Tutorials
Mobile Security For All
Steps To Securing Your Mobile Device
Understanding SIM-Based Attacks: How cybercriminals gain control of your phone number and then your accounts.
Set a SIM PIN: Add a PIN or passcode to your SIM card for extra security. You must enter the SIM PIN whenever the mobile device is switched on to access your phone service.
Request an e-Sim from your mobile communications provider: e-SIMs offer enhanced security by replacing physical SIM cards that can be switched to another phone if your phone is stolen.
Remove your cell phone as an account recovery option: Set your primary email address instead of your phone number for account recovery.
Set Strong Passwords: Use unique, complex passwords for all accounts, avoiding reusing passwords across platforms.
Enable Two-Factor Authentication (2FA): To reduce reliance on your phone number, use authenticator apps instead of SMS-based 2FA.
Going Passwordless: A modern approach to authentication that enhances both security and convenience.
Security Questions: A weak link? Feel free to lie as long as you can remember. Why not say "Pokemon" when asked for a favourite pet?
Theft Resilience: Android and iPhone users can use advanced features to protect their devices and data in case of device theft.
Limit Personal Information Sharing: Avoid sharing sensitive details on social media that could help attackers impersonate you.
Be Vigilant About Phishing: Do not click on suspicious links or provide personal information in response to unsolicited or fraudulent messages and physical mail.
Monitor Accounts Regularly: Check for unusual activity and immediately report any suspected fraud to your carrier.
By implementing these security measures and staying vigilant, you can significantly reduce the risk of falling victim to SIM-based attacks. If you notice any signs of a potential attack, contact your mobile service provider immediately and take steps to secure your accounts and personal information.
Understanding SIM-Based Attacks
SIM-based attacks come in two primary forms:
SIM Swapping: Cybercriminals gain control of your phone number by transferring it to a new SIM card.
SIM Porting: Scammers transfer your number to another service provider.
5 Telltale Signs of a SIM Swap Attack
Unexpected Service Changes: Notifications about your SIM or phone number being activated elsewhere.
Communication Disruption: Inability to make or receive calls and text messages.
Security Alerts: Notifications about profile data changes or failed login attempts from unfamiliar sources.
Carrier Account Lockout: Blocked access to your mobile provider account.
App and Account Access Issues: Inability to log into phone apps and online accounts.
Additional Warning Sign: Unusual activity on social media accounts, especially for those with substantial followings.
Set a SIM PIN:
Physical SIM PIN Setup:
A SIM PIN adds an extra layer of security to your mobile device, preventing unauthorized access to your mobile network. Here's how to set it up:
Locate the Default PIN: Most SIM cards come with a default PIN, often "0000" or "1111" (check with your provider if unsure).
Enable the SIM PIN:
iPhone: Settings > Mobile Service > SIM PIN > Toggle on > Enter default PIN > "Change PIN"
Android: Settings > Security > Advanced > SIM card lock > Toggle on > Enter default PIN > "Change SIM card PIN"
Set Your New PIN: Enter a personalized 4 to 8-digit code that's easy for you to remember but hard for others to guess.
Choosing a Secure SIM PIN:
When selecting your SIM PIN:
Avoid Years: Birth years (1925-2024) offer limited combinations, making them guessable.
Balance Simplicity and Security: With only three attempts before locking, avoid overly complex codes.
Use Memorable Patterns: Consider reversing a meaningful date (e.g., "1985" becomes "5891") or use a unique sequence.
Be Aware of Lockouts: Three incorrect attempts will lock your SIM, requiring a PUK code from your provider.
Handling a Forgotten SIM PIN:
If you forget your PIN and enter it incorrectly three times:
Your SIM will lock.
You'll need the PUK code from your carrier (via their app or customer service).
Caution: Ten incorrect PUK entries will permanently block the SIM, necessitating a replacement.
Setting an eSIM PIN:
For eSIM-enabled devices:
iPhone:
Settings > Mobile Data
Select eSIM profile
Ensure "Turn On This Line" is active
Tap "SIM PIN"
Toggle on "SIM PIN"
Enter the desired PIN
Tap "Done"
Android:
Settings
"Security" or "Biometrics and Security"
"SIM card lock" or "Set up SIM card lock."
Toggle on the SIM lock
Enter the desired PIN
By implementing a secure SIM PIN for both physical and eSIMs, you significantly enhance your mobile network security, protecting against unauthorized access even if your device falls into the wrong hands.
Request an eSIM from a UK Provider
eSIMs offer enhanced security by eliminating physical SIM cards and provide a more convenient way to manage mobile plans. To get an eSIM in the UK, follow these steps:
Contact your provider: Reach out to your mobile network operator (e.g., EE, Vodafone, O2, Three) through their official channels:
Website: Log into your account and look for eSIM options
Mobile app: Use the latest version of your provider's app
Customer service: Call or visit a store for assistance
Request eSIM activation: Ask for an eSIM activation pack or QR code. Some providers may offer:
Digital QR code sent via email
Physical QR code mailed to you
Activation code for manual entry
Activate the eSIM: Follow your provider's specific instructions, which typically involve:
Scanning the QR code with your device's camera
Entering the activation code manually in your device settings
Following on-screen prompts to complete the setup
eSIM-Compatible Devices
Many modern smartphones and tablets support eSIM technology. Here's a list of some popular eSIM-compatible devices:
Apple Devices
iPhones: Models from iPhone XS/XR onwards
iPads: Recent models with cellular capabilities (e.g., iPad Pro, iPad Air, iPad mini)
Samsung Devices
Galaxy S series: S20, S21, S22, S23, S24 (and their variants)
Galaxy Z series: Fold, Fold2, Fold3, Fold4, Flip, Flip3, Flip4
Galaxy Note series: Note20, Note20 Ultra
Google Devices
Pixel series: Pixel 2 and newer models
Other Manufacturers
Huawei: P40, P40 Pro, Mate40 Pro
Sony: Xperia 10 III Lite, Xperia 10 IV, Xperia 5 IV, Xperia 1 IV
Motorola: Razr 2019, Edge series (2022 and newer)
Oppo: Find X3 Pro, Find X5, Reno series (select models)
It's important to note that device compatibility can vary by region and carrier. Some models purchased in specific countries (e.g., China, Hong Kong, or US versions) may not support eSIM functionality. Always check with your device manufacturer and mobile provider to confirm eSIM compatibility for your specific model
Remove your cell phone as an account recovery option
General Steps
Log in to each of your important online accounts
Navigate to the account security or recovery options section
Remove your phone number as a recovery method
Add or confirm your primary email address as the main recovery option
Enable two-factor authentication using an authenticator app if available
For Major Platforms
Go to myaccount.google.com > Security
Under "Ways we can verify it's you", remove phone and add email
Set up 2-Step Verification
Go to Settings & Privacy > Settings > Security and Login
Edit "Choose 3 to 5 friends to contact if you get locked out"
Remove phone from "Add a phone number" and ensure email is set
Apple ID
Go to appleid.apple.com > Sign-In and Security
Remove phone from trusted phone numbers
Add a recovery email address
Set up two-factor authentication with device prompts
Microsoft
Go to account.microsoft.com > Security
Remove phone from "Ways to prove who you are"
Add recovery email under "Advanced security options"
Enable two-step verification
Set Strong Passwords
Creating strong passwords is crucial for protecting your online accounts. However, strong passwords are not easy to make or remember. For this reason, it is strongly recommended that you use a password manager, as password managers can formulate passwords for you.
Here are key strong password guidelines to follow:
Use a Password Manager
Use a password manager to generate and store complex passwords securely
This allows you to create unique, strong passwords for each account without having to remember them all
Examples of free password managers:
Bitwarden: Offers unlimited password storage across unlimited devices, open-source architecture, and basic vault health reporting.
NordPass: Provides unlimited password storage, a password generator, and secure notes in its free plan.
Dashlane: This service allows you to store 25 logins on a single device and includes features like password sharing and breach notifications.
Proton Pass: Offers unlimited password storage on unlimited devices, up to 10 email aliases, and vault health reports.
RoboForm: Provides basic password management features with its free version, including auto-filling capabilities.
If you are not already using a password manager, wait until completing the section on two-factor authentication before choosing.
Length and Complexity
Use a minimum of 12 characters
Combine uppercase and lowercase letters, numbers, and symbols
Best Practices
Create unique passwords for each account
Avoid using personal information like birthdays or names
Consider using a passphrase (a series of random words) for added security and memorability
Avoid Common Mistakes
Don't use sequential numbers or letters (e.g., "123" or "abc")
Avoid using common words or phrases that can be easily guessed
Passphrases: A Stronger Alternative
Passphrases offer several advantages over traditional passwords:
Easier to remember: Consists of multiple words, making them more memorable than complex strings of characters
Enhanced security: Due to their length, passphrases typically have higher entropy, making them more difficult for cybercriminals to crack or guess
Better protection: Generally considered more secure than traditional passwords, especially given the poor password habits many users have
Versatility: Can be used as a substitute for passwords in most systems that accept longer character strings
When creating a strong passphrase:
Aim for at least four words and 15 characters in length
Ensure randomness by avoiding related words or phrases
Consider deliberately misspelling a word for added complexity
Never reuse passphrases across multiple accounts
Passphrases are particularly useful for master passwords, such as those used for password managers. However, be aware that some websites or applications may have character limits.
Combine strong passwords or passphrases with multi-factor authentication (MFA) whenever possible to maximise security. (Don't worry; we will cover this.) Remember, a strong password or passphrase is your first defence against unauthorized account access. Following these guidelines and using a password manager can significantly enhance your online security.
Use the password strength tester below to see how long it would take to hack passwords (but please, do not use your real passwords).
Enable Two-Factor Authentication (2FA):
Two-factor authentication, commonly known as 2FA, is an additional layer of security used to protect your online accounts. Users must provide two authentication factors to verify their identity before accessing an account or system. The concept of 2FA is based on the principle of "something you know" combined with "something you have" or "something you are." Here's how it typically works:
Something you know: This is usually your password.
Something you have: This could be a mobile device, a hardware token, or a security key.
Something you are: This refers to biometric data like fingerprints or facial recognition.
By requiring two different types of authentication, 2FA significantly enhances account security. Even if attackers obtain your password, they need the second factor to access your account. Common examples of 2FA include:
A code sent via SMS to your phone (no longer considered secure; always choose to send codes via WhatsApp where possible)
A code generated by an authenticator app
A notification is sent to your mobile device
A hardware security key that you use with your device
Implementing 2FA adds an extra step to the login process, but it dramatically improves the security of your online accounts, making it much more difficult for unauthorized users to gain access.
Keeping Your Online Accounts Safe: Free and Paid OptionsIn today's digital world, protecting your online accounts is important. There are two main ways to do this: a free method and a paid method that offers extra security.
Free Option: Password Manager and Authentication App
This free option uses two tools to keep your accounts safe:
Password Manager (like Bitwarden, NordPass, or Proton Pass):
Stores all your passwords securely
Creates strong passwords for you
Works on all your devices (phone, computer, tablet)
Alerts you if your passwords might be at risk
Authentication App (like Ente Auth):
Adds an extra layer of security to your accounts
Works on your phone, computer, and tablet
Keeps your information safe even if you lose your device
Easy to use with helpful features
Using these two tools together keeps your passwords and security codes separate, making it harder for others to access your accounts. You can still get into your accounts even if you lose your phone.
Paid Option: Security Key and Password Manager
For those willing to spend a bit more for added convenience and security:
Security Key (Example: YubiKey):
A small device you can carry on your keychain
Works with popular services like Google, Apple, Facebook, and Microsoft
It makes it nearly impossible for others to access your accounts without physical access to the security key device.
Two types are available:
a) Basic version: Good for most people, easy to use
b) Advanced version: For those who need extra features that include a very good 2FA app.
Password Manager with extra features:
Similar to the free version but with more options
Works well with the security key
This option is even more secure because it uses a physical device to protect your accounts.
Important Things to Remember
Caution! It is possible to be locked out of your accounts
If you use a security key, write down backup codes for your accounts
Consider having a spare security key just in case (mandatory to secure apple accounts)
Regularly check that your backup methods still work
Choose the option that fits your needs, budget, and how much security you want. Both options are much safer than just using passwords. The free option is good for most people, while the paid option gives extra protection for those who need it.
Going Passwordless
Going passwordless is a modern approach to authentication that enhances both security and convenience. Here's what you need to know as an end user:
What is Passwordless Authentication?
Passwordless authentication is a method of verifying your identity without using a traditional password. Instead, it relies on alternative, often more secure methods.
Benefits for You
Improved Security: No more weak or reused passwords that can be easily compromised.
Enhanced Convenience: No need to remember complex passwords or frequently change them.
Faster Login: Often quicker than typing a password, especially on mobile devices.
Common Passwordless Methods
Biometrics: Use your unique physical features to log in, such as:
Fingerprint scan
Facial recognition
Voice recognition
Magic Links: Receive a one-time login link via email or SMS.
Hardware Tokens: Use a physical device like a security key or smart card.
How to Use Passwordless Authentication
Set Up: Follow your service provider's instructions to enable passwordless login.
Login Process:
For biometrics: Scan your fingerprint or face when prompted.
For magic links: Click the link sent to your email or phone.
For hardware tokens: Insert or tap your security key when requested.
Backup Method: Always set up a backup authentication method in case your primary method is unavailable.
What to Keep in Mind
Ensure your devices are secure and up-to-date.
Be cautious with magic links, especially on shared devices.
If using biometrics, make sure your device's sensors are clean and functioning properly.
By embracing passwordless authentication, you're taking a significant step towards a more secure and user-friendly online experience.
Security Questions:
Websites sometimes ask you personal questions to prove who you are. These questions usually ask about your pets, your favourite foods, or where you went to school. While this might seem helpful, it's not very safe.
Why These Questions Can Be Risky
Think of these questions like a spare key to your house. Just as you wouldn't leave your spare key in an obvious place, you shouldn't use obvious answers to these questions. Many people can find your pet's name or high school by looking at your Facebook page or other social media.
A Safer Approach
Instead of using real answers, try this simple trick:
Make up fun, imaginary answers that only you would know
For example, if asked about your pet's name, don't use your actual pet's name, "Fluffy."
Instead, use something silly like "PurpleDinosaur123."
Remember
Think of these security questions as another password. Just as you wouldn't use an easy-to-guess password, don't use easy-to-guess answers to these questions.
The key is to create answers that are:
Not true facts about your life
Easy for you to remember
Hard for others to guess
Keep your made-up answers in a safe place, just like you would with your passwords. This way, you'll have them when you need them, but others won't be able to guess them.
Theft Resilience
In today's digital age, smartphone theft remains a significant concern. Both Android and iPhone users can take advantage of advanced features to protect their devices and data in case of theft. Here's a comprehensive guide on how to enhance your device's theft resilience:
Strategies to Prevent Phone Theft
Use Physical Security Measures:
Enable phone locks (PINs, patterns, biometrics)
Use secure storage when not in use
Stay Aware of Your Surroundings:
Remain vigilant in crowded places
Avoid displaying devices unnecessarily
Never Leave Devices Unattended in public areas
iPhone Theft Protection
Apple's Stolen Device Protection, available in iOS 17.3 and later, offers enhanced security:
Biometric Authentication: Requires Face ID or Touch ID for sensitive actions
Security Delay: Imposes a one-hour delay between biometric authentications for critical changes
Location-based Protection: Activates enhanced security when away from familiar locations
To enable Stolen Device Protection:
Go to Settings > Face ID & Passcode (or Touch ID & Passcode)
Enter your passcode
Scroll down and tap "Stolen Device Protection"
Toggle the switch to turn it on
Android Theft Protection
For Android devices running Android 10 and later:
Open Settings
Tap Google > All services > Theft protection
Enable the following options:
Theft Detection Lock: Uses AI to detect if your phone has been snatched
Remote Lock: Allows remote locking using a verified phone number
Offline Device Lock: Locks the device if disconnected from the internet
Additional Theft Resilience Measures
Enable Find My Device:
iPhone: Settings > [Your Name] > Find My > Find My iPhone
Android: Settings > Google > Find My Device
Use Strong Passcodes:
iPhone: Settings > Face ID & Passcode > Change Passcode
Android: Settings > Security > Screen lock
Enable Two-Factor Authentication for your Apple ID or Google Account
Set Up Regular Backups:
iPhone: Settings > [Your Name] > iCloud > iCloud Backup
Android: Settings > System > Backup
Protect Your SIM Card with a PIN:
iPhone: Settings > Cellular > SIM PIN
Android: Settings > Security and privacy > More security settings > SIM lock
Steps to Take if Your Phone is Stolen
Report the Theft:
Notify local authorities and your mobile carrier immediately
Use Remote Wiping and Tracking:
Activate Find My iPhone or Google Find My Device to locate or erase your phone
Change Passwords:
Update passwords for all accounts accessed on the stolen device
By implementing these features and practices, both Android and iPhone users can significantly enhance their device's resilience against theft, protecting not just the hardware but also the valuable personal data stored within.
Limit Personal Information Sharing:
Meet Sarah, a 35-year-old dog lover who recently adopted a golden retriever named Buddy. Excited about her new furry friend, Sarah couldn't resist sharing photos of Buddy on social media, along with his name and adoption date. Little did she know this innocent act would soon lead to a cybersecurity nightmare.
Like many others, Sarah struggled to remember multiple complex passwords for her various online accounts. She decided to use variations of Buddy's name and adoption date for her passwords, thinking it would be easy to remember and secure enough.
One day, Sarah noticed strange activity in her bank account. Unauthorized purchases had been made, and her savings were rapidly disappearing. Panicked, she discovered that her bank account, email, and social media accounts had been compromised.
As it turned out, a cybercriminal had easily guessed Sarah's passwords using the information she had shared about Buddy online. The hacker used these credentials to access multiple accounts, stealing Sarah's identity and financial information.
Limiting Personal Information Sharing: A Crucial Cybersecurity Practice
In today's digital landscape, where mobile phones have become our digital passports, the importance of cybersecurity cannot be overstated.
One critical aspect of maintaining our digital safety is limiting the sharing of personal information online. Let's explore why this is crucial and how we can implement this practice effectively.
The Risks of Oversharing
Sarah's story illustrates the potential consequences of sharing seemingly innocent personal information online. By posting details about her new pet, Buddy, she inadvertently provided cybercriminals with valuable data that could be used to compromise her accounts.
This scenario highlights the need for caution when sharing personal information on social media platforms.
Best Practices for Limiting Personal Information Sharing
Be Mindful of Social Media Posts: Avoid sharing sensitive information such as full names, birthdates, addresses, or details about pets that could be used to guess passwords or security questions
Strengthen Password Practices:
Create strong, unique passwords for each account, combining uppercase and lowercase letters, numbers, and symbols
Aim for a minimum of 12 characters in your passwords.
Avoid using personal information like pet names or birthdates in your passwords.
Utilize Password Managers: Consider using a password manager to generate complex passwords for your accounts and store them securely.
Implement Two-Factor Authentication (2FA): Enable 2FA on key accounts to add an extra layer of security beyond just passwords.
Be Aware of Phishing Attempts: Learn to identify and avoid phishing scams that may trick you into revealing personal information.
The Importance of Cybersecurity Education
Understanding the potential impact of identity theft is crucial. It's not just about financial loss; 80% of identity theft victims report experiencing anxiety, 74% feel violated, and 72% experience anger.
By limiting the personal information we share online and implementing strong security practices, we can significantly reduce the risk of falling victim to such attacks.
Balancing Security and Convenience
While being security-conscious is important, remember that the goal is to balance security with convenience. As the workshop philosophy states, "Weak security is better than no security at all." Equally poorly considered security that is too restrictive, causing loss of access, is not security by any measure.
Start by implementing basic security measures and gradually enhance your practices. Following these guidelines and being mindful of the information we share online can significantly improve our digital security and protect ourselves from potential cyber threats. Remember, in the digital age, our personal information is one of our most valuable assets – let's treat it as such.
Be Vigilant About Phishing
Phishing attacks remain one of the most prevalent cybersecurity threats in our digital landscape. Understanding various phishing techniques and staying alert can significantly reduce your risk of falling victim to these deceptive practices.
Common Types of Phishing Attacks
Email Phishing: Attackers send emails that appear legitimate, tricking recipients into revealing sensitive information or clicking malicious links.
Spear Phishing: This targeted approach focuses on specific individuals or organizations, often using personalized information to appear more credible.
Whaling: Also known as CEO fraud, these attacks target high-level executives with sophisticated, well-researched communications.
Smishing (SMS Phishing): Fraudulent text messages lure victims into providing sensitive data or downloading malware.
Vishing (Voice Phishing): Scammers use phone calls to manipulate victims into divulging personal information or making unauthorized transactions.
Snail Mail Phishing: While less common in the digital age, this method involves sending physical letters or postcards that appear to be from legitimate sources, requesting personal information or directing recipients to malicious websites.
Recognizing Phishing Attempts
To protect yourself from phishing attacks, look out for these red flags:
Urgent or threatening language creates a sense of immediacy
Requests for sensitive information via email, text, or mail
Unexpected attachments from unknown sources
Suspicious links or URLs that don't match the supposed sender
Poor grammar or spelling errors in official-looking communications.
Best Practices for Phishing Prevention
Verify the Source: If unsure about a message's legitimacy, contact the supposed sender through a known, trusted channel.
Use Multi-Factor Authentication: This adds an extra layer of security even if your password is compromised.
Keep Software Updated: Ensure your devices and applications have the latest security patches.
Think Before You Click: Always pause and consider the legitimacy of a message before taking any action.
Use Strong, Unique Passwords: Employ a password manager to create and store complex passwords for each account.
Educate Yourself: Stay informed about the latest phishing techniques and scams.
What to Do If You Suspect a Phishing Attempt
Do not click on any links or download any attachments.
Report the suspicious message to your IT department or service provider.
Delete the message from your inbox.
If you've accidentally clicked a link or provided information, change your passwords immediately and monitor your accounts for unusual activity.
By remaining vigilant and applying these strategies, you can significantly reduce your risk of falling victim to phishing attacks. Remember, when it comes to your digital security, a healthy dose of skepticism can go a long way in protecting your personal information and online accounts.
Safely Unsubscribing from Nuisance Emails
While clicking on unsubscribe links in emails can sometimes be risky, there are safer methods to remove yourself from unwanted mailing lists without potentially exposing yourself to security threats.
Using Built-in Unsubscribe Features
Many email clients now offer built-in unsubscribe options that are safer than clicking links within emails:
Gmail:
Look for the "Unsubscribe" link next to the sender's address at the top of the email.
On mobile, tap the three-dot menu and select "Unsubscribe" if available.
Apple Mail:
Watch for a banner at the top of the email saying, "This message is from a mailing list. Unsubscribe".
Tap this banner to safely unsubscribe without opening potentially harmful links.
Outlook:
Look for a message at the top of emails saying, "Getting too much email? Unsubscribe".
Click this built-in option to remove yourself from the mailing list safely.
Alternative Unsubscribe Methods
If your email client doesn't offer a built-in unsubscribe feature, consider these safer alternatives:
Contact the sender directly: If it's a legitimate organization, send them a separate email requesting removal from their mailing list.
Use email aliases: Create unique email aliases for different services or subscriptions. If an alias starts receiving unwanted emails, you can easily deactivate or delete it without affecting your main inbox. Many email providers offer built-in alias features:
Gmail: Use the "+" trick (e.g., yourname+shopping@gmail.com)
Outlook: Set up aliases in account settings
Yahoo Mail: Create disposable email addresses
For more robust alias management, consider dedicated services like SimpleLogin or AnonAddy.
Use a third-party unsubscribe service: Apps like Leave Me Alone can manage your subscriptions securely without you needing to interact with potentially harmful links.
Create email filters: Set up rules in your email client to automatically move messages from specific senders to a separate folder or the trash.
Mark as spam: Consistently marking unwanted emails as spam can train your email client's filters to block future messages from that sender.
Remember, maintaining email security is crucial. By using these safer methods to unsubscribe, you can reduce unwanted emails while protecting yourself from potential phishing attempts or malicious links.
Monitor Accounts Regularly:
aa
Monitor Accounts Regularly:
aa
Protect your identity by attending our free workshops
© 2024. All rights reserved.