Zero-click attacks target social media – how to protect yourself

While we all learn to avoid clicking on shady links and be on the lookout for scams, this week we were reminded that there are silent threats out there that we must also be wary of: zero-click attacks.

As Forbes first reported, video-sharing app TikTok confirmed that the accounts of some celebrities, including CNN and Paris Hilton, were compromised by simply opening a direct message. The attackers reportedly exploited a zero-day vulnerability in the messaging component to execute the malicious code as soon as the message was opened.

The US National Security Agency (NSA) has recommended that all smartphone users turn their devices off and on again once a week to protect themselves from zero-click attacks. But as the NSA admits, the trick of turning the phone on and off is Only sometimes prevent these attacks from being successful. However, there are still things you can do to protect yourself – and security software like the best VPNs can help you do just that.

What is a zero-click attack?

As the name suggests, a zero-click attack or exploit does not require any action from the victim. The malware can be installed on the target device without the owner clicking on a link or downloading dangerous files.

This feature also makes it really difficult to detect these types of attacks. This is simply because the lack of interaction significantly reduces the traces of malicious activity.

Cybercriminals exploit unpatched vulnerabilities in software code to implement zero-click exploits, known as zero-day vulnerabilities. As experts at security company Kaspersky explain, apps that offer messaging or voice calling features are a popular target because “they are designed to receive and interpret data from untrusted sources” – and are therefore more vulnerable.

Once a device vulnerability is successfully exploited, hackers can inject malware such as info-stealers to steal all your sensitive data. Worse still, they can silently install spyware that works in the background and records all your activities.

This is precisely how the Pegasus spyware managed to infect so many victims – more than 1,000 people in 50 countries, according to the 2021 joint study – without them even noticing.

That same year, security researchers at Citizen Lab confirmed that nine Bahraini activists successfully hacked their iPhones with the Pegasus spyware using two zero-click iMessage exploits. In 2019, attackers exploited a zero-day vulnerability in WhatsApp to load spyware into communications via a missed call.

As the celebrity TikTok hack story shows, social media platforms are becoming the next popular target. Meta, for example, recently patched a similar vulnerability that would have allowed attackers to hijack any Facebook account, according to a Nepali researcher.

🚨PSA🚨Apple users, update your devices ASAP! They are vulnerable to zero-click attacks. pic.twitter.com/HuF3xaNhWd9 September 2023

How to protect yourself from zero-click attacks

Zero-click attacks typically target high-profile individuals such as politicians, corporate figures, journalists, and activists. However, the reality is that any of us can fall victim to an attack at some point.

The good news is that there are still some steps you can take to minimize your risk of becoming vulnerable to zero-click exploits.

First of all, I suggest you the device’s operating system and all downloaded apps are up to date at any time. This is very important because developers generally fix security bugs with new updates, so it’s possible that they’ve already patched the zero-day vulnerability that cybercriminals would otherwise exploit.

Overall, you should maintain good cyber hygieneThis includes deleting apps you no longer use, downloading new applications only from official stores, backing up your systems regularly, and protecting your device with a password.

While a virtual private network (VPN) mainly encrypts Internet connections and spoofs your IP address, some top providers now offer advanced protection features such as Ad and malware blocker. This can help you detect and block malware so that it doesn’t infect your device. On this point, I recommend checking out NordVPN, ExpressVPN and Surfshark.

However, a VPN with integrated anti-malware tools cannot provide the protection of a comprehensive virus protection. Therefore, I recommend looking for reliable software and installing it on your smartphone.

Related Posts

17-year-old killed in traffic accident in Dickson County

Chilmark man charged Sunday in Plymouth stabbing; ‘likely’ connection to Braintree attacks

The story of Swiss International Air Lines Flight 850