<p><span data-contrast="none" class="TextRun SCXW136316728 BCX0" style="margin: 0px; padding: 0px; color: #000000;"><span class="NormalTextRun SCXW136316728 BCX0" style="margin: 0px; padding: 0px;">Wh[..]

LastPass Report: Strategies for SMB Leaders Facing the Cybersecurity Disconnect

What is a Trojan Virus?

Understand the risks of trojan viruses and discover how LastPass's robust security measures safeguard your information. 

Understanding Trojan Viruses and How to Protect Your Devices

<h2><strong>What Is Session Hijacking?&nbsp;&nbsp;</strong></h2>
<h3><strong>Definition and explanation of session hijacking </strong></h3>
<p>Session hijacking is a cyberattack whereby rogue actors gain access to a system or application when the victim is connecting online for a legitimate purpose. &nbsp;</p>
<p>You could be logging into a business application at work, for example, or shopping online during your lunch hour. The attack could also occur when you&rsquo;re accessing your banking portal to check your account balances. &nbsp;</p>
<p>Regardless of what you&rsquo;re doing while connected, session hijacking allows third parties to exploit the control mechanism, such as a session token. This lets cybercriminals impersonate their victims and either steal information, perform unauthorized actions or spawn further attacks. </p>
<h3 class="p1" style="color: #0f374e; margin-right: 0px; margin-bottom: 5.3px; margin-left: 0px;"><span style="color: #000000;"><strong>What is a session?</strong></span></h3>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;">Before we explain session hijacking, let&rsquo;s talk about sessions.</p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;">A session is the length of time you spend interacting with a website or application. For example, when you shop on Amazon, your session begins when you log in and ends when you log out. You get a unique session ID or identifier for each login.</p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;">Your session can also end if there&rsquo;s a period of inactivity. Let&rsquo;s say you head to the kitchen to fix yourself a sandwich. When you return after 15 minutes, your session has expired, and Amazon has logged you out. If you log in again and begin putting items in your cart, Amazon counts this as a new session.&nbsp;</p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;">Amazon uses&nbsp;<a rel="noopener noreferrer" href="https://www.baeldung.com/cs/web-sessions" target="_blank">session IDs</a>&nbsp;to manage multiple sessions simultaneously. Session data is stored on Amazon servers. This helps Amazon remember your shopping cart contents, display relevant product recommendations, show your recently viewed items, and note your language, payment, and delivery preferences.</p>
<h3><strong>Different types of session hijacking </strong></h3>
<p>Cybercriminals can hijack your web session in one of two ways, but both have damaging consequences. &nbsp;&nbsp;</p>
<p>In passive hijacking, for example, threat actors will quietly monitor the traffic between their prospective victim&rsquo;s computer and a server. Think of it as a form of digital eavesdropping. &nbsp;</p>
<p>Attackers may not take over the session and perform any actions as though they were victim in this case. The main purpose here is to gather information and potentially steal data. This could include credentials like passwords to other applications. &nbsp;</p>
<p>Active hijacking is more of an overt attempt to bypass the security of an authenticated session and essentially silence the victim&rsquo;s computer. Cybercriminals can then issue commands, like opening additional online accounts, transferring data or even launching denial of service attacks. &nbsp;</p>
<h3><strong>Comparison between session hijacking and session spoofing </strong></h3>
<p>Session spoofing and hijacking are similar in nature, but with an important difference. &nbsp;&nbsp;</p>
<p>Hijacking a session means the victim is already logged into a web application, and threat actors are essentially invading. Session spoofing refers to situations where cybercriminals try to masquerade as their victim and launch a new online session. This could happen long after the victim has logged off and is going about their day. &nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>How Does Session Hijacking Work? </strong></h2>
<p>In order to see how web sessions get hijacked, you first need to understand what sessions are in the first place, and why they&rsquo;re important. &nbsp;&nbsp;</p>
<h3><strong>Overview of the process of session hijacking </strong></h3>
<p>Entering your username and password to a web application starts an HTTP authentication process between you and the service. &nbsp;</p>
<p>Although it helps verify that your credentials are correct, this type of connection is considered &ldquo;stateless&rdquo; by the server running the application. Rather than having to log in again every time you move from one page to another (or when you go from placing an order to checking out), sessions keep the original authentication active until you finish what you&rsquo;re doing and log out. &nbsp;</p>
<p>Hijackers are essentially stealing these sessions by interfering with the control mechanisms that enable them. &nbsp;&nbsp;</p>
<h3><strong>Common methods used by attackers </strong></h3>
<p>One of the most common approaches to session hijacking involves rogue actors monitoring their prospective victim&rsquo;s network traffic. &nbsp;&nbsp;</p>
<p>This is sometimes known as &ldquo;session sniffing,&rdquo; and much like a dog that detects the scent of meat, cybercriminals may discover the victim has chosen to log into an application using an unsecured connection like public Wi-Fi hotspot. This opens the door for them to steal the session cookie, otherwise known as a session side-jacking attack. &nbsp;&nbsp;</p>
<p>Attacks can happen even more unexpectedly if cybercriminals can use a phishing scheme to dupe someone into clicking on an attachment or link that downloads a trojan onto their machine. Cybercriminals can then activate the malware when the victim logs onto a specific site or application. In these &ldquo;man-in-the-browser&rdquo; attacks (which are similar to man-in-the-middle attacks) cybercriminals can then make requests that appear legitimate to the server, such as modifying transactions or performing other transactions. &nbsp;</p>
<p>Session fixation attacks are similar, at least in the way they fool innocent users. Threat actors will create their own session by setting up a bogus login page that gets sent to the victim. Once they log in, the fake session ID provides cybercriminals the access they were looking for. &nbsp;</p>
<p>The most direct approach is probably cross-site scripting, whereby attackers inject scripts into web applications or servers that contain a known vulnerability. Once those are running, threat actors can find session keys within the victim&rsquo;s web browser and make themselves at home. &nbsp;&nbsp;</p>
<h3><strong>Real-life examples of session hijacking attacks </strong></h3>
<p>In late 2022, popular messaging and collaboration platform <a href="https://securityboulevard.com/2023/01/slack-security-breach-highlights-risks-of-saas-session-hijacking/" target="_blank" rel="noopener noreferrer">Slack admitted session hijackers had managed to break into its private GitHub repositories</a> and steal some of its code. This reflected the proprietary work of its developers to continuously improve its service. By stealing employee session tokens, threat actors were easily able to perform a data breach. &nbsp;</p>
<p>Meanwhile, reports surfaced in late 2023 of threat actors stealing data by <a href="https://www.techtarget.com/searchsecurity/news/366566674/Google-researchers-in-dispute-over-account-hijacking-attacks" target="_blank" rel="noopener noreferrer">restoring expired sessions on Google accounts</a>. The attacks began through social engineering campaigns that led victims to deactivate tools to protect against malware, at which point cybercriminals were able to spot multiple login attempts. &nbsp;</p>
<p>Then there was the flaw in Citrix&rsquo;s NetScaler ADC and NetScaler Gateway products that exposed users to session hijacking. Though the vendor issued a patch, researchers reported a steady stream of attacks using the so-called <a href="https://www.cybersecuritydive.com/news/citrixbleed-patch-hunt-malicious/699164/" target="_blank" rel="noopener noreferrer">CitrixBleed vulnerability</a> against retailers, manufacturers and health-care organizations. &nbsp;&nbsp;</p>
<div id="callout">&nbsp;</div>
<h2><strong>Consequences of Session Hijacking </strong></h2>
<p>These kinds of attacks happen so often and with such ease in some cases that organizations should consider the fallout they face when they become the next victim. &nbsp;&nbsp;</p>
<h3><strong>Impact on user privacy and security </strong></h3>
<p>When hackers break into a user&rsquo;s web application session, they can gain data that can be used in myriad ways. &nbsp;</p>
<p>By taking a victim&rsquo;s passwords, email address or other personal details, for example, they could commit identity theft by posing as that individual by logging into their financial institution or their employer&rsquo;s database. &nbsp;</p>
<p>If they opt for the latter, cybercriminals could compromise the privacy of the employer&rsquo;s staff or customers, stealing even more data or targeting additional victims. &nbsp;&nbsp;</p>
<h3><strong>Potential financial losses due to compromised sessions </strong></h3>
<p>Many web applications, such as those run by an e-commerce retailer, save payment information to make online shopping more convenient for their customers. If those sessions get hijacked, though, threat actors could use that information to make additional purchases. &nbsp;</p>
<p>Financial theft can also happen if hijackers gain access to bank accounts or an organization&rsquo;s procurement systems, where they can transfer money to their own accounts. &nbsp;&nbsp;</p>
<h3><strong>Reputation damage for businesses and organizations </strong></h3>
<p>Any IT security incident has the potential to undo all the time and effort organizations put into building strong relationships with their customers and the general public. &nbsp;&nbsp;</p>
<p>A successful session hijacking attempt means that cybercriminals could potentially infect an organization with malware, launch distributed denial of services (DDoS) attacks or other threats. &nbsp;</p>
<p>That in turn could mean organizations will have to communicate what happened to all the relevant stakeholders &ndash; not just their customers but law enforcement officials and possibly the media. </p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>Preventing Session Hijacking &nbsp;</strong></h2>
<p>Rather than become an IT security statistic, it&rsquo;s best to be proactive in making sure the way employees use web applications keeps data safe, and cybercriminals at bay. &nbsp;</p>
<h3><strong>Best practices for securing sessions </strong></h3>
<p>At a bare minimum, using HTTPS throughout web sessions helps avoid hijacking because it offers both clients and servers a secure connection where data is encrypted. Similarly, secure cookies restrict how data such as session IDs are stored and submitted. &nbsp;&nbsp;</p>
<p>Some IT departments go a step further by validating session data every time employees use a web application to check for any anomalies or inconsistencies in network traffic. Companies can also require sessions to timeout after a specific period, such as when users are inactive for a while. &nbsp;</p>
<h3><strong>Implementing strong authentication and encryption measures </strong></h3>
<p>Session hijacking may pose an increased risk for organizations whose authentication processes are based on single sign-on (SSO), because rogue actors could use the same credentials across a host of platforms. <a href="https://blog.lastpass.com/posts/2024/06/sso-vs-mfa" target="_blank" rel="noopener noreferrer">Multi-factor authentication (MFA)</a> may offer an additional layer of protection. &nbsp;</p>
<p>Organizations should also secure the way session data is stored, and even explore regenerating session IDs at critical transitions within an application, such as when a privilege level changes. &nbsp;</p>
<h3><strong>Regularly updating software and applying security patches </strong></h3>
<p>Whether they opt for active or passive hijacking, it becomes easier for cybercriminals to target sessions in web applications that are exposed to publicly known bugs. &nbsp;&nbsp;</p>
<p>Vendors typically take care to regularly issue patches for these vulnerabilities. The more often these are tracked and applied, the more you&rsquo;ve reduced the risk &ndash; not just the risk of session hijacking, but a number of other cyber threats. &nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>How LastPass Protects Against Session Hijacking </strong></h2>
<p>Beyond the regular best practices, LastPass offers tools that can avoid or mitigate the likelihood that rogue actors will take over your employee&rsquo;s web application sessions. &nbsp;&nbsp;</p>
<h3><strong>Features and functionalities that enhance session security </strong></h3>
<p>By offering <a href="https://www.lastpass.com/security/zero-knowledge-security#:~:text=LastPass%20encrypts%20your%20vault%20data%20to%20protect%20it%20from%20bad%20actors.&amp;text=A%20one%2Dway%20function%20that,unreadable%20output%20called%20a%20hash.#:~:text=LastPass%20encrypts%20your%20vault%20data%20to%20protect%20it%20from%20bad%20actors.&amp;text=A%20one%2Dway%20function%20that,unreadable%20output%20called%20a%20hash." target="_blank" rel="noopener noreferrer">secure password storage</a>, MFA, breach monitoring and secure password creation, LastPass ensures session hijackers are either stopped in their tracks or won&rsquo;t get very far. Even if a session is breached, for example, LastPass allows customers to store passwords and other sensitive data in an encrypted vault. &nbsp;&nbsp;</p>
<p>LastPass even offers security for autofills like forms, which means threat actors won&rsquo;t be able to fool employees with bogus login pages. &nbsp;</p>
<h3><strong>Benefits of using LastPass to mitigate session hijacking risks </strong></h3>
<p>It&rsquo;s not only important to choose a cybersecurity partner with great products and services, but proven processes. LastPass works with third-party testing services, for example, conducts regular security audits and identifies and addresses potential vulnerabilities by participating in a bug bounty program. &nbsp;&nbsp;</p>
<p>No matter your organization&rsquo;s size or the sector in which it operates, employees should be able to use web applications with confidence, focusing on the work they&rsquo;re doing rather than worrying about whether system access and data has been compromised. &nbsp;</p>
<p>Take the next natural step: <a href="https://lastpass.com/enterprise_trial.php" target="_blank" rel="noopener noreferrer">Start your LastPass trial</a> today.&nbsp;</p>

What is Session Hijacking?

Learn what session hijacking is, how it threatens your online security, and how LastPass helps protect your data with advanced security measures. 

Understanding Session Hijacking and How to Prevent It

<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>Tips to Check If a Link Is Safe </strong></h2>
<p>Checking to see if a link is secure might feel like an extra step or a hassle in an already busy day, but it&rsquo;s easy to make a few steps a quick habit that can prevent a future headache.&nbsp;</p>
<h3><strong>Verify the source of the link </strong></h3>
<p>Before clicking on a link, take a moment to verify its source. Ask yourself:&nbsp;</p>
<ul>
    <li><strong>Who sent the link?</strong> Is it from someone you know and trust?&nbsp;</li>
    <li><strong>Is the sender's email address or social media profile legitimate?</strong> Look for subtle discrepancies, like slight misspellings in the domain name.&nbsp;</li>
    <li><strong>Does the message context make sense? </strong>If you receive an unexpected link, especially one urging immediate action, be wary. </li>
</ul>
<h3><strong>Check for HTTPS and secure connections </strong></h3>
<p>A secure website will use HTTPS (HyperText Transfer Protocol Secure) rather than HTTP. HTTPS encrypts the data exchanged between your browser and the website, making it significantly harder for cybercriminals to intercept and manipulate the information. Always look for a padlock icon in the address bar and ensure the URL begins with "<span style="color: #2969b0;">https://</span>" before entering any personal information.&nbsp;</p>
<h3><strong>Use URL scanning tools </strong></h3>
<p>Several online tools are available to help you check the safety of a link before you click on it. These tools can analyze a URL and provide a report on its safety. Some popular options include:&nbsp;</p>
<ul>
    <li><strong>Google Safe Browsing</strong>: Integrated into browsers like Chrome, this tool warns you about potentially dangerous sites.&nbsp;</li>
    <li><a href="https://safeweb.norton.com/" target="_blank" rel="noopener noreferrer"><strong>Norton Safe Web</strong></a>: This tool provides safety ratings for websites based on user feedback and threat analysis.&nbsp;</li>
</ul>
<p>Using these tools can reduce the risk of online threats and help protect users online.&nbsp;</p>
<p style="color: #000000; margin: 0in 0in 8pt;">To summarize, here&rsquo;s &ldquo;how to check if a link is safe&rdquo;:</p>
<p style="color: #000000; margin: 0in 0in 8pt;">First, you&rsquo;ll want to verify the source of the link, credibility of the sender, and rationale behind the email. If there aren&rsquo;t satisfactory answers to the three questions above, it&rsquo;s best to refrain from clicking on the link.</p>
<p style="color: #000000; margin: 0in 0in 8pt;">Second, make sure the URL begins with HTTPS, rather than the less secure HTTP.</p>
<p style="color: #000000; margin: 0in 0in 8pt;">Third, use link scanning tools like Google Safe Browsing and Norton Safe Web before clicking on links in unsolicited emails.</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>How to Check if a Link Is Safe on an iPhone </strong></h2>
<h3><strong>Preview link in Safari </strong></h3>
<p>On an iPhone, Safari allows you to preview a link before committing to a click. This feature is handy for checking the destination of a link without opening it. To use this feature, press and hold the link until a preview window appears. This preview can help you verify the URL and assess whether it looks legitimate.&nbsp;</p>
<h3><strong>Scan website tool in Safari </strong></h3>
<p>Safari also includes a built-in tool that checks the safety of websites you visit. This tool uses a database of known malicious websites to provide warnings when you attempt to visit a potentially dangerous site. To ensure this feature is enabled, go to Settings &gt; Safari &gt; Fraudulent Website Warning and make sure the toggle is turned on. This tool adds an extra layer of protection, alerting you to threats before they can cause harm.&nbsp;</p>
<h2><strong>How to Check if a Link Is Safe on an Android </strong></h2>
<h3><strong>Update security settings </strong></h3>
<p>Keeping your Android device&rsquo;s security settings up to date is crucial for protecting against malicious links. Navigate to Settings &gt; Security and ensure that features like "Google Play Protect" and "Safe Browsing" are enabled. These settings help detect and prevent threats from affecting your device.&nbsp;</p>
<h3><strong>Enable Play Protect </strong></h3>
<p>Google Play Protect is a built-in security service that scans apps and links for potential threats. To enable it, open the Google Play Store, tap the menu icon, and select "Play Protect." Ensure it is turned on to benefit from real-time protection. Play Protect continuously scans your device for harmful behavior, helping to keep your data safe.&nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>What to Do If You Click on a Malicious Link </strong></h2>
<h3><strong>Recognizing signs of a malicious Link </strong></h3>
<p>After clicking a link, you might notice several red flags indicating that the link was malicious:&nbsp;</p>
<ul>
    <li><strong>Unexpected pop-ups</strong>: A sudden influx of pop-up ads or messages can signify malware infection.&nbsp;</li>
    <li><strong>Slow device performance</strong>: Malware can run in the background, consuming resources and slowing down your device.&nbsp;</li>
    <li><strong>Unauthorized changes</strong>: Be alert for changes to your device&rsquo;s settings or the appearance of unfamiliar apps, which could indicate malware activity. </li>
</ul>
<h3><strong>Steps to take after clicking on a suspicious link </strong></h3>
<p>If you realize you&rsquo;ve clicked on a malicious link, take immediate action to mitigate potential damage:&nbsp;</p>
<ul>
    <li><strong>Disconnect from the Internet</strong>: This step can prevent malware from communicating with its command center or spreading further.&nbsp;</li>
    <li><strong>Scan your device</strong>: Use reputable antivirus or anti-malware software to perform a thorough scan of your device and remove any detected threats.&nbsp;</li>
    <li><strong>Change your passwords</strong>: Update passwords for sensitive accounts, prioritizing those linked to financial information or personal data.&nbsp;</li>
    <li><strong>Monitor your accounts</strong>: Keep a close watch on your financial and online accounts for any signs of unauthorized activity. Report any suspicious transactions to your bank or service provider immediately. Some security tools like LastPass offer <a href="https://www.lastpass.com/features/dark-web-monitoring" target="_blank" rel="noopener noreferrer">dark web monitoring</a> to help users catch potential data breaches early and monitor any leaks of sensitive information.&nbsp;</li>
</ul>
<h3><strong>Reporting and blocking malicious links </strong></h3>
<p>Reporting malicious links helps protect others from falling victim to similar threats. You can report suspicious links to your email provider or the website hosting the link. Additionally, use your browser's tools to block the site and prevent future access. Many browsers offer built-in features to report phishing sites and malicious content, contributing to a safer online environment for everyone.&nbsp;</p>
<div id="callout">&nbsp;</div>
<h2><strong>Stay Protected From Malicious Links </strong></h2>
<h3><strong>Importance of using a reliable link checker </strong></h3>
<p>Link checkers are tools that can detect and warn users about potential threats, significantly reducing the risk of clicking on dangerous links. By incorporating link checkers into your daily browsing habits, you can enhance your security and protect your personal information.&nbsp;</p>
<h3><strong>Benefits of LastPass in link safety </strong></h3>
<p>LastPass is widely known for its password management capabilities, but it also offers features that enhance link safety. By storing and autofilling passwords securely, LastPass helps you avoid phishing sites that try to steal your login credentials. Additionally, LastPass can generate complex, unique passwords for each of your accounts, further protecting against threats. Integrating LastPass into your online routine adds a layer of security against malicious links and phishing attempts.&nbsp;</p>
<h3><strong>Additional security measures for safe browsing </strong></h3>
<p>In addition to using link checkers and password managers, several other measures can help ensure safe browsing:&nbsp;</p>
<ul>
    <li><strong>Keep software updated</strong>: Regularly update your operating system, browsers, and security software to protect against the latest threats. Cybercriminals often exploit vulnerabilities in outdated software, so installing updates and patches is key. &nbsp;</li>
    <li><strong>Use strong, unique passwords</strong>: Avoid reusing passwords across multiple accounts. Using a password manager like LastPass <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">helps users create</a> and store strong, unique passwords for each account, which means that even if one account password is compromised, it can&rsquo;t be used across every account. LastPass not only stores and protects your passwords, but also lets admin users set a minimum requirement for length and complexity. &nbsp;</li>
    <li><strong>Enable </strong><a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer"><strong>two-factor authentication (2FA)</strong></a>: Add an extra layer of security to your accounts by enabling 2FA, which requires a second form of verification (such as a code sent to a user's phone) in addition to an account password.&nbsp;</li>
    <li><strong>Prioritize </strong><a href="https://www.lastpass.com/resources/webinars" target="_blank" rel="noopener noreferrer"><strong>learning and education</strong></a>: Staying informed about the latest cybersecurity threats and best practices can reduce risk and improve user security. &nbsp;</li>
</ul>
<p>Ensuring link safety is a critical component of maintaining against online-based threats, and adopting these practices will help you navigate the digital world with confidence and peace of mind. <a href="https://lastpass.com/create-account.php?premium" target="_blank" rel="noopener noreferrer">Start your free LastPass trial today</a>. &nbsp;</p>

How to Check if a Link is Safe

Learn how to verify the safety of a link before clicking. Follow LastPass’s expert tips to protect yourself from phishing and malicious websites. 

<p>While consumers focus on scoring holiday deals ahead of Black Friday and Cyber Monday, cybercriminals have their sights set on an even bigger prize: your credentials. While a wide range of retailers offer discounts on products for the major online shopping event over the holiday season, it will also attract cybercriminals who exploit the increased activity to launch attacks through email, text, and phone scams&mdash;particularly targeting user credentials. Cybercriminals frequently target this shopping period to enable fraud and conduct other malicious attacks. We expect to see an uptick in similar cyber threat activity over the next several weeks.</p>
<p>The following are key cyber threats related to passwords during Black Friday and how they can compromise your account security.</p>
<ul>
    <li><strong>Phishing</strong>&nbsp;is one of the most common tactics used to steal passwords. Cybercriminals craft fake emails, SMS messages, or social media posts that appear to come from retailers offering exclusive deals, gift cards, or urgent account notifications. They also spoof delivery services like UPS since a lot of shipments for online orders occur during this period. Victims are then directed to fake login pages that mimic the real site. When they enter their credentials, the attackers capture the username and password. Once attackers gain access to an account, they may use the same credentials to target other accounts the user owns, especially if passwords are reused across multiple services.</li>
    <li><strong>Credential stuffing</strong>&nbsp;is another common attack method during high-traffic shopping events like Black Friday. This occurs when attackers use previously stolen username-password pairs (often from unrelated data breaches) to attempt logins on various sites. Attackers use automated tools to try large volumes of login credentials. If users reuse passwords across different services, attackers can potentially gain access to their accounts. If successful, attackers can hijack accounts, place fraudulent orders, or change shipping and payment details.</li>
    <li>Cybercriminals may create&nbsp;<strong>fake apps or websites</strong>&nbsp;to trick users into providing their login credentials. Users may download a malicious app or visit a fraudulent website that appears to offer special deals or early access to Black Friday sales. These apps or sites prompt users to log in with their credentials, which are then stolen by the attacker. Beyond just stealing credentials, these malicious apps can also install malware that steals additional information, including other stored passwords on the device.</li>
    <li>During large-scale shopping events, attackers may distribute&nbsp;<strong>malware</strong>, such as infostealers, that target stored passwords. Infostealers are malware designed to steal credentials stored in browsers or password managers. During Black Friday, attackers may target users with malware disguised as legitimate tools or deal notifications, infecting their systems and harvesting stored credentials. If infostealers gain access to a user's device, they can compromise multiple accounts, including banking, email, and social media.</li>
</ul>
<h2>New Threat Vectors Pose Unique Threats</h2>
<p>While most of this activity isn&rsquo;t new, we expect to see some new threat vectors emerge.</p>
<ul>
    <li>With artificial intelligence (AI) tools like large language models now more readily accessible, cybercriminals can create more convincing phishing/smishing messages and social engineering campaigns at scale. Threat actors can rely on these tools to craft well-worded, grammatically accurate messages to add legitimacy to their campaigns. Widely available AI tools also allow more low-skilled threat actors to set up and run mass phishing campaigns. Since ChatGPT launched in November 2022, there has been over a 4,000% surge in malicious phishing messages, according to SlashNext&rsquo;s&nbsp;<a href="https://www.infosecurity-magazine.com/news/341-rise-advanced-phishing-attacks/">The State of Phishing 2024 report</a>.</li>
    <li>QR codes have become more common as they&rsquo;re convenient for contactless transactions and information sharing, but they have also become a target for cybercriminals. Quishing, or QR code phishing, has increased significantly in recent years. In 2021, QR codes were used in only 0.8% of phishing attacks; by the first half of 2024, that number increased to&nbsp;<a href="https://www.egress.com/newsroom/new-egress-report-reveals-millennials-are-the-key-target-as-ai-quishing-and-multi-channel-attacks-top-phishing-trends">nearly 11%</a>.&nbsp;QR codes are a popular marketing tool that can be used in online retail in many ways, such as driving traffic to a store&rsquo;s page, making payments, or providing customer support. This leaves the door open for cybercriminals to use malicious QR codes for attacks to redirect users to fake websites or login portals that request personal information or other sensitive details, download malicious files to a user&rsquo;s device without their knowledge, redirect payments to threat actors&rsquo; bank accounts, or in social engineering attacks to bypass security measures like moving the attack from a protected email environment to a mobile device.</li>
    <li>The explosion in digital retail has transformed how we shop and interact with brands. Social commerce&nbsp;made up about 5% of US e-commerce sales in 2022&nbsp;and is expected to increase to nearly 7% by 2025, according to&nbsp;<a href="https://www.mintel.com/press-centre/nearly-half-of-us-consumers-say-they-have-made-a-purchase-through-social-media/#:~:text=Social%20commerce%20made%20up%20about,2025%2C%20according%20to%20Mintel%20research.#:~:text=Social%20commerce%20made%20up%20about,2025%2C%20according%20to%20Mintel%20research.">Mintel research</a>. Meanwhile, cybercriminals have developed sophisticated techniques to exploit social media platforms, using them as potential attack vectors. Social media users interacting with supposed trusted brands to shop online may have a false sense of security. Beware of fake accounts impersonating brands or promoting supposed products and links.</li>
</ul>
<h2>Keep Your Passwords Safe</h2>
<p>During Black Friday, heightened online commerce activity creates a prime opportunity for cybercriminals to launch password-related attacks. Consumers must remain vigilant, avoid common pitfalls like reusing passwords, and employ strong security practices such as MFA and password management tools. Taking proactive steps to secure accounts is the best way to defend against these prevalent threats. To stay cyber safe this holiday season, consider the following countermeasures:</p>
<ul>
    <li>Always check the URL before clicking on a link or entering your login credentials. If a message over email or text seems suspicious, block the sender and delete it.</li>
    <li>Enable multi-factor authentication (MFA) for your accounts to add an extra layer of security. That will prevent anyone with access to your credentials from simply logging in.</li>
    <li>Avoid password reuse by using unique passwords for each account. A password manager can help generate and store complex, distinct passwords for different services.</li>
    <li>Only download official apps from legitimate stores like Google Play or the Apple App Store.</li>
    <li>Use antivirus software to scan for malware and avoid downloading software from untrusted sources. Consider using a password manager that encrypts credentials.</li>
</ul>

Black Friday Deals Come with Cyber Risks: Keep Your Passwords Safe

During Black Friday, heightened online commerce activity creates a prime opportunity for cybercriminals to launch password-related attacks. Consumers must remain vigilant, avoid common pitfalls like reusing passwords, and employ strong security practices such as MFA and password management tools. Taking proactive steps to secure your accounts is the best way to defend against these prevalent threats. 

Watch for Cyber Monday Scams

The hottest retail event of the year is a magnet for cybercrime. Understand the quickest, easiest ways to spot scams.

Preventing Clickjacking Attacks | LastPass

Discover what clickjacking is, its impact on online security, and how LastPass helps protect users from this type of malicious attack. Learn more now. 

What Is Clickjacking and How to Prevent It

<p>Hashes, salts, and rainbow tables may sound like an avant-garde piece of art. But they&rsquo;re all related to cybersecurity, primarily in the context of password management.&nbsp;&nbsp;</p>
<p>If [..]

Understanding Rainbow Table Attacks and How to Protect Against Them 

<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin-right: 0px; margin-bottom: 10.7px; margin-left: 0px;"><span class="s1" style="background-color: #ffffff;">We recently hosted a webinar led by <a rel="noopener noreferrer" href="https://www.lastpass.com/" target="_blank"><span class="s2" style="color: #386573;">LastPass</span></a> experts Stephanie Schneider, Alex Cox, and Jerome Ferrara, who shared key insights on cyber hygiene practices and strategies to prevent unauthorized access.&nbsp;&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Read on to learn more about how you can apply these learnings to your own business.&nbsp;&nbsp;</span></p>
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Unauthorized access: the starting point for data breaches&nbsp;</span></h2>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Unauthorized access can start a chain reaction that leads to data theft, system disruption, and reputational damage. &nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Weak passwords, credential reuse, brute force attacks, SaaS app exploitation, insider threats, phishing, and social engineering are what attackers use to breach security borders, Alex Cox, Director of Information Security at LastPass explained.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Jerome Ferrara, Principal Product Specialist at LastPass, underscored the need for robust measures, such as strong passwords, MFA, and employee awareness training to combat these issues.&nbsp;</span><span style="color: #131313;"></span></p>
<p>&nbsp;<iframe width="560" height="315" src="https://www.youtube.com/embed/0sONpnTfMDE?si=tYuw6TkaIv5-kO7C" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe></p>
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Case studies: Snowflake &amp; Okta&nbsp;</span></h2>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Stephanie Schneider, Cyber Threat Intelligence Analyst at LastPass, added a practical POV to the discussion, citing Snowflake and Okta.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Using Snowflake as an example of a security crisis precipitated by the absence of multi-factor authentication (MFA), Schneider emphasized the need for robust password policies, regular password rotation, and dark web monitoring.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">The second case involved the Scattered Spider cybercrime group implementing intricate social engineering attacks on high-profile companies like Okta and MGM Resorts. Schneider highlighted the evolving tactics of such groups and their recent focus on cloud environments, SaaS platforms, and high-level permissions to deploy ransomware.&nbsp;</span><span style="color: #131313;"></span></p>
<p>
<iframe width="560" height="315" src="https://www.youtube.com/embed/_6ouMTcavNM?si=GHSSjwD1wX8aUZw7" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>&nbsp;</p>
<h2><span style="background-color: #ffffff;">How to empower secure user behavior&nbsp;</span></h2>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">A key theme of the session, Schneider stressed day-to-day cyber hygiene, including regular password rotation and monitoring, vigilance against third-party threats, and an educated, cyber aware workforce.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Schneider emphasized the importance of multi-factor authentication (MFA), a crucial layer of protection to deflect attacks. Along with MFA, she added that regular security audits help in the early detection of potential weaknesses.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">The need for continuous training and education for employees in order to prevent them from falling for sophisticated phishing and social engineering tactics was another recommendation. Humans, Schneider stressed, are often considered the weakest link in cybersecurity.&nbsp;</span></p>
<p>
<iframe width="560" height="315" src="https://www.youtube.com/embed/0aDa6NJrOcQ?si=yzw4UDq-UWtSDhlK" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin"></iframe>&nbsp;</p>
<h2><span style="background-color: #ffffff;">LastPass: securing passwords, simplified&nbsp;</span></h2>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Users can store complex passwords securely, effectively eliminating the need to remember multiple passwords when they use a password manager like LastPass. Admin features include policy setting, detailed reporting, and secure password sharing, simplifying the onboarding and offboarding process.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Ferrara explained the versatility LastPass offers in setting up policies for offline access, adding users, and federated login. Exportable detailed reports, multi-factor authentication options, and user activity tracking are additional features of LastPass.&nbsp;</span></p>
<h2 class="p2" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Q&amp;A session: addressing queries, mitigating concerns&nbsp;</span></h2>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">During the Q&amp;A session, Schneider and Cox answered questions about the potential risks of hacking authenticator apps, biometrics, password sharing, and changing policies. They advised staying vigilante even with MFA and advocated for biometric authentication.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">Finally, Ferrara cited the user-friendly nature of LastPass, which is capable of integration with browsers and mobile apps, giving users seamless access.&nbsp;</span></p>
<p class="p1" style="color: rgba(0, 0, 0, 0.85); margin: 0px 0px 10.7px;"><span class="s1" style="background-color: #ffffff;">With a surge in unauthorized access and breaches, safeguarding your data has never been more critical.&nbsp;&nbsp;</span></p>
<p class="p4" style="color: #386573; background-color: #ffffff; margin: 0px 0px 10.7px;"><span class="s5"><a rel="noopener noreferrer" href="https://eventhub.goldcast.io/?eventHubId=fac6501f-9d3b-452c-b050-2c62da72908b&amp;utm_source=website&amp;utm_medium=blog&amp;utm_campaign=unauth-access" target="_blank"><strong>Watch the full webinar here</strong></a></span><span class="s6"><strong>.&nbsp;</strong>&nbsp;</span></p>

Blocking Unauthorized Access: Key Takeaways From Our Webinar

With a surge in unauthorized access and breaches, safeguarding your data has never been more critical.

Passphrase vs Password: Which is Safer? | LastPass 

Explore the differences between passphrases and passwords, their security benefits, and how LastPass can help you choose the best option for protecting your accounts. 

Passphrase vs Password: Understanding the Differences 

<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>The potential risks of visiting unsafe websites</strong></h2>
<p>Visiting unsafe websites can expose your device to malware, leading to data breaches and cybersecurity vulnerabilities. These scam websites may also trick you into providing personal information, which can be used for identity theft. Unsafe websites pose a significant threat to your online security, as they can easily become a gateway for hackers to access your sensitive information. Check the website address for safety before entering any personal data. Keep in mind that not all websites are what they seem, and some may be set up by scammers with the sole purpose of stealing your information.&nbsp;</p>
<p>When you visit an unsafe website, you&rsquo;re putting your personal and financial information at risk. Cybercriminals can use various methods to steal this information, including phishing scams, malware, and hacking. They can then use this information to commit fraud, identity theft, and other cybercrimes. It&rsquo;s crucial to know how to tell if a website is secure before you enter any sensitive information.&nbsp;</p>
<h3><strong>How cybercriminals exploit vulnerable websites </strong></h3>
<p>Cybercriminals use various tactics to exploit vulnerable websites. They may inject malicious code, create fake login pages, or use deceptive content to trick users into revealing their personal information. Cybercrimes are becoming increasingly sophisticated, often using social engineering techniques to deceive users. They may disguise their scams as legitimate companies, making it difficult for users to distinguish between a safe website and a scam site. This knowledge can help you avoid falling victim to cybersecurity crime and ensure that your online experience is safe and secure.&nbsp;</p>
<p>Bad actors are always looking for new ways to exploit vulnerabilities in websites. They use sophisticated techniques and tools to gain access to sensitive information, often without the user even realizing it. By understanding how these attacks work and how to identify them, you can help protect yourself and your information from these threats.&nbsp;</p>
<h3><strong>Why protecting personal information online is crucial </strong></h3>
<p>Protecting personal information online is essential to prevent identity theft and other cybercrimes. By ensuring a website is safe before providing personal information, you can significantly reduce the risk of becoming a cybercrime victim. Whether you&rsquo;re shopping, banking, or just browsing, it&rsquo;s essential to ensure that your personal data is secure. Remember, once your information is online, it can be incredibly difficult to remove, so it&rsquo;s best to prevent any potential breaches from occurring in the first place. Always check the website address for safety before entering any personal information and be wary of any site that doesn&rsquo;t appear to be secure.&nbsp;</p>
<p>In addition to the risks posed by cybercriminals, there are also privacy concerns to consider when sharing personal information online. Many websites use cookies to collect personal information from their users, either to provide a personalized experience or for advertising purposes. However, not all websites handle this information securely or responsibly. Understanding how a website uses and protects your personal information before you choose to share it can help you stay in control of your sensitive information.&nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>Signs of a Secure Website </strong></h2>
<p>Knowing how to identify a secure website can help you browse the internet safely. Here are some signs to look for.&nbsp;</p>
<h3><strong>Checking for HTTPS and SSL certificates &nbsp;</strong></h3>
<p>Secure websites use HTTPS and display a padlock icon in the address bar. They also have an SSL certificate, which you can view by clicking on the padlock icon. This is one of the most reliable signs of a secure website, as it indicates that the site encrypts any data sent between you and the server, making it harder for hackers to intercept.&nbsp;</p>
<h3><strong>Verifying trust seals and security logos &nbsp;</strong></h3>
<p>Trust seals and security logos indicate that a website has passed certain security checks. However, make sure these are genuine by clicking on them to verify their authenticity. Fake websites may display these logos without authorization, so it&rsquo;s always a good idea to double-check.&nbsp;</p>
<h3><strong>Importance of a website&rsquo;s privacy policy </strong></h3>
<p>A legitimate website should have a clear privacy policy that outlines how it collects, uses, and protects your personal information. This is a crucial aspect of website safety, as it shows that the site is committed to protecting your data.&nbsp;</p>
<h3><strong>Contact information </strong></h3>
<p>Safe websites usually provide contact information, such as a physical address or phone number. Be wary of websites that only provide a contact form without any other contact information. If a website doesn&rsquo;t provide a way for you to contact them directly, this could be a red flag.&nbsp;</p>
<h3><strong>Seeing website reviews </strong></h3>
<p>Check for reviews of the website online. If many users report negative experiences or scams, it&rsquo;s best to avoid the site. Reviews can provide valuable insight into the experiences of others, helping you make an informed decision about whether to trust a website.&nbsp;</p>
<h3><strong>Finding a site owner </strong></h3>
<p>You can use a &ldquo;WHOIS&rdquo; lookup to find out who owns the website. If the owner&rsquo;s information is hidden or doesn&rsquo;t match the website&rsquo;s content, it could be a red flag. This information can help you determine whether a website is legitimate or not.&nbsp;</p>
<p>In addition to these signs, it&rsquo;s also important to trust your instincts. If something about a website doesn&rsquo;t feel right, it&rsquo;s better to be safe than sorry. Always err on the side of caution when it comes to your online safety.&nbsp;</p>
<h2><strong>Tools to Assess Website Safety </strong></h2>
<p>There are several tools available to help you assess website safety:&nbsp;</p>
<h3><strong>Using website safety checkers and online scanners &nbsp;</strong></h3>
<p>Website safety checkers and online scanners can analyze a website for potential security threats. These tools can provide a safety rating based on factors like website reputation, SSL certificate validity, and presence of malicious content. They can be a valuable resource in helping you determine if a website is safe.&nbsp;</p>
<h3><strong>Leveraging browser-based safety tools and extensions </strong></h3>
<p>Many web browsers offer built-in safety features or extensions that warn you when you&rsquo;re about to visit a potentially unsafe website. These tools can provide an additional layer of protection, helping you browse the internet safely.&nbsp;</p>
<h3><strong>Understanding the role of antivirus software in website protection </strong></h3>
<p>Antivirus software can provide real-time protection against threats from unsafe websites. It can block malicious downloads, warn about unsafe sites, and scan your device for malware. Antivirus software is a crucial tool in protecting your device from online threats.&nbsp;</p>
<p>These tools can provide valuable insights into a website&rsquo;s safety and can help you make informed decisions about which websites to trust. However, they should not be used as a substitute for good online safety habits. Always be vigilant and proactive in protecting your personal information online.&nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=1" target="_blank"><button class="lp-button lp-button--primary">Try Premium</button></a></div>
<h2><strong>Identifying Red Flags of Unsafe Websites &nbsp;</strong></h2>
<p>Being able to identify the red flags of unsafe websites can help you avoid falling victim to scams.&nbsp;</p>
<h3><strong>Spotting suspicious URLs and domain names &nbsp;</strong></h3>
<p>Be wary of websites with URLs or domain names that have misspellings, use unfamiliar top-level domains, or contain a string of random characters. These could be signs of a scam website, designed to trick you into providing personal information.&nbsp;</p>
<h3><strong>Recognizing phishing attempts and deceptive content </strong></h3>
<p>Phishing websites often mimic legitimate websites to trick you into providing personal information. Be cautious of websites that ask for sensitive information, like your password or credit card number, without a valid reason. Always double-check the URL and look for other signs of a secure website before entering any personal information.&nbsp;</p>
<h3><strong>Common warning signs of fraudulent websites </strong></h3>
<p>Fraudulent websites often have poor design, lack contact information, display many pop-up windows, or have content with poor grammar and spelling errors. These are all red flags that suggest a website may not be trustworthy.&nbsp;</p>
<p>If you encounter a website with these red flags, it&rsquo;s best to leave the site immediately and report it if possible. Remember, your online safety is more important than any potential benefit you might gain from using an unsafe website.&nbsp;</p>
<h2><strong>Best Practices for Secure Website Interaction &nbsp;</strong></h2>
<p>To ensure your online safety, follow these best practices.&nbsp;</p>
<h3><strong>Creating strong and unique passwords </strong></h3>
<p>Use a unique, strong password for each online account. Consider using LastPass&rsquo;s password manager to generate and store complex passwords. This can help protect your accounts from being compromised, even if one of your passwords is leaked.&nbsp;</p>
<h3><strong>Enabling two-factor authentication for added security &nbsp;</strong></h3>
<p>Two-factor authentication adds an extra layer of security by requiring a second form of verification in addition to your password. This can significantly reduce the risk of unauthorized access to your accounts.&nbsp;</p>
<h3><strong>Regularly updating software and browsers for vulnerability patches</strong></h3>
<p>Keep your software and browsers updated to protect against the latest security threats. Software updates often include patches for known vulnerabilities. By keeping your software up to date, you can protect yourself from known threats and vulnerabilities.&nbsp;</p>
<p>By following these best practices, you can significantly reduce your risk of falling victim to online scams and cybercrimes. Remember, your online safety is in your hands. &nbsp;</p>
<p><a rel="noopener noreferrer" href="https://lastpass.com/create-account.php?premium=" target="_blank">Start your free LastPass trial today</a>. &nbsp;</p>
<h2><strong>Frequently Asked Questions </strong></h2>
<h3><strong>How can I check if a website is safe? </strong></h3>
<p>You can check if a website is safe by looking for security indicators such as HTTPS and a padlock icon in the address bar, verifying trust seals, checking the website&rsquo;s privacy policy, and using website safety checkers. Additionally, consider using tools like Google Safe Browsing, which can help identify unsafe websites. &nbsp;</p>
<h3><strong>How to check if a website is credible? </strong></h3>
<p>Check if a website is credible by looking for contact information, reading online reviews, verifying trust seals, and using a &ldquo;WHOIS&rdquo; lookup to find out who owns the website. Also, consider the website&rsquo;s design and functionality. Legitimate sites often have a professional look and are free from spelling errors and broken links.&nbsp;</p>
<h3><strong>What are three signs a website is trustworthy?</strong>&nbsp;</h3>
<p>Three signs a website is trustworthy are the use of HTTPS, a clear and comprehensive privacy policy, and positive online reviews. Additionally, trustworthy websites often provide clear and easily accessible contact information.&nbsp;</p>
<h3><strong>How do I detect a fake website? </strong></h3>
<p>Detect a fake website by looking for red flags such as poor design, suspicious URLs, lack of contact information, and content with poor grammar and spelling errors. Also, be wary of websites that require you to enter sensitive information without a clear reason or privacy policy.&nbsp;</p>
<h3><strong>What are the red flags for an unsafe website?</strong> </h3>
<p>Red flags for an unsafe website include the lack of HTTPS, suspicious URLs, pop-up windows, requests for sensitive information without a valid reason, and content with poor grammar and spelling errors. If you encounter a website with these red flags, it&rsquo;s best to leave the site immediately and report it if possible.&nbsp;</p>

How to Check If a Website Is Safe | LastPass

Learn simple ways to check if a website is safe before entering personal information. Protect your data with these essential security tips from LastPass.

How to Determine If a Website Is Safe

<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>What Is SIM Swapping?</strong><span style="font-size: 13px;">&nbsp;</span></h2>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;"><span class="s2" style="color: #386573;"><a rel="noopener noreferrer" href="https://www.microsoft.com/en-us/microsoft-365-life-hacks/privacy-and-safety/what-is-sim-swapping" target="_blank">SIM swapping</a></span><span class="s1"> (also known as SIM hijacking) occurs when an attacker tricks your mobile phone company into transferring your phone number to their SIM card.</span></p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;"><span class="s1">If the deception is successful, the attacker will be able to intercept your MFA authentication codes and gain unauthorized access to all your accounts.</span></p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;"><span class="s1">SIM swapping has become so prevalent that the <a rel="noopener noreferrer" href="https://www.fcc.gov/consumer-governmental-affairs/fcc-announces-effective-compliance-date-sim-swapping-item" target="_blank"><span class="s3" style="color: #386573;">FCC adopted new SIM Swap and Port-Out rules</span></a> in 2023 to protect mobile phone users from it.</span></p>
<p class="p2" style="color: #000000; margin: 0px 0px 10.7px;"><span class="s1">These rules were slated to go into effect on July 8, 2024, but have since been waived until the <a rel="noopener noreferrer" href="https://www.tlp.law/2024/07/08/fcc-amends-sim-swapping-port-out-fraud-compliance-date/" target="_blank"><span class="s3" style="color: #386573;">OMB (Office of Management and Budget) completes a thorough review</span></a>. That likely won&rsquo;t happen until late November 2024. Meanwhile, read on to discover how you can protect yourself from this insidious threat.</span></p>
<h3><strong>Why SIM swapping is a growing concern </strong></h3>
<p>SIM swapping is becoming a larger concern because it relies on identity theft and social engineering. The attacker usually begins by gathering a critical mass of information on you, the phone account owner, online. How? They buy information about you online through the black market or collect it from your social media profiles. &nbsp;</p>
<p>Another common way is through a phishing scam. The attacker will impersonate a phone service provider and send you an email. The email will usually have a link to a web page where you&rsquo;re asked to enter information like your birthday, passwords, or even your Social Security number. The attacker is posing as a legitimate company, so this approach is an easy way to trick people. &nbsp;</p>
<p>After the attacker gathers your information, they can pose as you to your phone carrier to convince them that they&rsquo;re the account holder. Once they pass through the verification tests, the attacker can ask the carrier to &ldquo;port&rdquo; your number to a new SIM card because &ldquo;you&rdquo; lost &ldquo;your&rdquo; original one. The attacker can now control your phone and interfere with phone calls and text messages. They might even access authentication codes for accounts like your banking or social media profiles. &nbsp;</p>
<h3><strong>How SIM swapping affects individuals and businesses </strong></h3>
<p>A SIM swap is theft and sabotage for individuals on multiple levels. The fraudster steals your identity and corrupts your relationship with your mobile carrier to access your information. They can transmit false information by impersonating you, extracting data or confidential information, and blocking access to your accounts.&nbsp;</p>
<p>For example, <a href="https://www.nbclosangeles.com/investigations/phone-sim-swapping-scam/3388687/" target="_blank" rel="noopener noreferrer">NBC Los Angeles</a> recently reported on a man who lost $21,000 in a SIM swap scam. Jeff Drobman started receiving notifications from his bank that someone had logged into his account and changed his password. A fraudster got Drobman&rsquo;s personal information and convinced Spectrum, his cellphone company, to transfer his number to a new phone. They could bypass two-factor authentication to access the authentication codes typically sent to his phone. Then, they were able to log in and steal $21,000.&nbsp;</p>
<p>There are larger-scale consequences for organizations. As <a href="https://www.twilio.com/en-us/blog/sim-swap-fraud#:~:text=SIM%20swap%20attacks.-,Bypassed%20security%20procedures,when%20it's%20actually%20being%20penetrated.#:~:text=SIM%20swap%20attacks.-,Bypassed%20security%20procedures,when%20it's%20actually%20being%20penetrated." target="_blank" rel="noopener noreferrer">Twilio</a> points out, a SIM swap attack can destabilize your organization&rsquo;s security. The hacker may pass your company&rsquo;s multi-factor authentication, and an &ldquo;employee&rdquo; can steal and corrupt your files, financial information, and customer records. If the hacker infiltrates your network, they can steal your customers&rsquo; data and conduct identity theft attacks. They may also make a false purchase, acting as your customer.&nbsp;</p>
<p>The monetary and reputational damages from a SIM swap attack could be debilitating. First, your organization would have to contend with the loss of trust from employees and customers by not making the organization secure enough to prevent data theft. Your customers and investors would abandon you, subject you to lawsuits, and potentially dissuade others from doing business with you, resulting in significant revenue declines. In 2023, the <a href="https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf" target="_blank" rel="noopener noreferrer">FBI</a> reported a loss of over $50 million due to SIM swapping. &nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>How to Protect Against SIM Swapping </strong></h2>
<h3><strong>Enable two-factor authentication </strong></h3>
<p>If you think a scam has happened, the hacker has likely circumvented your existing two-factor authentication. To enhance security, use authenticator apps rather than receiving codes through e-mail or text. It adds another layer of protection where you could add PIN codes, a facial recognition ID, or fingerprints.&nbsp;</p>
<h3><strong>Use a strong and unique PIN for your SIM card </strong></h3>
<p><a href="https://www.mcafee.com/blogs/mobile-security/what-is-sim-swapping/" target="_blank" rel="noopener noreferrer">McAfee</a> advises against creating passcodes that are easy to guess, such as anniversaries, birthdays, or addresses. You can compile several random numbers and memorize them, or you can use a password generator to create one for you. &nbsp;</p>
<h3><strong>Regularly monitor your mobile account for suspicious activity </strong></h3>
<p>Keep watch for social engineering schemes like phishing. Phishing is when cybercriminals &ldquo;fish&rdquo; for your personal information and try to impersonate you to gain access to your information. They can trick you into submitting personal information like your credit card or social security number. One well-known scam is receiving false texts from UPS telling the recipient their package couldn&rsquo;t be delivered and fooling them into inputting personal details. &nbsp;</p>
<h3><strong>Use a password manager&nbsp;</strong></h3>
<p>A password manager helps you create, use, and store an intricate password that&rsquo;s extremely difficult to guess. It&rsquo;s more advantageous if your password manager has zero-knowledge encryption qualities; only you will know your password, not the manager tool. &nbsp;&nbsp;</p>
<h2><strong>Signs That You May Be a Victim of SIM Swapping &nbsp; </strong></h2>
<h3><strong>Sudden loss of cellular service </strong></h3>
<p>If your phone suddenly can&rsquo;t make or receive texts or calls and you lose service where you should have it, an attacker may have deactivated your SIM card.&nbsp;</p>
<h3><strong>Unusual text messages or emails from your mobile carrier </strong></h3>
<p>Alarm bells should go off when you start receiving strange texts or emails from your mobile service provider. The messages may report an unexpected change to the service. If you&rsquo;re suspicious, contact your mobile carrier immediately.&nbsp;</p>
<h3><strong>Unauthorized access to your online accounts </strong></h3>
<p>It may be a sign of a sim swap scam if you suddenly can&rsquo;t access your bank accounts, social media profiles, or emails. You may see suspicious transactions through your bank or credit card money. Another red flag is if you see unusual posts through your social media profiles that you did not create. &nbsp;&nbsp;</p>
<div class="button-container"><a rel="noopener noreferrer" href="https://lastpass.com/enterprise_trial.php" target="_blank"><button class="lp-button lp-button--primary">Try Business</button></a><a rel="noopener noreferrer" href="https://www.lastpass.com/resources/demo/password-and-identity-management" target="_blank"><button class="class lp-button--red-outline">Request a Demo</button></a></div>
<h2><strong>How to Report a SIM Swap Scam </strong></h2>
<h3><strong>Contact your mobile carrier immediately </strong></h3>
<p>This seems obvious, but if a SIM hijacking happens, your attacker has already managed to deceive your mobile carrier. Contact them immediately; hopefully, they&rsquo;ll have security protocols that only you can pass.&nbsp;</p>
<p>If an attack occurs, your provider may have to deactivate your SIM card and phone account. Consider buying a backup mobile device or a burner phone. &nbsp;</p>
<h3><strong>File a report with your local law enforcement</strong>&nbsp;</h3>
<p>After contacting your mobile carrier, contact your financial institution. You can also file an identity theft report with the Federal Trade Commission (FTC). &nbsp;&nbsp;</p>
<h3><strong>Inform your bank and other financial institutions </strong></h3>
<p>Even if the hijacking didn&rsquo;t occur in your bank account, contact your bank anyway. They can alert or stop unauthorized access. Also, place an alert through one of the credit bureaus you use, like Experian, TransUnion, or Equifax, so the bureau with the alert will notify the other bureaus. &nbsp;</p>
<h2><strong>How Social Media Plays a Role in SIM Swap Fraud </strong></h2>
<h3><strong>How personal information shared on social media can be exploited </strong></h3>
<p>Think your X (Twitter) account may not be the cause of your security hack? Think again. One of the first and most significant steps for a sim hijacker is gathering as much of your personal information as possible. Your social media accounts are fertile ground. They could see an address, your college, or a pet&rsquo;s name and test if they are your passwords. From there, they can drive the attack. &nbsp;</p>
<h3><strong>Tips for protecting your privacy online </strong></h3>
<p>Always be vigilant and cautious about strange emails, suspicious links, or organizations that ask you to give personal information. A quick Google search can greatly prevent a costly mistake if you suspect a scam. Being judicious and deliberate about your password creation and storage and enabling multi-factor verification will go a long way. &nbsp;</p>
<h3><strong>Educating others about the risks of SIM swapping </strong></h3>
<p>Most people don&rsquo;t give much thought to the tiny chip card in their cell phones. However, SIM swapping is becoming a more prevalent cybercrime. Embedding SIM swapping prevention into your organization&rsquo;s training and cybersecurity practices will&mdash;at a minimum&mdash;raise awareness of this growing issue.&nbsp;</p>
<h2><strong>LastPass&rsquo;s Role in Protecting Against Sim Swapping </strong></h2>
<h3><strong>Utilize LastPass's strong password generator </strong></h3>
<p>Use the <a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">built-in generator</a> to create a guess-proof password that auto-fills in one click on any device.&nbsp;</p>
<h3><strong>Enable multi-factor authentication (MFA) for your LastPass account</strong></h3>
<p>LastPass&rsquo;s MFA uses biometric and contextual factors to enhance your account's security. Though a SIM swapping criminal may be able to guess your password, the MFA ensures that there are security barriers that only you can get through.&nbsp;&nbsp;</p>
<h3><strong>LastPass&rsquo;s security features to safeguard your online account </strong></h3>
<p>A password manager will drastically reduce the chance of a SIM hijacking attack. First, LastPass uses zero-knowledge encryption, meaning only you know your password. LastPass has a security dashboard and automatic data breach monitoring to spot and stop threats immediately. It also offers impenetrable ways to safely share your password with your colleagues, family, or other trusted parties you authorize.&nbsp;</p>
<p>A SIM swap hijack can transform from a strange notification to stolen funds and large data breaches in minutes. It could be a taxing situation involving your mobile carrier, law enforcement, or customers. Since cyberattacks are becoming cleverer, you&rsquo;re more susceptible than ever to attacks through your phone. Smart online behavior and optimal cybersecurity will stop potentially devastating attacks before they take shape. <a href="https://lastpass.com/enterprise_trial.php" target="_blank" rel="noopener noreferrer">Start your LastPass trial today</a>. &nbsp;</p>

Understanding SIM Swap Attacks

Learn what SIM swap attacks are, how they work, and how to protect against them. Get expert tips from LastPass to keep your data and accounts secure. 

What Is Sim Swapping and How to Protect Yourself

<p>Did you know that 4 million people in the world use&nbsp;<a href="https://techreport.com/statistics/cybersecurity/password-reuse-statistics/" target="_blank" rel="noopener noreferrer">&ldquo;password&rdquo; as the code word</a> for their accounts?&nbsp;</p>
<p><a href="https://cybernews.com/security/cost-of-week-password-hacking/" target="_blank" rel="noopener noreferrer">Weak passwords</a> are a cybersecurity risk. In 2016, 21 million users on the Alibaba-owned Taobao platform had their accounts breached because of easily guessed code words.&nbsp;</p>
<p>Civilians aren&rsquo;t the only ones vulnerable to such&nbsp;<a href="https://blog.lastpass.com/posts/2022/05/what-is-a-brute-force-attack" target="_blank" rel="noopener noreferrer">brute-force attacks</a>. In 2018, hackers gained access to the email accounts of Northern Irish parliamentary officials, due to poor password practices.&nbsp;</p>
<p>In 2024, password security is critical to preventing such breaches. Below, we explore the powerful role it plays in protecting your business accounts.&nbsp;</p>
<h2>Why Is a Master Password Important? </h2>
<h3>Role in password management </h3>
<p>A master password is a single password used to access your password vault. Ideally, it should be&nbsp;<a href="https://www.lastpass.com/security/zero-knowledge-security" target="_blank" rel="noopener noreferrer">zero-knowledge encrypted</a> for superior data security and privacy.&nbsp;</p>
<p>In this way, your data remains unreadable to attackers, even if they successfully execute a server-side attack.&nbsp;</p>
<p>Ultimately, the role of a master password is to protect the contents of your vault. At LastPass, your special code word or master phrase is never shared with us and&nbsp;<a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/c_lastpass_faqs_users_about_account_recovery.html&amp;_LANG=enus" target="_blank" rel="noopener noreferrer">can&rsquo;t be recovered with traditional reset methods</a>.&nbsp;</p>
<h3>Benefits of using a master password </h3>
<p>Many people ask us, &ldquo;Should I have a master password?&rdquo;&nbsp;</p>
<p>The short answer is yes.&nbsp;</p>
<p>By using one, you eliminate password fatigue, the burden of remembering multiple, complex passwords. &nbsp;&nbsp;&nbsp;</p>
<p>And by unlocking your vault with your master password, you also enable&nbsp;<a href="https://www.lastpass.com/features/autofill" target="_blank" rel="noopener noreferrer">autofill functionality.</a> This powerful feature protects you against phishing sites. Here&rsquo;s how: LastPass won&rsquo;t fill in your credentials if the phishing website&rsquo;s URL doesn&rsquo;t match the stored URL in your vault.&nbsp;</p>
<h3>How a master password keeps your data safe </h3>
<p>You aren&rsquo;t alone if you&rsquo;re wondering, &ldquo;How does a master password protect my online accounts?&rdquo;&nbsp;</p>
<p>In a nutshell, it&rsquo;s like a lock that encrypts your vault of secrets. To derive your encryption key at&nbsp;<a href="https://www.lastpass.com/security/zero-knowledge-security" target="_blank" rel="noopener noreferrer">LastPass,</a> we run your master password and a unique salt (random value) through PBKDF2, using HMAC-SHA256 as the underlying function, for 600,000 iterations.&nbsp;</p>
<p>The&nbsp;<a href="https://www.kiteworks.com/secure-file-sharing/unlocking-the-power-of-aes-256-bit-encryption/" target="_blank" rel="noopener noreferrer">256-bit derived key</a> is then used as the key for&nbsp;<a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/incident-work-completed-roadmap.html&amp;_LANG=enus" target="_blank" rel="noopener noreferrer">AES-GCM-256</a> encryption. Ultimately, your AES-GCM-256 key is a symmetric key, which means it&rsquo;s the only key you need to encrypt and decrypt your vault contents.&nbsp;</p>
<p>It&rsquo;s also highly secure, making brute force attacks computationally impractical for hackers.&nbsp;</p>
<h2>How to Create a Strong Master Password </h2>
<h3>Importance of a strong code word or passphrase </h3>
<p>A master password is the&nbsp;<strong>only password</strong>&nbsp;you need to access the contents of your vault.&nbsp;&nbsp;</p>
<p>Thus, a strong one is critical for preventing unauthorized access to your vault.&nbsp;&nbsp;</p>
<h3>Tips for creating a strong master password </h3>
<p>Here&rsquo;s another important question we&rsquo;re often asked: How do I create a strong master password?&nbsp;</p>
<p>One way is to use a&nbsp;<a href="https://www.lastpass.com/features/password-generator" target="_blank" rel="noopener noreferrer">secure password generator</a>. At LastPass, our&nbsp;<a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/generate-secure-passwords.html&amp;_LANG=enus" target="_blank" rel="noopener noreferrer">autosave feature prompts</a> you to save a newly generated password every time you create an account on a website.&nbsp;</p>
<h3>Best practices for choosing a secure master password </h3>
<p>In 2024, the best practices for choosing a secure master password are to align with these directives by:&nbsp;</p>
<p><a href="https://pages.nist.gov/800-63-3/sp800-63b.html" target="_blank" rel="noopener noreferrer"><strong>NIST</strong></a><strong>&nbsp;(National Institute of Standards and Technology): </strong></p>
<ul>
    <li>Focus on length rather than complexity.</li>
    <li>Use two-factor authentication or multi-factor authentication.</li>
    <li>Consider rate-limiting or lockouts after multiple login attempts.</li>
    <li>Passwords should be salted and hashed.</li>
    <li>Choose a password manager with <a href="https://www.lastpass.com/security/zero-knowledge-security" target="_blank" rel="noopener noreferrer">zero knowledge architecture</a>.</li>
    <li>Passwords&nbsp;shouldn&rsquo;t&nbsp;be changed periodically or arbitrarily. A change should be&nbsp;required&nbsp;only if there&rsquo;s evidence of a compromise.</li>
    <li>Newly created passwords should be monitored or compared against a list of credentials known to be commonly used or previously compromised.</li>
</ul>
<p><a href="https://www.cisa.gov/secure-our-world/use-strong-passwords" target="_blank" rel="noopener noreferrer"><strong>CISA</strong></a><strong>&nbsp;(Cybersecurity and Infrastructure Security Agency): </strong></p>
<ul>
    <li>Minimum&nbsp;password length should be 16 characters.</li>
    <li>Make passwords random with a passphrase or string of mixed-case letters,&nbsp;numbers&nbsp;and symbols.</li>
    <li>Use a password manager for secure generation and storage of credentials.</li>
    <li>Create unique code words or passphrases for each account.</li>
</ul>
<p><a href="https://www.cisecurity.org/insights/white-papers/ms-isac-security-primer-organizational-password-best-practices" target="_blank" rel="noopener noreferrer"><strong>CIS</strong></a><strong>&nbsp;(Center for Internet Security): </strong></p>
<ul>
    <li>Minimum&nbsp;password length should be 14 characters.</li>
    <li>Avoid sequential characters.</li>
    <li>Passwords must&nbsp;contain&nbsp;lower and uppercase characters, numbers 0 through 9, and non-alphanumeric characters.</li>
    <li>Avoid contextual words such as usernames and their derivatives.</li>
    <li>The&nbsp;maximum&nbsp;password age must be between 30 and&nbsp;90 days.</li>
    <li>A minimum age is recommended to limit password reuse.</li>
    <li>Use of MFA is recommended for added security.</li>
</ul>
<h2>What Makes a Strong Master Password </h2>
<h3>Character length </h3>
<p>So, how long should your master password be?&nbsp;</p>
<p>The ideal minimum length is at least 16 characters.&nbsp;<a href="https://pages.nist.gov/800-63-4/sp800-63b/passwords/" target="_blank" rel="noopener noreferrer">NIST</a> currently recommends 8 characters (or more) and has emphasized length as the key to greater security against credential-based attacks.&nbsp;</p>
<p>Here&rsquo;s why: longer passwords make it computationally expensive for hackers to crack. This means it takes them significantly more time, processing power, and energy costs to decipher them.&nbsp;&nbsp;</p>
<p>According to&nbsp;<a href="https://tech.co/password-managers/how-long-hacker-crack-password" target="_blank" rel="noopener noreferrer">penetration testers at Hive Systems</a>, it takes 46 million years to crack a 16-character password with uppercase and lowercase characters.&nbsp;&nbsp;</p>
<p>And a 16-character one with upper and lowercase characters, numbers, and symbols? That&rsquo;ll take 5 billion years.&nbsp;&nbsp;</p>
<h3>Complexity </h3>
<p>You&rsquo;ll want to avoid&nbsp;<a href="https://www.geeksforgeeks.org/most-common-passwords/" target="_blank" rel="noopener noreferrer">easily guessed sequential patterns</a> like &ldquo;123456,&rdquo; &ldquo;qwerty123,&rdquo; or &ldquo;123456789.&rdquo;&nbsp;</p>
<p>A good master password involves a combination of uppercase and lowercase letters, numbers, and&nbsp;<a href="https://owasp.org/www-community/password-special-characters" target="_blank" rel="noopener noreferrer">special characters</a>.&nbsp;&nbsp;</p>
<p>It&rsquo;s also best to avoid using&nbsp;<a href="https://www.dcode.fr/leet-speak-1337#f1" target="_blank" rel="noopener noreferrer">leet speak</a> to meet password strength requirements. This is the practice of replacing letters with graphically similar numbers or symbols, like l00t (&ldquo;loot&rdquo;) or n00b (&ldquo;noob&rdquo; or newbie).&nbsp;</p>
<p>Leet speak was popularized before the Internet became widely accessible, back when tech enthusiasts mingled on&nbsp;<a href="https://www.britannica.com/technology/bulletin-board-system" target="_blank" rel="noopener noreferrer">bulletin board systems</a> (BBS) -- similar to our Reddit forums today.&nbsp;</p>
<p>The BBS community hosted a vibrant hacker culture, with users forming their own elite groups of computer nerds. These users were called &ldquo;leets&rdquo; (slang for &ldquo;elites&rdquo;). Leet speak later became popular among gamers, with the most revered members called HaXXors or H4XXors.&nbsp;</p>
<p>You&rsquo;ll want to avoid leet speak, however, and here&rsquo;s why: While leet speak makes&nbsp;<a href="https://www.researchgate.net/publication/365478150_Evaluation_of_Leet_Speak_on_Password_Strength_and_Security" target="_blank" rel="noopener noreferrer">passwords significantly more complex</a>, hackers have become privy to their use and have developed specialized programs to crack them.&nbsp;</p>
<h3>No personal identifiers </h3>
<p>You&rsquo;ll also want to refrain from using these personal identifiers:&nbsp;</p>
<ul>
    <li>Names of relatives, friends, and pets</li>
    <li>Phone numbers, addresses, and locations you regularly visit</li>
    <li>Birthdates, anniversaries, graduations, and favorite holidays</li>
    <li>Nicknames or phrases associated with you</li>
</ul>
<h3>Do not reuse passwords </h3>
<p>If you generally&nbsp;<a href="https://financesonline.com/password-statistics/" target="_blank" rel="noopener noreferrer">reuse your passwords</a>, you aren&rsquo;t alone: 44% of your professional peers also engage in the same practice.&nbsp;</p>
<p>However, 80% of breaches are caused by reused login credentials.&nbsp;</p>
<p>For your security, we recommend that you avoid reusing your master password.&nbsp;&nbsp;</p>
<h3>Enable MFA authentication </h3>
<p>You may have heard that multi-factor authentication (MFA) is a critical, added defense against traditional brute force attacks.&nbsp;&nbsp;</p>
<p>However, hackers are now leveraging&nbsp;<a href="https://arstechnica.com/security/2024/03/mfa-fatigue-attack-targets-iphone-owners-with-endless-password-reset-prompts/" target="_blank" rel="noopener noreferrer">push bombing or MFA prompt bombing</a> to bypass MFA protections. In this type of attack, your mobile device may be bombarded with 100+ prompts to reset your password.&nbsp;&nbsp;</p>
<p>The attackers hope that, by overwhelming you with an avalanche of requests, you&rsquo;ll simply tap &ldquo;Allow&rdquo; to dismiss the invasive prompts. In many cases, the prompts &ldquo;lock up&rdquo; your phone, forcing you to act to maintain your phone&rsquo;s functionality.&nbsp;</p>
<p>However, all hope is not lost.&nbsp;<a href="https://www.lastpass.com/products/multifactor-authentication" target="_blank" rel="noopener noreferrer">Passwordless FIDO2 authentication</a> incorporates factors like biometrics, contextual behavior, location attributes, or passkeys to provide reinforced immunity against these MFA-based attacks.&nbsp;</p>
<h3>Use character strings </h3>
<p>In&nbsp;<a href="https://www.programiz.com/c-programming/c-strings" target="_blank" rel="noopener noreferrer">C programming</a>, a character string is a set of characters that end with a null character (&lsquo;\0&rsquo;). An example is char c [6] = {&lsquo;M&rsquo;, &lsquo;a&rsquo;, &lsquo;n&rsquo;, &lsquo;g&rsquo;, &lsquo;o&rsquo;, &lsquo;\0&rsquo;}&nbsp;</p>
<p>In the context of creating strong passwords, character strings allow for complex and unpredictable sequences that promote data security.&nbsp;</p>
<h2>Remembering Your Master Password </h2>
<h3>Techniques for memorization </h3>
<p>One great way to memorize your password is to increase your cognitive abilities. Research shows that the effort made in learning new skills can&nbsp;<a href="https://www.psychologytoday.com/us/blog/black-belt-brain/202407/trying-harder-increases-cognitive-effort-and-enhances-memory?msockid=2437e7ee919466051bbbf33390f667e5" target="_blank" rel="noopener noreferrer">improve working memory allocation</a>.&nbsp;</p>
<p>And in turn, enhanced memory allocation can lead to&nbsp;<a href="https://www.verywellmind.com/what-is-brain-plasticity-2794886" target="_blank" rel="noopener noreferrer">increased neuroplasticity</a> and greater recall capacity.&nbsp;&nbsp;</p>
<p>If you&rsquo;re looking for memory-enhancing activities, these five activities will get you up to speed (the first three are the easiest to fit into a busy schedule):&nbsp;</p>
<ul>
    <li>Reading 1-5 pages from a non-fiction book daily&nbsp;</li>
    <li>Using&nbsp;<a href="https://www.lifehack.org/851026/spaced-repetition" target="_blank" rel="noopener noreferrer">spaced repetition</a>, where you spend anywhere from 10 to 20 minutes each day or every other day reviewing and reciting your master password</li>
    <li>Playing online memory games for 10-15 minutes daily</li>
    <li>Learning a musical instrument</li>
    <li>Learning a new language</li>
</ul>
<p>While learning a new skill is time and effort intensive, studies show that active engagement in learning a musical instrument or new language can promote greater brain plasticity than&nbsp;<a href="https://www.bbc.com/news/health-68105868" target="_blank" rel="noopener noreferrer">passive activities</a> like listening to music.&nbsp;</p>
<h3>Using mnemonic devices to recall your master password </h3>
<p>A mnemonic device is a fancy way of saying &ldquo;memorization tool.&rdquo;&nbsp;</p>
<p>These&nbsp;<a href="https://www.verywellmind.com/using-mnemonics-for-improved-memory-7370351" target="_blank" rel="noopener noreferrer">mnemonic devices</a> can prompt greater recall. They include:&nbsp;</p>
<p>1) Creating a playful or even outlandish sentence, using the first letter of each word, and adding special characters and numbers, like&nbsp;<strong>I love 35 blue cheese * and * peppermint sauce patties on 83 lamb kebabs!</strong>&nbsp;(Il35bc*a*pspo83lk!)&nbsp;</p>
<p>2) Using a&nbsp;<a href="https://www.rd.com/article/good-passwords/" target="_blank" rel="noopener noreferrer">passphrase</a> or sentence that appeals to your personality.&nbsp;</p>
<p>For example, if you enjoy summer romance novels, use a memorable line from your favorite novel as a passphrase.&nbsp;</p>
<p>Not a fan of romance novels? Try autobiographies, action thrillers, historical fiction, or mystery novels. You can even adapt phrases from your favorite songs, movies, or documentaries.&nbsp;</p>
<p><strong>A note of caution:</strong>&nbsp;Phrases from well-known literary or musical works are more vulnerable to brute force attacks.&nbsp;&nbsp;</p>
<p>Random word passphrases (although harder to remember) offer greater protections. Consider implementing a hybrid approach. Add random words, special characters, numbers, and symbols to your quotes.&nbsp;</p>
<p>3) Creating a&nbsp;<a href="https://practicalpie.com/memory-palace-simple-guide/" target="_blank" rel="noopener noreferrer">Memory or Mind Palace</a>, where you combine recall and visual abilities to recite your password or passphrase effortlessly.&nbsp;</p>
<p>Below is a very basic example you can adapt:&nbsp;&nbsp;</p>
<ul>
    <li>Choose a passphrase. Here's an improvised one from the book <em>The Making of a King: King Charles III and the Modern Monarchy</em> (Robert Hardman): &ldquo;King Charles says trust and visibility are the main components of good leadership.&rdquo;</li>
    <li>Select a location such as your home.&nbsp;</li>
    <li>Determine the loci (or locations in your home) that you&rsquo;ll use for your memory palace.&nbsp;</li>
</ul>
<p><strong>TV in the living room:</strong> Picture a crown from the opening credits of the Netflix series The Crown. This symbolizes King Charles.&nbsp;</p>
<p><strong>Tap in the kitchen: </strong>Each time you turn on the tap, you &ldquo;trust&rdquo; that water will flow from it.&nbsp;&nbsp;</p>
<p><strong>Oven in the kitchen: </strong>This is where you prepare your meals. It&rsquo;s &ldquo;visible&rdquo; every time you enter the kitchen.&nbsp;&nbsp;</p>
<p><strong>Dry erase board on the pantry door (listing domestic chores assigned to family members):</strong> This list represents what &ldquo;leadership&rdquo; looks like in your home.&nbsp;</p>
<p><strong>Tip #1:</strong>&nbsp;Each location should help you remember key words in your passphrase.&nbsp;&nbsp;</p>
<p><strong>Tip #2: </strong>Add symbols and numbers to make your passphrase more complex.&nbsp;&nbsp;</p>
<p><strong>Tip #3:</strong>&nbsp;Make your passphrase longer.&nbsp;</p>
<h3>Tips for securely storing your master password </h3>
<p>Here are four tips for&nbsp;<a href="https://lifehacker.com/how-to-safely-store-sensitive-files-in-the-cloud-1848529835" target="_blank" rel="noopener noreferrer">securely storing your master password</a>:&nbsp;</p>
<ul>
    <li>Never write it down on paper or store it in plain text.</li>
    <li>If you must store it in plaintext, use a safe or safe deposit box.</li>
    <li>Save it in your OneDrive Personal Vault.</li>
    <li>Store it in encrypted folders on your desktop or laptop.</li>
</ul>
<p>But what if you lose your secret code word or passphrase? At LastPass, we make security easy with <a href="https://support.lastpass.com/s/document-item?language=en_US&amp;bundleId=lastpass&amp;topicId=LastPass/recover-master-password.html&amp;_LANG=enus" target="_blank" rel="noopener noreferrer">these recovery options</a>. If you&rsquo;re ready to enjoy greater peace of mind, sign up for a <a href="https://www.lastpass.com/trial/business" target="_blank" rel="noopener noreferrer">free, no-obligation trial today</a>.&nbsp;</p>

What is a Master Password? | LastPass 

Learn what a master password is, its importance in securing your LastPass account, and how to create a strong, secure master password to protect your sensitive information. 

What Is a Master Password? 

When it comes to your employees authenticating, multiple methods makes for a complex tech stack. What if there were a simpler solution? One that could consolidate your tools while removing a login method that is largely reliant on human behavior – passwords.

In our new report out today with the FIDO Alliance, <strong><em>The 2023 Workforce Authentication Report: Embracing the Passwordless</em> </strong><em><strong>Future</strong>, </em>we look to understand the state of passwordless, its benefits and barriers, and the role passkeys will play in the business environment.

Surveying over one thousand IT decision makers from the United States, United Kingdom, France, Germany, and Australia, the results show businesses readily embracing the passwordless future -- 92% of respondents to be exact -- as they look to fewer passwords to keep their credentials more secure.

“The move towards passwordless authentication has gained steam over the past few years as an increasing number of organizations have moved to eliminate the risk and liability of passwords as they are the source of the vast majority of data breaches,” said Andrew Shikiar, Executive Director and CMO of the FIDO Alliance. “Today’s report backs up this trend by illustrating that global IT leaders are rapidly aiming to reduce their reliance on legacy forms of authentication in favor of passkeys for user-friendly, phishing-resistant sign-ins.”

Read LastPass and the FIDO Alliance’s<em> The 2023 Workforce Authentication Report: Embracing the Passwordless</em> <em>Future</em> to learn:
<ul>
 	<li>Why businesses are looking to passwordless authentication to secure their data;</li>
 	<li>How and when they plan on implementing passwordless technology within their organization;</li>
 	<li>The important role of passkeys in this passwordless future.</li>
</ul>
The passwordless road lies ahead. Which direction is your organization going?

Find out by downloading the report <a href="https://www.lastpass.com/resources/ebook/the-2023-workforce-authentication-report-embracing-the-passwordless-future" target="_blank" rel="noopener"><strong>here</strong></a>.

The 2023 Workforce Authentication Report: Embracing the Passwordless Future

When it comes to your employees authenticating, multiple methods makes for a complex tech stack. What if there were a simpler solution? One that could consolidate your tools while removing a login met[..]

<span data-contrast="none">If you’ve just gotten a new device, are new to password managers, or want to take your online security </span><span data-contrast="auto">to the next level, LastPass can put your digital life at your fingertips in four easy steps. </span><span data-contrast="auto">Whether you’re looking to secure your personal credentials or your business, password peace of mind is just a few steps away. Ready? Let's get your new LastPass account set up. </span>
<ol>
 	<li>
<h3><b><span data-contrast="auto">Download the app </span></b></h3>
</li>
</ol>
<span data-contrast="auto">You can download the LastPass app on your iOS or Android device from either the Apple App Store or Google Play Store in just a few touches.  </span>

<span data-contrast="auto">We recommend using LastPass on both mobile and desktop, so make sure to also download the LastPass </span><a href="https://lastpass.com/misc_download2.php" target="_blank" rel="noopener"><span data-contrast="none">browser extension</span></a><span data-contrast="auto"> on Safari, Chrome, and Firefox. The browser extension prompts you to save passwords to your LastPass vault, generate new passwords, and autofill login information seamlessly. How easy is that? </span>
<ol start="2">
 	<li>
<h3><b><span data-contrast="none"> Use your master password to login</span></b></h3>
</li>
</ol>
<span data-contrast="auto">Your master password is the last password you’ll ever need when using LastPass, so make sure it’s unique. That means </span><b><i><span data-contrast="auto">never</span></i></b><span data-contrast="auto"> (and we mean never) reusing it.  </span>

<span data-contrast="auto">Whether you’re already a password pro or need some guidance on creating </span><a href="https://support.lastpass.com/help/generate-secure-passwords-lp020011" target="_blank" rel="noopener"><span data-contrast="none">strong credentials</span></a><span data-contrast="auto">, it’s always good to take stock of what makes a master password difficult to crack.  </span>
<ul>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559683&quot;:0,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="auto">A minimum of 12 characters (the longer the better!) </span></li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559683&quot;:0,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="auto">Upper case, lower case, numeric, and special character values </span></li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559683&quot;:0,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="auto">A random, memorable passphrase (but one that’s not easily guessed) </span></li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559683&quot;:0,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="auto">No personal information (pet names, street addresses, family names) </span></li>
</ul>
<ol start="3">
 	<li>
<h3><b><span data-contrast="none"> Set up authentication</span></b></h3>
</li>
</ol>
<span data-contrast="auto">LastPass Authenticator offers an adaptive authentication experience while adding an extra layer of security. The </span><a href="https://lastpass.com/auth/" target="_blank" rel="noopener"><span data-contrast="none">LastPass Authenticator app</span></a><span data-contrast="auto"> can be downloaded onto your new iOS or Android device.  </span>

<span data-contrast="auto">Multi-factor authentication combines biometric and contextual factors to prove your identity – something you know (a password), something you have (a mobile device), and something you are (a biometric).  </span>

<span data-contrast="auto">If you’d like to take authentication a step further, you can </span><a href="https://blog.lastpass.com/2022/06/passwordless-is-possible-lastpass-gets-you-there-sooner/" target="_blank" rel="noopener"><span data-contrast="none">set up passwordless login</span></a><span data-contrast="auto"> to your vault with the Authenticator. No need for your master password again, unless for account-related changes</span>

<span data-contrast="auto">Pair your </span><a href="https://support.logmeininc.com/lastpass/help/i-have-a-new-phone-what-should-i-do" target="_blank" rel="noopener"><span data-contrast="none">new device to your LastPass account</span></a><span data-contrast="auto"> by logging into your LastPass account, select</span><i><span data-contrast="auto"> I have a new phone &gt; Send me a recovery email</span></i><span data-contrast="auto"> and follow the subsequent prompts. You’ll be sent an authentication registration email to pair your LastPass account with your new device. </span>

<span data-contrast="auto">If you’re using LastPass for your business, multi-factor authentication is a critical component of a strong cybersecurity strategy in the face of rising </span><a href="https://blog.lastpass.com/2021/05/worried-about-ransomware-turn-on-mfa/" target="_blank" rel="noopener"><span data-contrast="none">ransomware attacks.</span></a><span data-contrast="auto">  Additionally, many </span><a href="https://blog.lastpass.com/2021/09/cybersecurity-insurance-providers-require-multi-factor-authentication-mfa/" target="_blank" rel="noopener"><span data-contrast="none">cyber insurance providers</span></a><span data-contrast="auto"> now require MFA as breaches continue to plague companies, small and large alike.  </span>
<ol start="4">
 	<li>
<h3><b><span data-contrast="none"> Update your trusted devices</span></b></h3>
</li>
</ol>
<span data-contrast="auto">If you’re the only person using this new device and have good password hygiene, you can update your account settings to trust this device. When prompted by MFA after logging in, you can select this as a trusted device for the next 30 days.  </span>

<span data-contrast="auto">Make sure to take stock of all your trusted devices. If there’s one that’s out of commission, </span><a href="https://support.logmeininc.com/lastpass/help/manage-trusted-devices-for-multifactor-authentication-lp030010" target="_blank" rel="noopener"><span data-contrast="none">make sure to delete</span></a><span data-contrast="auto"> it from your list of Trusted Devices.  </span>
<h3><b><span data-contrast="none">You’re LastPass ready!</span></b></h3>
<span data-contrast="auto">Made it all the way to step four? You’re now secure with LastPass! </span>

<span data-contrast="auto">Keep exploring your </span><a href="https://www.lastpass.com/features/password-vault" target="_blank" rel="noopener"><span data-contrast="none">LastPass vault</span></a><span data-contrast="auto"> to ensure all your credentials are accounted for; that you’ve set up </span><a href="https://www.lastpass.com/features/emergency-access" target="_blank" rel="noopener"><span data-contrast="none">Emergency Access</span></a><span data-contrast="auto"> by adding another active LastPass user; and that </span><a href="https://support.lastpass.com/help/how-do-i-enable-dark-web-monitoring-in-lastpass" target="_blank" rel="noopener"><span data-contrast="none">Dark Web Monitoring</span></a><span data-contrast="auto"> is turned so you can stay ahead of breaches.  </span>

<a href="https://www.lastpass.com/" target="_blank" rel="noopener"><span data-contrast="none">Learn more</span></a><span data-contrast="auto"> about all that LastPass has to offer to take your security – whether personal or professional – to the next level.  </span>

How to Set Up Your New LastPass Account

<span data-contrast="none">If you’ve just gotten a new device, are new to password managers, or want to take your online security </span><span data-contrast="auto">to the next level, LastPass can put [..]

Blog