Subscribe
Printer Friendly
Share this PageTechnology
The Worst Outbreak in Years
Using a flaw in the Windows Server service that was detected and patched months ago, a single worm has managed to infect nearly 9 million PCs in just over two weeks — and the rate of infection is increasing by the day. In just four days, the "Downadup" worm (which is also sometimes referred to as "Conficker,") spread from an estimated 2.4 million computers to 8.9 million. It has been described by many security experts as the worst outbreak of malicious software in years.
In October, Microsoft sent out a rare emergency security update for all of its operating systems, including Vista, XP, and Windows 2000. Unfortunately, this update seems to have been ignored by a large portion of PC users, leaving millions vulnerable to Downadup.
Full Dangers Still Unknown
Right now the intentions of developers responsible for the malicious software remains unclear. For the time being, the hackers have only bothered to send out a fake security security program, which creates pop-ups designed to annoy users into paying for a worthless program. But Downadup could potentially hijack millions of computers and use them as bots capable of carrying out whatever commands the hackers send them.
That the whole problem could have been averted if users had just bothered installing a patch Microsoft issued long ago, underscores the importance of setting your operating system to automatically download and install security updates. Those with infected computers undoubtedly let the patch languish for months in an update queue, alongside much less essential software updates.
How to Update Windows Automatically
Windows XP
To set your PC to update automatically in Windows XP, simply access the Control Panel in the start menu, click "Automatic Updates," and choose "Automatic."
Windows Vista
For Vista, open Windows Update in the start menu, select "Change Settings," and then select "Install updates automatically."
How to Remove the Worm
Your computer might not be showing any signs of infection or you may have seen some odd behavior.
From Microsoft:
If your computer is infected with this worm, you may not experience any symptoms, or you may experience any of the following symptoms:
- Account lockout policies are being tripped.
- Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
- Domain controllers respond slowly to client requests.
- The network is congested.
- Various security-related Web sites cannot be accessed.
If your PC has already been infected by Downadup, first install the emergency update, then run the latest edition of Microsoft's Malicious Software Removal Tool to remove the worm from your computer.
More information about the worm is available from Microsoft. You can also read more on Computerworld.
The British newspaper Mail Online reports that a local postman was scammed out of his life savings by an an attractive female "friend" he met on the popular online community site MySpace.
Saving the Damsel in Distress
The postman, Shane Symington, seems like a nice fellow who was simply trying to help a fellow human being. He befriended an American woman named 'Angela Gates' on MySpace in 2007. After a few weeks of friendly banter, the woman began asking for money to pay for her mother's funeral and for medical expenses.
What could Shane do but rush in and save her from her predicament? She needed him!
In order to hit every soft spot Shane had, 'Angela' also told him she needed more money to pay for legal fees that would allow her to inherit a $2 million piece of property. Anyone who's studied Advanced Fee Fraud scams will recognize this kind of story.
Damsel Turns Out to Be a Dude
Unfortunately, it appears Shane hadn't studied much about scams. It turns out this attractive, bikini-clad and potentially rich American woman was really a Nigerian man. Surprised? I doubt it.
After emptying Shane's bank account the Nigerian man even contacted Shane and admitted his fraud, but the story doesn't end there.
From the Mail Online:
He was then contacted by another woman, again from America, claiming she had also been caught in the scam.
He said that he then helped pay her legal expenses and the cost of hiring two ex-FBI agents in an attempt to regain the lost money for both of them.
Mr. Symington said that he now believes that these people are also involved in the scam. He said that he had paid out more than £30,000 to them, bringing his total losses to more than £130,000.
Ouch!
The lesson to learn here is that when this scammers find a victim, they hit them with multiple scams from multiple people until they have milked their target completely dry.
What does Shane have to say about all of this:
I feel sick from it all, I feel disillusioned, they have just played on my good nature. I've lost my life-savings, I have two loans and credit card debts, I'm in huge debts because of all of this.
You just can't trust anyone on the internet. I want to warn people but I know I won't be the last to fall for something like this.
The police in Hampshire working the case said that there's little they can do to recover the money because of the current political situation in Nigeria.
What Can We Do?
These stories are hard to read. We can't believe someone can be so easily manipulated. So what can we do? I suggest you help your friends, relatives, and neighbors by educating them about these kinds of scams. Shane said it best - "I won't be the last to fall for something like this."
Don't let it happen to someone you know.
Read the whole story (w/ pics of the lovey 'Ms. Gates' on the Mail Online web site.
It's a new year and — what do you know — there's a new tactic in the endless quest for new and improved phishing schemes from scammers.
Here's How It Works
Researchers at Trusteer recently released a security advisory detailing this new phishing technique. Rather than using email to lure unsuspecting victims into clicking over to a fake web site, this technique uses what Trusteer is calling "in-session" attacks. Here's a typical scenario:
- A user opens a browser and logs into their banking web site
- Leaving that browser session open, they open another browser window to check on their Webkinz or some other web pursuit.
- After a time, a pop-up window opens — supposedly from their bank web site — asking for them to re-enter their username and password.
- Since the user has recently logged in to the targeted web site, they are more likely to enter their info.
That's it! Their login credentials are now in the hands of the scammers.
What Makes It Possible?
A few things have to be in place for this to work. First, the scammers need a compromised web server in order to install the malware. Fortunately, there are lots of those around. Second, the malware has to be able to determine which other sites the user has visited. This is possible based on a vulnerability in the JavaScript engine used by Internet Explorer, Firefox, Safari, and Chrome.
From Trusteer:
The source of the vulnerability is a specific JavaScript function. When this function is called it leaves a temporary footprint on the computer and any other website can identify this footprint. Websites that use this function in a certain way are traceable. Many websites, including financial institutions, online retailers, social networking websites, gaming, and gambling websites use this function and can be traced.
How Can You Protect Yourself?
Well, the planets have to align a bit to pull this scam off and it's likely the JavaScript vulnerability will be patched in the near (hopefully) future.
Until then, Trusteer recommends the following preventative measures:
- Have an up-to-date anti-virus installed
- Be suspicious of any pop-ups asking you to login
- Log out of banking or other sensitive sites before heading over to Pogo.com for your bingo fix.
and most of all...
Learn more about this attack by downloading Trusteer's security advisory.
For the second year in a row, malware has been discovered in major-brand digital photo frames, carried by some of the nation's biggest retailers.
Software that came pre-installed in frames manufactured by Samsung, Element, and Mercury, was found to enable the "Autorun" function in Windows, allowing it automatically install malicious code to a PC whenever it is connected. The nature of the malware varied with the device, and it isn't even yet clear in some cases whether the malicious code was put there intentionally, or if it simply replicated itself from an infected computer used in the manufacturing process.
This problem isn't just contained to digital frames though. In past years, a variety of electronic gizmos—from flash memory sticks to satellite navigation devices—have all been found to pose security threats.
Peripheral Devices And You
What do most of the popular electronic holiday gifts such as digital cameras, music players, photo printers or even cell phones have in common? They're all "peripheral devices"—meaning that they have to be connected to a personal computer in order to become fully functional. Without these devices, our home computers remain just that—stationary libraries of songs, photos, and other data, inaccessible to us when we're outside of the house.
What many consumers don't know is that anything capable of downloading data given to it by a computer, is also capable of replicating its data onto that PC in the process. So before you plug a new device into your USB port, there are a few steps you should take to keep your computer safe.
Digital Photo Frames Can Contain Malware
What You Can Do
As always, the best way to protect your computer is to have a good, up-to-date anti-virus program installed and running at all times. These programs can identify almost any potential threat and neutralize it immediately upon connection of a device to your computer.
Staying away from cheap brands you've never heard of before (like those $15 drug-store digital cameras or MP3 players,) is also something many experts recommend. But top-notch anti-virus software should be enough to protect you—even from those yPod and Suny products you might find at the flea market.
On December 17th, Microsoft released an emergency security patch for all versions of Internet Explorer. The patch is considered a critical fix for a current security flaw that has believed to have infected over 2 million computers.
The following version of Internet Explorer are affected:
- Internet Explorer 5.01
- Internet Explorer 6
- Internet Explorer 7
How Serious is the Flaw?
The flaw can be used to let attackers steal personal data such as passwords if a user visits a compromised Web site, of which at least 10,000 are thought to already exist. Thus far, the vulnerability has been used primarily for grabbing gaming passwords for black market sales. The hole could, however, potentially also be used to steal more sensitive information such as banking passwords and other private information. Definitely not a hole you want left unpatched for an extended period of time especially if you have been doing a lot of holiday shopping over the Internet.
Steps To Secure Internet Explorer
First, download the appropriate Microsoft security patch at the Microsoft Update site as well as at the Microsoft Download Center. It is always the best policy to obtain any hardware or software patches directly from the hardware or software vendor’s website instead of some unknown third party website. An unknown third party website purporting a hot patch fix is more likely than not also including unwanted extra baggage in their download in the form of malware resulting in ironically making your system even less secure than before.
After successfully applying the IE security patch, update the virus definitions on your antivirus software on your system. The virus definition date should be December 17th or later. Then run a full virus scan on your system to make sure nothing sneaked in during the period before you applied the security patch. If your virus scan comes back clean, then you can go on the Internet with confidence to finish any last minute holiday shopping.
More technical details are available on the Microsoft Technet website.
Myspacers have been dealing with identity theft scams for years, but now there's mounting evidence that hackers are targeting Myspace's more mature brother, Facebook. According to a Reuters wire story, a virus known as "Koobface" has been making the rounds using the Facebook messaging system.
How Does it Work?
Users are typically told that they "look awesome in this new movie" that the sender has uploaded, and are redirected to a site that in turn asks them to install a bogus Adobe Flash player update. If the user decides to take the bait, the Koobface virus is instantly installed on their computer, at which time it goes about its business gathering credit card numbers and other sensitive information.
How Do I Get Rid of It?
According to Guy Bunker of Symantec, Koobface is fairly easy to get rid of. Users can either install some anti-virus software (which will automatically find and destroy it,) or locate two files in their Windows directory. The files are named "tmark2.dat" and "mstre6.exe", and should be deleted immediately if found.
Find more details on detection, files affected, removal, etc. on the McAfee web site.
Even if Koobface itself isn't all that scary, the Reuters piece cites a security researcher with McAfee as saying that such viruses are on the rise on social networking sites. Presumably surfers are more trusting with these sites because they typically use them to connect with friends, and aren't expecting to be targeted the way they would in a random email from an unknown spammer.
In 2005 and 2006, Myspace suffered from a rash of security problems, the most widespread being a JavaScript virus named "Samy." Samy was relatively harmless since it targeted internet profiles rather than PCs. Nevertheless, more than 1 million users ended up displaying the message "Samy is my hero" on their Myspace profiles in 2005.
How Do I Protect Myself in the Future?
Social networking sites like Facebook turn us into fools when it comes to installing software.
- Want to throw a virtual snowball at someone? Install this application.
- Want to find out what kind of sandwich you are? Install this application.
- Want to know how you're going to die? Install this application.
That's why these sites are the newest playground for virus creators - people are connected, they click on stuff, they install stuff, rinse and repeat.
One good rule of thumb is to avoid redirect links in Facebook or Myspace messages unless you can absolutely verify that the URL is legit. Never download a file from a page you've been redirected to. Report the incident to the support staff at social networking site, and await further instruction.
You may know who your friends are in real life, but it's important to remember that an internet persona can always be hijacked---even if you do look really awesome in that movie.
Screenshots
Here's how the Koobface virus, and other related viruses appear within Facebook:
What Appears in Facebook
Notification in Your Email
Website Download
Updated to add:
Variants of this virus appear to be pointing to data collection or revenue generating web sites. Here are a few titles I've had reported recently:
"hey is this u on thebestphotosonline.com"
and...
"whats the deal with u bein on imdownwitu.com"
Whether you're a business traveler touching base with the home office or a vacationer catching up on some last-minute Christmas shopping during holiday travel, airport wireless networks are a welcome distraction during a layover.
But beware...
According to a recent article in Forbes, anyone who logs on using an airport wireless connection is instantly exposed to data and identity theft.
How Bad Are They?
Forbes interviewed a so-called "white-hat hacker," working for AirTight Networks (which makes wireless security software and hardware,) and found that during AirTight's survey of 20 American airports, agents had identified serious security flaws in nearly every network. Some airports even allowed critical baggage handling and ticketing data to pass through their network unencrypted---a potential security risk in more than just the digital sense.
The purpose of the tests was to alert airports to the problem in the hopes that they would choose to hire AirTight as their security provider, but in the short term, let it stand as a warning to travelers: You are nowhere near as safe logging in at an airport hub as you are even at home. Even shopping malls and many universities provide more network protection to their users, and since there are currently no laws on the books that require airports to try any harder, don't expect any of this to change overnight.
Here's a quote from Forbes on how bad things are:They found rampant phony Wi-Fi hot spots created by phishers and, at several large airports, plenty of open or insecure networks run by critical operations such as baggage handling and ticketing. Almost all public networks allowed data such as user names and passwords to pass through the air unencrypted. Only 3% of people used something more secure.
How Do I Stay Safe?
Most security experts would recommend these four steps to relative safety on public wireless networks like those found in airports:
- Be sure that you're connected to a legit network. Phishers sometimes set up bogus hotspots in airports, waiting for unsuspecting travelers to log on.
- Use a firewall.
- Don't type in any credit card information or critical passwords while connected to these networks.
- Disconnect from the network when you're not using it.
These steps won't guarantee you 100 percent safety, but it's a good start if you decide that uploading those Christmas photos to Flickr can't wait until tomorrow.
This video from Forbes provides more details on what you should watch out for:
According to investigative reporters for WirtschaftsWoche, 21 million Germans have had their personal information stolen along with their bank account and bank code numbers. The thieves are offering to sell the data for 12 million euros (about 15.3 million dollars). It is believed the scammers gathered the data by using employees at financial institution call centers.
Could this happen in the U.S.?
It certainly could. Privacy laws throughout Europe are generally tighter than U.S. laws and Germany is among the tightest. Low employee morale, caused by a deteriorating job market and chaos within the financial sector makes crimes like this more likely. I'm sure it's tempting for employees to grab whatever data they can as they're shown the door or maybe they're just looking to add to a mediocre salary. Whatever the reason, it may be time to buckle up and prepare for a bumpy ride.
What could criminals do with this data? Make bank withdrawals.
Criminals can use the bank account info to make withdrawals - either big or small. A .57 cent bank withdrawal from 21 million accounts still ads up to... ummm... let me get my calculator out... $11.97 million dollars. And that's this month, and next month, and the next month, etc. until they're caught or they decide to make a big withdrawal and run.
Here's their strategy, detailed in an IT World article:
Although banking passwords were apparently not included on the CD, criminals would be able to use this data to withdraw funds from a victim's account, said Thierry Zoller, an independent security consultant based in Luxembourg.
Scammers could use this type of information to initiate a large number of debits from German banks, making each withdrawal small in hopes that it would not be noticed by the victim, he said.
This is why carefully checking your bank records is important. If you see a unexplained entry - even if it's small - you should track it down until you understand where it came from. Otherwise you might unexpectedly see a much bigger withdrawal from the same source somewhere down the line.
More about this story at the WirtschaftsWoche in English and German.
You can also find coverage at The Register, and IT World.
We've been hard at work for the past six months on a new and improved site. Let us know what you think.
We've incorporated more video onto the site as well as an easier to understand layout and design.
Do you like it? Let us know.
We're still completing a content review and clean-up throughout the site and you might see a few issues here and there until that's completed.
Hope you like it...
Every one loves a "Top 10" this time of year, so here is a great one from our friends at Kroll Fraud Solutions. It was put together by Brian Lapidus - Kroll Fraud Solution chief operating officer and identity theft expert.
Enjoy!
1. Beware the Word "Prevent"
No person and no product can prevent identity theft. As long as criminals can benefit from stealing, there will be theft. Sensitive personal information (SPI) is everywhere, housed and archived in a mind-boggling variety of ways. Individuals and companies can reduce access to SPI and improve safeguards around it by working to change how we share, collect, store and dispose of information.
2. There Are No Guarantees
This mantra holds true for a lot of things in life and dealing with identity theft is no exception. While a number of instances of fraud can be restored to pre-theft status, some identity dilemmas simply can’t be fixed. If you’re on the ‘no fly list’ thanks to an imposter or an error, you’ll stay there. A third-party solution cannot deliver a remedy.
3. Watch for "Shoulder Surfers" and "Skimmers"
Shield the entry of personal identification numbers (PINs), and be aware of people standing entirely too close by when using your credit or debit card in public. Especially with the advent of cell phone cameras, a sneaky, shoulder surfing thief can get your private information pretty easily, if you’re not careful. It’s also advisable to use teller machines that are familiar to you, so you are in a better position to identify when the equipment looks different or doesn’t “feel right.” Your increased awareness may reveal a skimmer’s attempt to steal PINs and banking details at that site.
4. Keep Your Social Security Card Safe at Home
Unless you’re on your way to fill out a job application, there are very few reasons to carry around the crown jewel of SPI. At lunch a few weeks ago, the woman beside me opened her wallet for a credit card and there was her Social Security card, too. Remember, ID theft and fraud are not exclusively credit-related – thieves can use a clean Social Security number to construct a whole new life.
Additional note from Dave: I regularly receive emails from Fight Identity Theft visitors explaining how they just had their purse or wallet stolen with their Social Security card inside. Remove that card today!
5. Destroy Before You Dump That Old Computer
Erasing data just enables the computer to write over that space again; it doesn’t actually eliminate the original bits and bytes. Physically remove the hard-drive to ensure you’re not tossing out or passing along your personal details. Our company is often called upon to recover data from an erased or damaged drive; we’re very good at it – and so are some professional thieves.
Additional note from Dave: You could also consider using a software tool like Eraser to do a complete wipe of your drive. If you physically remove your drive, smash the drive with a hammer (find someone strong) before throwing it in the trash.
6. Choose "Forget Me’ Instead of "Remember Me"
How many Web sites do you frequent that invite you to enable an automatic log on the next time you visit? Don’t check that box! When convenience trumps confidentiality, you’re asking for trouble. The harder you make it for hackers to follow your trail into an online store or bank account, the better.
Additional note from Dave: This is absolutely necessary when using public computers. In fact, you should avoid accessing any secure sites from a public computer (like a library, internet cafe) or when using a public wireless network or wifi hotspot.
7. Don’t Rely On Fraud Alerts Or Credit Freezes Alone
Fraud alerts are meant to stop an identity thief from opening new accounts in your name. Credit freezes let you restrict access to your credit report, which would also make it hard for someone else to open new accounts. But, neither one will stop a thief from trading your SPI for cash, or using it for tax fraud or in any of the countless other ways fraudsters exploit stolen identities.
8. Practice Prudent Posting
Social networking sites on the internet enable individuals around the world to chat, share photos, recruit employees, date, post resumes, auction property, and more. Because the Web makes it possible for any posted document to link with another, any data you put out online have the potential to stay there for what amounts to electronic eternity.
Additional note from Dave: I suggest creating usernames or an email address that don't contain your name or anything traceable to you, whenever possible. You also might consider using different usernames on different sites. This makes sense because if someone is able to determine that you use "CatLuvr55" on one site, it's an easy search to track down "CatLuvr55" on any other sites where you have a profile.
9. Keep That Key
When you check out of a hotel where you were issued a card-key to unlock the door to your room, don’t leave the card-key behind. Hold on to it until you’re safely home and can shred or otherwise discard it safely. Some say it’s an urban myth that the card-keys hold vital details like credit card numbers, while others report having tested and confirmed the presence of private data coded into the magnetic strip. Even if there’s no definitive answer, why risk it?
Additional note from Dave: Not sure I'm convinced on this one. I'd need to see more data showing that it is a problem. Snopes.com debunks this pretty thoroughly.
10. What’s In Your Wallet?
Make photocopies of the personal material in your wallet: Driver’s license, credit cards, insurance cards, all of it – front and back. Should your wallet be lost or stolen, you won’t be left wondering what was actually taken, and you’ll be able to quickly notify the appropriate agencies about what has taken place.
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion. You can find us on Facebook or Twitter.
Fight Identity Theft Newsletter
Enter your email address and keep up to date. More info | Unsubscribe
Recent Blog Entries
- May, 2010 (1)
- March, 2010 (1)
- February, 2010 (1)
- January, 2010 (3)
- December, 2009 (1)
- November, 2009 (5)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (38)
- Government (21)
- Identity Theft (39)
- Junk Mail (5)
- Phishing (13)
- Privacy (19)
- Scam (32)
- Technology (52)
- Telemarketing (2)
- Viruses (11)
- Visitor Stories (1)
- Worms (11)
