This article is about cryptocurrency security. We will share a few tips, methods, and basic technical knowledge to understand security threats and be able to avoid becoming a victim of them. This article won’t cover all topics of cyber security, however, if you understand the basic concept of network traffic and utilize some of these tips you could very well secure yourself against cyber threats.
First of all, you must understand that everything is hackable IF hackers can access it. Here comes the first solution to avoid hacks: Do not let threats enter your network.
You have to understand how computers communicate with each other on a very basic level.
Know your network
Have you ever wondered what happens “inside” your computer when you type a web address into your browser? At a very basic level, the URL that you type in will be processed by different protocols. The only important thing to us is that the URL will become an IP address of the server you want to reach. You can try this on a Windows machine (as well):
- Hit “windows + R”
- Type “cmd”
- Type “ping google.com”
- As you can see you get a reply on “172.217.19.110” (at least In my area)
- If you enter this IP into your browser instead of “google.com” you will land on the same page
Computers on the internet communicate with IP addresses, think of that as the address of your home. However, imagine a scenario when you open 3 different tabs with 3 different websites. For example google.com, Midas.investments, f1.com
Your IP address (who sent the request to websites) is the same for all 3 sites. So all 3 sites will reply to the same IP as yours, but into which browser tabs? How does f1.com know that his data will land on the correct browser tab? Well, it’s pretty simple:
When you request f1.com your computer sends your IP address and a random number called port to the server of that website. When F1.com receives your request, it will see those, so it will send back data to your IP address and includes your port information as well. You can check this by opening “resource manager in Windows” see below:
You can see the ”chrome.exe” application, our computer IP “192.168.1.109” opened the port for that tab “63345” and destination IP of 31.13.84.8. Please note that there are other “chrome.exe” instances with different port numbers, those for different browser sessions.
If you play a game in multiplayer, it will open ports on your network to be able to communicate with game servers. Here is a picture of where we started Call of Duty Warzone.
It is using port number 50172.
When you got hacked, malware software will report to the hacker’s server by opening ports as well.
Every communication between your computer and a computer on the internet goes through your router/modem. In these devices, you can filter which ports you will allow to and from your network manually.
There is a service called UPnP (Universal Plug And Play) in your router which allows any computer programs to open ports on your router. This is originally developed for Microsoft Xbox to make it easier to play multiplayer games. It should work only on LAN, but nowadays this is not the case.
If you disable UPnP you make it harder for any cybersecurity threats to communicate or even to infect other computers on your network.
You can read a decent article on UPnP here: https://nordvpn.com/blog/what-is-upnp/
Practical network tips:
- Don’t let other people join your home network. Not even your best friend. Maybe his computer is already infected. You can create a ‘guest’ network in your router, they should use that.
- Don’t fill in sensitive information on untrusted websites. Everything you type in is unencrypted.
- If you can, use cable internet instead of wifi.
- Don’t use your computer on untrusted wifi networks.
Now that you understand more about networking, you will be better at understanding cybersecurity.
THREAT TYPES (which usually affect cryptocurrency security)
Ransomware:
Ransomware is malware that employs encryption to hold a victim’s information at ransom. It encrypts all of your files in the background and when it is finished it will delete all original files then you will be asked to pay BTC to get back access to your files. Unfortunately, if files had been encrypted you lose all of them! The only effective way to restore it is from backup saves. Please make a backup of your important files!
Keylogger:
It is a piece of software or hardware(!) that logs all USB data // or keystrokes and reports your activity to hackers. You can imagine, approximately within 20 characters after the “@” symbol is likely your password.
This type of threat is very primitive in general, but there are some sophisticated ones so be very careful: ‘keyloggers’ can even take pictures of your screen or records mouse positions. Back in the early ’20s, there was a practice only to use an on-screen keyboard to type passwords to make sure to eliminate possible keylogging hacks, especially if you worked on a guest computer. Nowadays this is not going to work.
Phishing:
Phishing is a method of social engineering used to obtain sensitive data such as passwords, usernames, credit card numbers. The attacks often come in the form of instant messages, SMS, or phishing emails designed to appear legitimate. You should always double (or triple) check any email /SMS which asks you to click on a link. Check the sender domain, look for grammar mistakes, and so on. Be always suspicious!
Clipboard Viruses:
These types of tricky threats became more common as crypto expanded. This is also a very simple software that hides behind the scene and gets activated only if it detects a crypto address on the clipboard, then it replaces the users’ address to the hacker’s address. It’s a very important practice to ALWAYS check manually the first three and the last three letters of your addresses, even if you copied and pasted it!
Spyware:
It can contain keyloggers that record personal information including email addresses, passwords, even credit card numbers, making it dangerous because of the high risk of identity theft.
Computer worm:
Computer worms are pieces of malware programs that replicate quickly and spread from one computer to another. A worm spreads from an infected computer by sending itself to all of the computer’s contacts, then immediately to the contacts of the other computers. A computer worm can contain keyloggers, Clipboard viruses, Ransomware, anything!
Rootkit:
Rootkit is a collection of software tools that enables remote control and administration-level access over a computer or computer network. Once remote access is obtained, the rootkit can perform many malicious actions; they come equipped with keyloggers, password stealers, and antivirus disablers.
Practical Password tricks:
Make sure that your password is reasonable long and it contains letters, numbers, symbols as well.
There is a funny little tool to check how long does it take to crack your password: https://www.betterbuys.com/estimating-password-cracking-times/
In general, brute-forcing an 8 chars long password takes about 5 hours, a 9 char long 5 days, 10 chars is about 4 months.
As you can see, cracking time is exponential with the character numbers. A password that is at least 10 chars included spec characters is considered secure.
Password generators are a common way to generate your appropriate password. The problem with that is that it is hard to remember a 10++ chars long gibberish. If you write it down, you already take a risk that someone will find it.
Now password managers come into the picture. Password managers are nice programs that can automatically fill your password based on certain rules and even generate new ones. However, those are still programs. Remember, anything is hackable except your mind (at least now).
By making your own cipher only you can decode your password and you are the only one who can remember it easily. But what is a cipher? We are sure you used to play grammar games when you were a kid. You say words in backward order or miss all vowels, etc. If you have played games like this, you have already used ciphers.
A cipher is an algorithm to encrypt and decrypt data. You can create your own cipher when you think about passwords. For example, lets “make” our cipher which takes every 3 letters of a word and adds numbers in incremental order instead of space:
Original sentence “I like Midas Investments”
Ciphered version: “I1lik2Mid3Inv”
It’s pretty hard to read even if you know what’s written there!
Shoulder Surfing:
What we still see is that a lot of people are still doing Shoulder Surfing. This is when someone stands near you when you type your password in. Don’t be shy and ask him to look away, or even turn around. It’s so obvious and still so many are making this mistake.
How to store private keys?
Cold Wallet, hardware wallet, and so on…
How to store private keys/seeds:
Hardware wallet: this is a special type of wallet which stores the user’s private keys in a secure hardware device. If you want to use it, it must be connected to a computer. In general, it is considered a safe method to store your private keys, but there are downsides as well. In 2020 over 1 million email addresses and 272,000 names, mailing addresses, and phone numbers were leaked of people who ordered devices from Ledger. If you decided that you buy a Hardware wallet, please make sure to buy a brand new sealed one. DO NOT BUY second-hand hardware wallets at all!
On (your) computer: You can store your private keys, “wallet.dat” files on your computer as well. It is not recommended by IT pros, however, sometimes reversed psychology is more effective than you think.
Method 1: Hide as far as you can. You can create a password-protected archive file that is stored uniquely. You can store your password-protected archive in a hidden partition, without an assigned drive letter for example. If your computer became infected, malware will scan through your files but it will never find your archive because it is sitting on an invisible unassigned partition. Only you as an admin can assign drive letter manually to that partition ( which is hidden and contains a password-protected file). It is also a common method to split the zipped archive into 2 parts and store it in different places. A good alternative could be to store password-protected archives outside of your computer. For example in a pen drive or an SD card as well.
Method 2: Bait method: This type of reversed psychology is very smart and can easily bewilder humans and bots as well. The main concept is that you make a real (but empty) wallet and dump its private key or “wallet.dat” to an obvious filename and put it into a very popular folder, like documents or even to desktop (At the same time you are still able to use method one in parallel with this). If you got infected or your computer cracked by a person it will have the initial impression that he hacked you by finding your files in those folders. However, in reality, they will take unimportant files of that empty wallet only. You still have time to unplug your computer from the network and clean your system.
COLD WALLET: Writing down your private key into paper is called a cold wallet. It has advantages outside of the digital world – no one can steal it from your computer. However, there is still a chance that someone will find it and steal it physically. Remember: Everything is hackable except your mind. Write down 9 words of your private key and memorize 3 words. In this way even if your paper private key is exposed, it is still unusable for hackers. We are sure you are curious why we are suggesting memorizing three words – why not just one? It is much easier to remember right? Well, we have to mention that it is possible to brute force your private keys. With special software, it is possible to “figure out” your missing private keyword(s) – however, brute-forcing a 9-word long private key would take years or even decades. Another method is to split your private keys into 2 parts and store those in different places.
Use Licensed antimalware software.
There were times when users thought that Mac OS-es were protected against cyber threats. Well, that is no longer the case. Every computer including macs can be infected. Using a free version of antivirus software usually won’t protect you in real-time. You can run it manually and likely will catch and eliminate the problems, however, our main goal is to keep cyber threats out of our system and network entirely. Because of this, it is critical to buy reputable antivirus software. Licensed antivirus software gives you real-time protection, meaning that it can detect malicious activity BEFORE it downloads to your computer. Just to name a few, we suggest trying out Malwarebytes- Antimalware’s, Bitdefender, and so on.
Security questions:
Do not give real answers to security questions. Your private information is already shared by YOU! Imagine just your Facebook public profile…
If you post a lot of pictures of your cute cat on Facebook. Likely all your friends know its name. They probably already know your security question and answer of the “ what’s your favorite pet’s name” question. Answer security questions with memorable words, gibberish, and unique sentences no matter what it is. IT IS NOT important to give a real answer! The only important thing is that you remember your answer. Think that it is a password.
DO NOT SELL YOUR USED HARDWARE:
Several hackers are targeting crypto users, who sell hardware. With appropriate hardware and knowledge, data is recoverable, sometimes even if you made a low-level format. This is especially could be true if you used “oldskool” Hard Drives. Recovering data from SSDs are much harder, but there are still possibilities. There were multiple series of SSD drives whose weak point was the controller. With a broken controller the SSD seems to be dead, but with decent tech skills controllers could be replaced, and data just recoverable. This is also true for capacitors, which is one of the main faults of SSDs drivers. Don’t sell it, keep it (or physically destroy it) maybe you will find your old private keys years later.
WHY would they hack me, I’m “poor”:
Hackers do not target only the rich! Hackers want to hack everything and everyone. If you are an average person, you probably won’t face a personal attack specifically against you. However, you have to understand that nowadays not only your crypto or your credit card has digital value. Personal data, even your behaviors are also important. You would be shocked if you would know how much money is earned just on your daily routines and on your interest. Facebook and Google have lots of information about you. What you like, what are your hobbies, what political side you are involved in, and so on. There are several markets on the darknet where leaked data of millions are already on sale. Let’s imagine that your name and email (without password) have been leaked from a crypto-related website. They will know that you probably like and are involved in crypto, and they will know your name, email, and so on. You just became a perfect target for a crypto phishing attack. Not to mention if all your data has been leaked, they can impersonate you and commit a digital crime on your behalf… That’s scary indeed!
The good news is that You can check data leeks by your email address on several sites:
https://www.f-secure.com/en/home/free-tools/identity-theft-checker
