Archive for March 16th, 2007

Another Big Phish

Posted in All Posts, Email Security, Scams on March 16th, 2007

Here is an example of another phishing email. This one is probably trying to get your Amazon user name and password. (If you have one.)

Warning: Whatever you do, do not ever clink on any link in any email warning of any dire consequences with any account. Period.

If you have any concerns, check your account by manually entering the correct address in your browser and check your account. OR, simply pick up the phone and give them a call.

Click on the following thumbnail to view a screen capture of this phish. (Then use the back button to return to this page)

Amazon phish

This phish contains many errors including unusual grammar, that should be big red flags. Check the bottom of the email and note the spelling errors:

Amazon sent this e-mail to you because your Notification Preferences indicate that you want to receive information about Special Events & Promotions. Amazon will request personal data (password, credit card/bank numbers) only on our home site, wich is securely incrypted with SLL.

Also, view the source code of this HTML email and you will find that the link to “amazon.com” has been spoofed. It definitely does not go to Amazon, it goes to an anonymous IP address. (You may also be able to view the actual link in the lower status bar of you email program while “hovering” the mouse pointer over the link.)

If you get a similar email and wish to report to Amazon, go to amazon.com and look under Help > Privacy and Security > Identifying Phishing E-Mails and follow the directions.

Somebody You Know is a Bot

Posted in All Posts, Anti-Malware Tools, Online Security, Privacy, Safe e-Commerce, Security Tools, Wired Network Security, Wireless Network Security on March 16th, 2007

Chances are, you know somebody who’s computer is a bot, and chances are they don’t know it.

Definition – A botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet. Any such computer is referred to as a zombie – in effect, a computer “robot” or “bot” that serves the wishes of some master spam or virus originator. Most computers compromised in this way are home-based.

According to a report from Kapersky Labs, botnets — not spam, viruses, or worms — currently pose the biggest threat to the Internet. A report from Symantec came to a similar conclusion.
Source

Yes, bot, as in robot, as in remote controlled zombie attack machine .

Why? Estimates are that as many as one quarter of all computers connected to the Internet are infected with Trojan Horse software that turns them into zombies under the command of the botnet creator. Source

Botnets are considered by many to be the biggest threat to the Internet.

So, how does one prevent a computer from becoming part of a botnet?

1) A good, two way, firewall.

2) Install all operating system security updates and service packs as soon as they are available.

3) Keep all vulnerable programs* up to date, such as Microsoft Office, Java, Flash, Reader, QuckTime, Real Media, web browser, etc.

* any program that is capable of accessing the Internet.

4) An Anti-virus program, updated regularly.

5) An Anti-spyware program, (with real-time prevention) updated regularly.

6) Inoculate your computer to prevent infection, with programs such as Spybot Search and Destroy and Spyware Blaster.

7) If you are particularly security conscious, install an active defense such as an intrusion prevention system.

Hey, it is a lot of work to keep computer systems secure. If you are not up to it, unplug that machine and never connect it to the Internet.

So, perhaps you are savvy enough to have a relatively secure computer. But how about your friends and relatives? If you can, take the time to help someone else who is not as computer savvy, and who might really need the help. It helps us all if there are fewer compromised computers on the Internet.

Friends don’t let friends surf insecurely.

Recommended File Shredder

Posted in Privacy, Security Tools on March 16th, 2007

It really should be common knowledge that “deleting” a file does not really delete it. It simply flags the file as “deleted” by changing one small bit of information in the file name.

The file is still readily accessible through the use of an “undelete” utility until at some point in the future, that files location on the hard drive is overwritten.

Even then, there are “forensic” tools that can often reconstruct files even after they have been simply overwritten.

Therefore sometimes it is wise to “shred” files, so that they cannot be reconstructed. Shredding is a common name for a technique that overwrites the file numerous times in a manner that as been carefully developed to prevent that file from being reconstructed.

We recommend the Eraser secure file shredder utility, which is available *free of charge* at the authors web site:
http://www.heidi.ie/eraser/

_____________________________________________________________________________________________________________