Season one of last summer’s hit new TV show, Mr. Robot, was filled with interesting and, for the most part, accurately portrayed hacks. The hacks were carried out by the show’s main character Elliot and hacker group fsociety. Their goal throughout the season was to take down the multi-national conglomerate, E Corp.

Although the hacks on the show were rather complex and to a certain extent elaborate, there are a few things SMBs can learn from them.

Season two of Mr. Robot will be airing soon, so I sat down with Avast security experts to recap the hacks from the first season and to hear their thoughts on how SMBs can protect themselves:

Truly value your IT department

In eps1.2_d3bug.mkv Elliot is admitted to a hospital whose IT department is lead by a single person, with a budget of $7,000. According to Elliot, he uses useless virus scans, dated servers and security software that runs on Windows 98. It’s one of the reasons why Elliot made that particular hospital his primary care facility, since he can easily modify his records to look average and innocent.

Many companies, even hospitals, unfortunately, do not provide their IT departments with enough resources. This can be extremely dangerous, as IT departments’ jobs are to protect your company’s and perhaps even your customers’ data. In order for IT departments to do their job properly, so that you can run your company without having to worry about being hacked, you need to make sure they have enough resources to hire experts, purchase up-to-date software and the latest hardware. Avast’s Free for Business is a great solution for businesses who need to save on IT costs. - Jaromir Horejsi, Senior Malware Analyst

Beware of social engineering

In eps1.4_3xpl0its.wmv Elliot and fsociety physically social engineer their way into Steel Mountain’s facility.

Social engineering tactics are heavily used by cybercriminals. Social engineering is a combination of psychological techniques that cybercriminals use to trick people into giving up sensitive information or performing certain actions, such as downloading malware or giving out sensitive information. While in the episode fsociety physically social engineering their way into your office or facility, SMBs need to worry about someone digitally social engineering their way into their network, which is why employees should keep informed and vigilant.

Cybercriminals attack using phishing attacks, which are emails pretending to be from a trusted source,  in two ways: either through general attacks, using phishing emails, that target anyone they can, or with specific targeted attacks, spear phishing directly targeting specific people, like the attack on Austria’s FACC in January. Therefore, it is important that you and your employees stay educated in security best practices. If employees are taught to be careful and are aware of current threats, the chance of falling victim to an attack will certainly be lowered. If more employees knew what typical phishing emails or sites look like, they wouldn't be likely to fall for them. - Michal Salat, Threat Intelligence Manager

Update your software on a regular basis

In eps1.1_ones-and-zer0es.mpeg Elliot hacks Tyrell and notices that E Corp’s mail servers haven’t been patched since “Shellshock”, making it easy for him to hack.

While Tyrell purposely did not update E Corp’s mail servers after the “Shellshock” patch had been released, because he wanted Elliot to hack him, you should always update all software your company uses on a regular basis. Not updating software can put your company at risk, because it gives hackers the opportunity to exploit known software vulnerabilities and thus they can hack your accounts or infiltrate your company’s network. - Jaromir Horejsi, Senior Malware Analyst

Use two-factor authentication to protect your accounts

Elliot hacks Tyrell in eps1.1_ones-and-zer0es.mpeg and notices that he doesn’t use two factor authentication, making it easier for Elliot to hack his accounts.

Again, while Tyrell did this on purpose it doesn’t mean you should make it easier for hackers to hack into your accounts, whether they be your professional or personal accounts. Two-factor authentication requires users to enter a second code along with their username and password. This code is typically sent to a mobile number or can be generated on a mobile device. If that user isn’t trying to log in to that account, two-factor authentication can also serve as a warning system when someone else is trying to break in. We have, however, also come across mobile malware specifically designed to steal one-time passwords (OTP) in order to access victims’ banking accounts. One more reason to make sure you install antivirus on your mobile device, like Avast Mobile Security. - Jan Sirmer, Senior Malware Analyst

Make sure your establishment’s Wi-Fi is secure

In the pilot, eps 1.0_hellofriend.mov, Elliot hacks the owner of Ron’s Coffee, Rajid via his cafe’s Wi-Fi network.

If you are an access point owner providing Wi-Fi to customers, you should use strong encryption method like WPA2, with a strong password. Your password should not be a dictionary word, but should be at least eight characters long, include lower and upper case letters, numbers and special characters.

If you are a user connecting to the public Wi-Fi, you should use a virtual private network (VPN) application, like Avast SecureLine VPN, to protect your communication from hackers and snoops. - Jaromir Horejsi, Senior Malware Analyst

Season two of Mr. Robot airs on Wednesday, July 13th at 9/10 pm Central on USA Network. Check out the Avast blog every Thursday for Mr. Robot hack reviews, with security tips from Avast’s security experts!

Image via: USA Network @whoismrrobot