Nov 15 2012

Tips for staying safe this Cyber Monday

Category: cyber security,CybercrimeDISC @ 12:52 pm

Cyber Monday deals

Cyber Monday, one of the largest online shopping days of the entire year, is coming November 26. The National Retail Federation estimates that shoppers spent more than $1.2 billion last year, doing more than a third of their holiday shopping online.

The issue? This influx of activity online, often times during business hours on a corporate network, is a holiday in itself for scammers and seasoned hackers.

As much as the bosses may not like it, the shopping on Monday is inevitable. So what should end users be mindful of to protect themselves AND the sensitive data on their personal or corporate networks?

FortiGuard Labs threat researchers, Guillaume Lovet and Derek Manky offer a few security tips to help you stay safe online.

1. Unsolicited e-mails: While it may be tempting to click on an email link that says, “Great Deal on iPads… 50% off!” Be careful! By clicking on that link, you could be taken to a compromised Website that downloads malware onto your computer. That malware can then be used to capture your computer key strokes, download additional malware, such as fake antivirus applications, or simply turn your computer into a spam generator.

What to do: If a deal looks too good to be true? It probably is. If you’re still tempted, simply place your cursor over the link (without clicking on it) and check to make sure the URL listed is where you were intending to go.

2. Nefarious search engine results: Search Engine Optimization (SEO) attacks (also known as search engine poisoning) typically occur during major events and holidays. This time of year, hackers may use search terms such as “Holiday Sale,” “Christmas bargains,” or “Year End Specials.” When a user clicks on the malicious link, they could be taken to a Website where their computer can be immediately compromised.

What to do: Same with the tip above, check the link before you click. Also, make sure if you do go to the site that the content looks relevant to what you searched for, versus lots of keywords globbed together on a page in random sentences

3. Unknown online retailers: If you discover an online store that’s offering unbelievable specials on holiday merchandise, do some digging to make sure it’s a legitimate store and not a false front that will disappear later that day along with your credit card information. And even if they are legitimate, you’ll want to make sure their site hasn’t been unknowingly compromised by SQL injection or other server attacks.

Compromised websites won’t always redirect you to a malicious site, but often will phish or try to surreptitiously install other forms of malware on your computer, such as Trojans, bots, keyloggers and rootkits, which are designed to harm systems and steal personal information.

What to do: Make sure your antivirus system is up-to-date, as well as intrusion prevention to help guard against these exploits. Without them, you may not even know that you’re infected.

4. Beware of friends sharing unsolicited links: Malicious links don’t always come from spam emails. They could come from your closest friend on Facebook or via e-mail whose machine has been unknowingly compromised. The infected machine may have a botnet that’s been programmed to comb through email or Facebook address books and send malicious links to everyone in them. The message might say, “Hey, check out the holiday sale going on here!” or “This place is have a 50% off Christmas sale!” By clicking on the link you could be taken to a malicious Website that installs malware on your system or phishes for your credit card credentials.

What to do: Use common sense. Does your friend normally update you on when sales come up? If you’re not sure, a quick private message or phone call to ask, “Did you mean to send me this?” could save you from compromising your personal (and corporate) sensitive information.

Tags: Credit card, Cyber Monday, National Retail Federation, Online shopping, SQL injection, Website


Apr 21 2010

Raid said to have hacked Google password system

Category: CybercrimeDISC @ 3:30 pm

Google Appliance as shown at RSA Expo 2008 in ...
Image via Wikipedia

John Markoff, New York Times

Ever since Google disclosed in January that Internet intruders had stolen information from its computers, the exact nature and extent of the theft has been a closely guarded company secret.


But a source with direct knowledge of the investigation now says that the losses included one of Google’s crown jewels, a password system that controls access by millions of users worldwide to almost all of the company’s services, including e-mail.


The program, code-named Gaia for the Greek goddess of the earth, was attacked in a lightning raid taking less than two days in December, the source said. The software is intended to enable users to sign in with their password just once to operate a range of services.


The intruders do not appear to have stolen passwords of Gmail users, and the company quickly started making changes to the security of its networks after the intrusions. But the theft leaves open the possibility that the intruders may find weaknesses that Google might not even be aware of, independent computer experts said.


The new details seem likely to increase the debate about the security and privacy of systems that now centralize the personal information of millions of individuals and businesses.


Link to ‘poisoned’ site


The theft began with a single instant message sent to a Google employee in China, according to the person with knowledge of the inquiry, who spoke on the condition he not be identified. By clicking on a link and connecting to a “poisoned” Web site, the employee inadvertently permitted the intruders to gain access to his (or her) personal computer and then to the computers of a critical group of software developers at Google’s headquarters in Mountain View.


Ultimately, the intruders were able to gain control of a software repository used by that team.


Tightening security


The details surrounding the theft of the software have been a closely guarded secret by the company. Google first publicly disclosed the theft in a Jan. 12 posting, which stated that the company was changing its policy toward China in the wake of the theft of unidentified “intellectual property” and the apparent compromise of the e-mail accounts of two human rights activists.


Company executives declined to comment Monday about the new details of the case.


Google continues to use the Gaia password system, now known as Single Sign-On, but has tightened the security of its data centers.


Several technical experts said that because Google had quickly learned of the theft of the software, it is unclear what the consequences of the theft have been. One of the most alarming possibilities is that the attackers might have intended to insert a Trojan Horse – a secret backdoor – into Gaia and install it in dozens of Google’s global data centers to establish clandestine entry points.


This article appeared on page D — 1 of the San Francisco Chronicle on Apr 20, 2010

Cyber War: The Next Threat to National Security and What to Do About It

Tags: china, Gaia, Google, Human rights, Personal computer, Software developer, Trojan horse, Website


Nov 10 2009

Facebook, MySpace users hit by cyber attacks

Category: CybercrimeDISC @ 1:27 am

facebook
Image by sitmonkeysupreme via Flickr

NZ HERALD reported that Facebook users – already being targeted in a malware campaign – are now under threat from a phishing scam.

Security specialists Symantec report that the company’s systems have picked up fake messages that appear to be sent by the social networking service.

Users will receive an email that looks like an official Facebook invite or a password reset confirmation.

If a duped user clicks on the ‘update’ button they will be redirected a fake Facebook site. They will then be asked to enter a password to complete the updating process.

As soon as the unwitting Facebook user does this, their password is in the hands of cybercriminals.

Dodgy subject lines for the phishing emails are: ‘Facebook account update,’ New login system’ or ‘Facebook update tool’.

The malware campaign that is still targeting Facebook is also propagated via email. This time, the message looks like a Facebook notification that the recipient’s password has been reset.

It includes a zip file that, if opened, launches an .exe file, which Symantec’s Security Response centre says is a net nasty called Trojan.Bredolab.

Once a users’ machine is infected by this malware, it secretly dials back to a Russian domain and, Symantec says, “is most likely becoming part of a Bredolab botnet.”

But it isn’t just Facebook that is being lined up by cybercriminals, News Corp’s MySpace is also under attack.

Potentially dangerous email subject lines to look out for are: ‘Myspace Password Reset Confirmation,’ ‘Myspace office on fire’ and ‘Myspace was ruined’.

Symantec believes their will be another attack on MySpace in the next day or two. “We also think that social networking sites with huge user bases are currently being targeted to infect maximum machines or gather passwords for more malicious activities in future,” the security team said in a statement.

It advised users to be extra-careful of suspicious attachments, especially those including password reset requests. Legitimate websites will not send an attachment for resetting a password, it said.

– NZ HERALD STAFF

Reblog this post [with Zemanta]

Tags: botnet, facebook, Malware, MySpace, News Corporation, phishing, Social network, Social network service, trojan, Website


Jan 22 2009

Web 2.0 and malware 2.0

Category: Malware,Web 2.0DISC @ 5:43 pm

Web 2.0 - No one owns it
A new position paper from ENISA describes the risks associated with web 2.0 and malware 2.0. Web 2.0 includes social networking, photo sharing, wikis and social bookmarking sites and malware 2.0 is defined as a web based infection in which user can be entrap by visiting website.

Web 2.0 applications are thriving because of their dynamic contents, in which users chip into the content and interact with each other. This dynamic interaction with other users comes with new threats of malware 2.0, in web 2.0 environment user trust the information without knowing anything about the author or integrity of the source, and that’s precisely why criminals are attacking these applications and using it to circulate malware 2.0.

ENSIA survey also evaluates the methods used by people to figure out if the web page is phony. People will be suspicious of a source if it only appears once on the web, but will start trusting the source (integrity of the source) if it appears more than once on the web. Assumption is somebody down the chain might have validated the source and as the source start spreading on the web somehow people start believing in the authenticity of the content.

“Misinformation is easily propagated through syndicated news stories, blog posts, and social data, which provides few trust cues to users. This has very serious consequences such as stock price manipulation and control of botnet via RSS feeds”

There is a need to establish an independent third party on the web to validate the source of the content. Availability of the web 2.0 content has to be balanced with a fitting dose of confidentiality and integrity of the content.

Survey results

[TABLE=12]

Related article
• 25 Most Shocking Crimes in Social Media History

    The Machine is Us/ing Us

httpv://www.youtube.com/watch?v=NLlGopyXT_g

Tags: availabiliy, confientiality, integrity, malware 2.0, On the Web, Photo sharing, risks, RSS, Security, Social bookmarking, Social network service, threats, Web 2.0, Web page, Website