July 2009 not only brought the hopes of fun summer activities, but it also brought the new vicious Trojan virus called Clampi. Clampi is a newly sophisticated virus designed to attack online banking systems. And unlike most Trojan viruses this virus can be picked up from trusted sites like blogs, online magazines, search engines and mainstream news websites, not just gambling and pornography sites. It also is only designed to attack computers running the Microsoft Windows operating system. So Mac users are safe from Clampi, for now.

Currently, Clampi is tracking over 4,500 financial websites. Most Trojan viruses usually track 30-40 sites at a time. Clampi is designed to watch: banks, credit card companies, e-mails, retail sites, utilities, online casinos, wire transfer services, share brokerages, government sites and mortgage lenders. Clampi is also not just limited to the United States. It has been found attacking in the United States, Britain and other English speaking countries.

How Clampi Operates

Once Clampi has been picked up it settles into your computer and waits.  What does it wait for? It waits for the user to log on to a bank account, credit card or some other financial website. Once the login information is entered, Clampi grabs it and shoots it to the cyber criminal's computer. From there the criminal uses the information to fulfill their desires. Whether it is taking money from a bank account, using a credit card to make purchases or reek whatever havoc they may. 

What Clampi Can Do

Maybe you're thinking that this can't happen to you and maybe it won't. But it has been reported that through the use of Clampi criminals have stolen $75k from a car parts company in Georgia, $30k from a non-profit childcare organization [56] in Seattle, $480k from an online city bank account [57], $150k from a public school district in Oklahoma, $350k from a Chicago-are school district [58] and $700k from the Western Beaver School District [59] in Pennsylvania. There have also been reports of companies losing anywhere from $10k to $500k because of this one virus. There is really no telling how many people have been victims of the Clampi virus.

What You Can Do

The most important thing you can do is to be proactive about protecting yourself from getting Clampi. Here are some ways to be proactive:

• Protect your computer with security software. It should be a natural part of being online. Make sure that you have the most current version of your anitvirus software and download any necessary patches to keep it current.
• Avoid clicking on suspicious links on blogs, e-mails and social networking sites. If you are not sure that it can be trusted, then don't go there.
• Don't use e-commerce sites that you are not familiar with and use a credit card instead of a debit card when making online purchases.
• Use caution when using a wi-fi network - especially one outside your home, like at an airport [60] or coffe shop. Don't access financial web sites when using wifi in these kinds of locations. Make sure that your connection is password protected so that others cannot hack into your connection. Use WPA2 [61] (or stronger) encryption and strong passwords when setting up your wireless network at home.

From a recent UC Berkeley report:

More than half of the internet’s top web sites use a little known capability of Adobe’s Flash plug-in to track users and store information about them, but only four of them mention the so-called Flash Cookies in their privacy policies.

Under the direction of Chris Hoofnagle of the Information Privacy Programs at the Berkeley Center for Law and Technology, the researchers discovered that most web users aren’t familiar with Flash cookies and that Flash web cookies can’t be controlled through the cookie privacy controls in a browser. Even more interesting was the use of Flash cookies to ‘re-spawn’ or bring back to life traditional browser cookies that had been deleted on customer computers. In the study even several federal government web sites were found to contain Flash cookie ID information. The federal government has a policy of banning the use of traditional browser cookies.

What’s all the fuss about? Internet web sites often attach browser ‘cookies’—small strings of identifying text and numbers—to your computer to help them keep track of you and your preferences when you visit their sites. In theory this is a useful connection between you and the web sites you visit. For instance, an online book vendor could store your customer preferences information to better help you find what you want and make it easier to make your purchases.

However, like many useful, good things on the web, browser cookies have turned out to be an avenue for identity thieves to find us and our personal information. A cookie that no one knows about and that is not controllable through our web browsers, and can be used to re-spawn traditional browser cookies—could be a useful avenue for identity thieves indeed.

Changing Flash Preferences

Removing Current Site Cookies

Turns out, Adobe has a Settings Manager on its site where you can control how Flash cookies are stored along with other things. If you right-click on a piece of Flash code in your browser you can select "Settings" and get to this special place. Or you can just click our handy link: Adobe Website Storage Settings Panel [68].

What you should be seeing is something like this:

Here you can see which cookies have been written to your computer along with the ability to DELETE all of them. That's something I would strongly consider. Remember, however, that there are some benefits with these cookies. If you frequent sites that use this technology (and many do) you will be deleting some of your settings with those sites and you may have to re-enter text each time you visit.

There is risk/reward with every choice you make in life...

Even if you decide to push the Delete all Sites button, you still have some work left.

Stopping New Sites from Writing Cookies

Even if you deleted the cookies that have already been written to your computer, you'll need to keep new cookies from being written as well. Luckily, Adobe has created a way to do that:

Adobe Global Storage Settings Panel [69]

If everything goes according to plan, you should be seeing something that looks like this:

Here you can tell Flash not to store any cookies in the future. Just drag the slider over to "None" and select "Never Ask Again." That's it!

Flash Cookie Removal Tools

Here are some other tools if you want 3rd party help with managing or controlling Flash cookies:

Windows:

• Better Privacy extension for Firefox -
  https://addons.mozilla.org/en-US/firefox/addon/6623 [70]
• Ccleaner - http://www.ccleaner.com [71]

Mac OS X:

• FlushApp - http://machacks.tv/2009/01/27/flushapp-flash-cookie-removal-tool-for-os-x/ [72]

Flash Cookie Storage Locations

You can always go to the directory where the cookies are stored and remove them manually. It's not a permanent solution - new cookies will get created in the future - but it works.

Windows:

LSO files are stored typically with a “.SOL” extension, within each user’s Application Data directory, under Macromedia\FlashPlayer\#SharedObjects.

Mac OS X:

For Web sites, ~/Library/Preferences/Macromedia/FlashPlayer. For AIR Applications, ~/Library/Preferences/[package name (ID)of your app] and ~/Library/Preferences/Macromedia/FlashPlayer/macromedia.com/Support/flashplayer/sys

GNU-Linux:

LSO files are stored in ~/.macromedia.

Wrap Up

Now you know about the mysterious and curiously difficult to remove Flash cookies. They are pervasive - even on government web sites [73] - and won't be going away anytime soon.

Please post any follow-up questions or concerns below...

When Barack Obama famously refused to relinquish his treasured BlackBerry, he became the first president in American history to use email while in office. He will also be the first to have to worry about personal internet security.

The president's new BlackBerry is a special modified variation with top-notch encryption features—further details are not being shared with the media. Vice President Joe Biden and other key officials have also been given this most limited of limited edition devices.

But is it Really Hacker-Proof?

But famed hacker Kevin Mitnick says that despite its special security features, no BlackBerry is impossible to compromise. In an interview with Fox News, Mitnick said "It's a long shot, but it's possible. You'd probably need to be pretty sophisticated, but there's people out there who are."

According to Mitnick, who is credited with hacking Motorola, Nokia, Sun Microsystems, FBI, and Pentagon networks (among many others,) the best course of action for a hacker would probably be to infiltrate the personal computer of somebody close to Obama. Then, the hacker would have to use that person's identity to divert Obama to a compromised website that would upload malicious code onto the BlackBerry.

The Most Exclusive List in Washington

That's precisely why the president's security team is keeping his email address such a closely guarded secret [80]. Obama will also have to frequently change his email address.

Who exactly has this address is unknown, but the number is believed to be considerably less than 50, with Biden, advisers David Axelrod and Valerie Jarrett, press secretary Robert Gibbs, and chief of staff Rahm Emanuel almost certainly at the top of the list. Beyond that, one can only guess: top supporter Oprah Winfrey, secretary of state Hillary Clinton, celebrity email buddy Scarlet Johanson, DNC chair Tim Kaine? One can only speculate.

If any of our readers are on the list, please let us know so we can send him our suggestions on the economy...

Medical identity theft is a growing problem. Experts estimate that between 200,000 - 500,000 people are already a victim of this crime - and most don't even know it.

The World Privacy Forum [89] has been a pioneer in identifying and researching medical identity theft issues. Here's how they describe the problem:

Medical identity theft occurs when someone uses a person's name and sometimes other parts of their identity -- such as insurance information -- without the person's knowledge or consent to obtain medical services or goods, or uses the person’s identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim’s name.

Medical Identity Theft Basics

So how does medical identity theft occur and how can it affect you? Here's a video from CBS' The Early Show that explains the basics:

How Can You Protect Yourself?

The World Privacy Forum has great information on detecting and preventing medical identity theft. Here are the things to watch:

• Closely monitor any "Explanation of Benefits" sent by an public or private health insurer

  Health insurance companies often send out notices in the mail that describe recent medical events. Pay attention to these and contact your health care provider if they don't look familiar.

• Pro-actively request a listing of benefits from your health insurers
• Request a copy of current medical files from each health care provider

  Look over these files to make sure that all the information is familiar. Report any errors or strange information to your health care provider.

• Correct erroneous and false information in your file
• Keep an eye on your credit report [90]

  Medical expenses should eventually show up on your credit report - especially unpaid accounts that were created by an identity thief.

• Request an accounting of disclosures

  This is a benefit of HIPAA (the Health Insurance Portability and Accountability Act). This relates to all of the documents you now sign when going to your doctor relating to privacy and information sharing. You can request a list of all the times your medical information has been shared along with the reason for sharing.

More information from World Privacy Forum [91].