How to avoid having your computer hacked

Designed to encrypt and ransom data and spy on everything a user does, malware has become very prevalent in the last few years. The 2017 WannaCry attack put the malicious software on front pages everywhere, and it's likely that won't be the last time software like that is in the news. We spoke with malware researcher Amanda Rousseau to find out how users can protect themselves - and what to do if they get attacked. Following is a transcript of the video.

Narrator: Does this screen scare you? It means your computer is disabled, your hard drive is encrypted, and you can't do anything unless you pay the ransom. But it can be avoided.

Amanda Rousseau: It's basically finding holes and gaps to do malicious things, stealing information, destroying your box, or you know, doing something nefarious pretty much. Typically with ransomware the most common thing is to use encryption to encrypt all of your files or your hard drive and then try to ransom you the objects to get them back.

Narrator: One of the most famous ransomware attacks happened fairly recently. In spring of 2017, WannaCry, malicious code based on a leaked NSA exploit, spread around the world infecting about 200,000 computers. Hospitals in the UK were hit so hard they were forced to turn away non-critical emergencies. And while ransomware like that sounds like a nightmare, spyware may be even worse.

Amanda Rousseau: It can cover keystrokes, screenshots, video, or audio. Essentially it's like the Trojan Horse, you look like something benign but inside is malicious. And it'll keep connecting back to its command and control server. And it'll keep sending data constantly back to that command and control. And on the hacker's end, he can access your box and see like what kind of data just came back.

Narrator: Someone could be logging everything you do on your computer. A nightmare scenario that records your keystrokes as you enter your bank password, captures confidential documents onscreen, and even watches you through your camera as you watch this video.

Amanda Rousseau: Let's just say the average breach is, it's like 40 days. Like they don't figure it out until after 40 days. So, that's 40 days for them to steal data and information and get out and clean up.

Narrator: 40 days! That's probably more than enough time for someone to steal all of your information. So, how do you avoid this malicious software?

Amanda Rousseau: You should have something as a stopgap to prevent it. Like, for instance, if you're gonna download a document, the most common thing is to allow macros, right. Macros allow like little programs within the document, in a Word document. But that's the most common way that malware is delivered these days. So, by allowing, enabling macros you're allowing you know, some code to run in the background within the document.

Narrator: Your computer can get infected from just a tiny piece of software in a text document. But also, be careful with the websites you're visiting.

Amanda Rousseau: You wanna look at the reputation of the website. Does the website have SSL encryption, or if it doesn't have the https like on the actual URL, like that'll be a big indicator. If there's a pop-up just close down the browser really. 'Cause by allowing that user interaction you're giving the program rights to do what it needs to do.

Narrator: It's very easy to hide malicious software in other programs. So, make sure the software you download is from a reputable source.

Amanda Rousseau: Even a Flash player or a Fake AV, there are a lot of clickable downloads out there that says "Oh, your computer is hacked" with a bright red screen. But it's totally fake.

Narrator: Also, make sure you're being proactive in maintaining your security.

Amanda Rousseau: The more stopgaps you have, two-factor authentication, strong passwords, you know, is there a special like code that you have with the person, your account representative. Like who's gonna know your first-grade teacher, or something like that.

Narrator: Finally, try to limit the amount of data you put online. That includes your vacation photos.

Amanda Rousseau: You know, once you get onto a social media platform or a banking site, you're giving up personal information about yourself. So, the whole thing of using cloud, and cloud servers is like, yeah, you're giving data to that company but you're also giving the third party access to the data, as well. And even the more information that you give out on the web, like there's these whole programs to go search for personal information about you. And every social media profile, everything that you have publicly, it will find it and use it as like a way to kind of guess your password, or guess your activities. So, what if a robber knows where you live and can figure out when you go out on vacation? They're gonna go after your stuff.

Narrator: And if you do wind up getting hit with some sort of malware, don't panic. You may still be able to save your data.

Amanda Rousseau: Just completely disconnect the box, or if you have a picture of the ransom note, go to a different computer and look up like what type of ransomware it is because eventually you'll find that there could be a decrypter out there for it. And you can get all of your information back without having to pay the ransom.