Those dastardly phishers have been up to their tricks again, and this time it seems they reeled in over 30,000 email passwords.
The BBC is reporting that a phishing attack first reported yesterday, and thought to be limited to Hotmail, has actually proven to be even larger than first suspected. The account holders that were hit in the latest attack came from Hotmail, Gmail, Yahoo, AOL, Comcast and Earthlink.
The phishers used fake web sites to lure people into using their passwords to “log in”, but in actuality they were capturing those passwords for nefarious uses. The total list of the captured accounts and passwords were later posted on a web site for hackers to download. The list has since been removed, but it is highly probable that multiple copies were downloaded before that action was taken.
Google was the quickest to respond, and has pinpointed the affected Gmail accounts. All of those account holders have been contacted and instructed to change their passwords after having a forced reset done on them by Google.
A Google spokesperson said to the BBC:
We recently became aware of an industry-wide phishing scheme through which hackers gained user credentials for web-based mail accounts including Gmail accounts. As soon as we learned of the attack, we forced password resets on the affected accounts. We will continue to force password resets on additional accounts when we become aware of them.
This is not viewed as a security breach by any of the companies as in all of the cases the users had to take an action to use their passwords.
We aren’t sure who it is that still reads spam, let alone makes purchases from it, but please stop.
According to Ars Technica, a security researcher from Sophos names Dmitry Samosseiko did some sleuthing, and was able to find his way into the administrative backend of a spamming network. What he discovered was that there is still big money being made from spam emails, and the conclusion is that so long as people continue to purchase Viagra and other drugs via these emails, we will all suffer.
In a lengthy report (PDF link), Mr. Samosseiko details how the one spam network he got into has about 30 sales a day, totaling up to $4,000. $1,600 of that goes to the spam software generator, a group named GlavMed, while the rest goes to the person using the spam bots. In other words, GlavMed makes around $584,000 a year from spam, and this is just one of possibly many spam networks set up by them.
The latest iteration of spam seems to be centered on Russians setting up the networks to sell the drugs that come out of Canadian pharmacies. While there is no way to know for sure, it wouldn’t be surprising to learn that this is tied in with the Russian mob, but that is purely speculation on my own part.
It is amazing to me that there are still people even reading their spam emails after the endless warnings that have been made by security groups over the dangers of even opening these emails, let alone clicking on any links in them. You are opening yourself up to viruses, Trojan horses, identity theft and any other slew of nastiness by even reading this junk mail.
The other problem is that you are subjecting everyone else on the Internet to continue receiving them because even a small percentage of them work. It costs next to nothing to send out hundreds of thousands of spam emails, so why should the spammers care if only 30 a day result in a sale? The only way for this to end is for everyone to just stop looking at them, but somehow I doubt that will ever happen.
Maybe we need a new slogan, something like, “Every time you read a spam email, God kills a kitten”. Think that would finally get the point across?
If your blog gets hacked, who do you point the finger at as the culprit for this pain?
Yesterday we wrote up about how if your WordPress blog was not running version 2.8.4 that you needed to upgrade immediately to patch a security hole that was being exploited by hackers in all older versions of the software. While most people headed the warning and did the upgrade, unless they had already done so as 2.8.4 had been out for a little while, there were still some holdouts who did not heed the warning.
Robert Scoble, a well-known blogger and video host, was one of those people who not only failed to upgrade, but decided to blame every one but himself for the hackers getting in. In a blog post entitled “I don’t feel safe with WordPress, hackers broke in and took things“, Mr. Scoble admits that he had not updated his blog since one of the minor updates to version 2.7, and also admitted he had not backed up his blog data, so he lost two months worth of posts that the hackers deleted it.
Mr. Scoble goes on about how he no longer feels safe using his WordPress blog, but he will soldier on, but he feels violated like when his childhood home was broken in to.
I don’t normally use this site as a soap box, but this time I feel I must:
As you can see from the above image, WordPress makes it very obvious every time the software requires upgrading. While upgrading used to be a pain in the backside, the system is now fully automated and all you must due is click one button to have your software updated inside of just a few minutes. There is really no excuse any more to have not updated, and especially if you hadn’t done since 2.7.x. Notifications go out just about everywhere when it is a serious security fix, so those people who claim they didn’t know they needed to do it are also full of BS.
The rule here is always upgrade your blog and keep a backup on hand, and if you fail to do those things, then don’t cast disparaging remarks towards the software for not doing its job when you were the one who chose not to update.
If some security experts have their way, you may soon need a license to log on to the Internet.
It’s all in the name of “protecting” you, but there are people in Europe and Australia that think it might be a good idea for you to have a license to surf the Internet.
The theory is a simple one: there are people on the Internet who want to defraud you, and you should be required to take a class to learn to avoid these situations prior to being allowed on the Web. At least that is the idea that Dr. Russel Smith, principal criminologist at the Australian Institute of Criminology, has been saying to iTnews.
While it seems his heart is in the right place, Dr. Smith is simply going too far with such a concept. The majority of Internet fraud concerns can be solved with a short pamphlet that Internet service providers (ISPs) could send out to customers when they sign up. Essentially it boils down to three things:
Never give out your password or personal info
Never send money to someone
Never use a credit card on a suspicious looking site
There, you’ve just earned your “license”.
Dr. Smith attempts to make an analogy between driving a car and controlling a computer, both items being dangerous machines, but it just comes off as lame. Yes, the Internet can be a big scary place, but just because a handful of people get defrauded each year doesn’t mean that the hundreds of millions of other people on the Internet should have to jump through hoops to use their own computers.
You know what else is dangerous? Guns. But you don’t have to take a safety course before buying one.
You know what else is dangerous? Alcohol. But you don’t have to take a course before you drink.
You know what else is dangerous? Smoking. But you don’t have to take a course before you buy a pack of cigarettes.
It seems the governors of some states in the U.S.A. have been receiving mysterious laptops, and no one is quite sure who is sending them, or what they may contain.
According to Computerworld, West Virginia Governor Joe Mahchin received a mysterious shipment of 5 HP laptops a few weeks ago that no one is quite sure where they came from. Seeing as the incident was just too odd, his office reported it to the Federal Bureau of Investigation (FBI), and they looked into it. It seems his office wasn’t the first to get such a shipment, nor was he to be last.
In total, four states received such shipments, and six more were scheduled, but those have since been held up from being delivered.
The belief is that these laptops may be true “trojan horses” with some sort of nasty surprise hidden inside of them to compromise security in the offices of these governors. Luckily the West Virginia governor’s office had the right mind set to report this and did not attach the suspicious computers to the network.
This is a great object lesson about never trusting any strange computer equipment. If someone hands you a USB thumb drive, and you aren’t 100% sure what’s on it, don’t use it. Same with laptops, desktops, PDA devices etc. Always be careful with unkown computer items.
Ever had a charge show up on your credit card from a web site you forgot to join? Don’t worry, it isn’t just you this happens to.
Many subscription based web sites use a tactic called “opt-out” to their auto-renweing subscriptions to confuse consumers. What this means is that the site automatically sets your account to automatically renew each time your subscription expires. To stop it, you must go and change the setting yourself, which is known as “opt-out”.
Sadly I just went through something like this with Classmates.com, and I have no one to blame but myself at the end of the day, but that doesn’t mean it stings any less. You should always go to your account settings immediately after joining a site, look at your billing information and make sure there isn’t a checkmark next to something that says something like “this account will automatically renew at the end of your subscription.” Wording can vary quite a bit, so be careful, and read everything multiple times.
It would be nice to see every site adopt an “opt-in” policy, but that seems unlikely. Under that system you have to tell the site that you wish it to auto-renew as opposed to telling it you don’t want it to. It would be the friendlier thing for consumers, hence why it seems unlikely to ever happen.
Okay, admit it, odds are that at least a few of you reading this post have responded to an advertisement in a spam email.
Don’t. Just… don’t.
According to a new study by the Messaging Anti-Abuse Working Group (MAAWG), 52% of email users have clicked or read a spam email message, and even more frightening is that 12% of users say they have attempted to purchase a product advertised in spam. No wonder spammers keep attempting to get into our inboxes!
For the love of crimeny, you should not be buying items from spam, let alone reading them! A good portion of spam contains viruses, trojan horses and bots that will turn your computer into a spam generating zombie system. (no, I am not making that up) No matter how enticing you think the offer may look, do NOT open spam emails. They are nothing but a minefield of dangers, and seeing as 80% of respondents to the study of 800 email users with self-managed accounts think that they are at no risk from these dangers, it is obvious you need to be reminded.
Please, do not read spam emails, do not be tempted by insanely low prices for perscriptions or, even worse, think about buying pills that will… um… enlarge portions of your anatomy. There is a reason this stuff is called “spam”.
If you’re going on vacation, do you know that Wi-fi hotspots you use to check your email may not be who they say they are?
I am always leery of studies released by parties with a vested interests in the results (i.e. a group of wine makers releasing a study about wine being good for you), but sometimes they still bring up good points. While I think the basis of this Fox News story on Wi-Fi security is a little suspect, it still raises good points for Wi-Fi security any time you are away from your home.
Multiple security firms issued warnings about your information security while in places such as an airport (again, notice the warning was issued by security firms…) or a hotel, and to make sure that the network you are connected to is legitimate. Yes, this is good advice, and is something you should pay attention to, but the reason I find this whole thing suspect is that the original study was issued by AirTight Networks, a company that specializes in wireless security measures. They sent out experts to 27 airports around the world to test their Wi-Fi and claim to have found unsecured networks in baggage claim, ticketing areas, passangers connecting to hacker Wi-Fi hotspots and more.
The reason I find this whole thing a bit “off” is:
Are the hackers buying tickets every day to get past security, and then setting up in waiting areas with Wi-Fi sniffers? No one notices the people then not getting on flights?
Are they run by employees in the secured areas of the airport? Those people are searched each day also.
No one notices stray, unexplained equipment in a storage room?
If all this is to be believed, I’m more worried about my physical safety if hackers can get this Wi-Fi equipment in with no one noticing.
No matter how cynical I may be, Symantec still offered five good pointers in the article:
— Pay attention to your surroundings. Just because you’re on vacation doesn’t mean you’re not in public. Don’t look at important documents when sitting in a waiting area for a plane or a train — wait until you’re alone and in private for that.
— Beware of “Evil Twins.” Some Wi-Fi networks look legitimate but are actually dummy networks created by criminals. Even if they contain the name of your airport, airline or hotel, they will directly link your computer to the hacker’s. If you always use the official access keys provided by the establishment, then you should be safe.
— Always assume Wi-Fi connections are being eavesdropped on. Never enter sensitive data — Social Security numbers, bank account information, etc. — when browsing the Web via a Wi-Fi network.
— Set all Bluetooth devices to “hidden,” not to “discoverable.” Better yet, if you don’t use Bluetooth, just shut off the function altogether.
— Keep your security software current and active. Mobile PCs are just as vulnerable to viruses, worms and Trojan horses as are desktops, so make sure you have the latest protection installed.
I would say don’t live your life in constant fear, but do try to use common sense and your own good judgement in what networks you connect to.
Please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc.
In theory this is mainly done due to Facebook not allowing you to see the profile of anyone you have not friended, but that feature is optional on all other social networks.
As Mr. Hodson points out, this is tantamount to handing over the keys of your house to your employer, and telling them to have a look around. Not only would you be giving them access to your profile, but also to your private messages, the ability to see your friends profiles that are otherwise private and other potentially sensitive information in your account. Never mind the fact that one of the first rules of passwords is to never give them out to any one.
City attorney Greg Sullivan explained the reasoning of this request to MontanasNewsStation.com this way:
So, we have positions ranging from fire and police, which require people of high integrity for those positions, all the way down to the lifeguards and the folks that work in city hall here. So we do those types of investigations to make sure the people that we hire have the highest moral character and are a good fit for the City.
While it is understandable that a city would want to hire only upstanding people, demanding access to their private information is a whole different matter. Mr. Sullivan also continued:
You know, I can understand that concern. One thing that’s important for folks to understand about what we look for is none of the things that the federal constitution lists as protected things, we don’t use those. We’re not putting out this broad brush stroke of trying to find out all kinds of information about the person that we’re not able to use or shouldn’t use in the hiring process.
The problem I have with this is what if someone entrusted with the checking of your profiles is unethical? What if they are a gossip? You are giving some faceless person all of the information they need to find out pretty much anything they want to know about you, and that is worrisome. And what happens to those pieces of paper you write down your information on? Can the city guarantee that those documents will be under lock and key at all times with records kept at all times of whom accessed them?
It is easy to understand that in these difficult economic times that people will do whatever they can for a job, but for the city to even suggest that you should hand over this type of sensitive information is insanity. And, lets be honest here, do they really suspect that if someone is doing something illegal that this will give them the magic solution to finding out? Do they really think that if someone is a child molester it is going to be spelled out for them on their social networking profiles?
No matter how you slice it this is a bad idea, and something that the City of Bozeman has no right asking for. What is private is private, and you sure would never catch me giving them access.
The extent of our request for a candidate’s password, user name, or other internet information appears to have exceeded that which is acceptable to our community. We appreciate the concern many citizens have expressed regarding this practice and apologize for the negative impact this issue is having on the City of Bozeman.
Thanks to heatherkoyuk on Twitter for bringing this to our attention.
People everywhere are concerned about the Conficker virus that is running rampant across the Internet, butas it sits dormant for so long, it can be difficult to tell if you have it or not. Luckily the Conficker Working Group has come up with an amazingly easy way to tell if you have it by just taking a look at the chart below.
Conficker Eye Chart
How to interpret:
If you see this above:
It probably means this:
= Normal/Not Infected by Conficker (or using proxy)
= Possibly Infected by Conficker (C variant or greater)
= Possibly Infected by Conficker A/B variant
= Image loading turned off in browser?
Any other combination
= Poor Internet connection?
If you’re curious as to how this works, the first row of images are served up by the actual websites for those anti-virus programs. As Conficker prohibits you from going to those sites to download tools, you would not be able to see them if you were infected. The second row is there merely as a control sample so you know if your browser is working properly. If you are showing signs of infection you can go here to check out some tools to help you get rid of it.
Those dastardly phishers have been up to their tricks again, and this time it seems they reeled in over 30,000 email passwords.
We aren’t sure who it is that still reads spam, let alone makes purchases from it, but please stop.
If your blog gets hacked, who do you point the finger at as the culprit for this pain?
If some security experts have their way, you may soon need a license to log on to the Internet.
It seems the governors of some states in the U.S.A. have been receiving mysterious laptops, and no one is quite sure who is sending them, or what they may contain.
Ever had a charge show up on your credit card from a web site you forgot to join? Don’t worry, it isn’t just you this happens to.
If you’re going on vacation, do you know that Wi-fi hotspots you use to check your email may not be who they say they are?
