Obulumbaganyi bw’okusiba ebiwandiiko: Mayiro z’ennyonyi ezifuuse amazzi, obubonero bwa wooteeri, ne bbalansi za kaadi z’ebirabo eziterekeddwa¶

Okuzuukuka ng’olaba ku email nti omuntu yaakabookinga ennyonyi ey’ensi yonna ey’ekika kya bizinensi ey’oludda olumu ng’akozesa mayiro 180,000 ku kkampuni yo ey’ennyonyi etera okubuuka, n’akyusa obubonero 250,000 obw’obwesigwa mu wooteeri ku akawunti y’omuntu gw’otomanyi, oba okufulumya bbalansi yo eya Starbucks, Target, Walmart, Sephora, oba Amazon gift card gy’otereka nga kaadi yo ey’okuwola ekyali mu waleti yo mu ngeri ey’obukuumi, gwe mukono wa Okulumba kw'okusiba ebiwandiiko mu ngeri ey'obwengula. Okwawukanako n’okulumba okugendereddwamu okukuba amafumu oba a okumenya akawunti ya bbanka, okujjuza ebiwandiiko ebikakasa kukozesa pulogulaamu ya botnet ekola mu ngeri ey’obwengula (OpenBullet, . SilverBullet, . Sentry MBA, nga zigatta wamu n'emikutu gya proxy egy'okusulamu) okugezesa obukadde n'obukadde bw'okugatta email-n'password ezifulumye ("combo lists" okuva emabega okumenya data n’okufuluma kw’ebigambo by’okuyingira) ku bikumi n’ebikumi by’emikutu gy’obwesigwa egy’ennyonyi, wooteeri, eby’okulya, emizannyo, n’eby’amaguzi omulundi gumu. Abamenyi b’amateeka ku mikutu gya yintaneeti batunuulira nnyo akawunti ezitera okubuuka (Delta SkyMiles, . American Airlines AAdvantage, . United MileagePlus, . British Airways Executive Club, . Air Canada Aeroplan, . Qantas Frequent Flyer), empeera za wooteeri (Marriott Bonvoy, . Hilton Honors, . World of Hyatt, . IHG One Rewards), ne kaawa/emmere ey’amangu/apps z’okutunda (Starbucks, . Chick-fil-A, . Dunkin', . Target Circle, . Walmart, . Ulta, . Sephora) kubanga pulogulaamu zino zikwata enkumi n'enkumi za ddoola mu "quasi-currency" ezitafugibwa eziyinza okufulumizibwa mu kaadi z'ebirabo za digito, Apple electronics, oba tikiti z'ennyonyi ez'olunaku lwe lumu mu sikonda ezitasukka 90, emirundi mingi nga zero mandatory Multi-Factor Authentication (MFA) esobozeseddwa nga bwekiba. Singa era olaba ebikumi n’ebikumi by’ebiwandiiko ebitaliimu nsa nga bibooga mu inbox yo mu kiseera kye kimu ddala, omulumbaganyi aba addukanya Email Bombing / Subscription Flood okuziika email entuufu ey’okununula ennyonyi oba lisiiti ya kaadi y’ekirabo; kebera guide waffe ku email account hacked, amateeka g'okuweereza, n'okuzzaawo amangu ago. Bw’oba oyolekedde okuggyibwako ssente mu bwangu oba okutiisibwatiisibwa mu mubiri, kuba ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, . 112 okwetoloola omukago gwa Bulaaya, . 999 mu Bungereza) oba weebuuze ku dayirekita yaffe ey’ensi yonna ennamba z’amangu.

Kino kikole kati¶

1. Nga tonnasazaamu mataba ag'amangu aga emails 500 eza spam ("Email Bomb"), noonya mu folda zo eza Inbox, Spam, ne Trash ozuule ebigambo "Redemption", . "Points", . "Miles", . "Ticket", . "eGift", . "Order", . "Transfer", oba "Added a payment": Buli bot ejjuza ebiwandiiko (credential-stuffing bot) lw’efulumya obulungi amazzi mu kkampuni y’ennyonyi, wooteeri, oba akawunti y’ebyamaguzi, omulumbaganyi amangu ago akola script essa omukono ku ndagiriro yo eya email okutuuka ku nkalala z’amabaluwa ezitali za bulijjo 500 ku 2,000 mu ddakiika 3 kale n’osubwa lisiiti emu entuufu eraga akawunti y’obwesigwa eyaakaggwaamu. Okuzuula okumanyisibwa okwo okumu mu ssaawa 2 ezisooka kikusobozesa okusazaamu tikiti y'ennyonyi y'omubbi oba okusiba kaadi y'ekirabo kya digito nga omusaabaze tannalinnya nnyonyi oba okununula bbaakoodi.
2. Yingira mu akawunti y’ennyonyi, wooteeri, oba ey’obwesigwa mu by’amaguzi eri mu kabi ku browser ennyonjo, kyusa ekigambo ky’okuyingira okudda ku password empya ey’ennukuta 16+ ezitali za bulijjo, era oggyewo kaadi zonna ez’okuwola/okusasula n’obubonero bwa PayPal/Venmo/Apple Pay obuyungiddwaako:
3. Ng'oggyeeko okumala mayiro zo ezikung'aanyiziddwa oba bbalansi ya kaadi y'ekirabo, ebiwandiiko ebijjuza ebiwandiiko ebikakasa oba "Auto-Reload" (Starbucks / . Dunkin' / . Toll Pass) oba okunyiga omulundi gumu stored credit card checkout is enabled basobole okupampagira $100 ku $500 ez’enjawulo okuva ku Visa/Mastercard yo eyungiddwa mu bbalansi ya app’s gift card ne bafulumya ekyo nakyo.
4. Kebera "Upcoming Trips / Reservations / Orders / Points Activity" tab munda mu akawunti y'obwesigwa, era TOSAZAamu ennyonyi ey'empeera ey'olukujjukujju oba okubuuka wooteeri ku yintaneeti ggwe kennyini singa pulogulaamu esaba ssente z'okuddamu okutereka oba okusindika obubonero okudda ku akawunti omubbi gy'akyafuga ng'ayita mu kiseera ky'essimu ekikola:
5. Mu kifo ky’ekyo, wandiika Ekiwandiiko ky’amannya g’abasaabaze mu nnyonyi ekirimu ennukuta 6 (PNR / Koodi y’okukakasa), ennamba ya e-Ticket eya digito 13 (okugeza, 001-... ku lwa Mumerika, . 006-... ku lwa Delta, 016-... ku lwa United, 125-... ku British Airways), erinnya ly'omusaabaze omubbi lye yabuukidde tikiti wansi w', oba Ennamba y'okukakasa wooteeri / Ennamba y'okulagira kaadi y'ekirabo, era oyite ku pulogulaamu y'obwesigwa eya dedicated Fraud / Revenue Protection Desk amangu ddala.
6. Kebera oba omulumbaganyi yakyusizza Secondary Recovery Email, Phone Number, oba yayongeddeko "Family / Household Pooling / Redemption Nominee" member munda mu loyalty profile yo:
7. Pulogulaamu nga British Airways Executive Club, . JetBlue TrueBlue, . Hilton Honors, . Marriott Bonvoy, . Air Canada Aeroplan, era Qantas kiriza akawunti okuyunga Omukwanaganya wa Akawunti y'Awaka / Points Pooling oba Omuganyulwa mu kukyusa. Abalumbaganyi bayunga akawunti yaabwe ey’ennyumbu ku kidiba kyo, ne bafulumya obubonero bwo mu kidiba, era basigala nga bayungiddwa ne bw’oba okyusizza ekigambo kyo eky’okuyingira okuggyako ng’obalirira mu bulambulukufu n’osaanyawo Ekidiba ky’Amaka.
8. Kuba essimu mu bbanka oba omukubi wa kaadi yo ey'okuwola amangu ddala singa "Auto-Reload" oba kaadi eterekeddwa yasasulwa: Tegeeza ekitongole ky'obufere nti akawunti yo eya app y'omusuubuzi yakwatibwa ng'oyita mu kussaamu ebiwandiiko ebikakasa (Unauthorized Card-Not-Present Transaction), saba okukyusa ennamba ya kaadi mu bwangu, era obasabe okusazaamu Visa/Mastercard Account Updater y'omusuubuzi (VAU/ .ABU) token kale ennamba yo empya eya kaadi ey’okukyusaamu tesika mu ngeri ya otomatiki okudda ddala mu app y’eby’amaguzi eyali efuuse obuzibu.
9. Funa buli akawunti endala gye wali okozesezza password eyo y'emu (oba enkyukakyuka ey'okumpi nga Summer2024 -> Summer2025) era ozikyuse amangu ddala ng’okozesa omuddukanya ebigambo by’okuyingira: Email yo ne password pair bwe zimala okukuba olukalala lwa botnet combo olukola credential-stuffing botnet, automated bots zijja kugezesa password eyo entuufu ku emikutu gy’empuliziganya egy’oku ntikko egisukka mu 300 (amakampuni g’ennyonyi, wooteeri, emikutu gy’okugula tikiti nga Ticketmaster/StubHub, apps ezituusa emmere nga DoorDash/Uber Eats, crypto exchanges, n’okutunda amaduuka) mu ssaawa 24 okutuuka ku 72 eziddako.

Omuti gw’okusalawo: okugezesa n’okuzzaawo obwesigwa obw’okujjuza ebiwandiiko oba okufulumya amazzi mu by’amaguzi¶

Kozesa enkola eno ey’emirimu okuyimiriza active point drain oba stored-balance theft n’okuzzaawo balance yo:

flowchart TD
    Alert["Alert: Okununula Mayiro/Points ezitakkirizibwa, Okufulumya Kaadi y'Ebirabo Okuterekeddwa, oba Amataba ag'amangu ga 500+ Junk Newsletter Emails"] --> SearchBomb["OMUDDAALA 1: Noonya Email Inbox + Trash + Spam ku 'Okununula', 'Miles', 'Points', 'Ticket', 'Order', 'Reload', oba 'Changed Email'."]

    SearchBomb --> TargetType{"Kika Ki ekya Akawunti Eyamenyebwa Credential-Stuffing Bot?"}

    TargetType -->|"Ennyonyi etera okubuuka (Delta, AA, United, BA, Ennyonyi, Qantas)"| AirlinePath["OMUDDAALA 2A: Record Rogue PNR + Passenger Name -> Kyusa Password + Enable MFA -> Kuba essimu ya Airline Fraud / Revenue Protection Desk okusazaamu Ticket & Freeze Account"]

    TargetType -->|"Obwesigwa mu wooteeri (Marriott Bonvoy, Hilton Honors, Hyatt, IHG) Omuwandiisi w’ebitabo."| HotelPath["OMUDDAALA 2B: Kebera 'Points Activity' ku Point Transfers / Gift Card Cashouts / Room Bookings -> Okusaanyawo 'Points Pooling' -> Kuba Ttiimu y'okufera obwesigwa okudda emabega okukyusa"]

    TargetType -->|"Kaawa / Emmere ey’amangu / App y’okutunda (Starbucks, Target, Walmart, Sephora, Chick-fil-A)"| RetailPath["OMUDDAALA 2C: Sazaamu Credit Cards eziterekeddwa + Ggyako 'Auto-Reload' amangu ddala -> Kuba essimu ya Customer Support okuggyawo Compromised Virtual Gift Card Barcode & Reissue Balance"]

    AirlinePath --> AuditEmail["OMUDDAALA 3: Okubala Akawunti Yo eya Email Enkulu (Gmail/Outlook/Yahoo) okuzuula Amateeka g’Okuweereza oba Ebisengejja Ebikyamu Okusazaamu Email z’Obwesigwa"]
    HotelPath --> AuditEmail
    RetailPath --> AuditEmail

    AuditEmail --> RotateAll["OMUDDAALA 4: Zingulula Buli Akawunti Ggabanya Eyaddamu Okukozesa Password Nga Okozesa Password Manager + Passkeys / TOTP 2FA"]

Engeri bots ezijjuza ebiwandiiko gye zifulumya mayiro, obubonero, ne kaadi z’ebirabo mu sikonda ezitakka wansi wa 90¶

Okutegeera makanika omutuufu ow’okulumba okujjuza ebiwandiiko ebikakasa kinnyonnyola lwaki akawunti ezibadde zitudde okumala emyaka nga tezikwatibwako zifuluma mangu ku ssaawa 02:00 ez’oku makya:

1. Lwaki Loyalty & Retail Accounts ze #1 Target eri Combo-List Bots¶

Omukutu omunene bwe gufuna okumenya data, obukadde n’obukadde bwa... email:password babiri bakuŋŋaanyizibwa mu fayiro z'ebiwandiiko eziyitibwa Combo Lists. Abalumbaganyi batikka enkalala zino eza combo mu bikozesebwa mu kukola browser automation ezitaliiko mutwe ku sipiidi ya waggulu (OpenBullet 2 / . SilverBullet) nga okozesa Okusengeka fayiro (.anom / . .loli / . .opk) ewandiikiddwa mu ngeri ey'enjawulo ku API ez'enjawulo ez'ennyonyi, wooteeri, n'eby'amaguzi: 1. Stage 1 (Automated "Capture" Scanning): Bot egezesa emitwalo 50 egyavuddemu email:password babiri buli ddakiika nga bayita mu kukyusakyusa proxy z'amayumba okusinziira ku mobile app login API of Marriott, . Hilton, . American Airlines, . United, . Delta, . Starbucks, . Target, oba Sephora. 2. Stage 2 (Automated Balance Parsing): Buli okuyingira lwe kutuuka ku buwanguzi (kubanga oyo eyakoseddwa yaddamu okukozesa password y’emu gye yakozesa ku forum oba omukutu gw’okugula ebintu ogwamenyeddwa emyaka 4 egiyise), script ya bot esika otomatika akawunti eno Point/Mile Balance, Stored Gift Card Value, ne Saved Credit Card Last-4 Digits, okusunsula akuba mu mitendera (okugeza, . "100,000+ Miles" oba "$50+ Gift Card"). 3. Omutendera 3 (Okuyingiza ssente mu bwangu / Okufulumya ssente): - Emikutu gy'okukyusa kaadi z'ebirabo (Points-to-Gift-Card): Emikutu mingi egy’obwesigwa ku wooteeri, kkampuni z’ennyonyi, ne kaadi z’ebbanja gikkiriza okununula amangu obubonero ku yintaneeti ku kaadi za digito Apple, Best Buy, Amazon, Target, Walmart, oba Visa eGift eziweerezeddwa okuyita ku email, omulumbaganyi z’akwata oba n’azikyusa. - Point Transfers & Household Pools: Omulumbaganyi akyusa... Hilton Honors, . Marriott Bonvoy, oba Airline asonga ku akawunti y'obwesigwa "mule", oba okuyunga akawunti yo mu Household Pool n'azinunula okuva mu kuyingira kw'ennyumbu. - Same-Day / Next-Day International Award Flights & Luxury Hotel Stays: Underground Telegram travel-fraud syndicates zitwala akawunti yo eyawambibwa ne mayiro 150,000 ne bookinga ennyonyi y’ensi yonna ku lunaku lwe lumu oba okusula mu wooteeri ey’ebbeeyi ekiro 5 eri omuguzi ow’okusatu ng’asasula omukozi w’obuzibu ssente 30 ku ddoola mu ssente za crypto. - Okufulumya amazzi mu bbaalakodi z'essimu mu dduuka (Starbucks, . Target Wallet, . Walmart Pay, . Sephora, . Ulta): Ku pulogulaamu z’ebyamaguzi ne kaawa, bot eggyayo ennamba ya bbaakoodi/QR code yo eya gift-card gy’otereka (oba eyingira butereevu mu app yo ku ssimu ey’okwokya ku register y’okwesasula), n’ekola Auto-Reload okuva mu Visa/Mastercard yo gy’otereka, n’egula ebintu ebitundibwa ennyo oba kaadi z’ebirabo ezirabika mu dduuka.

2. Lwaki Tewafuna Email Alert: Akakodyo ka "Email Bomb" & Inbox Filter¶

Omulumbaganyi bw’afulumya obubonero bwo, omukutu gw’obwesigwa bulijjo guweereza email ey’okukakasa mu ngeri ey’obwengula ("Your Marriott Bonvoy Points Transfer is Complete" oba "Your Delta eTicket Receipt"). Okukulemesa okulaba email eyo mu budde okukubira kkampuni y’ennyonyi essimu n’okusazaamu tikiti nga tebannasimbula, abalumbaganyi bakozesa obukodyo bubiri: - Obukodyo A (Bwe baba tebalina lukusa ku email account yo): Batongoza Subscription Bomb (Email Bomb), ng’okozesa ebiwandiiko ebikola mu ngeri ey’obwengula okuleeta endagiriro yo eya email ku foomu 1,000+ ezitakakasiddwa ez’okuwandiisa amawulire g’omukutu okwetoloola ensi yonna mu sikonda 120. Essimu yo ewuuma nga teyimiridde nga erina 1,000 "Confirm your subscription to..." emails mu ddakiika 10, ekyaviirako abantu abasinga okulonda emails zonna 1,000 ne bakuba Delete, mu butanwa ne basazaamu okulabula okumu okwa nnamaddala okwa kkampuni y’ennyonyi oba ku mivuyo gya bbanka okwaziikiddwa ku layini 412. - Trick B (Bw’oba okozesezza password SAME EXACT SAME ku Email Account yo nayo): Omulumbaganyi ayingidde butereevu mu Gmail yo, Outlook, oba Yahoo Mail, akola Inbox Rule / Filter etalabika (If sender contains "delta.com", "marriott.com", "hilton.com", or "starbucks.com" -> Skip Inbox and Delete It / Move to Trash), era ejjuza folda yo eya Trash n’otolaba ku kumanyisibwa na kumu.

Omutendera 1: Okuzza emabega mayiro z’ennyonyi ezifuuse amazzi n’obubonero bwa wooteeri (Provider-by-Provider Playbook)¶

Okwawukanako n’okutambuza waya oba okutunda ssente za cryptocurrency (ezitasobola kukyusibwa oluvannyuma lw’okusasulwa ku lujegere), mayiro z’ennyonyi, obubonero bwa wooteeri, ne kaadi z’ebirabo ez’omunda mu katale bituula munda mu kifo ekikulu eky’enkolagana ekifugibwa kkampuni ebitundu 100 ku 100. Ne bwe kiba nti omukozi w’obuzibu yakyusa dda obubonero bwo eri mmemba omulala oba n’afulumya tikiti y’ennyonyi ey’engule, kkampuni y’ennyonyi oba wooteeri eya Corporate Fraud / Revenue Protection Investigation Team esobola okulondoola akawunti yennyini gy’ogenda, okusazaamu tikiti oba okukyusa, okuwera paasipooti/akawunti y’oyo afuna, n’okuzzaawo ebitundu 100 ku 100 ebya mayiro zo oba obubonero bwo obubbiddwa mu nnamba ya akawunti y’obwesigwa empya efulumiziddwa, ennyonjo.

Goberera emitendera egy’enjawulo egy’okuzzaawo enteekateeka yo ey’obwesigwa wansi:

Omutendera 2: Okuyimiriza "Auto-Reload" & Saved Payment Token Drain¶

Bangi ku bantu abakoseddwa okuteekebwamu ebiwandiiko by’okutunda n’okukozesa kaawa bafiirwa ssente entuufu okuva ku akawunti yaabwe eya bbanka oba kaadi yaabwe ey’okuwola ng’oggyeeko ebifo byabwe eby’obwesigwa bye batereka. Laba engeri Auto-Reload & Tokenized Wallet Drain gy'ekola n'engeri y'okugiggalawo:

1. Engeri Abalumbaganyi gye Bakozesaamu "Auto-Reload" ne "Scan & Pay":
2. Mu apps nga Starbucks, . Dunkin', . Chick-fil-A, . Panera, . EZ-Pass / Toll Tag accounts, ne kaadi z’okutambuza abantu, abakozesa batera okutereka kaadi y’okuwola oba akawunti ya PayPal okuddamu okusasula bbalansi yaabwe gye batereka.
3. Ne bwe kiba nti kaadi yo eya Starbucks yalina $4.50 zokka ku yo nga omubbi ayingidde, omubbi akuba "Reload $100.00" emirundi etaano egy'omuddiring'anwa ng'akozesa akabonero ko aka Visa/Mastercard/PayPal k'otereka (akatera te okusaba digito 3 CVV code ng’oddamu okutikka bbalansi ya kaadi y’ekirabo ey’ekibiina ekisooka eyaliwo), olwo amangu ago n’akyusa bbalansi eyo eya doola 500 ku kaadi ey’enjawulo ey’omubiri oba n’agimala ku lijesita.
4. Lwaki Okukyusa Ennamba Ya Credit Card Yo Oluusi Tekimala (Visa VAU / . Mastercard ABU):
5. Bw’okubira bbanka yo essimu okuloopa omusango ogw’obufere ne bakuweereza kaadi empya ey’okuwola ng’eriko ennamba empya eya digito 16, Visa (Visa Account Updater VAU) ne Mastercard (Ekitereeza okusasula ssente mu ngeri ey’obwengula ABU) otomatiki ssika ennamba yo empya ennyo eya kaadi eya digito 16 eri abasuubuzi abaddiŋŋana ne waleti z’oku ssimu kaadi yo enkadde gye yaterekebwa.
6. Singa omulumbaganyi akyalina akabonero k’olutuula lwa OAuth akakola munda mu pulogulaamu yo ey’okutunda oba ey’okutuusa emmere eriko obuzibu, kaadi yo empya ey’okukyusaamu esobola okulabika munda ddala mu pulogulaamu eyamenya nga kaadi yo ey’omubiri tennatuuka wadde mu mailbox yo.
7. Ky’olina okugamba bbanka yo: Buli akawunti y’omusuubuzi eriko kaadi eterekeddwa lw’eyingizibwa, tegeeza omukugu mu mivuyo mu bbanka yo: > "Nsaba osazeeko kaadi yange, osazeewo obubonero bwonna obuliwo obw'okusasula omusuubuzi mu ngeri ya digito obukwatagana ne." [Merchant Name], era oteeke ekiziyiza eky'ekiseera eky'okuva ku Visa Account Updater / Mastercard Automatic Billing Updater kale ennamba ya kaadi yange empya n'eleme kunyigirizibwa butereevu eri omusuubuzi alina obuzibu."

Omutendera 3: Okubala Akawunti Yo eya Email okuzuula Amateeka g’Okukkaanya & Inbox mu kiseera kye kimu¶

Olw’okuba abantu 65 ku buli 100 baddamu okukozesa ekigambo ky’okuyingira kye kimu ku akawunti eziwera, buli bot ejjuza ebiwandiiko by’eyingira mu akawunti yo ey’ennyonyi, wooteeri, oba ey’amaduuka, olina okukebera amangu ddala oba bot eyo y’emu nayo yayingira mu Akawunti yo eya Email enkulu (Gmail, . Outlook / Hotmail, . Yahoo, . iCloud, . AOL):

1. Kebera Active Sign-In Logs ku Akawunti Yo eya Email:
2. Gmail: Ssenda wansi ku ddyo mu inbox yo onyige Details (Last account activity), oba okukyalira myaccount.google.com/device-activity.
3. Microsoft Outlook / Hotmail / Live: Lambula account.live.com/Activity era okebere buli kugezaako okuyingira gye buvuddeko (ojja kutera okulaba amakumi g’okugezaako okujjuza ebiwandiiko bya IMAP/POP3/Exchange okulemererwa era okuwangudde okuva ku ndagiriro za IP ez’amayumba ag’ebweru).
4. Yahoo Mail: Genda ku Account Info > Ebikoleddwa gye buvuddeko.
5. Kebera Amateeka Go aga Email Forwarding & Auto-Delete Filter KATI KATI:
6. Ggulawo ensengeka za email yo ku desktop web browser (apps za mail ku ssimu zikweka amateeka g'okusengejja):
   • Gmail: Ensengeka (Gear Icon) > Laba ensengeka zonna > Filters ne Blocked Addresses NE Okugenda mu maaso ne POP/IMAP.
   • Outlook.com: Ensengeka (Gear Icon) > Mail > Amateeka NE Mail > Okuweereza NE Mail > Junk email > Abasindika n'ebifo ebizibiddwa.
   • Yahoo Mail: Ensengeka > Ensengeka endala > Ebisengejja.
7. Noonya etteeka lyonna erigamba nti: If From/Subject contains [Airline / Hotel / Bank / PayPal / Amazon / "Security" / "Code"] -> Delete it / Mark as Read / Move to Trash / Archive. Ssaako buli rogue filter amangu ddala.
8. Okusobola okutambula mu bujjuvu ku kulongoosa email, goberera ekitabo kyaffe ku email account hacked, amateeka g'okuweereza, n'okuzzaawo.

Omutendera 4: Okumalawo Okuddamu Okukozesa Password Mu Bulamu Bwo Bwonna obwa Digital¶

Obulumbaganyi bw’okujjuza ebiwandiiko bukola wansi w’akakwakkulizo kamu kwokka: wakozesezza ekigambo ky’okuyingira ku mukutu ogwo ogw’obwesigwa oba ogw’okutunda ogwali gulabika emabegako mu kumenya data (oba nga kyangu okuteebereza etteeka ly’okukyusakyusa mu nkuluze).

Okugema enkalakkalira okuva ku kussaamu ebiwandiiko ebikakasa ku akawunti zo zonna, jjuzaamu olukalala luno olw’emitendera 5 egy’okukakanyaza:

• 1. Duka Email Endagiriro Yo Nga Oyita Mu Have I Been Pwned (haveibeenpwned.com):
• Yingiza email zo ez’obuntu n’ez’omulimu ku haveibeenpwned.com okulaba okumenya data ki ey’ebyafaayo okwabikkula ebiwandiiko byo.
• 2. Ggulawo Browser Yo / Password Manager "Password Checkup" Okubala & Okusooka Okukyusa Buli Password Ezzeemu Okukozesebwa:
• Ebigambo by'okuyita mu Apple (iOS 18 / . macOS Sequoia oba Settings > Passwords > Security Recommendations), Omuddukanya ebigambo by'okuyingira mu Google (passwords.google.com/checkup), 1Ekigambo ky'okuyita (Watchtower), ne Bitwarden (Vault Health Reports) mu ngeri ey'otoma okugatta byonna eby'okuyingira byo ebiterekeddwa mu "Ebigambo by'okuyita ebikoseddwa" ne "Ebigambo by'okuyingira ebizzeemu okukozesebwa".
• Sonda ebigambo byo eby'okuyingira ebizzeemu okukozesebwa okusinziira ku akabi k'ebyensimbi/omuwendo era buli kimu kikyuse n'ekigambo eky'enjawulo, ekikoleddwa mu ngeri ey'ekifuulannenge ekigambo ky'okuyingira eky'ennukuta 16 okutuuka ku 24 (oba ekigambo 4 eky'okuyita ekitali kigenderere nga correct-horse-battery-staple):
  1. Akawunti za Email ezisookerwako (Gmail, . Outlook, . Yahoo, . iCloud) .
  2. Bbanka, Brokerage, ne Apps z’okusasula (PayPal, . Venmo, . Cash App, . Zelle) .
  3. Akawunti z'abavuzi b'ennyonyi abatera okubuuka n'obwesigwa mu wooteeri (Delta, . AA, . United, . BA, . Marriott, . Hilton, . Hyatt) .
  4. Apps ez'okutunda, okugula tikiti n'okutuusa emmere nga zirina kaadi/Bbalansi eziterekeddwa (Amazon, . Target, . Walmart, . Starbucks, . Ticketmaster, . Uber, . DoorDash, . Sephora, . Ulta) .
• 3. Ggyako Okukakasa Ensonga Ennyingi (MFA) oba Passkeys ku Buli Loyalty & Retail Account Egiwagira:
• Abakozesa bangi basobozesa 2FA ku banka ne email yaabwe naye beerabira nti Delta SkyMiles, . American Airlines, . United MileagePlus, . British Airways, . Air Canada Aeroplan, . Marriott Bonvoy, . Hilton Honors, . Hyatt, . Amazon, . Target, . Walmart, . Starbucks, era Ticketmaster kati bawagira 2FA oba Passkeys, naye bangi baleka 2FA OFF by default okutuusa lw'ogikoleeza mu ngalo munda mu Account Security Settings.
• 4. Toterekangako Credit Card oba Debit Card Munda mu Apps z'emmere ey'akaseera obuseera, Kaawa, oba Retail:
• Mu kifo ky’okutereka ennamba yo eya Visa/Mastercard eya digito 16 embisi munda mu pulogulaamu 40 ez’enjawulo ez’emmere, kaawa, n’okugula ebintu (nga bot yonna ejjuza ebiwandiiko by’esobola okugisasuza), sazaamu kaadi zonna eziterekeddwa okuva ku bifaananyi by’abasuubuzi era okebere ng’okozesa Apple Pay oba Google Pay (ekyetaagisa Face ID yo / Touch ID biometric scan yo butereevu ku ssimu yo ey’omubiri buli lw’oddamu okutikka oba okugula), oba okukozesa ennamba za kaadi z’ebbanja eziriko kkufulu eri abasuubuzi / ezikozesebwa omulundi gumu (Privacy.com, . Capital One Eno, . Citi Virtual Account Numbers, . Revolut Disposable Cards) nga balina ekkomo erikakali erya doola 25 buli mwezi.
• 5. Kozesa Email Aliases ez'enjawulo ku Akawunti ez'omuwendo omungi:
• Lowooza ku ky’okukyusa endagiriro ya email y’okuyingira ku akawunti zo enkulu eza bbanka, kkampuni z’ennyonyi, ne wooteeri ez’obwesigwa okudda ku email alias eyeetongodde (you+loyalty@... oba Apple Hide My Email / SimpleLogin / Fastmail alias) etakozesebwangako kwewandiisa ku mikutu gya lukale, amawulire, oba amaduuka g’ebyamaguzi. Singa olukalala lwa combo lw’omulumbaganyi terumanyi ndagiriro ya email yo ey’okuyingira, tebasobola na kugezaako kusiba password ku akawunti yo.

Ennamba z’embeera ez’amangu mu bitundu n’ebiragiro by’ebitongole¶

Okuyingira nga tolina lukusa ku akawunti z’obwesigwa, ez’entambula, n’ez’okutunda ng’oyita mu kussaamu ebiwandiiko mu ngeri ey’obwengula musango (wansi w’etteeka lya Amerika erya Computer Fraud and Abuse Act, UK Computer Misuse Act 1990, n’amateeka ageenkanankana mu nsi yonna). Okuloopa ensonga eno kivaamu ennamba y’omusango entongole eyamba okuwaliriza kkampuni z’ennyonyi, wooteeri oba bbanka ezitayagala okuzzaawo bbalansi ezibbiddwa:

• Amerika ne Canada:
• Empeereza ey'amangu: Kuba 911 singa wabaawo okutiisatiisa kwonna mu mubiri oba okukola obumenyi bw’amateeka mu buntu.
• Ekifo kya FBI ekiloopa obumenyi bw’amateeka ku yintaneeti (IC3): Fayira lipoota ku mutimbagano ku ic3.gov okuwandiika ku kununulibwa kwa point/mile okutakkirizibwa, erinnya ly’omusaabaze omufere/PNR bwe kiba nga kirabika, n’omuwendo gw’ensimbi ogwabbibwa.
• Akakiiko ka Federo akavunaanyizibwa ku by'obusuubuzi (FTC) & Ekitongole ky'ebyentambula (DOT) (US): Loopa okutwala akawunti ya retail/gift-card ku ReportFraud.ftc.gov; singa kkampuni y’ennyonyi egaana okunoonyereza oba okuzzaawo mayiro ezibbiddwa nga tolina nsobi yo ng’ebifuga eby’okwerinda tebiriiwo, osobola n’okuloopa abaguzi mu kitongole kya U.S. Ekitongole ky’ebyentambula (airconsumer.dot.gov) oba Ssaabawolereza wa Gavumenti mu ggwanga.
• Ekitongole kya Canada ekirwanyisa obufere (CAFC): Lipoota ku mutimbagano ku... antifraudcentre-centreantifraude.ca oba kuba ku 1-888-495-8501.
• Obwakabaka bwa Buganda:
• Empeereza ey'amangu: Kuba 999 (oba 101 ku poliisi etali ya mangu).
• Action Fraud (Ekitongole kya Bungereza ekivunaanyizibwa ku mivuyo n'obumenyi bw'amateeka ku mikutu gya yintaneeti): Lipoota ku mutimbagano ku actionfraud.police.uk oba kuba ku 0300 123 2040, era oweereze email zonna ezikwatagana ne phishing/spam eri NCSC ku report@phishing.gov.uk.
• Omukago gwa Bulaaya:
• Empeereza ey'amangu: Kuba 112 mu mawanga gonna agali mu mukago gwa EU.
• National Cybercrime & Consumer Protection Authorities: Waayo lipoota ya poliisi ng'oyita ku mukutu gwa Europol ogw'eggwanga ogw'okukola lipoota (europol.europa.eu/report-a-crime/report-cybercrime-online) era otegeeze bbanka yo mu ddirisa lya PSD2 unauthorized-transaction singa enkola y’okusasula eterekeddwa yasasulwa.
• Australia ne New Zealand:
• Empeereza ey'amangu: Kuba 000 mu Australia oba 111 mu kibuga New Zealand.
• Alipoota ku mukutu gwa yintaneeti (ACSC) & Scamwatch (Australia): Lipoota ku mutimbagano ku cyber.gov.au/report-and-recover/report oba kuba ku 1300 CYBER1 (1300 292 371).
• CERT NZ / NetSafe (New Zealand): Alipoota ku cert.govt.nz oba kuba ku 0508 NETSAFE (0508 638 723).
• Buyindi ne Asia-Pacific:
• Omukutu gw'eggwanga ogwa Buyindi ogw'okuloopa obumenyi bw'amateeka ku mikutu gya yintaneeti: Dial 1930 amangu ddala okuloopa emivuyo mu by’ensimbi/wallet oba okwemulugunya ku cybercrime.gov.in.
• Singapore (ScamShield / Ekifo kya SPF ekilwanyisa emivuyo): Kuba 1799 oba 1800-722-6688.

Ebibuuzo ebitera okubuuzibwa¶

Ababbi bamenya batya akawunti yange eya kkampuni y’ennyonyi oba wooteeri ng’ate kkampuni eyo ey’ennyonyi oba wooteeri egamba nti SSI tebayingiziddwa?¶

Mu bulumbaganyi obw’okujjuza ebiwandiiko, teyalina kumenya tterekero lya kkampuni y’ennyonyi oba wooteeri yennyini. Wabula, a eby’enjawulo omukutu gwe wakola akawunti emyaka egiyise (nga app ya fitness, omukutu gwa tikiti, forum, oba retail store) yafuna okumenya data eyafulumya endagiriro yo eya email ne password. Olw'okuba wakozesa password eyo yennyini (oba enkyukakyuka kumpi efaanagana) ku app yo eya kkampuni y'ennyonyi, wooteeri, oba kaawa, bots ezikola otomatiki zamala "kuyingiza" email-and-password pair yo eyafulumye mu lupapula lw'okuyingira mu kkampuni y'ennyonyi oba wooteeri ne ziyingira ddala.

Lwaki omulundi gumu nafuna emails 1,000 ezitaliimu nsa "Confirm your newsletter subscription" mu ddakiika 10 ddala nga obubonero bwange oba gift cards zange zibbibwa?¶

Oyo amataba ga junk signups gayitibwa an Email Bomb (oba Bbomu ey'Okwewandiisa) .. Ekiwandiiko ky’omulumbaganyi ekifulumya ssente mu ngeri ey’obwengula kyassa omukono ku ndagiriro yo eya email mu bugenderevu okutuuka ku mawulire 1,000 agatali ga bulijjo ku yintaneeti mu kaseera kennyini ke baanunula mayiro z’ennyonyi zo, ne bakyusa obubonero bwo mu wooteeri, oba ne bateeka order ku akawunti yo ey’okutunda. Ekigendererwa kyabwe kwe kuzitoowerera okumanyisibwa ku ssimu yo n’okuziika email emu entuufu eya lisiiti okuva mu kkampuni y’ennyonyi, wooteeri, oba dduuka osobole okulonda email zonna 1,000 n’ozisazaamu nga tomanyi akawunti ki eyaakafuluma. Tosazaamu bbomu ya email mu bungi nga tonnanoonya inbox yo ne spam folder ebigambo nga "Okulagira"., . "Ensonga"., . "Maayiro"., . "Tikiti", . "Okukyusa"., oba "Lisiiti"..

Nsobola okunoonya amannya amatuufu ag’omuntu abuuka ku tikiti eyabuukiddwa ne mayiro zange ez’ennyonyi ze nzibe ne nziloopa ku poliisi?¶

Mazima ddala olina okukuba screenshot ku Passenger Name Record (`PNR`), amannya g’omusaabaze, paasipooti/ebikwata ku Mutambuze Amanyiddwa (bwe biba birabika mu screen y’okuteeka), n’ennamba y’ennyonyi era obiwe bombi ekitongole ky'ennyonyi ekivunaanyizibwa ku mivuyo gy'ebitongole / okukuuma enyingiza n’okukuuma amateeka (`ic3.gov`). Wabula kijjukire nti omuntu atudde mu ntebe eyo ey'ennyonyi atera okuba omutambuze ow'okusatu atamanyi eyagula "tikiti esaliddwako" okuva ku mufere akola ku by'entambula mu nkukutu ku Telegram, WeChat, oba Instagram, okusinga omubbi eyaddukanya botnet ejjuza ebiwandiiko. Ttiimu y’abafere mu kkampuni eno egenda kusazaamu tikiti eno era enoonyereze ku IP y’okubuuka n’enkola y’okusasula ekozesebwa ku misolo/ebisale.

Lwaki akawunti yange ey’ennyonyi oba eya wooteeri teyasaba hacker code ya 2FA nga bayingidde okuva mu nsi endala ne bafulumya obubonero 200,000?¶

Pulogulaamu nnyingi ez’omulembe ezitera okubuuka, ez’obwesigwa mu wooteeri, n’ez’okutunda oba ziva mu Multi-Factor Authentication (`MFA`) yakyuka OFF nga bwekiba (ekyetaagisa okusima mu ngalo mu nteekateeka z'Obukuumi bwa Akawunti okugikoleeza) oba okussa mu nkola 2FA yokka ku mukutu gwabwe ogw'oku mutimbagano nga oleka **mobile app API endpoints** oba **partner point-transfer APIs** enkadde nga tezikuumibwa kusoomoozebwa kwa 2FA. Okusobozesa 2FA/Passkys mu bulambulukufu mu profile yo ey’obwesigwa n’okukozesa password ey’enjawulo, ey’ennukuta 16+ ezitali za bulijjo kiyimiriza bots ezijjuza ebiwandiiko mu ngeri ey’obwengula ne ku API z’essimu ez’edda.

Ddala Marriott, Hilton, Delta, American, United oba Starbucks bananzizaayo obubonero oba bbalansi ya kaadi y’ebirabo gye nnali nzibye?¶

Yee, mu misango egisinga obungi egyawandiikibwa, kasita oloopa amangu okununulibwa okutakkirizibwa eri ttiimu yaabwe eyeewaddeyo **Loyalty Fraud / Account Security** era n’oteekawo ekigambo ky’okuyingira eky’enjawulo ne 2FA. Olw’okuba obubonero bw’obwesigwa ne kaadi z’ebirabo mu dduuka eriggaddwa biba biwandiiko bya ledger eby’omunda okusinga okutambuza ssente mu waya ezitasobola kukyusibwa, ttiimu y’abafere mu kkampuni esobola okusazaamu okuteeka wooteeri mu ngeri ey’obufere, okusazaamu tikiti y’ennyonyi, okuzzaawo obubonero okuva ku akawunti y’oyo afuna, okukuwa ennamba empya ey’obwesigwa oba ennamba ya kaadi y’ekirabo ey’omubiri (virtual gift card number), n’okuzzaawo bbalansi yo enzijuvu.

Ebiragiro ebikwatagana nabyo¶

• Data breach response ne password leaks: engeri y’okukebera n’okukuuma akawunti zo
• Email account hacked, amateeka g'okuweereza, n'okuzzaawo
• Okumenya akawunti ya bbanka: okusiba emivuyo mu bwangu n’okuzzaawo
• Phishing ne akawunti ezikoseddwa
• Okuwamba kuki z'olutuula, infostealer malware, n'okusazaamu ebisumuluzo by'okuyita
• Ennamba z’amangu okusinziira ku nsi

Ensonda n’obulagirizi obutongole¶

• Ekitongole ky’ebyokwerinda ku mikutu gya yintaneeti n’ebizimbe (CISA) & Ekifo kya FBI eky'okwemulugunya ku bumenyi bw'amateeka ku yintaneeti (IC3) (United States): Okukendeeza ku bulumbaganyi bw’okuteeka ebiwandiiko ebiraga nti omuntu alina ebiwandiiko, okutwala akawunti (ATO), ne Kampeyini z’okukuba bbomu ez’okuwandiika.
• Pulojekiti y’obukuumi bw’okukozesa mu nsi yonna eggule (OWASP): Ekitabo ky'okutiisatiisa ekya OWASP mu ngeri ey'obwengula: OAT-008 Okujjuza Ebiwandiiko & . OAT-019 Okugatta Akawunti n’Okuyingiza ssente mu Bubonero bw’Obwesigwa.
• Ekitongole ky’eggwanga ekikola ku mutindo ne tekinologiya (NIST) (United States): Ekiwandiiko eky’enjawulo 800-63B: Enkola y’endagamuntu ya digito: Okukakasa, okuddukanya enzirukanya y’obulamu, n’okukebera ebigambo by’okuyingira ebimenya.
• Ekitongole ky’eggwanga eky’ebyokwerinda ku mikutu gya yintaneeti (NCSC) (United Kingdom): Okujjuza Ebiwandiiko, Obulabe bw’Okuddamu Okukozesa Password, n’Obulagirizi bw’Okukakasa Ensonga Ennyingi eri Abakozesa n’Empeereza za Intaneeti.
• Akakiiko ka Federo ak’ebyobusuubuzi (FTC) & Ekitongole ky’ebyentambula ekya U.S. (DOT): Emitindo gy’okunoonyereza ku mivuyo mu nteekateeka y’okukuuma abakozesa n’ennyonyi ezitera okubuuka / ez’obwesigwa.