Cybersecurity Advisory for Online Content Creators
Published on 31 Mar 2023
This advisory highlights cyber threats that online content creators may face, and provides guidance on how they can protect themselves.
As an online content creator, it is imperative to take the security of your accounts seriously to safeguard your brand's reputation, maintain the trust of your followers, and keep them safe from malicious content. If a creator's account is compromised, an attacker may leverage the reach they have to broadcast harmful and inappropriate content. It is therefore crucial for all online creators to practise good cybersecurity measures.
An example of a recently observed cyber-attack targeting creators is "StreamJacking", a variant of account hijacking. StreamJacking occurs when an unauthorised party takes control of a live stream and uses it for their own purposes, such as broadcasting harmful content like spam, scams, or insensitive messages. The resulting activity by the attacker would likely lead to reputational loss, and even a suspension or permanent ban of the compromised account.
Often, attackers gain information about login credentials through social engineering. They could attempt to guess your password or answers to security questions based on what they know of you, send a phishing email to trick you into providing them with your login credentials or other personal information, or offer a "free" (and malicious) version of a legitimate software for download. To minimise the risk of having your accounts compromised, here are some tips:
- Use Strong Passwords: Create a strong password of at least 12 characters with a mix of upper and lower case letters, numbers, and symbols. Avoid using easy-to-guess passwords, such as your name or birth date, and do not reuse passwords across multiple accounts.
- Enable Multi-Factor Authentication (MFA): Multi-Factor Authentication adds an extra layer of security to your accounts. This feature requires you to provide additional verification (e.g. One-Time Password, verifying identity from another device) to log in to your account. This will prevent unauthorised access even if someone has your password. Read more about MFA here: https://www.csa.gov.sg/alerts-advisories/Advisories/2023/ad-2023-006
- Install an Antivirus Software: Regularly scan your devices with an updated Antivirus software to detect and remove any malware.
- Update Apps and Devices Regularly: This will ensure that the latest patches to address security vulnerabilities will be installed. You may wish to set your devices to update automatically.
- Avoid Excessive Disclosure of Personal Information: Always be aware of the personal information you disclose online and avoid oversharing. An attacker may obtain the information that was freely shared, and subsequently use the information to answer your account's security questions to gain access to your account.
- Beware of Unsolicited and/or Too-good-to-be-true Sponsorships: While sponsorships may provide valuable income and exposure for content creators, it is essential to approach these opportunities with caution. Unsolicited offers, particularly those that promise unrealistic compensation, may be phishing for personal information for malicious purposes. Always research the company or brand offering the sponsorship to review their reputation and track record.
- Be Wary of Suspicious Links and Attachments: Do not click on suspicious links or open email attachments from unknown sources, especially if they were unsolicited or unexpected. These links often lead to phishing websites which download malware into your device. You can also enable the option to view file extensions in Windows computers to help identify potentially harmful files. Certain file extensions, such as .exe, .bat, and .scr, are commonly associated with malware when they attempt to masquerade as document files. Be vigilant when you spot such files and avoid downloading or opening them.
- Monitor Your Accounts Regularly: Monitor your social media accounts regularly for any suspicious activity, including unauthorised access or changes to your profile. If you notice unauthorised activities, change your password immediately and notify the platform.
If you notice any suspicious activity from your account that indicates a possible compromise, consider the following measures:
- Notify the Platform Immediately: Most online platforms have dedicated support teams that can assist you with account recovery.
- Change your Password and Enable MFA: Change your account password immediately, and enable MFA (if you have not already done so) to prevent any further unauthorised access.
- Notify your Followers: Inform your followers about the incident as soon as possible and encourage them to report any malicious activity posted from your compromised account to you or the platform.
- Check for Unauthorised Activity: Review your account to identify any unauthorised posts, messages, or other activities. Remove any content that was not posted by you.
- Report any Illegal Activity: If you suspect that your account has been hijacked to commit a crime, such as broadcasting of malicious content, report the incident to the police and to the platform.
- Keep a Record of the Incident: Keep a record of all events related to the incident, as well as all communications with the platform, police, or any other parties involved in the incident. This includes any support tickets, emails, or phone calls. Having such a record can be useful if you need to provide evidence of the incident, especially if a crime has been committed.
References:
