There is an Apple enthusiast I know – and I’m sure you have a similar friend – who used to gleefully brag about all the suspicious links he could click on from his phone or computer with no fear of consequences.
But after Apple’s confirmation this weekend that it was in the process of creating and issuing patches to resolve a massive security flaw in its operating systems and many of its connected programs, he’s singing a different tune.
The SSL bug, as it’s being called, is actually just a tiny logic error in a small piece in Apple’s massive operating system – but big things often come in small packages. In layman’s terms, the flawed bit of code is supposed to be responsible for making sure that your computer’s or your phone’s Internet connection with other, secure servers across an Internet connection is itself secure from hackers. But because of the tiny error, which has reportedly been around at least since September 2012, your computer or phone has showed such connections as secure whether or not they actually were.
While the mechanics of the bug would make it difficult for a random person in Central Europe to gain access to your computer, it does make it very easy for the guy next to you on an unsecured WiFi connection to do exactly that – and to get into your email, your bank accounts, your Facebook or any other secure application that would normally be slightly more private on a public WiFi server.
Now, if we were all being smart about our phones and our computers, this might not matter as much: you really shouldn’t be conducting financial transactions on public WiFi connections or letting your phones automatically connect to any open network whether you have a Mac or a PC, or an Android phone or an Apple one. But in reality, Apple’s perceived imperviousness from viruses and malware has left more than one person with the false impression that they, too, were impervious from a cyberattack.
Well, no more. Apple fans had a nice run, but it’s time to face the fact that perhaps the only thing standing between most of us and a successful targeted cyberattack is our own behavior, not our operating systems.
So what should you be doing now? The same things you should’ve been doing all along.
1. Avoid Unsecured WiFi Networks
Between the increasing fear-of-missing-out (FOMO) engendered by a wired world and wireless companies’ data caps, those unsecured WiFi connections represent quite a temptation – and hackers know it. But unless it’s an emergency, you should really avoid using them when at all possible. Change your phone settings to make sure you’re not connecting to unsecured wireless systems automatically, keep your activity to a minimum and never, ever use them to log into a bank account, use a credit card or enter any kind of password.
2. Always Install Security Updates Immediately
We’ve all dismissed that little Apple pop-up box encouraging us to download the latest fix – and some of us have dismissed it more than once – but it’s time to stop the madness. Nothing you are doing on the Internet right now is more important than making sure no one else is poking around in your computer or your phone – and whatever you are doing, including reading this article, is something you can start doing again pretty soon.
3. Don’t Click on Weird Links From Strangers or Even Friends
You see them on Twitter – little egg avatars that respond randomly with just a shortened link to something for no apparent reason. They’re in your email inbox from friends you haven’t heard from in a while. Sometimes, they even arrive by text. But if you can’t tell where they lead, or even if you can but the links seem like an odd thing for someone to send you without context, don’t click them. They were dangerous before, they’re dangerous now and, patch or no patch, they’ll be dangerous tomorrow.
4. Don’t Take Your Security for Granted
It’s easy enough in this day of virus checkers, malware spotters, supposedly impenetrable networks and browsers that won’t let you visit suspicious sites to just think the tech companies have it covered – but they don’t. They can only protect you from what they know exists, and hackers are always out to make something new to avoid detection. Don’t rely on technology over your own common sense.
Apple has already issued a patch for its phones and promised one for its computer operating system and connected programs affected by the SSL bug. [Update: Apple issued a patch for its computer operating system, OSX, just after the publication of this article.] But once you download it, don’t assume that you’re safe. Let this be a wake-up call to some and a reminder to the rest of us that technology isn’t an impenetrable force field against attacks: it’s just a Maginot line against a direct attack.
