The information provided on this website does not, and is not intended to, act as legal, financial or credit advice; instead, it is for general informational purposes only. Information on this website may not be current. This website may contain links to other third-party websites. Such links are only for the convenience of the reader, user or browser; we do not recommend or endorse the contents of any third-party sites. Readers of this website should contact their attorney, accountant or credit counselor to obtain advice with respect to their particular situation. No reader, user, or browser of this site should act or not act on the basis of information on this site. Always seek personal legal, financial or credit advice for your relevant jurisdiction. Only your individual attorney or advisor can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation. Use of, and access to, this website or any of the links or resources contained within the site do not create an attorney-client or fiduciary relationship between the reader, user, or browser and website owner, authors, contributors, contributing firms, or their respective employers.
Credit.com receives compensation for the financial products and services advertised on this site if our users apply for and sign up for any of them. Compensation is not a factor in the substantive evaluation of any product.
There is an Apple enthusiast I know – and I’m sure you have a similar friend – who used to gleefully brag about all the suspicious links he could click on from his phone or computer with no fear of consequences.
But after Apple’s confirmation this weekend that it was in the process of creating and issuing patches to resolve a massive security flaw in its operating systems and many of its connected programs, he’s singing a different tune.
The SSL bug, as it’s being called, is actually just a tiny logic error in a small piece in Apple’s massive operating system – but big things often come in small packages. In layman’s terms, the flawed bit of code is supposed to be responsible for making sure that your computer’s or your phone’s Internet connection with other, secure servers across an Internet connection is itself secure from hackers. But because of the tiny error, which has reportedly been around at least since September 2012, your computer or phone has showed such connections as secure whether or not they actually were.
While the mechanics of the bug would make it difficult for a random person in Central Europe to gain access to your computer, it does make it very easy for the guy next to you on an unsecured WiFi connection to do exactly that – and to get into your email, your bank accounts, your Facebook or any other secure application that would normally be slightly more private on a public WiFi server.
Now, if we were all being smart about our phones and our computers, this might not matter as much: you really shouldn’t be conducting financial transactions on public WiFi connections or letting your phones automatically connect to any open network whether you have a Mac or a PC, or an Android phone or an Apple one. But in reality, Apple’s perceived imperviousness from viruses and malware has left more than one person with the false impression that they, too, were impervious from a cyberattack.
Well, no more. Apple fans had a nice run, but it’s time to face the fact that perhaps the only thing standing between most of us and a successful targeted cyberattack is our own behavior, not our operating systems.
So what should you be doing now? The same things you should’ve been doing all along.
Between the increasing fear-of-missing-out (FOMO) engendered by a wired world and wireless companies’ data caps, those unsecured WiFi connections represent quite a temptation – and hackers know it. But unless it’s an emergency, you should really avoid using them when at all possible. Change your phone settings to make sure you’re not connecting to unsecured wireless systems automatically, keep your activity to a minimum and never, ever use them to log into a bank account, use a credit card or enter any kind of password.
We’ve all dismissed that little Apple pop-up box encouraging us to download the latest fix – and some of us have dismissed it more than once – but it’s time to stop the madness. Nothing you are doing on the Internet right now is more important than making sure no one else is poking around in your computer or your phone – and whatever you are doing, including reading this article, is something you can start doing again pretty soon.
You see them on Twitter – little egg avatars that respond randomly with just a shortened link to something for no apparent reason. They’re in your email inbox from friends you haven’t heard from in a while. Sometimes, they even arrive by text. But if you can’t tell where they lead, or even if you can but the links seem like an odd thing for someone to send you without context, don’t click them. They were dangerous before, they’re dangerous now and, patch or no patch, they’ll be dangerous tomorrow.
It’s easy enough in this day of virus checkers, malware spotters, supposedly impenetrable networks and browsers that won’t let you visit suspicious sites to just think the tech companies have it covered – but they don’t. They can only protect you from what they know exists, and hackers are always out to make something new to avoid detection. Don’t rely on technology over your own common sense.
If you are worried that your financial information has been compromised because of this or any other form of cyber-insecurity, be sure to monitor your credit reports closely. You can access each of your three major credit reports for free once a year from the major credit reporting agencies, and you can use a free tool, like the Credit Report Card, to monitor both the information in your credit report and your credit scores monthly.
Apple has already issued a patch for its phones and promised one for its computer operating system and connected programs affected by the SSL bug. But once you download it, don’t assume that you’re safe. Let this be a wake-up call to some and a reminder to the rest of us that technology isn’t an impenetrable force field against attacks: it’s just a Maginot line against a direct attack.
Image: Dmitry Kutlayev
October 19, 2023
Identity Theft and Scams
May 17, 2022
Identity Theft and Scams
May 20, 2021
Identity Theft and Scams