47.800 It really is your phone model, OS, browser version, IP address, 97 00:04:47.800 --> 00:04:50.560 maybe even how many process scores you have, approximate location. 98 00:04:50.879 --> 00:04:53.120 It's a stark demonstration of the data trail we leave 99 00:04:53.240 --> 00:04:53.920 just by browsing. 100 00:04:54.160 --> 00:04:56.519 It's a practical way to see that digital footprint in 101 00:04:56.560 --> 00:04:59.560 action shows that data collection is often just part of 102 00:04:59.639 --> 00:05:00.639 using the web. 103 00:05:00.680 --> 00:05:02.959 And it's not just stuff you type in. Remember the 104 00:05:03.000 --> 00:05:07.360 car photo. Blurring the plate seemed smart, But here's the kicker. 105 00:05:08.160 --> 00:05:14.240 The photo file itself can contain hidden info metadata. The 106 00:05:14.279 --> 00:05:18.519 material defines it simply as data about data. 107 00:05:18.120 --> 00:05:20.600 So information about the photo not just what's in the. 108 00:05:20.560 --> 00:05:23.639 Photo precisely, like when it was taken, what camera was used, 109 00:05:23.680 --> 00:05:26.120 even potentially the GPS coordinates of where you took it. 110 00:05:26.560 --> 00:05:29.399 That blurred plate might be safe, but the location could 111 00:05:29.399 --> 00:05:30.319 still give a lot away. 112 00:05:30.480 --> 00:05:33.199 That car photo is a perfect example of these hidden layers. 113 00:05:33.600 --> 00:05:36.920 Metadata provides context that can be just as revealing, sometimes 114 00:05:36.959 --> 00:05:38.800 more so than the main content totally. 115 00:05:38.839 --> 00:05:41.480 So PII isn't just name an address, it's phone number, 116 00:05:41.639 --> 00:05:45.439 social media handled, they identify your recognizable photos and yeah, 117 00:05:45.480 --> 00:05:49.079 even that metadata. The key point is the resources stress 118 00:05:49.319 --> 00:05:52.720 is control. Data privacy is about controlling when, how and 119 00:05:52.839 --> 00:05:55.079 how much of your PII gets revealed. 120 00:05:55.319 --> 00:05:58.439 And that idea of control is really the heart of 121 00:05:58.560 --> 00:06:02.600 online anonymity. Isn't it empowering you to make informed choices 122 00:06:02.639 --> 00:06:05.879 about your digital footprint? Limit that unwanted sharing. 123 00:06:06.120 --> 00:06:08.480 And it's not just active sharing. Think about your phone, 124 00:06:08.879 --> 00:06:11.560 the material uses and for it. As an example, if 125 00:06:11.600 --> 00:06:14.600 you're logged into Google and most of us are for convenience, 126 00:06:14.639 --> 00:06:17.959 your phone is constantly gathering data, often in the background. 127 00:06:18.120 --> 00:06:22.040 It highlights that trade off we constantly make convenience versus privacy. 128 00:06:22.480 --> 00:06:26.000 Seamless services often mean continuous background data collection. 129 00:06:26.480 --> 00:06:31.120 Interestingly, Windows gives you a peak too in Settings under Privacy. 130 00:06:31.240 --> 00:06:35.600 Then Diagnostics and Feedback, there's an option open Diagnostic Data Viewer. 131 00:06:35.639 --> 00:06:37.439 You can see some of the technical data your device 132 00:06:37.480 --> 00:06:40.199 sends back to Microsoft. And it's not just the OS. 133 00:06:40.439 --> 00:06:43.560 Think about apps. Ever seen a simple flashlight app ask 134 00:06:43.639 --> 00:06:44.319 for your location? 135 00:06:44.560 --> 00:06:47.519 Oh yeah, that's a classic red flag. 136 00:06:47.240 --> 00:06:49.519 Right That should definitely make you pause and think. 137 00:06:49.360 --> 00:06:52.040 Those permission requests that seem totally unrelated to what the 138 00:06:52.079 --> 00:06:55.439 app does, often a sign of unexpected data gathering. Reviewing 139 00:06:55.439 --> 00:06:58.519 app permissions regularly is just good digital hygiene. 140 00:06:58.600 --> 00:07:00.879 Okay, so we get what sense it and how it 141 00:07:00.959 --> 00:07:04.480 might leak, But what do attackers do with this stolen info? 142 00:07:05.519 --> 00:07:10.199 The material gets into the less pleasant side now, primarily 143 00:07:10.720 --> 00:07:12.480 impersonation and identity theft. 144 00:07:12.720 --> 00:07:15.680 These are the core harms. Really. Once someone can pretend 145 00:07:15.680 --> 00:07:18.120 to be you or steal your identity, all sorts of 146 00:07:18.120 --> 00:07:19.079 bad things can happen. 147 00:07:19.360 --> 00:07:22.720 Impersonation is pretty straightforward. They use your details to pretend 148 00:07:22.720 --> 00:07:25.720 to be you for dodgy reasons. Identity theft is often 149 00:07:25.759 --> 00:07:31.279 about financial gain, accessing bank accounts, getting fake IDs, even passports. 150 00:07:30.759 --> 00:07:32.800 Applying for loans, credit cards. 151 00:07:32.480 --> 00:07:35.439 In your name, exactly leaving you to clean up the mess. 152 00:07:35.800 --> 00:07:38.600 The material mentions the US Social Security number as a 153 00:07:38.600 --> 00:07:41.680 prime target used for fraud, even helping criminals get bail. 154 00:07:42.120 --> 00:07:45.600 The victim ends up with wrecked credit, making life really difficult. 155 00:07:45.759 --> 00:07:48.560 The fallout from identity theft can be incredibly damaging and 156 00:07:48.600 --> 00:07:52.120 take a long time to fix. Effects finances, legal standing, 157 00:07:52.439 --> 00:07:54.720 just your overall well being and your email. 158 00:07:54.800 --> 00:07:57.079 Could be a gold mine for them if they get 159 00:07:57.120 --> 00:08:00.680 in their hunting for unencrypted credit card numbers, taxed emails 160 00:08:00.680 --> 00:08:04.360 about social media, banking, PayPal, anything useful. Yeah. 161 00:08:04.399 --> 00:08:07.480 The source material even mentions stolen documents being sold on 162 00:08:07.480 --> 00:08:09.360 the dark web. It's a whole hidden economy. 163 00:08:09.439 --> 00:08:12.680 Compromised email is like a master key, isn't It opens 164 00:08:12.680 --> 00:08:15.160 the door to so much other personal and financial data. 165 00:08:15.879 --> 00:08:20.079 Even everyday emails can contain critical bits they can exploit. Absolutely, 166 00:08:20.160 --> 00:08:22.959 so how do they actually break into systems? The resources 167 00:08:23.000 --> 00:08:26.560 say you generally need three things. A system with a weakness, 168 00:08:27.480 --> 00:08:30.680 a way to exploit that weakness, and an attacker motivated 169 00:08:30.680 --> 00:08:31.120 to do it. 170 00:08:31.240 --> 00:08:35.039 The classic triad vulnerability, exploit and motivation. 171 00:08:35.360 --> 00:08:41.000 Finding weaknesses is key. That's vulnerability assessment. Security pros use tools, 172 00:08:41.120 --> 00:08:45.320 nessus pro open vas are mentioned to scan for known flaws. 173 00:08:45.440 --> 00:08:47.679 It's about finding those holes before the bad guys do 174 00:08:48.080 --> 00:08:50.120 a constant process in cybersecurity. 175 00:08:50.240 --> 00:08:53.720 Then there's malware. Trojans are particularly sneaky. They look legit 176 00:08:53.840 --> 00:08:56.000 but do nasty stuff behind the scenes. 177 00:08:55.879 --> 00:08:58.120 Like creating backdoors for attackers. 178 00:08:57.679 --> 00:09:01.360 Exactly, letting them access your system steal data. The material 179 00:09:01.440 --> 00:09:04.960 mentions androrat for Android showing how an attacker can gain 180 00:09:05.000 --> 00:09:08.799 control and it's not just software you download. The resources 181 00:09:08.799 --> 00:09:12.639 warned about phones received as gifts, especially if they aren't sealed. 182 00:09:13.440 --> 00:09:14.840 Could a spyware pre installed? 183 00:09:14.960 --> 00:09:18.159 Oooh, that's a sneaky one. A factory reset is definitely 184 00:09:18.240 --> 00:09:21.639 wise in that case. Absolutely, the sophistication of malware just 185 00:09:21.720 --> 00:09:23.679 keeps growing. You've got to be careful where you get 186 00:09:23.720 --> 00:09:26.039 software and apps from and ensure your devices are clean. 187 00:09:26.279 --> 00:09:31.279 And we can't forget compromise credentials, user names, passwords, even 188 00:09:31.279 --> 00:09:34.720 if they don't get full system control. Getting valid logins 189 00:09:34.799 --> 00:09:38.480 lets attackers mimic real users, which can be hard to detect. 190 00:09:39.000 --> 00:09:42.480 And using common passwords password onety three admin even if 191 00:09:42.480 --> 00:09:45.399 they meet complexity rules still incredibly risky. 192 00:09:45.480 --> 00:09:47.519 Oh totally easy pickings for attackers. 193 00:09:47.600 --> 00:09:50.440 Plus, if passwords aren't stored securely or are sent over 194 00:09:50.519 --> 00:09:54.679 old unencrypted connections like plane, HTTP or FTP, they're just 195 00:09:54.679 --> 00:09:55.360 sitting ducks. 196 00:09:55.440 --> 00:09:58.399 We Passwords and poor encryption are like leaving the front 197 00:09:58.440 --> 00:10:03.000 door unlocked wrong. Unique passwords and encryption, especially for data 198 00:10:03.039 --> 00:10:06.080 and transit, are absolutely fundamental. 199 00:10:05.519 --> 00:10:08.159 Which brings us to password attacks. The resources list a 200 00:10:08.159 --> 00:10:10.360 whole bunch dictionary attacks. 201 00:10:09.960 --> 00:10:12.399 Brute force keyloggers, recording what you. 202 00:10:12.440 --> 00:10:17.080 Type, credential stuffing, using stolen password lists from other. 203 00:10:16.919 --> 00:10:21.519 Breaches, password spraying, trying a few common passwords against many accounts. 204 00:10:21.679 --> 00:10:26.320 Yeah, and that's concisely why multi factor authentication MFA is 205 00:10:26.360 --> 00:10:31.279 so vital. That extra layer beyond just the password. 206 00:10:31.000 --> 00:10:33.919 MFA makes a huge difference. It means attackers need more 207 00:10:33.960 --> 00:10:38.279 than just your password. A really effective defense against credential theft. 208 00:10:38.399 --> 00:10:42.039 Now here's a slightly creepy one, Showdan. It's like a 209 00:10:42.080 --> 00:10:45.159 search engine, but for Internet connected devices. 210 00:10:44.879 --> 00:10:48.399 Finding webcams, routers, industrial control systems. 211 00:10:48.559 --> 00:10:52.720 Exactly the material mentions hickvision cameras as an example. Often 212 00:10:52.879 --> 00:10:56.279 these devices still use their default passwords. Attackers find them 213 00:10:56.320 --> 00:10:59.679 on Showdan, log in with admin password or whatever. 214 00:10:59.399 --> 00:11:01.919 And suddenly they can watch the camera feed, change settings, 215 00:11:01.960 --> 00:11:04.279 maybe even use it to attack other things on your network. 216 00:11:04.360 --> 00:11:04.960 It's scary. 217 00:11:05.000 --> 00:11:08.120 Shout in really exposes how many insecure devices are out there. 218 00:11:08.480 --> 00:11:11.799 A stark reminder to change default passwords and keep firmware 219 00:11:11.879 --> 00:11:14.000 updated on everything connected to the Internet. 220 00:11:14.240 --> 00:11:18.600 Finally, for this bit, zombies and botnets, bots or automated programs. 221 00:11:18.759 --> 00:11:21.519 If your device gets infected, it becomes a zombie controlled 222 00:11:21.519 --> 00:11:24.879 by an attacker right link. Thousands of these zombies together, 223 00:11:25.080 --> 00:11:27.879 you get a botnet huge power. They use them for 224 00:11:27.919 --> 00:11:34.200 distributed denial of service attacks dvs, overwhelming websites, knocking them offline, and. 225 00:11:34.159 --> 00:11:38.240 These infections can sneak in anywhere browsers, software, even smart 226 00:11:38.240 --> 00:11:39.039 home gadgets. 227 00:11:39.120 --> 00:11:41.360 They often run silently too right, making them hard. 228 00:11:41.200 --> 00:11:43.879 To spot exactly. Botnets are a major threat because they're 229 00:11:43.919 --> 00:11:46.720 distributed and can generate so much malicious traffic. 230 00:11:46.799 --> 00:11:49.919 Okay, whoo, so we know what they want and lots 231 00:11:49.919 --> 00:11:51.840 of ways they try to get it. Let's shift now 232 00:11:52.240 --> 00:11:56.000 what we unintentionally revealing? The resources talk about a cyber 233 00:11:56.080 --> 00:11:59.879 exposure index. A key part whois records. 234 00:12:00.120 --> 00:12:02.360 Yes, the domain registration information. 235 00:12:02.120 --> 00:12:04.519 Material shows a search for Microsoft dot com. You can 236 00:12:04.559 --> 00:12:08.440 see who registered it, contact details, organization info, lots exposed. 237 00:12:08.519 --> 00:12:11.559 Originally meant for transparency, but now a handy info source 238 00:12:11.600 --> 00:12:13.360 for attackers scouting targets. 239 00:12:13.519 --> 00:12:16.919 The good news is you could often get WHIS privacy 240 00:12:16.960 --> 00:12:20.919 protection from your domain registrar hid some personal details. 241 00:12:20.440 --> 00:12:23.879 But the resources warn against using false info right could 242 00:12:23.960 --> 00:12:24.960 cost you your domain. 243 00:12:25.159 --> 00:12:27.960 Yeah, best stick to the official privacy features as possible. 244 00:12:28.639 --> 00:12:33.320 Beyond WHIS, think about email addresses. How easily do. 245 00:12:33.279 --> 00:12:36.320 They leak resumes online? Old bills in. 246 00:12:36.320 --> 00:12:40.399 The trash, email signatures, even just replying to spam confirms 247 00:12:40.440 --> 00:12:41.360 your addresses live. 248 00:12:41.600 --> 00:12:44.159 Every bit of info we put out there, online or 249 00:12:44.200 --> 00:12:47.120 even offline, if it can be digitized, adds to our exposure. 250 00:12:47.360 --> 00:12:50.639 Even chucking out paper documents isn't safe if someone's determined and. 251 00:12:50.639 --> 00:12:54.360 Here's a really big one. The material stresses our reliance 252 00:12:54.399 --> 00:12:55.759 on phone numbers for security. 253 00:12:55.960 --> 00:12:59.360 M two factor authentication often uses SMS. 254 00:12:58.840 --> 00:13:02.879 Exactly with strong passwords and two FA. If someone hijacks 255 00:13:02.879 --> 00:13:06.000 your phone number SIMSWAB attacks, for instance, they can often 256 00:13:06.000 --> 00:13:09.320 bypass everything. Reset Google, social media, bank accounts. 257 00:13:09.399 --> 00:13:12.200 It becomes a single point of failure. Convenient, yes, but 258 00:13:12.240 --> 00:13:14.639 potentially very vulnerable if that number gets compromised. 259 00:13:14.759 --> 00:13:17.960 One potential fix mention is using disposable or virtual phone 260 00:13:18.039 --> 00:13:21.360 numbers adds a layer of separation can be changed if needed. 261 00:13:21.600 --> 00:13:24.240 Some apps offer virtual numbers from different countries. 262 00:13:24.279 --> 00:13:26.799 Even what's really striking is a line in the material. 263 00:13:27.159 --> 00:13:30.320 Everything exposed in cyberspace matters, even if you feel you 264 00:13:30.320 --> 00:13:33.279 have nothing to hide. All the data shared, searched, downloaded, 265 00:13:33.360 --> 00:13:36.639 it's collected, monitored, stored. 266 00:13:36.360 --> 00:13:41.039 By operating systems, apps, browsers, networks, websites. 267 00:13:40.519 --> 00:13:44.600 Hackers, spies, even governments might be interested. That's why things 268 00:13:44.639 --> 00:13:47.840 like China's Great Firewall exist monitoring and control. 269 00:13:48.080 --> 00:13:51.240 It just shows how pervasive data collection is now. Seemingly 270 00:13:51.399 --> 00:13:54.039 tiny bits build up a bigger picture about you, and 271 00:13:54.080 --> 00:13:55.759 that picture has value to someone. 272 00:13:55.879 --> 00:13:59.240 Even your public IP address not usually top tier PII 273 00:13:59.480 --> 00:14:02.639 like your name, but it reveals your general location can 274 00:14:02.639 --> 00:14:05.519 be used for bands, impersonation attempts, maybe even trying to 275 00:14:05.679 --> 00:14:06.399 hack your router. 276 00:14:06.639 --> 00:14:09.320 Your IP is your public address online doesn't directly name 277 00:14:09.360 --> 00:14:11.399 you usually, but it's the starting point for a lot 278 00:14:11.440 --> 00:14:13.320 of online interactions, good and bad. 279 00:14:13.600 --> 00:14:16.200 So how do we manage this leakage better? The resources 280 00:14:16.200 --> 00:14:19.559 suggest using false info where it's not critical, names, addresses, 281 00:14:19.639 --> 00:14:23.080 phone numbers on non essential forms. Maybe use test data. 282 00:14:22.799 --> 00:14:27.159 Like from that ldtest dot com site mentioned fake names, SSNs, 283 00:14:27.279 --> 00:14:29.159 even credit card numbers just for testing. 284 00:14:29.480 --> 00:14:33.440 Yeah. Emails trickier, You often need a real one for verification, 285 00:14:34.159 --> 00:14:37.000 but temporary or alias emails are an option. 286 00:14:37.639 --> 00:14:41.000 Some providers like Perton mail, ormail dot com might let 287 00:14:41.039 --> 00:14:44.000 you sign up without another email or phone, depending. 288 00:14:43.600 --> 00:14:46.919 Where you are, and there are dedicated disposable email services too. 289 00:14:47.159 --> 00:14:50.759 A non addy Firefox Relay, simple log in are mentioned. 290 00:14:51.039 --> 00:14:54.159 Simple logins interface is even shown, making it easy to 291 00:14:54.200 --> 00:14:57.039 create random aliases to shield your real address. 292 00:14:57.240 --> 00:15:00.799 Using temporary emails and test data can definitely cut down 293 00:15:00.799 --> 00:15:03.720 on exposing your main info and full idea isn't needed. 294 00:15:04.039 --> 00:15:07.559 What about security questions mother's maiden name first. 295 00:15:07.279 --> 00:15:09.480 Pet ah the classic weak link? 296 00:15:09.639 --> 00:15:13.000 The resources suggest something interesting, don't use the real answer, 297 00:15:13.360 --> 00:15:14.840 maybe use your partner's info. 298 00:15:14.639 --> 00:15:17.320 Instead, The logic being you only needed if you forget 299 00:15:17.320 --> 00:15:19.960 your password and a memorable fake answer is more secure. 300 00:15:20.120 --> 00:15:24.480 Right, But the best approach, strongly emphasize is MFA. Enable 301 00:15:24.519 --> 00:15:25.360 it everywhere you can. 302 00:15:25.600 --> 00:15:29.559 Absolutely those easily guessable security questions are a liability fake 303 00:15:29.600 --> 00:15:32.320 answers plus MFA is much safer for caut recovery. 304 00:15:32.399 --> 00:15:35.759 For managing all those passwords, a password manager like bitwarden 305 00:15:35.840 --> 00:15:38.879 is highly recommended essential these days, and if you need 306 00:15:38.919 --> 00:15:42.440 fake personal details for unimportant sign ups, there are tools 307 00:15:42.480 --> 00:15:46.200 like the fake dam Generator. Also, remember to check whois 308 00:15:46.200 --> 00:15:49.519 privacy and be really careful with image metadata. 309 00:15:49.559 --> 00:15:50.799 At GPS tag. 310 00:15:50.639 --> 00:15:52.840 You can remove it. Windows has a built in way 311 00:15:53.279 --> 00:15:56.360 properties details remove properties and personal information. 312 00:15:56.720 --> 00:16:00.519 Actively managing metadata is important and password managers are crucial 313 00:16:00.559 --> 00:16:04.519 for strong unique passwords without needing a photographic memory. 314 00:16:04.840 --> 00:16:10.799 Lastly, here getting rid of old devices. Deleting data not enough. 315 00:16:10.879 --> 00:16:11.159 Oh no. 316 00:16:11.360 --> 00:16:12.960 Data recovery tools are powerful. 317 00:16:13.000 --> 00:16:15.879 You need to properly overwrite the data, maybe multiple times, 318 00:16:16.159 --> 00:16:19.399 using recognized standards like DoD five two twenty point two two, 319 00:16:19.480 --> 00:16:22.639 dance MMO or nissed SP eight hundred eighty eight. Driver 320 00:16:22.639 --> 00:16:23.679 eraser tools can help. 321 00:16:23.840 --> 00:16:27.440 Secure disposal is vital. Simply deleting files leaves them recoverable. 322 00:16:27.480 --> 00:16:29.080 You need to sanitize the drive. 323 00:16:28.879 --> 00:16:33.000 Properly at a final unnerving point. Those unsecured cameras findable 324 00:16:33.080 --> 00:16:36.840 via showdan or even specific Google searches like entitle blue 325 00:16:36.840 --> 00:16:39.399 iris remote view. You might be shocked how many are 326 00:16:39.399 --> 00:16:39.879 wide open. 327 00:16:40.120 --> 00:16:43.559 The ease of finding unsecured cameras online really hammers home 328 00:16:43.600 --> 00:16:46.440 the need for proper setup and strong passwords for all 329 00:16:46.440 --> 00:16:49.480 connected devices, home or office. 330 00:16:49.799 --> 00:16:52.240 Okay, let's tackle the social media elephant in the room. 331 00:16:52.879 --> 00:16:55.879 The resources call it a gold mine for scammers, and 332 00:16:55.960 --> 00:16:56.759 for good reason. 333 00:16:57.159 --> 00:16:58.519 The scale is massive. 334 00:16:58.879 --> 00:17:02.720 Fake banking links, payment scams try and steal logins, those 335 00:17:02.759 --> 00:17:06.440 scary account disabled messages tricking you into giving up info. 336 00:17:06.680 --> 00:17:10.160 Social media platforms with their huge user bases and networks 337 00:17:10.200 --> 00:17:13.440 are perfect hunting grounds for social engineering. They prey on 338 00:17:13.519 --> 00:17:14.640 trust and urgency. 339 00:17:14.720 --> 00:17:17.880 But it's not just scams, is it cyber stocking, cyberbullying, 340 00:17:18.240 --> 00:17:20.480 even cyber terrorism in extreme cases? 341 00:17:20.680 --> 00:17:24.799 Unfortunately, Yes, these platforms can be misused in many harmful ways. 342 00:17:24.559 --> 00:17:28.119 So protection tighten those privacy settings. Be very wary of 343 00:17:28.119 --> 00:17:29.440 friend requests from strangers. 344 00:17:29.519 --> 00:17:34.000 Look for red flags, brand new profiles, little content, bad grammar. 345 00:17:33.759 --> 00:17:36.119 Right often signs of a fake or malicious account. 346 00:17:36.279 --> 00:17:39.759 Proactively managing privacy settings and being skeptical of random requests 347 00:17:39.759 --> 00:17:42.000 are basic but essential steps on social media. 348 00:17:42.079 --> 00:17:44.839 So we know what they want, how we might accidentally 349 00:17:44.880 --> 00:17:48.599 expose it? How do attackers actively try to compromise privacy? 350 00:17:49.319 --> 00:17:51.000 Information gathering is step. 351 00:17:50.720 --> 00:17:53.440 One reconnaissance, learning out the target. 352 00:17:53.279 --> 00:17:57.920 Using online tools passively. Netcraft for finding subdomains is mentioned, 353 00:17:58.000 --> 00:18:01.480 along with others. Woppalizer to see what tech a website uses. 354 00:18:01.640 --> 00:18:06.440 It's all about gathering intelligence from public sources first, find weaknesses, 355 00:18:06.559 --> 00:18:07.480 plan the next move. 356 00:18:07.680 --> 00:18:12.079 After passive gathering, they might do enumeration, more active probing. 357 00:18:11.920 --> 00:18:15.480 Directly interacting with the target system to get specifics, listing 358 00:18:15.599 --> 00:18:17.880 user accounts, network shares, that kind of thing. 359 00:18:17.960 --> 00:18:22.400 Then there's physical exposure. Lost or stolen laptops phones. 360 00:18:22.119 --> 00:18:24.960 A direct route to potentially vast amounts of data if 361 00:18:24.960 --> 00:18:28.519 the device isn't secured. Encryption and strong passwords are vital 362 00:18:28.519 --> 00:18:29.960 for physical security too, and. 363 00:18:29.960 --> 00:18:34.759 Don't forget social engineering pure manipulation. The resources highlight the 364 00:18:34.799 --> 00:18:36.440 Social Engineer Toolkit. 365 00:18:36.319 --> 00:18:39.720 ST for creating convincing fake login pages. 366 00:18:39.400 --> 00:18:42.440 Exactly phishing pages that look like your bank social media, 367 00:18:42.799 --> 00:18:45.799 tricking you into typing your username and password, which ST 368 00:18:45.960 --> 00:18:48.480 then captures. It targets people, not systems. 369 00:18:48.759 --> 00:18:52.279 Phishing is incredibly common and effective because it exploits human psychology. 370 00:18:52.880 --> 00:18:55.920 Always be suspicious of unexpected requests for credentials. 371 00:18:56.160 --> 00:19:00.559 The resources also bring up Maltago, an OCENT tool open source. 372 00:19:00.359 --> 00:19:03.839 Intelligence right for visualizing connections between public data points. 373 00:19:03.920 --> 00:19:07.480 You feeded a domain, email name, and it maps out 374 00:19:07.519 --> 00:19:12.799 relationships using publicly available info. Great for attackers planning social engineering, 375 00:19:13.279 --> 00:19:14.480 understanding who knows who? 376 00:19:14.640 --> 00:19:18.279 Organizational structures osin tools like maltago showed just how much 377 00:19:18.319 --> 00:19:21.359 information is already out there waiting to be connected. Can 378 00:19:21.400 --> 00:19:24.200 be used for defense too, but attackers definitely leverage it. 379 00:19:24.279 --> 00:19:28.079 Even plainol Google is a powerful OCENT tool with advanced searches. 380 00:19:28.480 --> 00:19:33.039 Dorks using operators like sitelink, file type. 381 00:19:32.960 --> 00:19:36.960 Related dot cash. Combining them lets attackers find specific things 382 00:19:37.519 --> 00:19:41.680 like interal, dot adminlogin dot php to find login pages. 383 00:19:42.200 --> 00:19:45.279 There's even the Google hacking database full of these search strengths. 384 00:19:45.400 --> 00:19:48.680 Google dorks show the power of targeted searching highlights why 385 00:19:48.720 --> 00:19:51.480 website owners need to be careful not to expose sensitive 386 00:19:51.519 --> 00:19:53.160 stuff to search engines accidentally. 387 00:19:53.359 --> 00:19:56.680 Website owners can try to control indexing with no index tags, 388 00:19:57.599 --> 00:20:00.920 but the resources point out that robots dot tax meant 389 00:20:00.920 --> 00:20:04.400 to guide search engines can sometimes backfire. 390 00:20:04.039 --> 00:20:07.319 By revealing the site's directory structure to an attacker. 391 00:20:07.119 --> 00:20:11.200 Exactly making it easier for them to find potentially vulnerable areas. 392 00:20:11.279 --> 00:20:16.240 Misconfigurations like that can unintentionally help attackers. Careful web development 393 00:20:16.279 --> 00:20:17.400 and security are key. 394 00:20:17.599 --> 00:20:22.119 Interestingly, there are specialized search engines too. UVX is mentioned 395 00:20:22.319 --> 00:20:25.680 searches online file storage sites like media Fire even has 396 00:20:25.720 --> 00:20:28.440 a health search aiming for less biased medical info. 397 00:20:28.599 --> 00:20:31.400 Shows the diverse range of searchable data out there beyond 398 00:20:31.480 --> 00:20:33.079 just regular web pages and. 399 00:20:33.039 --> 00:20:35.799 Then public Wi Fi coffee shops. 400 00:20:35.839 --> 00:20:38.880 Airports still a big risk if the connection isn't encrypted. 401 00:20:38.960 --> 00:20:41.319