spinofflive
IMAGE: ARCHI BANAL
IMAGE: ARCHI BANAL

InternetSeptember 23, 2021

Overdue to be ‘pwned’? Here’s how to keep hackers out of your online accounts

IMAGE: ARCHI BANAL
IMAGE: ARCHI BANAL

New data shows hundreds of New Zealanders have been victims of recent cyber attacks. In the latest instalment of IRL, Dylan Reeve explores how you can avoid becoming one of them. 

After a balmy day lounging with her husband on a secluded Portuguese beach during a three week holiday in 2019, Sharon, an Auckland office manager in her early 60s, returned to her hotel room to discover dozens of new emails on her phone. The messages were replies to emails Sharon was certain she hadn’t sent, all in Russian. She began to panic. 

“I thought, ‘If they have got into my phone, and are able to send emails, what on earth else have they got?’” Sharon said. “It wasn’t like we had millions stashed away or anything, but I felt quite vulnerable being away from home.” 

Sharon didn’t know what to do – she was miles from New Zealand, wasn’t exactly a computer whizz, and had never encountered a situation like this. So she did the one thing that felt safest: “I turned my phone off.”

Sharon’s experience isn’t uncommon: new data released last week by CERT NZ, the government’s Computer Emergency Response Team, revealed that hundreds of New Zealanders were the victims of cyber attacks over a three month period this year – per the online lingo, they were pwned. CERT NZ has seen a steady rise in incident reports in the four years it’s been around, partly because people are becoming aware of the organisation’s work but also because more New Zealanders are falling victim to cyber criminals.

“We suspect it’s still only a small part of the bigger picture,” said CERT NZ director Rob Pope. “It’s an upward trend.”

A large part of the problem, according to Erica Anderson, chief operating officer of security consultancy SafeStack and self-described security nerd, is that “you can’t do anything nowadays without having some type of online account”. Today, many New Zealanders begrudgingly comply as their supermarkets, hairdressers, TV channels and even news outlets pester them to create yet another login.

But with so much personal information online, New Zealanders are putting themselves at risk of security breaches. Even a seemingly inconsequential account takeover – a supermarket loyalty card, say – can lead hackers to more important email, social media or even banking accounts. In the worst cases, information gained from user profiles may even be used to conduct identity theft, as an unlucky electronics developer from Lower Hutt recently discovered

Our geographic isolation is no protection, either. “When you’re online, no one cares that you live on a small island in the middle of the ocean,” Anderson said. “They’re just looking for whatever accounts they can get into.”

Research released this month by Google showed that almost 70% of New Zealanders are taking a “she’ll be right” attitude to their online security and failing to take the steps they should in order to protect themselves online. But the good news is these lax security habits are easy enough to rectify. 

For most regular punters, the first place to start is by improving password hygiene. Internet users quickly stack up dozens or even hundreds of online accounts without blinking an eye, but most aren’t using unique passwords for every site. Many use just a small handful, often a variation of a pet’s name (fluffycat14) or whatever was on their desk eight years ago when they signed up (gr33npen).

The ideal situation is one password per website, because hackers engage in “credential stuffing” on the (often correct) assumption that internet denizens use the same password in multiple places. Like the school caretaker trying every key on the giant key ring until the padlock finally opens, credential stuffing involves hackers using lists of usernames and passwords stolen from one site to try logging into many others, as thousands of Disney+ users found out the hard way a couple of years ago

THE WEBSITE HAVEIBEENPWNED.COM LETS INTERNET USERS TRACK POTENTIAL PASSWORD LEAKS.

Back in Aotearoa in 2019, Sharon’s son David – an IT professional with years of experience dealing with unwanted invaders on business computers – was alerted to the possibility she was facing down hackers on her holiday.  When he received “some random emails” purportedly from Sharon “that were clearly not from her,” he sprung into action: “I messaged her and let her know what was going on.”

He soon clocked what had happened. Hackers had accessed Sharon’s email using a password stolen from another site, and were sending malicious links to hundreds of email addresses in the hopes of tricking recipients into giving up their login details.

David believes the root of the problem was a hack into Dropbox a few years earlier, where over 68 million accounts were compromised – including his mum’s. “I must admit that password, I’d used it for a few things,” Sharon said, “but I didn’t know Dropbox had been compromised.” 

Keeping New Zealanders safe on the internet is a core role for CERT NZ. “People, through our advice and steps, are able to take more proactive action to look after themselves,” said Pope. And chief among CERT’s recommendations is to use a password manager.

It might sound counterintuitive, but it’s usually better not to know or remember passwords, as it’s too easy to fall into familiar bad habits (remember “fluffycat14”?). Instead, it’s better to have long passwords that are very random, and a password manager makes this practical by using a single master password, or a “passphrase”. This is the “final boss” of passwords, so it’s important that it be even longer than usual. Very long. Like, really, really long. 

“I tend to recommend a phrase from a book or a phrase from a poem,” suggested Anderson. “Just like, a long sentence that really sticks with you.”

Handily, the Google Chrome and Microsoft Edge browsers that most people already use have these capabilities built in, as do Apple’s devices. The downside, though, is these systems can be hard to access for non-website uses, or on other devices. 

A popular alternative is a third-party password manager, such as LogMeOnce, LastPass, Dashlane and 1Password. These apps securely store and manage passwords online under lock and key, like very security-conscious digital librarians. Then the apps can be incorporated into a web browser or installed on other devices such as smartphones and tablets.

With a password manager in place, it’s simple to generate a unique password per website and level up from “fluffycat14” to “d@R_qGJ8GiEZa9KxbYgv” (passwords that look like that time Fluffy the cat jumped on the keyboard while chasing a moth are the strongest.)

For those who stubbornly insist on remembering passwords, one way to improve security is by “salting” a strong and long base password, ie tweaking it each time with a predictable and memorable modification. For example, if your rule is that the first and third letter of the website in question be added into the base password’s second-to-last and first position respectively, the base password “password” – never, ever use this, by the way – would become “ipassworTd” when used for Twitter. Clear as mud?

It’s important to note, though, that salting isn’t as secure as using truly random passwords and a password manager. If an attacker acquired copies of passwords from multiple websites, they might be able to crack the salting formula – especially if it’s as transparent as “ipassworTd”. 

A second key area of vulnerability for New Zealanders online is the failure to use two-factor or multi-factor authentication. Google’s data shows that fewer than 1 in 10 New Zealanders are using this tool widely, but that’s a real mistake, as it provides crucial additional security.

“It’s like putting a second lock on your house,” said Pope. “So apart from a key lock, you might have a deadlock as well. Even if attackers get into the first layer, there’s a second layer.”

Still not sure what that means? Well, a password is a single factor, “something you know”. Adding “something you have” – like a device known to be controlled by the user – is a second factor, and some systems add a third by requiring biometric data such as a fingerprint, ie “something you are”. This stuff can sound more like it belongs in Mr Robot than the day-to-day lives of everyday New Zealanders, but Pope disagrees. 

In terms of setting up two-factor authentication, while many websites can be configured to send a text message to confirm new logins, often this isn’t ideal due to SMS delays and the periodic switching up of phone numbers. A better option is an authenticator app like Authy that runs on a phone or computer and generates a new six-digit code every 30 seconds. The app and the website share a secret code between them so they’re always thinking of the same number, meaning the website has peace of mind about who exactly is trying to get in.

IMAGE: ARCHI BANAL

Voila! With these two key steps – using unique passwords, and adding multi-factor authentication to key accounts – New Zealanders can dramatically reduce their risk of falling victim to cyber criminals. 

But what about keeping everyone’s actual devices and computers safe? Anderson’s advice is to trust the manufacturers. “Just use automatic [operating system] updates,” she said. Rest assured modern operating systems and mobile devices are being updated pretty often, and security is a key component.

A final word of warning from CERT NZ is to be scrupulous about information shared online. “A recent example is a Facebook post, ‘What’s your celebrity name?’ – you enter your first pet’s name and street name,” Pope explained. “It seems like a fun thing, but it’s a way that attackers are gathering personal information.”

For anyone who ends up in hot water or detects something suspicious, Anderson suggests phoning a friend, just as Sharon did to David. “Knowing who to call when something just seems kind of off or wrong, is helpful,” she said. “Maybe you have kids who are a bit tech savvy or a friend who works in IT.” If there are no friendly geeks readily accessible, all New Zealanders can reach out directly to CERT NZ

In the end, Sharon got lucky in Portugal: David thwarted the plans of the Russian hackers by wresting her email account back with a swift password change before they could do any lasting damage. (Also, in an ironic twist, we now know the Dropbox breach that first exposed Sharon’s password was the result of password reuse by a Dropbox employee, highlighting just how common these bad habits are.)

Sharon learned her lesson about online security the hard way, and knows things could have been much worse without David’s intervention: “I think it made me aware that I had to be more prepared than I had been,” she concluded. Sharon probably won’t have another run-in with Russian hackers anytime soon, thanks to her newly beefed-up security habits. But the thousands of New Zealanders reusing “fluffycat14” on website after website may not be so fortunate. 

Get in touch with us at irl@thespinoff.co.nz. 

Keep going!
Image: Archi Banal
Image: Archi Banal

InternetSeptember 17, 2021

Normal feelings, or ADHD, ASD or PTSD? Social media is here to diagnose you

Image: Archi Banal
Image: Archi Banal

Psychologists say more and more New Zealanders are self-diagnosing as neurodivergent or mentally ill. In the first instalment of IRL – a new series exploring the real-world consequences of online life – Josie Adams delves into the social media communities encouraging them to do so. 

Put a finger down if you regularly: touch your face, make impulse purchases, have more than four tabs open on your browser, ignore texts, lose things, or run late. If you lost a whole hand, you might have ADHD. At least, that’s what some TikTokkers are telling us.

Videos about conditions like ADHD, autism spectrum disorder (ASD) or Tourettes, and mental illnesses and disorders like depression, anxiety and PTSD, have boomed on social media over the past year: Paige Layle, a 21-year-old Canadian TikTokker with 2.6 million followers, posts relatable content about her experiences with ASD while Connor DeWolfe, another TikTok star, shares ADHD content with over 2.9 million followers.

With the encouragement of TikTok stars and Instagram influencers here and overseas, a number of New Zealanders are self-diagnosing using the vast resources of the internet, and declaring themselves neurodiverse or mentally ill without actually having a medical record to reflect it. 

Dr Kerry Gibson, a clinical psychologist and associate professor at the University of Auckland, says since the internet’s inception, self-diagnosis has been on the rise. “As long as we’ve had the virtual environment, we’ve had access to online quizzes asking ‘are you depressed?’ or ‘do you have ADHD?’,” she says, adding there’s been a “flurry” of social media posts about the symptoms of conditions like ADHD recently.

At Victoria University’s Clinical Psychology Centre, practice manager and clinical psychologist Dr Dougal Sutherland confirms he’s seeing more clients come in with self-diagnosed conditions who are looking for clinical validation. “It’s not necessarily a new thing, but it’s become a lot more common or frequent,” he says, “particularly in regard to ADHD and ASD.” 

But why is self-diagnosis of these conditions increasing, and what is the value – and risk – associated with these labels?

One of the key benefits of self-diagnosis, according to people who do it, is validation. Tammy*, a 33-year-old communications specialist based in Wellington, says self-diagnosing with ADHD helped her understand her existence isn’t just a long series of screw-ups. “I always wondered why other people were seemingly able to just go to work and do their job and not spend all day on Facebook and stuff,” she says, adding that the longest she’s held down a job is two years. 

She started looking for a way to explain that pattern in 2014, when she found herself consistently struggling to meet freelance writing deadlines. “I started Googling auditory processing disorder and kind of went down that rabbit hole,” she says. She read blogs, Instagram posts and WebMD articles, and realised she “ticked so many boxes for women with ADHD”.

Tammy quickly joined communities of other women with ADHD – both clinically and self-diagnosed – on Reddit, Instagram, and Facebook. “The really cool thing to me about that group was recognising that there were other people who had the same issues as me, and that it wasn’t in my head,” she continues. “I wasn’t just a lazy person who can’t push work out on deadline or clean their house.”

Online research can also help correct widespread under-diagnosis or misdiagnosis, alerting people to the possibility that they’re presenting atypically with a neurodiverse condition or mental illness.

Historically, ADHD and ASD diagnoses didn’t extend into adulthood, or had to be very severe: “You had to be Rain Man, essentially,” Sutherland says. The known prevalence of ADHD is about 6% of children – about two-thirds keep their symptoms into adulthood – and the prevalence rate of ASD is basically unknown, because of the changing definition. “We’ve started thinking about it much more as a spectrum, rather than a hard yes or no,” he explains.

According to Sutherland, the self-diagnosed are often not wrong. Most who come through his clinic are people in their 20s or early 30s, who might have had milder cases of ADHD and ASD and therefore slipped through their schooling with the conditions unnoticed. “If you have really severe difficulties, both the health and the education system will pick you up and probably provide you with some really good support,” he says. “But that’s only like, 3% of the population, and there’s often a whole huge chunk of people who have mild to moderate difficulties who simply get overlooked.”

David*, a 31-year-old student in Dunedin, is one such case. He says the internet and friends with the condition helped him expand his understanding of what ADHD looked like and realise his depression diagnosis might be off the mark. “My conception of ADHD was from the two or three kids I’d known with ADHD in primary school,” he says, “who were always really hyperactive and bouncing off the walls.” 

When his online research alerted him that low self-esteem and low educational achievement could indicate ADHD, he became more sceptical of his diagnosis of depression. “It’s not like I was ever depressed for no reason,” he continues. “I was depressed because I couldn’t get the things done that I wanted to, which also made me anxious.”

After self-diagnosing at 24, David received a formal diagnosis of ADHD in the subsequent years. He’s now medicated for ADHD – and nothing else. “It changed my life,” he says. “My depression disappeared.” 

But there are potential downsides to self-diagnosis, too. A major problem, in Gibson’s view, is that these online discussions can lead people to “pathologise ordinary experiences of distress or difficulty” – when you go through a terrible break up, for example, you might self-diagnose depression after seeing a TikTok. “I think it kind of sets up this false dichotomy between what is normal and what is supposedly not normal,” she says. Big posters like Layle and DeWolfe have clinical diagnoses of ADHD and ASD, but in the content they create about their conditions, they often isolate symptoms into small videos or images that can feel relatable even to the neurotypical, prompting comments like, “Are you diagnosing me!?” or “I thought this was normal!”

Gibson stresses, however, that it’s perfectly legitimate to seek support for ordinary life hardships. “I don’t want to give the message that young people don’t need help, and that they need to just sit there and be OK with feeling sad or struggling with schoolwork,” she says. “I’m saying the exact opposite; that they’re perfectly entitled to help even without that passport of the label. It’s OK to come forward and say, ‘I’m just struggling’.”

Navigating normal life under the shadow of a pandemic means greater numbers of New Zealanders are in this position. Calls and texts to Lifeline are up 40% during the latest lockdown compared to the first major lockdown last year, and more than 80% compared to 2019. The combination of being stuck at home, distressed, and spending more time on social media can drive even more people to self-diagnose.

Anne*, a 22-year-old also based in Wellington, has been floating between jobs since the lockdown last year, and she’s hoping her ADHD self-diagnosis will provide some solace. Suddenly being at home without any external motivations like peer pressure, scheduled breaks, or human interaction was a shock to the system, and she couldn’t find the internal motivation to continue her work. “I felt like my hands were tied to my sides,” she says. “I just couldn’t work.”

She remembers first seeing ADHD self-diagnoses on Tumblr, but didn’t think it applied to her at the time. Last year made her reconsider: she began seeing content specifically about women with ADHD, and like Tammy, considered the possibility she was presenting atypically. “I thought, either I’m just a really horrible, lazy, selfish person, and that’s who I am,” she continues, “or maybe I have ADHD and that’s what’s making it really hard for me to work.”

 

View this post on Instagram

 

A post shared by The A World UK CIC (@theaworlduk)

While self-diagnosis can be a useful starting point, both Gibson and Sutherland have noticed individuals can become too attached to their own assessments.“I think it is fairly normal to have a bit of a Google before you go [to a medical professional], and come up with your own solutions,” Sutherland says. “You just don’t want to hold onto those too tightly. I mean, I know when I go to the doctor I’ve already Googled what I’ve got, but nine times out of 10 I don’t actually have a tumour in my knees.”

Self-diagnosis should be your entry point into psychological care, not a final destination – otherwise, as Gibson puts it, “you’re just left feeling like ‘I am this person with ADHD’ or ‘I’m this person with PTSD or depression’.”

According to David, some social media communities encourage the kind of inertia Gibson describes. “If you surround yourself with people in that first stage, who are just telling themselves, ‘Hey, you literally can’t ask me to do anything with my life or change or moderate my behaviour because I have BPD, ADHD, or ASD,’ it stunts you,” he says.

Seeking treatment isn’t always an easy task, however. A serious nationwide shortage of psychologists and psychiatrists means getting a clinical diagnosis for conditions like ADHD, ASD and PTSD could take over a year: The current demand for private psychologists has been called “unprecedented”, with more than 50% of clinical psychologists reporting in a recent survey they had to turn away more than 10 families each month. 

Sutherland says private diagnosis and treatment of ADHD and ASD is usually required, because DHB resources are set aside for the 3% of our population with the most urgent need – even though research has found that closer to 5% of the population has a severe need for mental health and addiction services. 

But even private treatment involves significant wait times. “I get referrals every day,” Sutherland says. “We are currently full and not taking on any new clients, probably until next year. I think that’s a fairly typical timeframe. So it’s really hard trying to find somebody.”

Tammy, the 33-year-old who self-diagnosed ADHD, says her online research and the ADHD-centred Facebook group she found have enabled her to prepare for the costly, lengthy journey ahead. “Now I know I need to go to a psychiatrist, that the wait time is going to be probably 12 to 18 months, and that it’ll cost me about $2,000,” she says.

Meanwhile Anne, the 22-year-old who thinks she might be presenting atypically with ADHD, has just spent $900 on her first session with a psychiatrist, and will need at least two more before she gets any treatment. “If I do end up getting a diagnosis and treatment, I’ll have pretty much no money left at that point,” she says. “I just can’t see a future. I can’t picture myself in a job, paying rent, the way that my mental state is. I need something. I need some treatment. I just can’t see any options.”

Gibson understands these feelings of frustration, but stresses there are other options. “I would suggest that if they can’t get to a mental health provider that they really speak to somebody else, like a GP or a counsellor or somebody who, even if that person isn’t going to make the diagnosis, may be able to advise them on ways of managing it in the meantime,” she says. “People don’t have to have a diagnosis to be helped. It’s been set up as a passport to getting help, but it shouldn’t be.”

At their worst, online communities encourage people to pathologise ordinary problems and over-identify with the labels they’ve given themselves – but at their best, they help people gather information, seek support and prepare for the lengthy process of getting a formal diagnosis. 

For Anne, the key benefit of self-diagnosing online was realising she’s not a terrible person, and a different life is possible. “It gives me hope that I can change these behaviour patterns that I’ve found myself in, and be better in the future,” she says. “Whereas without that, if this was just the way I am, I would have no hope.”

*Names have been changed for privacy

The original version of this article contained reference to an online influencer that has since been removed