Monthly Archives: October 2007

Harmful Websites

Posted by on 28 October, 2007 No comments

It seems Possibility Media’s websites have been hacked. There are a few interesting things to learn here. First have a look at the following screenshot:

Possibility Media
At the time of writing (28 Oct 2007) if you go to Google’s website and search for the term “possibility media” you’ll get the results shown above. Google found the correct website and if you look closely there’s a warning that “This site may harm your computer“. If you don’t notice this small writing and just click on the link Google will display a large warning spelling out the risks. This is a very nice security feature provided by Google. They use a 3rd party tool to analyse websites for malware and make it difficult for you to load a website that contains harmful code.

The other thing to note is that Possibility Media’s websites have been hacked and contain harmful code. It’s still unclear what damage this can do to your computer (it’s currently being investigated by antivirus companies). Some of their other websites that have also been hacked are:

  • webweekmag.com – Web Week Magazine
  • itweekmagazine.com – IT Week Magazine
  • technologyweekmag.com – Technology Week Magazine
  • theinternetstandardmag.com – The Internet Standard
  • securitystandardmag.com – Security Standard

Hopefully by the time you read this it would have been cleared up. The purpose of mentioning these websites is to point out that common websites that have completely legitimate businesses behind them are still vulnerable to malicious tampering and that it can affect pretty much everybody.

There are a couple of things you can do about this:

  • Use a good antivirus program on your computer. To be effective against this type of attack it needs to do something called “web filtering”.
  • Keep your antivirus software updated. This usually requires a paid (yearly) subscription.
  • Use an alternative web browser. I haven’t written about this yet but consider using either FireFox or Opera.

Lottery Scams

Posted by on 28 October, 2007 No comments

A reader of FraudO.com, LotteryChristoph, has reminded us of a particular type of scam called Lottery Scams, also called a Dutch Lottery or a 419 Scam or a lottery of various other European countries. These scams begin with a letter or email telling the victim they have won a lottery.

The email instructs the victim to contact a “claims agent” to collect their prize money. The agent then sends the victim a claim form to verify their identity. The fake agent is building rapport and making it appear that there’s a real agency behind the emails. The form is in fact used to collect personal information about the victim, such as their passport number and driver’s license number. This is where the identity theft begins.

If the victim asks for some proof of the agency’s legitimacy they often fax back a legal looking document (which of course doesn’t prove anything, it just makes the victim feel more comfortable). This web page has examples of the fax and other documents the scammers send.

The victim is then given some options on how to collect the alleged winnings. In each case the scammer is setting up the victim:

  • The winnings can be deposited directly to the victim’s bank account. This seems to be the more popular option. The scammer will request a large fee to make this happen (such as special taxes, insurance or legal fees). The scammer will end up keeping this money.
  • The victim has the option to open a new overseas bank account to receive the alleged winnings. The bank is fake, but the victim is told that the bank requires a large deposit to open the account.
  • The winnings can be picked up in person, often in The Netherlands. The victim will later be told that they have to pay a fee in cash to release the winnings. The victim is then given counterfeit prize money.

What to do:

  1. Don’t reply to the emails (or letters or phone calls). Don’t give the scammer any indication that you exist.
  2. Don’t send any money or provide any personal details.
  3. Report the scam to your local authorities.

It seems many people are victims of this particular kind of fraud. In most cases the scammers are never caught, and even if they are the money is usually never recovered. Please be aware of how common this scam is and help your colleagues, friends and family to be aware of it.

The scam works because people want to believe it’s real, even if they didn’t enter a lottery in a foreign country. It’s up to everyone to talk openly about it and increase awareness of it.

Adobe Reader Vulnerability

Posted by on 25 October, 2007 No comments

If you use Windows XP and have Adobe Reader version 7 – 8.1 you need to patch it. Use Adobe’s built in patching system to update it.

The vulnerability was discovered last month and there are already exploits that can allow attackers to take over your computer. Interestingly one of the known vulnerabilities was created by a Russian online crime syndicate called RBN (Russian Business Network). They’re responsible for a large amount of online crime.

A bulletin from Adobe is here, for reference.

A Summary On Nigerian Scams

Posted by on 24 October, 2007 6 comments

Nigerian scams are so called because the majority of them originate from Nigeria, and they use the same tactic. Below is a brief summary on what it is, why it works, and how large the problem is.

A victim received an email (or sometimes an old fashioned letter) from someone posing as a lawyer. The text contains a story about a large amount of money locked up in a bank account, which gets the reader’s attention, and asks for help in retrieving it. In exchange the pretend lawyer promises a large reward.

The email can contain a statement such as “…In the discharge of my duty, I stumbled on this domiciliary account that has remained dormant for three years now with eight million, five hundred thousand United States dollars ($8.5M) in it…. That my purpose of contacting you is because the deceased has the same name with you…”

What happens next is an exchange of correspondence, with the scammer and victim writing to each other. The story usually becomes emotional and touching, keeping the victim’s attention. Then the victim is asked to hand over some money to help with legal fees. The scammer often sends the victim a cheque as a token of good faith that the money is there. Unfortunately the cheque is fake and the victim’s bank won’t accept it. This is often where the victim realises what’s happened.

This scam has apparently been in use for many years, even before emails became prevalent. It continues to work because the victims are tempted by a large amount of money.

How widespread is the problem? In this British articledated 4 Oct 2007 it states that 4500 fake documents were seized and that US$16.2m of fake cheques were seized. It also states that it costs the UK GBP4.5b every year, though this probably includes law enforcement costs. The problem isn’t limited to the UK either, it’s global.

What can you do? Be aware that this is a common scam and talk about it with anyone unfamiliar with the dangers present on the internet, especially older people. It would also be useful to report such emails (and letters) to your local authorities. A lot of people get arrested for taking part in these scams and any evidence you might have could be useful.

I’ve read articles describing victims that have gone to Nigeria to hunt down the scammer and reclaim their money, and they story ends tragically with murder or kidnapping. If I find these articles again I’ll post them here.

Technical Definitions

Posted by on 23 October, 2007 No comments

This article summarises some terms used to classify all the different threats out there on the internet.

Terms that end with ware:

  • Malware – a general term that sums up all of the terms below. 
  • Spyware – programs that secretly spy on your computer recording such things as your passwords and sometimes even what’s on your screen.
  • Crimeware – a general term for programs that install themselves on your computer for the purpose of committing a crime (such as stealing your money from your bank account). These are usually controlled by hackers.
  • Adware – programs that cause your computer to display a large number of ads. They have the side effect of slowing down your computer.
  • Trackware – these programs monitor what websites you visit and send statistical data back to a 3rd party (often a marketing company). This is often considered an invasion of privacy.
  • Grayware – a general term for malware that is used for marketing (as opposed to committing crimes).

Other terms:

  • Spam – unsolicited email.
  • Browser Hijacker – a program that changes the settings of your web browser, such as your home page or the error page.
  • Freeloaders – any program that installs itself by fraudulent means.
  • Browser Helper - often seen as a toolbar for web browsers, such as the Google Toolbar or Yahoo Toolbar. Some of the less well known browser helpers monitor and manipulate your browser.
  • Keylogger – a type of spyware that records keystrokes on your keyboard. This will capture your username and password when you log into services.
  • Dialer – a program that makes phone calls using your dialup modem without your permission. Often to expensive premium phone services.
  • Zombie – a computer that has a hidden program allowing a hacker to take it over at any time.
  • Botnet – a large collection of zombie computers. Hackers sometimes need to control lots of computers at once to cause some of the trouble they cause.
  • Vulnerability – Almost all programs have vulnerabilities. Sometimes it takes days and other times it can take years for someone to find a vulnerability. They can then be exploited, e.g. to take control of computers.
  • Zero Day Exploit – when a vulnerability is discovered in any program, if hackers can exploit it on the same day it’s been discovered it’s called a zero day exploit. This means software and antivirus companies have less than 1 day to discover the exploit and update their software to combat it – often a difficult thing to achieve.
  • Phishing – the practice of tricking users into going to a login page that looks legitimate but sends login details to the hackers.
  • Cookies – these aren’t bad, they’re used so web pages can remember you. Some people consider this an invasion of their privacy.

This is only a small set of technical terms used to describe online security threats, most of the others are advanced and relevant to professional IT workers. The descriptions have also been simplified because this is an introduction to security.

Stock fraud using MP3 files

Posted by on 22 October, 2007 No comments

This is a fairly new tactic used by spammers. If you frequently download MP3 files (hopefully only those you have permission to download) sooner or later you might unknowingly download a file that doesn’t contain music but instead has a recorded message.

The message is computer generated, so it doesn’t sound human at all. And it tells you to invest in particular shares, called “penny stocks”. Obviously you’d be crazy to take financial advice from an audio spam you accidentally downloaded (in other words, delete the file and don’t buy their shares).

There isn’t much you can do at this stage to avoid it, other than taking care to download audio MP3 files from reputable (and legal) sources. I expect antivirus or antispam filters to quickly start checking audio files as well as the usual emails.

For now it’s being called “MP3 spam” by the media, we’ll see how this one evolves.

Unsolicited phone calls

Posted by on 20 October, 2007 1 comment

Phone handsetThis one isn’t about security online but rather over the phone. The same concept could be applied to the online world. In fact, it’s not about a scam but about how some organisations carry out legitimate work without realising how it affects the security of their customers.

From time to time some organisations contact their customers to confirm their details and just to ask if they’re happy with the service. The phone call is often from a call centre (whether internal or outsourced), and the originating phone number is often not provided.

The operator introduces themself, asks if they’re speaking to the correct customer, etc. Then the operator, following their script, goes and asks the customer to verify they’re the real account holder (or other relationship to the organisation).

The operator asks something along the lines of “to confirm you are <yourname>, can you tell me your street address?”, or asks for some other private information such as your password, date of birth, etc.

In most cases there is nothing fraudulent happening here, and I suppose most people would carry on the conversation by providing the correct information. There may even be an incentive such as a prize for completing the phone call. But what just happened here?

The customer received an unsolicited phone call from a private number asking for their personal details.

While this situation (which happens often) may be legitimate, the organisations are asking their customers to throw caution to the wind and to compromise the security of their accounts.

There are two major points to raise here:

  1. People should never divulge private data (passwords, dates of birth) to someone they can’t be 100% sure is a legitimate representative of the organisation.
  2. Companies should never ask their customers to do so.

I have received such phone calls from large service providers and even from the local tax office (government department). When I refused to provide my details the person on the phone was at first surprised, then eventually said they can’t help me any further without following their script.

Now I have no way of knowing whether these phone calls were really from who they said they represented, but I believe they were because in both cases I had recently made significant changes to my account. But I refused to provide this information in this scenario, and anyone who values their privacy (and their money) should also refuse.

What if there’s a good reason to continue with the call? Here are a few suggestions,

  • Ask for the caller’s name and the department they’re calling from. Then find their phone number from a directory service and call them back. Don’t ask them directly for their phone number, this doesn’t prove very much. You need to go to a trusted 3rd party for their phone number (such as a phone book, directory assistance, the company’s web site).
  • Ask them to provide the information in writing.
  • Ask them questions that you consider private and that they should have available in their computer system. Questions along the lines of when and where did you open the account, how much was your last bill, your password. (In my examples above the operator wasn’t allowed to tell me because of their security policy, after which I politely ended the call).
  • And most of all let them know that you have no way of distinguishing them from a scammer and that their phone call sounds suspicious.

It’s up to everyone to be vigilant about security, both you and the service providers.

Skype Defender

Posted by on 19 October, 2007 No comments

There’s a new trojan going around that is disguised as a Skype plugin called Skype Defender. If you install it, it will take your username and password and send it to a hacker.

It seems it only affects Windows users, and you recognise it by looking at the login button on Skype (the real one has a red bordeR). This document from Skype shows exactly what it looks like. It gets installed by a program called 65404-SkypeDefenderSetup.exe.

Skype Defender Trojan

Article On Securing Macs

Posted by on 18 October, 2007 No comments

This article explains some things you can do to make a Mac more secure. Most of these ideas would also apply to Windows (XP and Vista), and Linux (in a more general sense).