‘Free’ content a cybersecurity concern

Online tools that enable the free downloading of music, media and entertainment may seem like a harmless way to enjoy your favourite shows, songs and games without the accompanying bill. However, cyber-security specialist Lian Aldrich warns that these websites can leave users vulnerable in cyberspace.

Aldrich, a co-founder of Aphotic Security, said the issue is not confined to those below a certain income threshold.

“You don’t have to be ‘poor’ by Namibian standards – you can have a house and want a game, but not have N$700 to buy it, so you download a cracked copy,” he said.

But he warns: “Nothing in this world is free.”

Ask yourself why?

People who host and distribute copyrighted music, games and other content may face legal liability in many jurisdictions – which, Aldrich contends, should lead users to consider why such services exist and how they sustain themselves.

“When you are downloading copyrighted music, the providers of that open themselves up to legal liability, with exceptions like Russia, where people are not extradited for these offences, so you have to ask yourself, what do these people get out of it?” he said.

Believers that the building blocks of culture should be freely available may be behind some of these websites, but hosting such libraries still incurs costs, as servers have to be hosted and maintained, Aldrich explained.

“There are people who believe that culture – and thus, by extension, art – should be free, but they still have to bear some kind of cost, because you need servers,” he said. “So I would say, good luck finding such websites and, if you can find them, good luck keeping them like that.”

The concern is that users downloading unlicensed or cracked content may be exposed to malicious software, account theft or other forms of abuse – with little realistic recourse against the people operating the service.

Handling a compromise

Aldrich describes the response to a suspected device compromise as straightforward, but labour-intensive.

Users need to be highly conscious of what may have been exposed, he said, much as they would be when dealing with a virus. The key questions are: what has been exposed, and what accounts or services can be accessed through the affected device?

That assessment should shape the response. A compromised device may be used to access email, banking services, social media, cloud storage or work systems. Users should consider every account that may have been accessible on the device.

Aldrich said the general rule is that apps on phones are heavily “sandboxed” – meaning they are generally separated from the wider operating system. However, attackers can seek vulnerabilities and ways to escape that sandbox.

“Hacking phones is difficult,” he said, but users should not treat that as a reason to be careless.

For a potentially compromised phone or computer, Aldrich’s advice is to factory-reset the device.

“Exploits generally do not survive a factory reset,” he said.

However, cleaning the device is only part of the process. Users should reset the passwords for all accounts accessed from the device.

Aldrich also recommended using a local password manager, such as KeePass, to manage account credentials.

Verify

Aldrich said people should scrutinise unfamiliar download links and websites before acting.

An address a user does not recognise should immediately prompt questions about the context: why is this site offering the file, where did the link come from, and is there a legitimate reason to trust it?

Executable software should be treated with particular caution.

“Never just download and run something,” he said.

Downloading through the Microsoft Store can reduce the burden on an individual user by shifting some responsibility for security screening to Microsoft, he said. It is not a substitute for judgement, but it is preferable to obtaining software from an unfamiliar site.

Users should also read the letters in web addresses carefully. A lock icon in a browser does not establish that a website is legitimate.

“The lock only means this is the same address as on [the] encryption certificate,” Aldrich said.

In other words, an encrypted connection can protect the connection to a fraudulent website just as effectively as it protects the connection to a legitimate one. The crucial question remains whether the address itself is genuine.

For users tempted by a “free” download, Aldrich’s central message is clear: free content may come at a cost that is only revealed after a device, an account or personal data has been compromised.