Subscribe in a readerCredit Card Black Market
Where do stolen credit card numbers go?
One place is a web site called SellCVV2. Recently credit card details were discovered being sold on this site. Prices range from US$38 for a small set of credit card details. This is a fairly professional service offering guarantees and volume discounts on the stolen information.
It now seems that the site’s illegal contents have been cleared out since this information was made public. This doesn’t mean that the black market for stolen credit card numbers has disappeared, it’s only moved to another place.
This is how the site appears now.
Malware Statistics
Symantec, a large security company, have reported that there are now more malware writers than legitimate software writers.
They state that 65% of the 54,609 Windows applications released to the public in the past 6 months were malicious.
Another interesting statistic from this report is the percentage of browser plug-in vulnerabilities:
- 79% ActiveX
- 8% QuickTime
- 5% Java
- 5% Flash
- 2% Windows MediaPlayer
What this means is that by disabling ActiveX from your web browser (Internet Explorer) you can avoid 79% of web browser plug-in attacks. Here’s an article on how to disable ActiveX.
As for the other types of plug-ins, keep them patched and up to date to reduce the risk of infecting your computer.
Here is Symantec’s internet security report.
HP Flash Drives Ship With Malware
Hp flash drives were found to contain malware. These devices were sent as promotional items with new Proliant Servers.
Both 256MB and 1GB USB drives were infected with worms (W32.Fakerecy and W32.SillyFDC), and the worm can copy itself to all other mapped drives on your network.
This is particularly bad because IT technicians generally install these servers and generally have access to quite a few network drives.
HP’s software security response team admitted to the fault and has issued the following list of servers that shipped with the infected USB drive:
ProLiant BL20pG4; ProLiant BL25pG2
ProLiant BL45pG2
ProLiant BL260c
ProLiant BL460c; ProLiant BL465c; ProLiant BL465cG5; ProLiant BL480c
ProLiant BL680cG5; ProLiant BL685c; ProLiant BL685cG5
ProLiant DL120G5; ProLiant DL140G3; ProLiant DL145G3; ProLiant DL160G5;
ProLiant DL165G5; ProLiant DL180; ProLiant DL180G5; ProLiant DL185G5
ProLiant DL320G5; ProLiant DL320G5p; ProLiant DL320s; ProLiant DL360G5;
ProLiant DL365; ProLiant DL365G5; ProLiant DL380G5; ProLiant DL385G2;
ProLiant DL385G5
ProLiant DL580G4; ProLiant DL580G5; ProLiant DL585G2; ProLiant DL585G5
ProLiant ML110G4; ProLiant ML110G5; ProLiant ML115; ProLiant ML115G5;
ProLiant ML150G3; ProLiant Ml150G5
ProLiant ML310G4; ProLiant ML310G5; ProLiant ML350G5; ProLiant ML370G5
ProLiant ML570G4
IP Console Switch with virtual media
Server Console switch
Server Console Switch with virtual media
TFT7600 (USB Pass-through)
1U Rackmount Keyboard with USB
This kind of threat isn’t limited to HP customers. Any device you plug into a USB port can potentially carry malware. Therefore you should always have a good antivirus program running on your computers.
A while back we reported on similar incidents: Digital Picture Frames with malware, MP3 players sold with malware
Vishing
Vishing is short for voice phishing. This involves tricking someone into calling a phone number, listening to a recorded message, then being tricked into providing personal information to the phone service.
Why would someone want to set this up? To collect your personal information, such as credit card number, its expiry date, your date of birth, PIN codes, etc. That information is then either sold on the black market or used by the scammers to steal or spend your money (this is also called identity theft).
Setting up an automated phone system like the ones described here is fairly easy these days, and fairly cheap.
Do people fall for it? Oddly enough, yes. Hopefully by now everyone’s getting the message not to trust strange web sites on the internet. But less obvious methods such as automated phone services are easily forgotten.
Anti virus software can’t stop you making a phone call. And people can be more trusting of “old fashioned” technology such as phones.
How does it work in practice? Here’s a summary of a recent vishing attempt.
- Emails are sent in bulk to as many people as possible.
- The emails have forged headers to appear to come from service@irs.gov
- The email contains an important looking message. Note that it doesn’t have any links to click on, instead it gives a phone number.
- Internal Revenue Service Tax Refund
After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $215.
Tax Refund Number: <number here> - Will Expire on <date here>
Attention!
Tax refunds can be sent only to VISA or Mastercard DEBIT CARDS.
To receive your tax refund please call the IRS Tax Refund Department at: 602-427-59x
Internal Revenue Service
Tips to avoid this scam:
- A good anti virus package will detect fraudulent emails such as the one above and filter them out, so invest in one if you haven’t already.
- In a company (small or large) invest in mail filtering. This is usually not included in corporate anti virus software.
- Think carefully why you received this email. Did you really lodge a tax submit a tax return recently, and in the country the email says it’s from? (e.g., if you live in USA and receive an email offering a tax refund from Australia, it’s most probably a scam).
- Does your country’s tax department even have your email address? If you didn’t give it to them then why are you receiving this email?
- Don’t blindly dial the number shown in the email. Look them up in your local phone book.
This isn’t limited to tax refunds. Other vishing variations may appear to be from banks or other financial institutions.
Another variation of this scam is to send people an SMS instead of an email, with a shorter version of the message above. Treat SMS’s like you would treat emails. Note: it’s also easy to forge SMS’s to appear to come from other people.
Automated voice systems can also initiate phone calls with fake caller IDs. The technology’s easily available. VoIP systems are even easier to set up.
The potential to trick people into handing over personal details is just as easy using phones as it is using emails and web pages.
WordPress 2.5
Last night I upgraded this website to WordPress 2.5. Why? Because it’s important to always use the latest version of software.
The previous version (2.3.3) was doing well, it did everything I needed. But as with any piece of software vulnerabilities are eventually found and exploited. The good people at WordPress release new versions not only to add new features that I may or may not need, they fix vulnerabilities.
Recently a vulnerability was found in WordPress 2.3.3 (the previous version of WordPress). At last count there were 21,800 websites in the world using that version and are vulnerable to hacking. And on the 19th of March 2008 a vulnerability was found in WordPress 2.1.3.
The solution as always is to upgrade to the latest version as soon as it becomes available (you still need to test the upgrade and backup your files before doing any upgrade).
So version 2.5 is more secure. The new features it provides are nice but security should be the first priority. Imagine if this website were hacked and visitors’ PCs became infected just by browsing this site!
Notes:
- WordPress is the software that powers this website. I highly recommend it to anyone wanting to start a new website.
- I’ve been updating the sidebar on the right, apologies if it doesn’t look right.
Only In Malaysia Mah
There’s a website published by someone called Jason Tan, in Malaysia. On his website Jason claims to be earning incredible amounts of money with almost no work. After a lengthy sales spiel there’s an offer to buy his e-book for RM90 so that you too can make this much money.
So, is this real and is it worth spending the RM90 he asks for? Yes and no.
Based on comments and blogs from other websites on the internet it seems Jason earns his money from selling this e-book. It’s highly unlikely the house and Mercedes on his web site are actually his.
So what’s in the book? Some people have bought it and written their thoughts on it. Jason’s e-book basically tells readers that they should write an e-book and sell it online to make money just like he does. That’s it, that’s his big secret. This method doesn’t scale very well,
The other idea that Jason sells to people is an affiliate system. Anyone who wants to make a small amount of money with very little effort is encouraged to help Jason sell his e-book and earn commission. Unfortunately people have been spamming web sites and mailing lists in order to get their commission. Again this money making scheme that doesn’t scale very well.
Jason Tan’s website is http://www.onlyinmalaysiamah.com/
Another site that looks almost identical to his is Ewan Chia’s money making scheme. Once you start to see a pattern of these websites appearing it’s obvious that it’s a bit of a scam. Ewan’s site is here, http://autopilotprofits.com/
And James Ng created a site that’s also almost identical to the above two, http://www.besuccessonline.com/
Are you starting to see the pattern?
Save yourself the RM90 (or any other amount these people charge). Instead spend it on some business books at your local bookstore. You’ll get much better value.
Reference: This page has a long discussion thread about Jason Tan’s scheme with a detailed description of what his e-book contains.
Protect Your Tax File Number
In Australia your Tax File Number (TFN) is used by the Australian Tax Office to identify you. It could be used against you by other people to commit identity theft and fraud so you should take measures to ensure its security. Below are some tips to help you with this:
- Don’t give it out to just anyone else who asks - it’s confidential. See the list below.
- There have been bogus job ads on the internet and in newspapers that ask people to provide quite detailed personal information including tax file numbers. Don’t provide any of this information until you’ve met the potential employer at their office and confirmed their validity.
- Don’t carry your Tax File Number in your wallet or mobile phone
- Securely destroy any mail you receive from the Tax Office showing this number
- Only use tax agents that are registered on the Tax Agents Board, http://www.tabd.gov.au/
The following are allowed to request your Tax File Number:
- the Tax Office
- employers
- banks & other financial institutions
- tax agents
- Centrelink
- superannuation funds
-
-
Ads
-
-
Stats