Subscribe


July 2010
M T W T F S S
« Apr    
 1234
567891011
12131415161718
19202122232425
262728293031  

Categories

Archives

« Older Home
Loading Newer »

Fatal System Error

Published by Bryant April 24th, 2010 in CyberCrime. 0 Comments

“In 2010, aggressive malware now executes in stealth mode, running in the background with an oblivious end-user, and antivirus software that can’t detect it.”

Thus, in 24 words, reviewer Ben Rothke sums up why you should read Fatal System Error: The Hunt for the New Crime Lords Who are Bringing Down the Internet,  by Joseph Menn. Menn, a cyber security reporter for the Financial Times, takes the reader into the inner operations of today’s cyber-criminals, who use the Internet as their personal mint.

Billed as a non-fiction cyber-thriller, the book describes the cyber gangs who operate on the Internet.

If you don’t read the book, read Rothke’s review.

If you are not aware of the dangers on the Internet, you will continue to use it without knowing that is highly likely that you are aiding and abetting a criminal operation every moment that your computer is logged on.

You may think your anti-malware software is keeping you safe. It’s not. Every day at least 50,000 new malicious software programs are launched. Off-the-shelf anti-virus/anti-spyware software fails to detect most of it. The truth is, even the best business-grade anti-malware cannot keep you safe by itself. That’s why large businesses have IT departments staffed by experts who manage security using the most powerful and up-to-date technology weapons against criminal malware.

You can have leading business-grade security software and a virtual IT department to manage it and watch your back for as little as $15 a month. The first priority in keeping yourself and your family safe from cyber criminals is to keep your computer free and clear of their malware. Here is the company that has been keeping my machines safe for the last 5 years.

(Full disclosure: I am affiliated with the company. If you become a customer, I earn a commission.)

Inside a global cybercrime ring

Published by Bryant March 25th, 2010 in Adware, CyberCrime and Viruses. 0 Comments

malware screen shotA March 24, 2010 Reuters story headlined “Inside a global cybercrime ring” by reporter Jim Finkle leads with this paragraph:

Hundreds of computer geeks, most of them students putting themselves through college, crammed into three floors of an office building in an industrial section of Ukraine’s capital Kiev, churning out code at a frenzied pace. They were creating some of the world’s most pernicious, and profitable, computer viruses.

Every computer owner should read this fascinating story is about Innovative Marketing Ukraine, or IMU, a company that was at the center of a complex underground corporate empire that “built its wealth pioneering scareware — programs that pretend to scan a computer for viruses, and then tell the user that their machine is infected. The goal is to persuade the victim to voluntarily hand over their credit card information, paying $50 to $80 to “clean” their PC.”

The story tells how IMU solved its biggest problem: charge backs from credit card companies after customers complained that the “anti-virus” or “cleanup” programs didn’t work. IMU set up call centers to handle complaints and trick customers into thinking their problem was fixed!

Another quote from the story:

Anti-virus software makers have also gotten into the lucrative business of cleaning PCs, charging for those services even when their products fall down on the job.

Charlotte Vlastelica, a homemaker in State College, Pennsylvania, was running a version of Symantec’s Norton anti-virus software when her PC was attacked by Antispyware 2010. “These pop-ups were constant,” she said. “They were layered one on top of the other. You couldn’t do anything.”

So she called Norton for help and was referred to the company’s technical support division. The fee for removing Antispyware 2010 was $100. A frustrated Vlastelica vented: “You totally missed the virus and now you’re going to charge us $100 to fix it?”

Read this well-researched and documented report. You’ll be much better prepared when a criminal manages to infect your PC.

And please, don’t pay $100 or $150 to have your PC cleaned. Invisus will do the job for you for just $49.99, and your satisfaction is guaranteed. Here’s how it works. When you sign up for iSafe, a technician will access your computer remotely to do a complete cleanup and security makeover and install industrial grade protection software. If you are not pleased, simply cancel. If you like having your computer run as fast as it was when new, Invisus will keep it clean and running right for just $14.99 per month.

Identity Theft Picks Up Steam

Published by Bryant February 22nd, 2010 in Uncategorized. 0 Comments

Nashville Examiner reporter Brandon King reports on a recent study conducted by Javelin Strategy and Research, showing that 11.1 million adults were victims of identity theft in 2009.This represents a 12% increase from that of 2008 and up 37% from 2007.

Quoting from King’s article:

“The odds have never been higher for becoming a fraud victim,” said James Van Dyke, the President and founder of Javelin. “It’s an easy crime to perpetrate, a crime that’s almost impossible to catch when done in a sophisticated manner and a crime in which enforcement is very limited.” Van Dyke’s assessment lines up with a survey conducted by Gartner, a leading IT and research company, which show that only 1 out of 700 identity thieves are prosecuted.

See the full article here.

Cyber crime: a clear and present danger

Published by Bryant February 16th, 2010 in CyberCrime, Data Theft and Small Business Security. 0 Comments

I’ve just been reading a new report on cyber crime, published by Deloitte, the major international accounting firm. I’m in the business of protecting individuals and small business owners from cyber crime, and this whitepaper provides an important update on this incredibly dangerous phenomenon. The 16-page document is titled, “Cyber Crime: A Clear and Present Danger.” It’s an interpretation of the results of the 2010 Cyber Security Watch Survey,  released in January, which was conducted by CSO Magazine and in partnership with the U.S. Secret Service and the Carnegie Mellon Software Engineering Institute (CERT), and sponsored by Deloitte.

Some highlights:

… the threat of cyber crime has outpaced that of other cyber security threats… Indeed, driven by the prospect of significant profits, cyber crime innovation and techniques have outpaced traditional security models and many current signature-based detection technologies.

How do criminal organizations manage to “outpace” traditional security models and detection technologies? Like legitimate businesses, they outsource;  hiring, buying or otherwise acquiring the technology to infiltrate systems with new penetration techniques.  It’s just part of the cost of developing their criminal e-business networks.

The report identifies a number of cyber crime trends that the authors say “demand a strong, bold, near-term response.”

  • Cyber attacks and security breaches are increasing in frequency and sophistication, with discovery usually occurring only after the fact, if at all.
  • Cyber criminals are targeting organizations and individuals with malware and anonymization techniques that can evade current security controls.
  • Current perimeter-intrusion detection, signature-based malware, and anti-virus solutions are providing little defense and are rapidly becoming obsolete—for instance, cyber criminals now use encryption technology to avoid detection.
  • Cyber criminals are leveraging innovation at a pace which many target organizations and security vendors cannot possibly match.
  • Effective deterrents to cyber crime are not known, available, or accessible to many practitioners, many of whom underestimate the scope and severity of the problem.
  • There is a likely nexus between cyber crime and a variety of other threats including terrorism, industrial espionage, and foreign intelligence services.

Here is real cause for alarm: most indicators point to futurecyber crime attacks being more severe, more complex, and more difficult to prevent, detect, and address than current ones, which are bad enough. An underground economy has evolved around stealing, packaging, and reselling information. Malware authors and other cyber criminals for hire provide skills, capabilities, products, and “outsourced” services to cyber criminals. These include data acquisition and storage, stealthy access to systems, identity collection and theft, misdirection of communications, keystroke identification, identity authentication, and botnets, among others. Meanwhile, today’s security model is primarily “reactive,” and cyber criminals are exploiting that weakness.

The full report is worth reviewing. It avoids technical language, and is easy to read.  You can download a copy from Deloitte’s new Center for Security & Privacy Solutions.

If cyber crime is a problem for large businesses, what about you? What’s your response to this clear and present danger to your personal life, your family, and your business?  Remember, if you collect, process, or store information that criminals can turn into cash, you are a target. If you’re a small business owner, you are a much easier target than a big company. VISA says that “Data security breaches involving payment card information occur at small businesses more frequently than at all other merchant levels “ combined.” Eighty-five percent of data breaches happen at small businesses.

If you are a home PC owner, or you have a laptop, criminals can make money with it by simply hijacking it and adding it to a botnet, and you’d never know.

One solution is to install the same grade of firewall and anti-virus, anti-spyware technology that your bank and other large corporations use. I work with a 10-year-old company that specializes in computer security for small businesses and individual consumers. You can see full information on the company’s services here.

Victim catches identity thief

Published by Bryant September 8th, 2009 in Identity Theft. 0 Comments

It’s news when an identity thief is caught (only 1 thief in 700 reported cases is caught and prosecuted), but when the victim catches her own thief, that commands a headline!

In a byline article in the Seattle Times yesterday, Ian Ith reports the story of Michelle McCambridge, a 23-year-old retail clerk and college student whose identity was stolen back in January this year. Just a week after Miss Cambridge learned that someone had opened credit card accounts in her name, the thief appeared at her counter at J.C. Penney. Cambridge recognized the woman from a surveillance photo she had been shown by a federal agent when she reported the incident.

In January 2008, The Reader’s Digest ran the story of Karen Lodrick, a San Francisco writer and human resources consultant, who recognized her thief at a Starbucks, and then chased the woman through the streets of San Francisco, while directing police on her cell phone. What happened to the thief? Karen tells the story better than I can. But I will tell you that Karen was not pleased, and she started her own crusade–Fighting Back Now–to educate people about this growing threat.

The FTC’s latest figures indicate that there were more than 9 million reported cases of identity theft in 2007. Other agencies and public sources point out that many of these crimes go unreported–indeed, it often takes years for the crime to be discovered, especially in child id theft cases–and that the actual number is much higher. Some authorities believe the number is closer to 20 million and climbing.

The identity thieves who never get caught are the professionals who deal in them on a wholesale basis. Millions of personal records are exposed each year through data breaches. According to the Identity Theft Resource Center, 13,164,689 records have been exposed so far this year in 363 separate breaches. Millions of these records, containing social security numbers, drivers license numbers, names and addresses, and other critical information, reach the hands of organized crime gangs who offer them for sale in underground markets.

Law enforcement agencies warn that although you can and should take common sense precautions, this crime cannot be prevented. The most important step you can take is to be prepared. Choose a service that does the work of recovery for you. Every bit of it until your life is back to normal. The amount of work is staggering for an individual. It takes hundreds of hours, and the costs can run into the thousands of dollars. Most of the services you see advertised give customers a recovery kit and a help line for advice, but you have to do the footwork, the phone work, the notifying work, the credit bureau negotiations…and on and on…all by yourself. Who wants that?

Don’t take chances with your identity. It’s your most important possession.


Facebook virus leads to gold for hackers

Published by Bryant September 7th, 2009 in Viruses. 0 Comments

News of a new virus, called “Facebook Fan Check Virus”, is sending a lot of people to Google to search for information, and those searches are leading them right into hacker traps. Click on one of those websites and the most likely result is that you’ll download scareware, an urgent notice that your PC has been infected. This is accompanied by an offer to pay $30 or so to download the anti-virus software that fixes the problem.

Graham Cluley has an excellent post on this development in his Sophos blog. Rather than give you excerpts, I recommend that you read the complete article. It’s the best way to get the information you need. The source is safe and knowledgeable.

Scareware is big business. Don’t click on those urgent warnings. Carefully close the window by clicking on the X in the upper right or left corner.

And protect your PC with enterprise grade security software.

Bill would allow Obama to take over Internet

Published by Bryant September 3rd, 2009 in CyberCrime, CyberTerrorism and Uncategorized. 0 Comments

I’m in the business of cyber security, and I’m in favor of all the help we can get. But when a liberal Senator introduces legislation to fight cyber crime, my neck hairs stand up and vibrate.

Sen. Jay Rockefeller’s Cybersecurity Act of 2009 raised a lot of hackles when it was first introduced because of language that would give the president broad new powers to take control of the Internet in an emergency.

And guess what? The president would get to determine what constitutes an emergency.

Would too much criticism of the administration in the blogosphere constitute an emergency?

Well, probably not. I hope. I mean, they’re not thinking about ways to shut down talk radio just for being a pain the royal foofer, right? But read this from a story in eWeek:

The original draft bill gave the president the broad authority to designate various private networks as a “critical infrastructure system or network” and, with no other review, “may declare a cyber-security emergency and order the limitation or shutdown of Internet traffic to and from” the designated the private sector system or network.

Reaction to that language was so intense that Rockefeller changed it to something more vague, but no less ominous. It still allows the president to declare a cyber-security emergency and assume authority over “non-governmental” networks. It would only apply in times of national emergency, but that isn’t clearly defined. It’s left to the president to decide.

Another provision in the bill gives the government authority to standardize security software and force security firms to get government approval for new software. Yeah, right. Guess how long that would take. Of course, the law probably would apply to authors of malware, too, so why worry?

One more excerpt from the eWeek story:

The legislation also calls for a public-private clearinghouse for cyber-threats and vulnerability information under the authority of the Department of Commerce. The Secretary of Commerce would have the authority to access “all relevant data concerning such networks without regard to any provision of law, regulation, rule or policy restricting such access.”

Just what’s needed to fight cyber crime–more bureaucracy.

1 Down, 1 Million to Go?

Published by Bryant September 1st, 2009 in CyberCrime. 0 Comments

A big tip of my hat to investigators and the U.S. Attorney who brought down Albert Gonzalez, the Miami hacker authorities were able to tie to a cyber-crimewave that hit companies from Heartland Payment Systems to Hannaford Brothers.

The 28-year-old Gonzalez pled guilty to various charges and now faces up to 25 years in prison.

So that’s one cyber-criminal taken off the streets..er..the cyber highway. But untold thousands of professionals working for huge cyber-crime companies remain at work, developing new ways to steal everything you have, or make you into an unwilling, unwitting partner in crime.

From reports I have read, my guess is that Gonzalez is an expert amateur, not a professional on the level of those employed by organized crime.

I don’t know if there are a million criminal hackers out there, both amateur and pro. No one knows the real number, but a couple of years ago a government agency claimed that there were as many as 14 million hackers capable of breaking into a home computer with “average” protection.

So, score one for the good guys. But don’t relax. The odds that a criminal is controlling your PC at this very moment are better than 9 to 1. And don’t bet on your security software. The FBI says off-the-shelf or downloaded products have a failure rate well above 90%.

Can I ask a question? If someone were using your PC to send out tens of thousands of pieces of spam every day, or storing and distributing illegal stuff, like pornography, how soon would you want to know?


New Russian Ransomware Trojan

Published by Bryant July 31st, 2009 in Worms & Trojans. 0 Comments

Suddenly an ad appears on the webpage on your screen.

You try to delete it, but nothing works.

You go to another page. And another and another. The ad keeps following you.

It’s the newest ransomware scam from Russian hackers. The Ransomware Trojan is either dropped onto  systems already compromised by other strains of malware, or downloaded from legitimate websites that have been infected with the malware.

The ad tells you to send a text message to a premium rate number in order to remove the ad. In the process you will gain access to on online smut site. The idea behind the Ransomware Trojan is to annoy and embarrass you so much that you’ll give in and send the text message. That will get rid of the ad, but not the Trojan. And you’ll see a nice fat charge on your next cell phone bill.

If you see such an ad, DO NOT call or text the number. Here’s what to do instead. Update and run your anti-virus software. It should detect the tools that the hacker is using to control your PC.

Meanwhile, make sure you are running the latest version of Firefox. The Ransomware Trojan is not compatible with that version of the Firebox browser. However, it will work with Internet Explorer, older versions of Firefox, and Opera.

Don’t click on links or visit websites sent to you in emails, unless you know the sender and you are expecting the link. Links may take you to a hacked website.

Dark side leads technology

Published by Bryant July 30th, 2009 in Botnets and CyberCrime. 0 Comments

Sometimes it seems that the dark side is leading in the development of new technology. Technical journals and reports abound with examples.

Last week there was a reference to quality control services for malware makers in a report from Cisco. The report cited a Russian site that for a fee

tests malicious files against the latest versions of 26 virus-scanning software products to determine whether the anti-virus software can detect the malware.

Cisco says the process “results in malware that is 10 to 20 times more effective than it would be otherwise, and frees up the attackers to work on other products rather than test how detectable their current exploits are.”

Today, eWeek published a story on botnet technology. Headlined “A Day in the Life of the Rustock Botnet,” the article includes a slide show of images of this prolific spamming botnet in action. Evolving dark side technology like this makes it easier for botmasters to evade spam filters. Spam levels are up 60 percent between January and June, according to the article.

Cyber crime is not just big business, it’s a huge underground economy in which thousands of “companies” and hundreds of thousands of individuals interact and do business with each other. Their targets are you and I and our small businesses.

Big companies have IT departments with access to the best counter-crime technologies in the world. Do you have an IT department? How do you keep cyber criminals out of your PC and your life?