FSI - Security Training Guide

Doxing

DOXing comes from the word ‘document/docs’ - collecting personal information and documenting it. It is done with the intent to intimidate or blackmail the victim, with a possibility of distributing compromising content.

Under this, such information as:

Full Name or names of close relatives/friends

Home Address

Social Media & Phone number(s)

Personal Digits (Passport or ID; Credit Cards; etc.)

Phishing

Phishing comes from the word ‘fishing’ - attempting to get the victim to give their personal details. This is usually done with fraud or forged communication. A hacker can extract login information and any other sensitive information (see DOXing).

Widely used methods on habbo, but not limited to:

Habbo Top 10 Leaderboard messages

Rare Giveaway (read sticky) - link to a website

“Official” E-Mail from Sulake asking for credentials

A “hacker” demanding login information for a DOX

DoSing

Denial-of-Service attack - launching enormous amounts of packets at a website or a person, causing a malfunction, no internet access and downtime. Most rookie attacks can be mitigated with Cloudflare services. Both website and Portal are under this service already.

If you or someone you know have been affected by a DoS attack:

In case of dynamic IP, turn off your router for 5-10 minutes and then restart.

In case of static IP, call your local ISP to review the incoming traffic and ask them to moderate it.

Scam/ Internet Fraud

Internet fraud involves using online services and software with access to the internet to defraud or take advantage of victims. The term "internet fraud" generally covers cybercrime activity that takes place over the internet or on email, including crimes like identity theft, phishing, and other hacking activities designed to scam people out of money.

Internet scams that target victims through online services account for millions of dollars worth of fraudulent activity every year. And the figures continue to increase as internet usage expands and cyber-criminal techniques become more sophisticated.

Internet fraud offenses are prosecuted under state and federal law. For example, federal law has the controlling statute 18 U.S.C. § 1343 that covers general cyber fraud and can carry a punishment of up to 30 years in prison and fines of up to $1 million depending on the severity of the crime.

Source: https://www.fortinet.com/resources/cyberglossary/internet-fraud

Steps

Step 1. Do a Google search of your habbo username, and then a search of your real name. Make sure, these results display different things!

Step 2. If you have a social media account (or anything similar) that has your habbo username in it; change it or delete any records of it.

Step 3. Set your social media to private, (‘Friends Only’ or ‘Friends of Friends’) and review information that your account displays. Sometimes we don’t want social media to display our phone number, but it displays it for some reason - then you should hide it!

Step 4. Do NOT share your personal information on Habbo publicly. While you can share it with your close friends, whom you trust (at your own risk!) - however, there is no healthy reason to share your social media or real life full name in an online game. Especially as an FSIU member - you are the frontliner in cyber security of your agency, and always targeted first!

Step 5. Never accept friend requests on discord or Habbo from individuals you do not know, or at least do not expect a friend request from. Do not engage in any conversation with them either.

If you have been DoXxed

1. Do NOT panic! If the person is just threatening to spread personal information to your friends and everyone else, most likely it’s a hoax.

2. Check if the document/link provided is safe to browse, with a link checker

Ignore the message and report the account/document that stores this data.

3. You should still inform your close relatives and friends that there might be misinformation spread about you online.

4. Inform Foundation & FSIU Leadership, to moderate any mentions of the DOX document/message that is being spread. Reach out to other agencies to moderate it too, in case the hacker will try to spread it there.

Report to your local police a cyber crime, if things are really bad.