Security questions can be hacked

Time to read
1 minute
Read so far

Security questions can be hacked

July 15, 2017 - 13:17

Rocco Maglio, CISSP

The information you publish online can be used against you. Even if you use very secure passwords, if the security answers to the “forgot password” questions can be found online, then anyone can change your password and take over your account.

If your security question is where were you married and you shared photos on Facebook from your 25th anniversary where you revisited the spot where you were married — everyone who has access to see your Facebook knows the answer to that question. If your Facebook posts are only available to a small group of friends, then you have less exposure than if your posts are available to the general public.

Many celebrities have fallen victim to hackers using the “forgot password” security questions to gain access to their accounts. Where they were married, mother's maiden name, birthplace and other personal information is often available online. One of the most high profile account compromises was the Sarah Palin's yahoo email account. The attacker was able to find the answers to the security questions online and then released her emails online.

The very same attack was used to break into many celebrities email accounts. The emails of Mila Kunis, Scarlett Johansson, Renee Olstead and other celebrities were hacked using the “forgot my password” feature. The hacker then released their personal photos to gossip sites.

The advantage that the average person has is that they are the only one putting the answers to their security questions online. If you avoid mentioning the street that you grew up on and your first pet's name, these question can be used to verify it is you answering the questions. However, if you have already put the answers of these questions online you will need to come up with new answers.

One option would be to change what the question is asking, you will have to remember that you did that to get the right answer.

For example, you could change the question of what street you grew up on to be answered as the street your friend or your parent grew up on.