Subscribe
Printer Friendly
Share this PageFight Identity Theft Blog
Do You or Your Friends Take Facebook Quizzes?
Have you ever taken one of those ridiculous and inane quizzes on Facebook that tell you which color you are ("I'm Orange! Now what do I do?"), which Harry Potter character you are (see above), or which superhero your dog resembles?
Maybe you hate these quizzes and avoid them completely, but do your friends on Facebook take them? If so, all your private info is likely being shared with the quiz developers - whoever they may be. This access to your personal information has alarmed many groups, including the ACLU. Here is a warning from the ACLU of Northern California:
Even if your Facebook profile is “private,” when you take a quiz, an unknown quiz developer could be accessing almost everything in your profile: your religion, sexual orientation, political affiliation, pictures, and groups. Facebook quizzes also have access to most of the info on your friends’ profiles. This means that if your friend takes a quiz, they could be giving away your personal information too.
The ACLU of Northern California has heard from thousands of concerned internet consumers using the popular social networking software, Facebook, about privacy issues. The ACLU went digging and found there is good reason for concern: as it stands, quiz developers have access to just about everything in your profile and postings and those of your Facebook Friends.
Here are a series of screenshots where we show exactly what happens when you take a quiz or run other applications on Facebook:
Asking for Permission - For You and Your Friends
As you can see, Facebook tells you specifically that it will let the application developer "... pull your profile information, photos, your friends' info, and other content that it requires to work.
This is the privacy problem. Your friends are agreeing to share your information without your knowledge or consent. Not good.
Exactly What is Shared?
These, I believe, are the default privacy settings for applications. As you can see, you or your friend are agreeing to share a lot of personal information with a completely unknown party.
The ACLU Creates Its Own Quiz
Even if you are careful about your privacy settings in Facebook, quiz developers probably will be able to access your profile and your postings through the accounts of your Facebook Friends. To drive the point home the ACLU created their own short, instructional Facebook quiz. (And no, according to their privacy policy, the ACLU will not collect or sell your information from their Facebook quiz.) Even though I was expecting some kind of revelation it was a bit creepy to suddenly see my Facebook profile information and photos start scrolling on the screen.
What You Can Do
- Be aware that fraudsters dig through Facebook and other social networking sites looking for information to about you. Creating quizzes - any lame quiz appears to spread rapidly across Facebook - are one of the simplest methods they have to collect data.
- Adjust your Facebook privacy settings to project yourself. From the Facebook menu bar choose Settings > Privacy Settings > Applications > Settings. You should see a screen similar to the screenshot earlier in the article. Deselect anything you don't want shared without your permission (I'd suggest deselecting everything).
- Choose your Friends wisely. Many people are excited at the possibility of gathering hundreds if not thousands of Facebook Friends—many of whom are friends of friends instead of people they actually know. Anyone you accept as a Facebook Friend will be able to view your profile and postings unless you say otherwise.
- Sign the ACLU’s petition urging Facebook to tighten up their privacy policies.
- Say ‘no’ to those playful/stupid Facebook quizzes - and any Facebook applications.
More on this story from the San Jose Mercury News.
Consumers’ obsession with celebrity news and culture is harmless in theory, but one bad download can cause a lot of damage to a computer.
—Jeff Green, McAfee, Inc.
Jessica Biel Sites Are #1 for Malware
Internet security company, McAfee, Inc. has just released its yearly update of most dangerous celebrity web sites for online threats such as spyware, adware, spam, phishing, and viruses. In the survey, web searches for actress, Jessica Biel, had a one-in-five chance of ending up on a website that has tested postive for malware—putting Biel’s name at the top of the danger list and beating out last year’s most dangerous name, Brad Pitt. Biel became popular on TV’s “Seventh Heaven” and recently starred in “Easy Virtue”.
Pop star, Beyonce, placed second on the list. Web searches on “Beyonce ringtones” led to a dangerous website linking to a distributor of adware and spyware. Over 40 percent of the survey searches for “Jennifer Aniston screensavers” contained computer viruses. Other celebrities on this year’s list included Miley Cyrus, Ashley Tisdale, Lindsay Lohan, Megan Fox, Angelina Jolie and newlyweds, Tom Brady and Gisele Bundchen.
Every day, cybercriminals use celebrities’ names and images, like Kim Kardashian and Rihanna, to lure surfers searching for the latest stories, screen savers and ringtones to sites offering free downloads laden with malware.
What You Can Do
- Be aware of the connection between celebrity websites and malware. You may not visit those sites but your kids might.
- Be aware that malware-connected celebrity web sites change with the tide of popularity of the celebrities.
- Make sure you’re using anti-malware software on your computer and it is current.
More info from Reuters - http://www.reuters.com/article/internetNews/idUSTRE57O2P520090825
Ben Bernanke is a victim of identity theft. This is proof positive that it can happen to anyone.
Ben Bernanke - the Federal Reserve Board chairman - was one of hundreds of victims of an elaborate identity-fraud ring, headed by a convicted scam artist known as "Big Head," that stole more than $2.1 million from unsuspecting consumers and at least 10 financial institutions around the country.
How Did It Happen?
On August 7, 2008, Anna Bernanke - Ben Bernanke's wife - was at a Starbucks when her purse was stolen off the back of her chair.
What Was in Her Purse?
It's not good...
- Driver's License (no problem)
- Four credit cards (not so great - the fewer the better)
- Checkbook (no problem)
- Social Security card (OUCH!!!)
So the thieves had Mrs. Bernanke's SSN, Date of Birth (from the Driver's License), home address, and home phone (from the checks). This is the perfect combination of personal data.
It goes without saying that you should never carry your Social Security card in your purse or wallet. It should be tucked away in a very safe place at home or in a bank lock box. You should also limit the number of credit cards you carry. Just think of how many banks you'd like to call and/or fraudulent transactions you want to deal with and limit your cards accordingly.
Who Were the Thieves?
The thieves were part of a crime ring called "The Cannon to the Wiz." Here is the entry from the Urban Dictionary for "cannon":
Cannon - Old school term for a skilled pickpocket. "
These thieves were after personal information as well as checks and credit cards. They worked in government or medical offices or were simple pickpockets or mail thieves. They attended major sporting events in order to target victims with wallets and purses full of loot. One such victim was Donna Pendergast - an assistant Michigan Attorney General. Her experience went like this:
The robber was so adroit he managed to lift the wallet from her purse without her even knowing it. "They took it right out of my purse while it was on my shoulder," she said. "I didn't feel a thing."
Have They Been Caught?
Yes and no.
Federal agents busted the identity theft ring this summer, but George Lee Reid - the one who fraudulently used the Bernanke's checks to steal $9,000 - had the charges dropped against him, but the Feds are now searching for him again on related charges.
More information on this story from Newsweek.
From a recent UC Berkeley report:
More than half of the internet’s top web sites use a little known capability of Adobe’s Flash plug-in to track users and store information about them, but only four of them mention the so-called Flash Cookies in their privacy policies.
Under the direction of Chris Hoofnagle of the Information Privacy Programs at the Berkeley Center for Law and Technology, the researchers discovered that most web users aren’t familiar with Flash cookies and that Flash web cookies can’t be controlled through the cookie privacy controls in a browser. Even more interesting was the use of Flash cookies to ‘re-spawn’ or bring back to life traditional browser cookies that had been deleted on customer computers. In the study even several federal government web sites were found to contain Flash cookie ID information. The federal government has a policy of banning the use of traditional browser cookies.
What’s all the fuss about? Internet web sites often attach browser ‘cookies’—small strings of identifying text and numbers—to your computer to help them keep track of you and your preferences when you visit their sites. In theory this is a useful connection between you and the web sites you visit. For instance, an online book vendor could store your customer preferences information to better help you find what you want and make it easier to make your purchases.
However, like many useful, good things on the web, browser cookies have turned out to be an avenue for identity thieves to find us and our personal information. A cookie that no one knows about and that is not controllable through our web browsers, and can be used to re-spawn traditional browser cookies—could be a useful avenue for identity thieves indeed.
Changing Flash Preferences
Removing Current Site Cookies
Turns out, Adobe has a Settings Manager on its site where you can control how Flash cookies are stored along with other things. If you right-click on a piece of Flash code in your browser you can select "Settings" and get to this special place. Or you can just click our handy link: Adobe Website Storage Settings Panel.
What you should be seeing is something like this:
Here you can see which cookies have been written to your computer along with the ability to DELETE all of them. That's something I would strongly consider. Remember, however, that there are some benefits with these cookies. If you frequent sites that use this technology (and many do) you will be deleting some of your settings with those sites and you may have to re-enter text each time you visit.
There is risk/reward with every choice you make in life...
Even if you decide to push the Delete all Sites button, you still have some work left.
Stopping New Sites from Writing Cookies
Even if you deleted the cookies that have already been written to your computer, you'll need to keep new cookies from being written as well. Luckily, Adobe has created a way to do that:
Adobe Global Storage Settings Panel
If everything goes according to plan, you should be seeing something that looks like this:
Here you can tell Flash not to store any cookies in the future. Just drag the slider over to "None" and select "Never Ask Again." That's it!
Flash Cookie Removal Tools
Here are some other tools if you want 3rd party help with managing or controlling Flash cookies:
Windows:
- Better Privacy extension for Firefox -
https://addons.mozilla.org/en-US/firefox/addon/6623 - Ccleaner - http://www.ccleaner.com
Mac OS X:
Flash Cookie Storage Locations
You can always go to the directory where the cookies are stored and remove them manually. It's not a permanent solution - new cookies will get created in the future - but it works.
Windows:
LSO files are stored typically with a “.SOL” extension, within each user’s Application Data directory, under Macromedia\FlashPlayer\#SharedObjects.
Mac OS X:
For Web sites, ~/Library/Preferences/Macromedia/FlashPlayer. For AIR Applications, ~/Library/Preferences/[package name (ID)of your app] and ~/Library/Preferences/Macromedia/FlashPlayer/macromedia.com/Support/flashplayer/sys
GNU-Linux:
LSO files are stored in ~/.macromedia.
Wrap Up
Now you know about the mysterious and curiously difficult to remove Flash cookies. They are pervasive - even on government web sites - and won't be going away anytime soon.
Please post any follow-up questions or concerns below...
A recent article by Kevin Poulsen on Wired.com made a sobering observation: software hackers are becoming as sophisticated in their programming as the software they're trying to attack. Where hacking used to be something of a harmless, if annoying prank by bright, restless kids before they went off and got regular jobs, hackers are increasingly well-funded and making use of state-of-the art technology to design the trojans, viruses and spyware that attempt to get into your computer.
Today, the best hackers have the skill and discipline of the best legitimate programmers and security gurus. They're using mind-bending obfuscation techniques to deliver malicious code from hacked websites undetected. They're writing malware for mobile phones and PDAs.
The Case of the Clever Conficker
Poulsen cited the the worst case of computer infection in recent years, the Downadup worm , also known as the Conficker worm (see “Latest Worm Infect 9 Million PCs”). One reason the Conficker worm spread so quickly was that it was the first widely-released program—good or bad—to incorporate M6, a state-of-the-art cryptographic algorithm developed at MIT. When crypto expert Phillip Porras first dug into Conficker's code, M6 was available only from the websites of MIT and the U.S. National Institute of Standards and Technologies—and no one even recognized M6 at first. When it came to implementing M6 the bad guys had beat the good guys to the punch!
Other portions of Conficker were equally impressive: the way it doggedly hunts for anti-virus software on a victim's machine, and disables it; or the peer-to-peer mechanism. "There were points where it was pretty clear that certain major threads inside Conficker C seemed to be written by different people," Porras says. "It left us feeling that we had a more organized team that brought different skills to bear.... They aren't people who have day jobs.
Another reason the Conficker worm wriggled its way into so many computers was the flexibility and responsiveness of its software engineers. Just like legitimate software engineering teams, when the authors of Conficker discovered a security hole in the first release of their program they stayed up nights and patched their code within just a few weeks. Experts are observing new malware coming out as quickly as a couple of days after a new vulnerability is announced.
What You Can Do?
- Be proactive. Now. Believe that you're computers connected to the Internet are at risk and it's up to you to fortify them.
- If your anti-malware software doesn't run automatically get in the habit of running it daily. If you haven't updated your anti-malware software lately, do it today.
- Make sure your operating software is updated regularly. The best method is to let it download and update automatically. Software vendors will update their software as quickly as possible after a serious weakness is discovered.
More Info
Read the article - Future of Cyber Security: Hackers Have Grown Up.
Lately I've received several "smishing" text messages on my phone and I finally captured the audio of a full phone interaction with their voice response system.
Audio of Smishing Call
Here is the audio from a smishing phone call I recorded. Listen closely to see how they use fear to manipulate the victim into providing information.
What is Smishing?
Well, someone somewhere comes up with these cute names for things and "smishing" is no different. It's a play on the term "phishing", and the "Sm" part comes from SMS, which is the technical name for text messages on cell phones (Short Message Service). Did that make sense? If not, here's a description from the fount of all knowledge - Wikipedia:
Similar to phishing, smishing uses cell phone text messages to deliver the "bait" to get you to divulge your personal information. The "hook" (the method used to actually "capture" your information) in the text message may be a web site URL, however it has become more common to see a phone number that connects to automated voice response system.
Scam Tactics 101
As you listened to the call, you should have noticed a few tactics scammers use to get your information:
- Sound Official - The call starts with "You have reached Credit Union's National Association online banking center." That doesn't even make sense, but it sounds good. Scammers will imitate real brands or sometimes use something pretty generic like this, but they're always going to try to look and sound official.
- Create Fear and a Sense of Urgency - It doesn't take long before they start to scare you with "Compromised accounts may ruin your credit, place you in debt with us or other financial institutions." They add "Failure to run this process will result in account suspension or financial penalties." My favorite attempt to scare you is when they threaten you with prosecution if you give inaccurate information - unbelievable.
What Do They Ask For?
In this call, they are trying to capture a credit card number, expiration date, PIN, and card security code. With this information they will attempt to make purchases online with your card, pull money from your account with an ATM, or possibly create a fake card containing your information.
How to Protect Yourself
It should be obvious to most people that these messages are scams. Unfortunately, the scammers just have to get a small percentage of people to fall for these messages to make it worth their time. Just like spam email, if a few people respond it will continue to be financially viable.
What complicates things a bit is some banks are now using text messages as a communication method for alerts or other information. In these alerts they'll often ask you to phone in to confirm a transaction or to alert you to a problem with your account.
If you're concerned at all about the origin of an alert, always call your bank directly using the phone number from a bank statement or official web site. Never call using the number provided in a text message.
Read more about about smishing tactics in this recent Yahoo article.
The Better Business Bureau (BBB) has announced that April 18th is Secure Your ID Day and is offering free document shredding at various locations across the U.S.
You can bring up to three boxes/bags of paper documents and they will shred them on the spot. Even if you have your own shredder I imagine they'll have a bigger one that will be much faster, so it's worth checking out.
What Should You Shred?
If you're wondering what to bring, check out our shredding page and get a few tips. The short answer is you should shred any documents that has a signature, account number, social security number, or medical or legal information (plus credit offers).
Enjoy!
When Barack Obama famously refused to relinquish his treasured BlackBerry, he became the first president in American history to use email while in office. He will also be the first to have to worry about personal internet security.
The president's new BlackBerry is a special modified variation with top-notch encryption features—further details are not being shared with the media. Vice President Joe Biden and other key officials have also been given this most limited of limited edition devices.
But is it Really Hacker-Proof?
But famed hacker Kevin Mitnick says that despite its special security features, no BlackBerry is impossible to compromise. In an interview with Fox News, Mitnick said "It's a long shot, but it's possible. You'd probably need to be pretty sophisticated, but there's people out there who are."
According to Mitnick, who is credited with hacking Motorola, Nokia, Sun Microsystems, FBI, and Pentagon networks (among many others,) the best course of action for a hacker would probably be to infiltrate the personal computer of somebody close to Obama. Then, the hacker would have to use that person's identity to divert Obama to a compromised website that would upload malicious code onto the BlackBerry.
The Most Exclusive List in Washington
That's precisely why the president's security team is keeping his email address such a closely guarded secret. Obama will also have to frequently change his email address.
Who exactly has this address is unknown, but the number is believed to be considerably less than 50, with Biden, advisers David Axelrod and Valerie Jarrett, press secretary Robert Gibbs, and chief of staff Rahm Emanuel almost certainly at the top of the list. Beyond that, one can only guess: top supporter Oprah Winfrey, secretary of state Hillary Clinton, celebrity email buddy Scarlet Johanson, DNC chair Tim Kaine? One can only speculate.
If any of our readers are on the list, please let us know so we can send him our suggestions on the economy...
Remember when the McCain campaign had that garage sale a few months back and sold two BlackBerries with hundreds of GOP contacts still saved on them? It may have seemed like a silly blunder to those who heard about it at the time, but it turns out that most of us are just as careless with our mobile phones and handheld devices as the McCain staffers were with theirs.
99% of Cell Phone Recyclers Neglect to Erase Data
According to a study by Regenersis, one of the leading electronics recycling firms in the world, 99 percent of recycled cellular phones are handed over with their owners personal information and contact lists completely intact. The company did a random sampling of 2000 devices in the month of December, and found that only a handful of consumers had bothered to delete information like emails, banking data, or addresses.
How to Remove Data Before Handing Over An Old Cell Phone
Very few recyclers offer the service of wiping devices before they pass them along, but even if they did, you'd still be handing over an extensive catalog of personal information to a perfect stranger and trusting them to do the right thing.
To take matters into your own hands:
- Remove the SIM card from your phone. It's a little plastic memory card usually located behind the back cover underneath the battery.
- Call your service provider and ask them to disconnect the phone from your account.
That's it! That wasn't hard, was it?
Unfortunately, if you own an iPhone or BlackBerry, it can be a little more complicated but these videos should help:
Erasing a BlackBerry
Erasing an iPhone
An Important Disclaimer
If you've got national security secrets on your phone or maybe mission briefings and data from U.S. soldiers in Iraq and Afghanistan, it's important to remember that there's no way to completely erase a handheld device. Sophisticated forensic recovery methods are capable of reversing pretty much any data-destroying trick that doesn't involve a hammer or a blowtorch, so for highly sensitive data, you should probably contact a specialist. For the rest of us though, the above methods should do the trick.
To read more about phone recycling, head on over to Earth911 blog.
It May Be "Salami Slicing." It May Be Petty Theft.
The latest identity theft scheme doesn't aim to empty your debit account or charge you to the credit limit—not yet anyway. According to The Boston Globe, at least 800 credit and debit cardholders have reported finding tiny fraudulent charges on their statements in recent weeks.
The charges range from 21 to 48 cents, and are billed under at two phony business names: "Adele Services" and "GFDL."
The mysterious charges have lead to a range of speculation over the nature of the scam. Some think that the small charges are meant to test the validity of a registry of stolen credit card numbers which may have been resold by the original thieves. If the theory is correct, those whose cards have already been charged can probably expect to be targeted for much larger amounts down the line.
A Slice of Salami
A less likely theory parallels the scam attempted by the main characters in the movie "Office Space," which featured three disgruntled computer programmers who attempt to slowly embezzle money from their company, pennies at a time. The scheme is sometimes referred to as "salami slicing", but usually targets businesses or customers rather than an unconnected group of individuals.
If this theory holds, those who fail to notice that their accounts have been compromised will continue to be targeted for small amounts of money indefinitely. Most likely, the thieves would have to create new false companies with each wave of thefts.
Plan of Action
Regardless of the intent of the perpetrators, the course of action for those who notice small, unexpected charges on their debit and credit card statements is the same:
- Report the charges to your bank or other financial institution.
- Report your card stolen so that you can be issued a new credit card and credit card number.
As always, it's important for everyone to pick carefully through their statements each month (if not more frequently,) looking for charges they don't recognize. Whether a questionable charge is 1 cent, $1, or $100, it should always be treated as a potentially serious problem.
Special Offers
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion.
Subscribe to Breaking News
Subscribe to Fight Identity Theft and receive top stories and breaking news via email.
Recent Blog Entries
Blog Archives
- November, 2009 (4)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (36)
- Government (20)
- Identity Theft (37)
- Junk Mail (5)
- Phishing (12)
- Privacy (19)
- Scam (30)
- Technology (50)
- Telemarketing (2)
- Viruses (11)
- Visitor Stories (1)
- Worms (11)
