On the first day of Hari Raya last year, Muhammad Firdaus Mohamad Zuki received an email saying that his Instagram account had been temporarily blocked.
“The email was sent at 1am. The sender said I have two hours to respond or my images will be deleted and my account offered for sale,” says Muhammad Firdaus.
The 24-year-old accounting student and part-time photographer was devastated – not only could he not log in to his account but the username had been changed.
The account, which he mostly uses to post pictures of his work as a photographer, was set up in 2013 and had 25,000 followers.
The incident ruined his Hari Raya, as he was stuck thinking about the photos on the account that he would never see again as he had not saved them anywhere else.
“I asked the sender why he or she decided to target me but the only response I got was a request for US$235 (RM975) as payment to restore the account.
“I ignored it and reached out to Facebook (Instagram’s parent company) to try to get my account back,” Muhammad Firdaus says.
However, to his surprise, Instagram replied saying it is unable to “restore accounts that have been permanently deleted”.
Joros Zaini Johari faced a similar scenario in February – she received an email from Instagram informing her that his username had been changed.
Thinking it was a glitch, Joros tried signing into her account, but to no avail, as Instagram no longer recognised her username and password.
The 25-year-old online seller had worked hard to build a following – she had over 3,000 followers – as the account was essential in promoting her products.
She was shocked to discover that the person who had taken over the account deleted all her photos.
“When I sent a direct message, the person asked for RM150, as this person claimed he or she had bought over the account from a hacker,” she says Joros who hails from Gua Musang, Kelantan.
You shall not pass
Most users are tricked into revealing their login credentials and personal information through a phishing attack via email or text messages.
Users are duped into thinking that the messages originate from a trusted entity, such as the university they belong to or company they are working for, making them more willing to part with sensitive information or even click a malicious link.
The close cousin to this attack is “vishing” where the perpetrators try to defraud victims using the same tactics but over a phone call.
According to Yeo Siang Tiong, Kaspersky South-East Asia general manager, cybercriminals are clever to exploit current trends, including the ongoing pandemic, to trick users into giving out information.
“With the pandemic still raging on, it is safe to say that we are more vulnerable mentally and psychologically,” he says, adding that a person must not be too eager to click on a random link or open an attachment.
Users have to also change their perception about cybercriminals, says Acronis chief information security officer Kevin Reed, as most people believe they won’t be targeted if they are not a prominent figure or wealthy.
“It’s an extremely common perception despite more and more attacks and personal accounts being hacked or hijacked every day.
“Everybody has to understand that cybercrime is an ‘industry’ and it doesn’t discriminate, it targets everyone,” he says.
Users also risk compromising their online accounts when they reuse passwords or rely on weaker ones, says Reed, adding that poor password management is almost always the cause when an account is breached.
One of the methods still used today to beat weak passwords is the brute force attack, says Yeo.
“It is a trial-and-error method for guessing login info, encryption keys and finding hidden webpages. Hackers work through all possible combinations so the weaker your password, the easier it is for them to break into your account.
“This is an old attack method, but it’s still effective and popular with hackers,” Yeo says.
Cybersecurity firm LGMS founder Fong Choong Fook, who is also of the same opinion, says usernames and passwords from compromised accounts are easily found online.
“Chances are your password may have been exposed in a data leak from a different platform and it’s for sale on the dark web or hacker forums.
“It becomes a problem when users are not aware or ignore reminders to change passwords,” he says.
The website haveibeenpwned.com is a good place to check if your account has been compromised or “pwned” in a past data breach.
When setting up a new social media account, Muhammad Firdaus activated two-factor authentication.
“I wasn’t aware how important it was back then. If I had gotten an SMS about a suspicious login, I would have been able to take steps to protect my old account,” he says.
He also makes it a point to change his password at least once a month and uses different email addresses for business and personal accounts.
Reed says using account-specific emails offers an extra level of privacy but feels it’s better for most people to use a single email account with a strong password not used anywhere else and to enable two-factor authentication.
To pay or not to pay
It may be tempting to pay the ransom in the hopes that the hacker restores your account but most experts say that’s inadvisable.
Reed says it’s best to contact the social media support team right away, as it has the means to retrieve your account – as long as the account has not been permanently deleted – if you are able to prove that you are the rightful owner.
“Also, one needs to understand that unlike ransomware attacks, social media hackers leave lots of traces due to the very nature of social media interactions,” he says, urging victims to report the case to authorities.
However, a lot of users tend to use their social media accounts to store their personal images and videos, which puts them at a greater risk when their accounts are hijacked.
“Account takeovers and data breaches are no longer a question of ‘if’ but ‘when’.
“Having a backup of your files and important data can give you an upper hand against cybercriminals,” Yeo says, adding that backups are vital for both individuals and companies.
Fong too concurs and offers this simple advice: “If you don’t want to pay hackers to get back your data then have backups.”
Both Muhammad Firdaus and Joros opted not to pay the hackers out of fear that they might end up getting duped.
“By not paying them, I’ve wasted their time. I didn’t want them to benefit financially, otherwise they would be encouraged or motivated to find other victims,” says Muhammad Firdaus.
Lesson learned
Irfan Fauzilan, 26, still remembers the day his client called to inform that his Facebook account had been breached and the hacker had spent a whopping RM28,000 on random ads.
The digital marketing manager from Shah Alam, Selangor, said his client had received a message purportedly from Facebook asking him to verify his account.
Thinking it was a security check, he clicked on the link and entered the username and password for the Facebook account which was set up for business purposes.
The client only realised something was wrong when the language for the page had changed to Chinese.
“At first he thought it was a glitch but then he got a shock when he saw the amount spent under Facebook’s Ads Manager,” Irfan says.
“I remember trying to calm down my client and telling him that I will guide him through the process of seeking refunds from Facebook,” he says.
Irfan was able to regain control of the account after filing a report at facebook.com/hacked.
He had to furnish proof such as the company’s business ID, screenshots showing suspicious activity and a bank statement for the payment method attached to the account.
“We also managed to get a full refund for the money spent on ads,” he says, adding that he immediately changed the account password.
The account breach has also taught him that there should be more than one administrator for a business page.
“When one person gets locked out of the account, at least another person can try to access the page and kick out the unwanted person,” he says.
Betting on browsers
Remembering passwords and making it a point to change them is tedious for many people.
This has given rise to the popularity of password managers which now come built-in with most browsers.
The browser can even suggest complicated passwords, save them and autofill the login info when a user visits the same sites in the future.
Reed says the biggest issue with password managers built into browsers is that users will be compelled to stick to the same browser, but “it may or may not be a problem, depending on the user’s work pattern”.
Yeo agrees, saying: “Once you switch browsers, you have to set it up all over again which can be confusing and frustrating,” he says, adding that the features offered may be limited compared with standalone password managers.
Makers of third-party password managers also go the extra mile by offering integration with various browsers.
“It is worth noting that if the provider of the password manager is breached, it does not necessarily mean that all your passwords will be compromised, especially if the password manager employs strong encryption,” Yeo says.
He says it’s up to users to choose a password management system that they trust and understand.
“Overall, any password manager is better than no password manager at all,” he says.
To help others, Irfan shared his experience of retrieving the “stolen” Facebook business page on social media, and his post was shared more than 500 times.
“I felt the need to share the experience to help others out there to be more aware.
“I have heard stories of how those who are just learning to start an online business during the pandemic felt helpless when their accounts got hijacked,” Irfan says.
Muhammad Firdaus also shared his experience on Twitter, hoping others will learn from his experience and take more steps to secure their online accounts.
“I still feel sad when I think about some of the pictures I could never get back from my account.
“The experience has taught me to use unique passwords, keep backups and not assume it won’t happen again,” he concludes.
Already a subscriber? Log in
Get 20% OFF The Star Digital Access
Cancel anytime. Ad-free. Unlimited access with perks.
