Cyber Security Mara

online security rants, tips, and tricks; @themaradwrites for my fanfic blog

[cybersecuritymara]

MasterPost

Asks: OPEN - please send me asks, I'm happy to help! Taglist: OPEN

Operating system posts:

Windows 7/8

Passwords:

Password advice 2023

Cyber Security Training & Resources:

Free Online Information Security Training Resources

[cybersecuritymara]

Internet Safety: Part 2

AKA: What are the odds?

It's a fair question to ask - what are the odds?

You should always be able to make assessments based on risk.

The issue is that calculating the risk of being hacked isn't what you think it is (probably).

Most people look at the risk like this:

Why would a hacker target me? I'm nobody, I'm unimportant. This is just my fanfic account, if they want my smut, they can have it. If they want my spam mails from Amazon, they can have my email.

But that's not the actual risk.

So let's look at that together.

Let me start by asking you about your password.

How did you create it?

Do you use it anywhere else?

If it's generated by a password manager, is that password manager the one built into your browser?

How long is it?

When you added complexity to it, did you just add a 1 to the end? Your birth year? Maybe an underscore between words?

All of these things should be factoring into your risk calculation.

You can see my password advice and how easy it is to crack a password here.

So why the hell does this matter to the odds?

Let's say you use the browser-native password manager to create that password - what else could they potentially have access to, if they have that password? Your Google account? Do you have a banking app on your phone? Do you store your banking password in your browser-native password manager? What else is in there?

Risk isn't just inherent to the one thing that someone may have access to, it's lateral.

If someone gains access to one thing, what else can they gain access to?

Crowdstrike has a good summary of lateral movement here.

Effectively, any attacker, once they have access, may try to access other things - the higher the value, the higher the odds.

Do you value your banking information? Of course you do! So how can someone get from accessing your Gmail to your banking? Is the app installed on your Android phone? Is the password the same? Is the password stored in your Google password manager? All things you have to consider for risk.

I know what you're thinking: that's all well and good, but what are the actual odds someone's going to target me?

You specifically? Some random unknown person on the internet? A direct target on you yourself? Probably not that high, to be honest.

But that's not where the conversation ends.

Because you don't have to be the specific target to get hacked, you just have to be the easiest.

Let's look at an example: call centre scammers.

They have no idea who's calling them.

They didn't specifically put that fake virus message on your computer, they just put it out in the wild and let it go nuts. Whoever calls, calls.

It's the same for your online accounts and information.

A bad actor can obtain your login information from any given data breach on the dark web. (You can check haveibeenpwned to see if your email's been in a breach - if it has, change your password right away anywhere you use that password/email combination, and check your account activity/logins)

Which means that in a majority of cases, they already have your login information.

And not because you necessarily were the target, but because you were easy.

Also, you have to consider the version of something you're using.

I know we all hate updating our software.

Upgrading from Windows 10 to 11.

Installing that next update that gives the app a new look you just don't like, so you avoid it to keep the old look.

But hidden behind those updates are security patches, things that make your system more secure against attacks.

And if you're avoiding those updates and your computer is on the internet, someone can easily find you.

There's a whole-ass tool online out there that people can use to look for out of date systems.

Again, they're not targeting you, they're targeting the weakness that you're broadcasting to the world.

All it takes is one quick search and a random click on a red dot that happens to be your computer.

Update your computer, get a different operating system if you have to.

If you're not using your system for anything too heavy or Steam games, try something like Linux Mint or ZorinOS, which are designed to have a similar feel to more classic Windows experiences.

Get a password manager.

PC Mag has a list of free password managers for 2026 here, if you can't afford a paid version.

When considering risk, considering the odds that you specifically are the target, stop right there. And instead consider whether you are an easy target instead.

And FFS get MFA set up. If you don't want to use Google or Microsoft, Proton has one you can use.

[cybersecuritymara]

Privacy

With the world going to shit, I figured I'd put together some resources to help maintain some semblance of privacy and help you protect yourself.

The Electronic Frontier Foundation has some amazing resources to help out.

Their Tools page has some excellent tools to help you protect yourself and use the internet safely. This includes Privacy Badger - a tool to block invisible tracking cookies - and a tool called Cover Your Tracks to analyze how well your browser and add-ons protect you.

They also have this handy page - Security and Privacy Tips for People Seeking An Abortion.

And if you're curious if your data has been involved in a breach, you can check have i been pwned?, a fantastic site by Troy Hunt. You can also sign up to be notified in the event of a breach. The site also has a passwords section. There's also a handy FAQ to explain a bit more about the site.

Another thing to help you out is a proper password manager. No, not the one native to your browser, not the Google one, not the Apple one. If you're looking for a free password manager, Bitwarden has a free option as well as paid. Their $10 a year option includes security reports, though, so in my opinion, that's worth it if you can swing it.

Stay safe!

[cybersecuritymara]

Internet Safety Part 1

I recently saw a Tumblr post to beware of a Discord scam that...honestly, it included no real helpful information. I'm not going to link to it or call out the account that posted it, there's no point.

Instead, let's talk about internet safety!

1.If you receive an email asking you to click a link or perform an action, check the email address.

What does this mean?

Let's take the post I saw as an example. It claimed that there's someone reaching out on Discord with a Discord support email address they were asking you to add.

Things to look for:

What is the email domain? Is it @discord.com? Or is it some other random domain like gmail or hotmail? Discord support won't be using an unofficial @discord.com domain. If you're being given a contact for customer support or some other official channel with a company, google the email address. Go to the company's website and contact that department directly through the website. if it's an email that's not on the website, reach out to their customer service/support team via email or web form. Tell them what the issue the person in the email has claimed is. Basically, get help through official and confirmed channels.

If you're receiving an email, check what address shows up if you hit reply The from and reply emails may not match. Big red flag. If you know how to get ahold of the email header, there are tools you can use to analyze the email header and translate it into plain English to show you exactly who's emailing you - such as mxtoolbox.

2. Consider the source.

Have you received this information from someone you trust or is it a new account you've never heard of claiming to be someone you know?

If you receive any message from someone who claims to be someone you know, verify it.

If they say they're a Tumblr mutual you don't know IRL and they're reaching out on Discord or Instagram or whatever, go back to Tumblr and DM that person to confirm if it's them.

If you know them in real life, call them. Text them.

Honestly, though, this is just general life good advice. Consider the source.

Verify.

3. Don't tell people your real information.

Let's stray off the path for a second here.

The number of people I see posting their real names and birthdates on Tumblr is insane.

Do a few of my mutuals know my real name? Sure.

Did I post that on Tumblr? Fuck no, lol.

Let's say you reblog a post with your birthdate.

Then another with your childhood pet.

Maybe the city you were born in.

Your grandmother's maiden name.

What do all of these examples sound like?

Security questions.

If I'm a bad person, I now have everything I need to maybe access your online banking? Find your home address?

You would be surprised just how little information someone needs to gain access to your private information.

I recommend this video to see just how little information someone needs:

As Rachel says, assume everything you put online is public.

She got his address and birthdate from a couple of Tweets.

And from that, she was able to steal $2000 worth of hotel points and change his seat on his flight.

4. Do not click on unexpected links.

There are ways to verify a link before you click it. Antivirus programs have browser extensions to check the safety of your links. You can put the link in VirusTotal. You can even put downloads/attachments into VirusTotal to check.

Usually the link asks you to login to your account anyway, so just go directly to your account and login. If it's an official action you need to take, you should be able to do it by logging in directly instead of following the link.

[cybersecuritymara]

Internet Safety Part 1

I recently saw a Tumblr post to beware of a Discord scam that...honestly, it included no real helpful information. I'm not going to link to it or call out the account that posted it, there's no point.

Instead, let's talk about internet safety!

1.If you receive an email asking you to click a link or perform an action, check the email address.

What does this mean?

Let's take the post I saw as an example. It claimed that there's someone reaching out on Discord with a Discord support email address they were asking you to add.

Things to look for:

What is the email domain? Is it @discord.com? Or is it some other random domain like gmail or hotmail? Discord support won't be using an unofficial @discord.com domain. If you're being given a contact for customer support or some other official channel with a company, google the email address. Go to the company's website and contact that department directly through the website. if it's an email that's not on the website, reach out to their customer service/support team via email or web form. Tell them what the issue the person in the email has claimed is. Basically, get help through official and confirmed channels.

If you're receiving an email, check what address shows up if you hit reply The from and reply emails may not match. Big red flag. If you know how to get ahold of the email header, there are tools you can use to analyze the email header and translate it into plain English to show you exactly who's emailing you - such as mxtoolbox.

2. Consider the source.

Have you received this information from someone you trust or is it a new account you've never heard of claiming to be someone you know?

If you receive any message from someone who claims to be someone you know, verify it.

If they say they're a Tumblr mutual you don't know IRL and they're reaching out on Discord or Instagram or whatever, go back to Tumblr and DM that person to confirm if it's them.

If you know them in real life, call them. Text them.

Honestly, though, this is just general life good advice. Consider the source.

Verify.

3. Don't tell people your real information.

Let's stray off the path for a second here.

The number of people I see posting their real names and birthdates on Tumblr is insane.

Do a few of my mutuals know my real name? Sure.

Did I post that on Tumblr? Fuck no, lol.

Let's say you reblog a post with your birthdate.

Then another with your childhood pet.

Maybe the city you were born in.

Your grandmother's maiden name.

What do all of these examples sound like?

Security questions.

If I'm a bad person, I now have everything I need to maybe access your online banking? Find your home address?

You would be surprised just how little information someone needs to gain access to your private information.

I recommend this video to see just how little information someone needs:

As Rachel says, assume everything you put online is public.

She got his address and birthdate from a couple of Tweets.

And from that, she was able to steal $2000 worth of hotel points and change his seat on his flight.

4. Do not click on unexpected links.

There are ways to verify a link before you click it. Antivirus programs have browser extensions to check the safety of your links. You can put the link in VirusTotal. You can even put downloads/attachments into VirusTotal to check.

Usually the link asks you to login to your account anyway, so just go directly to your account and login. If it's an official action you need to take, you should be able to do it by logging in directly instead of following the link.

[cybersecuritymara]

Infostealers Are Using Persistent Cookies To Hijack Google Accounts

Several Infostealers Using Persistent Cookies to Hijack Google Accounts

A vulnerability in Google’s authentication process allows malware to restore cookies and hijack user sessions.

From the article:

UPDATE: Google has provided the following statement:

Google is aware of recent reports of a malware family stealing session tokens. Attacks involving malware that steal cookies and tokens are not new; we routinely upgrade our defenses against such techniques and to secure users who fall victim to malware. In this instance, Google has taken action to secure any compromised accounts detected. 

However, it’s important to note a misconception in reports that suggests stolen tokens and cookies cannot be revoked by the user. This is incorrect, as stolen sessions can be invalidated by simply signing out of the affected browser, or remotely revoked via the user’s devices page. We will continue to monitor the situation and provide updates as needed.

In the meantime, users should continually take steps to remove any malware from their computer, and we recommend turning on Enhanced Safe Browsing in Chrome to protect against phishing and malware downloads.

Or, you know, you can use Firefox and adblockers and don't click on links without checking them first.

[cybersecuritymara]

Passwords would be better if we were able to use Wingdings.

There. I said it.

⬲P⬳a⬴s⥻s⥺w⥶0⬺r➻d↰1↜2↭3

[cybersecuritymara]

Free Online Information Security Training Resources

I figured this might be helpful for some - either writers or people with an interest, but no money.

This is an in-progress list. If you have questions, please don't hesitate to shoot me a DM!

Cyber Security Terminology:

UK Cyber Security Council Glossary G2 SANS Institute

First, there are options to do free training videos on information security topics. These will often allow you full or partial access to their video libraries on a purely course auditing basis. There are no certificates. Below are some of my favourites:

Cybrary

Pluralsight

Udemy

Coursera

Code Academy

Digital Forensics & Incident Response:

DFIR Diva

Governance, Risk, & Compliance:

ISO27001 - International Standard SOC II - Security framework CCPA - California Consumer Privacy Act PIPEDA - Canadian Privacy Act (Personal Information Protection and Electronic Documents Act) GDPR - EU Privacy (General Data Protection Regulation) The Data Protection Act - AKA UK GDPR NIST - National Institute of Standards & Technology - US agency for security standards PCI-DSS - Credit card data security framework NCSC - UK-based - National Cyber Security Centre ITIL - IT Infrastructure Library - foundational standards for IT services, ITIL 4 is the latest version

Vulnerabilities: Mitre's CVE Database NIST Vulnerability Database

Incident Response: NCSC Incident Management IBM - What is Incident Response?

[cybersecuritymara]

Friendly Reminder

Don't download zip files off the internet from people you don't know.

If someone is offering you free versions of expensive software, don't trust it. Seek out alternatives that are free instead.

For example, if someone offers you free Photoshop, go download GIMP instead.

Don't click on links from people you don't know.

Always check your links before you click them.

Check the URL for links by hovering over them BEFORE you click. And make sure the link is accurate - a common way to make you think a website is legit is substitution, the same thing you do with your passwords. Make sure you're clicking on microsoft.com instead of m1crosoft.com. Some bad actors will even use letters in another alphabet that look very similar to English letters to make you think the website is legit.

Beware of typosquatting.

Download safely to a sandbox and check the file if you are unsure.

Check your files and links with VirusTotal.

CodeSigning has an excellent guide for checking if a file is malicious.

Use antivirus/antimalware programs like TrendMicro, BitDefender, AVG, McAfee, malwarebytes, etc.

I fully encourage everyone to check every damn link I provide in VirusTotal.

I'm happy to help provide resources and answer questions!

DO NOT TRUST STRANGERS ON THE INTERNET.

Yes, I even mean me. Go to your search engine of choice and look for the above resources yourself, fact-check me. Please. And tell me if I have something wrong.

[cybersecuritymara]

2023 Password Advice & MFA

Passwords suck, amirite?

So let's talk about some ways to make them suck less while making them easier for you to remember and more secure.

Getting the big point out of the way - get you a password manager that's not your browser.

Browser-based password managers are great for people with little to no technical know-how - in a risk vs benefit sort of way.

BUT

If you have any technical know-how, get yourself a password manager. Keeper, 1Password, LastPass, Bitwarden, Dashlane, etc. Invest in one if you can afford it.

Bitwarden has a free password manager option.

The only password you'll have to remember is your password manager password.

So why wouldn't you want to use a browser-based password manager? They're more easily compromised. If someone gets into your Google account, they now have access to your banking login if it's saved in your password manager. And it's not their primary focus.

A proper password manager is a better option.

So, how do you make a password that's secure AND easy to remember?

Use random words strung together.

And interrupt those words in random places.

There's the classic XKCD comic with 'CorrectHorseBatteryStaple'. Which is a solid base for the idea. But you can still be vulnerable to dictionary attacks, which are attempts to get your password by firing words at your login from a dictionary list.

So to make it more secure, you'd take:

CorrectHorseBatteryStaple

And make it:

Co_rrectHo*rseBatter*yStapl*e

And if you need to have numbers in your password:

Co_rrectHo*rseBatter*yStapl*e63

Pick a random number.

And aim for 16 characters or more. Which sounds like a lot under the old password rules, but with the above? Easier to remember, harder to crack.

Don't do any of these with your passwords:

Common substitutions. If you substitute the @ symbol for an A, don't. What, you think if someone's trying to get your password they've never heard of doing that? It doesn't work. And it doesn't matter. You're better off interrupting the words with random punctuation like in the above examples.

The number 1 at the end if a number is required. This'll be the first thing someone's going to try. It's useless. Don't do it.

Your birthday. Just...don't.

Your dog's name.

Your child's name.

Anything you post on your social media that someone could guess easily.

Social engineering is insanely easy to do.

Do NOT put your password into a tester online to check how secure your password is.

To get an idea, this is how secure your password is in 2023:

As for MFA:

Use it. This isn't even an option in my opinion. Use 2FA. I don't care if you think it's annoying. Use it. It will help keep you secure.

Google Authenticator. Easy set up on Android 4.4 and higher. Also works on iPhone.

2FAS. Read the guide for enabling 2FA.

Duo. Keep in mind that you NEED to save your security codes or you will not be able to recover your access. Make sure to read the linked guide for third party accounts before you use Duo.

Yubikeys. Not cheap, but a solid authentication option and incredibly secure. If you can afford it, I highly recommend getting one. You can attach them to your keychain!

Biometrics on your phone. Some phones also come with security keys which can be attached to your secure login - ie. biometrics.

Only use text-based MFA and email-based MFA as a last ditch option if you're not able to use anything else. These are both comparatively insecure. But having them is better than nothing. If you can do any of the above authenticators, please do that instead.

[cybersecuritymara]

Windows 7/8 Masterpost

Windows 8/7 Alternatives Steam Ending Windows 7/8 Support

[cybersecuritymara]

Windows 7 & 8 End-of-Life Alternatives to Keep You Secure & Safe!

Following on from my last reblog regarding Steam ending support for Windows 7 & 8 as they are end-of-life systems....

You can get free options to allow you to continue using Steam. Or keep you secure if you just don't want to or can't upgrade to newer Windows OS's.

Steam officially supports Ubuntu 12.04 LTS and higher. Ubuntu is a Linux operating system that you can download here.

PC World has a guide from switching from Windows 7 to Ubuntu here. Bleeping Computer also has a guide.

Or, if you don't care about Steam games, but you want an OS similar to Windows, you can look for Linux options that look like Windows. Zorin OS, Linuxfx, and many others will offer you similar experiences. OMG Ubuntu has a post about good alternatives as well.

These are all free alternatives to Windows that will keep you secure, if you are unable to afford a Windows 10/11 upgrade or if you simply do not like the new OS's.

Also, if you just haven't upgraded yet, but aren't unwilling to upgrade, you can see this article from ZDNet for how to upgrade for free.

[fluffmugger]

Reminder that steam is not only "no longer supporting windows 7" ,. they will be actively disabling all clients on this OS by end of this year. No, you can't run offline. No, you can't run the games standalone. The official steam position is go fuck yourself. Their reasoning is due to intertwinement with some google features, which imo is just making it even fucking worse, because why the fuck do google need to be involved in me playing a game I bought in 2013? And why do they get to say I can no longer access this game?

If you want a workaround, hit up this but in future, just use GOG.

This isn't about the OS, so don't even start with me. Deliberately disabling access to items you've already purchased with no recourse is the highest order of bullshit.

[kuromi-hoemie]

and windows 8/8.1 ...

Steam Support :: Windows 7 and Windows 8 Support

[kamikaze-kumquat]

And, this is where you go steal EVERYTHING.

Look, I actively write companies when they pull stupid shit like this and ask "So, you want people to steal your shit? Because, this is why people steal your shit."

And, they ignore me because I'm a tiny voice, and also, they think they can keep people from stealing their shit.

So, anyway, steal their shit.

YOU PAID FOR IT AFTER ALL.

[themaradwrites]

Came by to see what I've missed in the last two weeks and this is one of the first things on my dash.

I'm going to go full security on this for a second. Because holy fucking shit. Rant below the cut.

Also, TL;DR - links at the bottom for upgrading your OS from Windows 7 or 8.

If you are on Windows 7 or 8 and are actively on the internet, stop. Upgrade your damn OS.

Windows 7 and 8 operating systems do not receive critical security patches anymore.

This is why Steam are ending support. These are considered end of life systems.

You want to complain about Steam no long supporting your actively exploitable operating system? Complain about Microsoft not offering security patches instead.

This article is from January.

Windows 7 and Windows 8 will stop getting critical security updates in one week

There are still millions of systems running Windows 7.

"Oh, this will never happen to me, why would a hacker care about me?"

They don't. They're not looking for you. They're looking for a vulnerability.

There is a search engine used by people in cyber security and by black hat hackers that will literally tell them where a vulnerable system is. This search engine is called Shodan.

This is a map from Shodan of all Windows 7 machines near Washington, DC:

If you click on any of those red dots, you'll get more information, including the machine's IP address and the open ports.

This took me all of 15 seconds to get.

This is how easy it is for someone to hack you. And they don't even need to know it's you.

Steam are not the bad guys for refusing to support end of life operating systems. Go get mad at Microsoft.

And upgrade your operating system.

Oh, and while I'm on it, invest in a password manager that isn't the one in your browser. 1Password, Keeper, LastPass....

Describes an update that enables you to upgrade your computer from Windows 7 to a later version of Windows.

You Can Still Get Windows 10 for Free With a Windows 7, 8, or 8.1 Key

Microsoft's free Windows 10 upgrade offer is over--or is it? There's still a way to activate Windows 10 with a Windows 7, 8, or 8.