Spearfishing. It’s no longer just a tropical ocean sport that could provide seafood for dinner. In today’s tech world, spearfishing is when someone targets you specifically, usually with the goal of taking over your online accounts. Once that’s done, the attacker will try to siphon money from your bank account, impersonate you in an attempt to deceive family or colleagues into sending money, or attempt to ruin your reputation.
You’re probably thinking, “No one would ever target me. I’m not interesting enough.” It is true that the people who should worry the most about spearfishing attacks are high profile or have a high net worth, but modern online criminals aren’t that fussy. In particular, they’re more likely to go after older people. Why older people? Older people tend to be relatively well off and less likely to notice the symptoms of a spearfishing attempt. You should also be concerned if you’re a politician or journalist, have ever been involved in an ugly divorce or legal battle, or can easily think of people who have it in for you.
As we’ve said many times, it’s imperative that you use a secure password manager like 1Password or LastPass to create, store, and enter a strong, unique password for each of your online accounts. Plus, we recommend using two-factor authentication—where you have to enter a one-time code in addition to your password—on all accounts that support it, particularly important ones like your email and banking accounts. But even if you do all that, you may be vulnerable to another tactic favored by spearfishers—the cell phone SIM takeover.
Here’s how it works. Every cell phone, including every iPhone, has inside it a SIM card that gives it a phone number. Swap that SIM into a different phone and it will adopt the SIM card’s number. The problem is that support reps at cellular carriers like AT&T, Sprint, T-Mobile, and Verizon can also move your phone number from one SIM card to another. That makes it possible for you to lose your iPhone, buy a new one, and have your phone number associated with the new one. It also lets you port the phone number to a different carrier, if you wish to switch.
All an attacker has to do is call your cellular provider, pretend to be you, say that they’ve lost their iPhone, and ask to have the number ported to a new device (one they control). It’s likely that the support person will ask a few simple questions to verify your identity, but a clever attacker will likely know your address and be able to learn details like your mother’s maiden name, first-grade teacher’s name, and favorite color, all thanks to Facebook. Criminals can acquire even information like your Social Security number through other data breaches.
Once the attacker controls your cell phone number, they can try to reset the password on various accounts, receiving any verification codes that would normally have been texted to your phone. They’ll probably focus on your email account first because, with control over it, they can reset passwords elsewhere even more easily. And once the attacker has access to your accounts, it’s game over, and you’ll be faced with the difficult and complex task of retaking control and mitigating damage.
How can you protect yourself from such an attack? Whenever possible, it’s better to generate authentication codes with an app such as 1Password, Authy, or LastPass. That removes some of your exposure, but for better or worse, your cell phone number is still the most basic form of identity for many things.
The most important thing to do, then, is to set up an additional PIN or passcode that the carrier will ask for before making any changes to your account. You’ll also have to provide it when logging in to your cellular account online. Such a PIN or passcode is different from a two-factor authentication code that changes continuously—you set your PIN or passcode just like you do for your iPhone or ATM card. And, of course, make sure to store that PIN or passcode in your password manager alongside your other credentials so you don’t forget it.
Learn more about how each of the major carriers supports PINs and passcodes at the links below, and if your carrier isn’t listed, call the company’s support line:
Don’t put this off—if you don’t already have a PIN or passcode on your cellular account, set it up right away.
Manage Menu Bar icons
If your Mac is anything like ours, it’s suffering from an infestation of menu bar icons. Sure, the Wi-Fi menu is essential, and many others can be helpful.
But if you have too many, or they’re in random order, finding one when you need it can be frustrating. You can employ two techniques to increase the accessibility of your menu bar icons:
- Delete any Apple-provided status icon you don’t use by holding down the Command key and dragging it off the menu bar. (To put it back, select the “Show icon-name status in menu bar” checkbox in the associated System Preference pane.) Command-dragging to delete won’t work for most apps with a menu bar icon; for them, look for a preference in the app itself.
- Rearrange the menu bar icons in an order that makes sense to you by Command-dragging them around. You can’t move the Notification Center icon or put anything to its right, but every other icon is movable.
Make your own Keyboard Shortcuts
Power users like keyboard shortcuts because it’s faster to press a couple of keys than to navigate lengthy menus. But what about menu items that lack shortcuts?
Make your own in System Preferences > Keyboard > Shortcuts > App Shortcuts. Click the + button, choose an app from the Application menu, fill in the Menu Title field, click the Keyboard Shortcut field, press your desired key combination, and click Add.
You can even make shortcuts for Safari bookmarks, since they appear in the Bookmarks menu. If a shortcut doesn’t work, make sure you typed its menu title exactly right, including any punctuation like three periods for an ellipsis. To edit an item, double-click its title or shortcut in the list. If you no longer want an item, select it and click the – button.
Software Recommendations
macOS 10.14.6 Mojave. macOS 10.13.6 High Sierra is acceptable. Earlier versions should be upgraded ASAP. You can see your Mac's operating system version by going to the Apple menu in the top left corner of the screen and choosing "About This Mac." Don't even think about macOS 10.15 Catalina yet.
iOS 13.3.1. iOS 12.4.1 (or 12.4.2 for some models) acceptable. Any device that can run iOS 11 should be upgraded to 12.4.2 or 13.3. You can see your iPhone or iPad's operating system version by going to Settings > General > About > Version.
iPadOS 13.3.1. iPadOS 12.4.1 (12.4.2 for some models) also acceptable.
watchOS 6.1.2. Older versions of WatchOS acceptable if necessary; upgrade if your devices (iPhone and Apple Watch) support it. You can see your Apple Watch's operating system version by going to Settings > General > About > Version.
tvOS 13.3.1. tvOS 12 also acceptable. Note that earlier models of Apple TV do not run tvOS and are fine for what they do; not all channels, features, or apps will be available. You can see if there's a software update available for your Apple TV by going to Settings > System > Software Updates > Update Software.
Third-Party Software
Backblaze. Off-site backup remains important in mitigating the risk of fire or theft.
We use and recommend Backblaze. At a cost of $6 a month per Mac, Backblaze will encrypt then backup an unlimited amount of data from your Mac. Data has a 30-day retention window, though longer time periods are possible for an additional couple bucks.
Private Internet Access. A Virtual Private Network (or VPN) creates an encrypted tunnel between your computer and the VPN company's computers. From there, you surf the internet as you regularly do. Using a VPN means that anyone who might be spying on your at the hotel, Starbucks, etc. won't be able to see what you're doing. All they'll see if encrypted internet traffic.
Private Internet Access (PIA) costs about $75 a year—a cost that covers 5 or 6 devices including Mac, iPhone, and iPad.
Hardware Recommendations
Macintosh
- iMac: iMac10,1 (Late 2009) or newer
- Mac mini: Macmini4,1 (Mid 2010) or newer
- Mac Pro: MacPro5,1 (Mid 2010) or newer
- MacBook: MacBook6,1 (Late 2009) or newer
- MacBook Air: MacBookAir3,1 (Late 2010) or newer
- MacBook Pro: MacBookPro7,1 (Mid 2010) or newer
- Note that 2016-2019 MacBook Pro models have a higher than usual keyboard failure rate. Used 2015 models, which use a different style keyboard, may be a more reliable option. The new 2019 MacBook Pro 16" model uses a new keyboard mechanism and should be fine.
These are
minimum hardware recommendations based on what is necessary to run a secure operating system (macOS 10.13.6 High Sierra).
The following are the macOS 10.14 Mojave/10.15 Catalina system requirements. If your Mac does not meet these specifications, it will need to be replaced by fall of 2020, when High Sierra will no longer be secure.
macOS 10.14 Mojave/10.15 Catalina system requirements
- MacBook (Early 2015 or later)
- MacBook Air (Mid-2012 or later)
- MacBook Pro (Mid-2012 or later)
- Mac mini (Late 2012 or later)
- iMac (Late 2012 or later)
- iMac Pro (all models)
- Mac Pro (Late 2013 or newer)
macOS 10.15 Catalina was released in October 2019 and has the same system requirements as Mojave.
iPhone and iPad
- iPhone 6S or newer. Older iPhones cannot run iOS 13.
- iPhone 7 models have a higher than normal failure rate over time. Given the choice, we would recommend iPhone 8 models as a strong alternative to iPhone 7 models.
- iPad Air 2 or newer will be needed for the new iPadOS coming this fall
- iPad mini 4 or newer will be needed for the new iPadOS coming this fall
- iPad Pro (all models)
- iPad 5th generation or newer
The iPad line is made confusing by the multitude of model names and types (Air, mini, Pro, and just plain iPad). Generally speaking, devices introduced in October 2014 and later will run iPadOS. iPads that will not run iPadOS and should be replaced unless they will not be used on the internet.
Apple Watch
- Apple Watch Series 5 is highly recommended.
- All versions are secure and acceptable though Apple Watch Series 0 will not run the latest version of WatchOS and therefore lacks both the speed and features of later Apple Watches.
Apple TV
- Apple TV 4K is recommended. Apple TV (4th generation) is fine as well.
- Older models of Apple TV do not support tvOS and cannot run Apple TV Store apps, though we are unaware of any major security issues.
