If it sounds too good to be true, it probably is

Emails from McDonald's are making the rounds and it's very exciting.  Take a McDonald's survey and get $250 for participating.  The problem is, the email is not legitimate.  It was generated by cybercreeps who want to steal your information.

How it works:
1.  Take a 5 question survey
2.  To "win" your $250, provide your personal information AND your credit card so they will "credit" your account (warning!  warning!)

Tips to spot and avoid scams:
1.  Most surveys, if they offer everyone something, usually give you a nominal amount on a gift card or coupons for a free item
2.  If a company asks for your personal information along with credit card or bank account to "give" you money, it's most likely a scam
3.  Pay attention to the language used - does it sound like the company?  In this case, the message mentions that you are taking a "public opinion poll conducted by McDonald's, a non-partisan polling organization."  I appreciate the fact that the Golden Arches feels food should transcend political parties but that statement does not make sense.

Many thanks to Tony Bradley for highlighting this phishing scam!

Sources:

"McDonald's Phishing Scam: I'm Not Lovin' It", Tony Bradley, PCWorld, January 21, 2011.

Spam is down but new scam methods will be up

Is your email inbox suddenly a little leaner?  Less Viagra and Penny Stock emails getting through?  It's all a great sign for the war against spam but experts are worried that, since criminals go where the action is, they are just up to new tricks.

On Christmas Day, the Rustock Botnet, which seems to have replaced Mega-D for generating high volumes of spam, they are known for fake drug ads, was quiet.  Maybe cybercriminals do take days off?  Highly unlikely.  Rustock Botnet potentially owns 1.7 million  computers and uses those to generate and send more spam.

Rustock cranked back up again after the New Year but not at the same volumes.

What targets can you expect for this year?

1.  Shortened links:  hiding behind those shortened links so popular in social networking sites.

2.  Smishing:  text messages on your cell phone that look legitimate but the link is not

3.  Click through Ad fraud:  You click on an add for a legitimate product or company that has been hijacked or counterfeited

4.  Poisoned Searches:  Creating web sites that generate traffic so they hit the top of your search engine results and lead you to click on a link that is hiding malicious software

WHAT YOU CAN DO TO PROTECT YOURSELF:

Instead of clicking on the link, type the headline into your favorite search engine and connect via the original web site through the search engine link provided.

Use a tool like Norton's safe web tool or ExpandMyURL.  You can type in the link and get a report on the reputation of the site or the link.  Go to:  http://safeweb.norton.com/  or http://www.expandmyurl.com/


Sources:

"Experts fear cyberspammers are plotting new attack modes", Byron Acohido, USA Today, January 11, 2011.

Previous blog post, "Have Cybercreeps Gone Vegetarian on Us?" and sources from January 5, 2011.

WBTV Protecting Your Cyberturf Segment, "The New Hiding Spot for Spam", January 13, 2011.

Have cybercreeps gone vegetarian on us? The sudden drop in spam!

According to analysis provided by John E. Dunn in an article published by TechWorld, spam volumes appear to have peaked in the late summer of 2010 and then began falling.  Eric Park, in a post on Symantec's site reported the same analysis.

For example, M86 Security found that their spam measures dropped dramatically in late 2010, even with the typical high-volume period around year end and holidays.

Of course, Mega-D was caught and that outfit was a big spewer of spam.  That outfit was taken offline long enough ago that security experts do not think this can account for the drop.

So, have the cybercreeps gone good or given up "spam" for a more vegetarian diet?  The security community does not think so.  It is very likely that cybercreeps have turned their evil talents towards targeting you via social networking and mobile phones.

Case in point, Websense reported that Facebook and Twitter had an uptick in spam posts.

What can you do if your friend or colleague has a very interesting post but you are worried about clicking on the link?  One option is to go to Norton's Safe Web and type in the URL or shortened link to test it first. It's an extra step but might be worth it if the spam via email continues to drop but spam via your smart phone messages, Twitter, Facebook and other social networking sites rises!


Sources:

"Spam and Phishing Landscape:  December 2010", Eric Park, Symantec, December 16, 2010.

"Sudden Spam Drop Leaves Experts Baffled", John E Dunn, TechWorld, January 4, 2011.

The "e" in e-card for cybercreeps means "easy" to get past security

My family and friends know by now that I NEVER open e-cards without calling or emailing them first to ask them 50 questions about the card before I even consider opening it.  That might explain the decline in e-cards in my in basket?

Until now, most of my friends and family put up with it because they love me and they all know that like the kid in "6th sense" who "sees dead people", when I look at most anything I "see cyberbadpeople".

So, when I read that bogus White House Christmas e-cards were sent out to people, I absolutely cringed.  I knew, before I read the article, that people probably opened them.

According to articles I read, the e-card contained the infamous Zeus malware.

One article mentions that one of the servers used to deliver the e-cards from "the White House" was in Belarus.  It is believed that the hackers stole several gigabytes worth of data.

From the site KrebsOnSecurity, he posted the actual message sent to recipients:

“As you and your families gather to celebrate the holidays, we wanted to take
a moment to send you our greetings. Be sure that we’re profoundly grateful
for your dedication to duty and wish you inspiration and success in
fulfillment of our core mission."

The card included links with a picture of a decorated Christmas tree with a file named "card.zip".

The Zeus variant appears to have stolen passwords and used those to steal Word and Excel documents.


Sources:

"White House E-Card Spoof Steals Data", Brian Kalish, NextGov.com, January 4, 2011.

" 'White House' eCard Dupes Dot-Gov Geeks", KrebsonSecurity, January 4, 2011.

Hee Haw - Get Your Video Games and Apple Gift Cards By Way of a Mule?

Was an Apple gift card or video game under the Menorah or Christmas tree this recent holiday season?

Well, it may have come to you via a mule.   Slow down PETA members, I'm actually not talking about a new method of transit via animals, I am talking about money mules.

The Feds recently busted a major, multi million dollar ring involving two exchange students in Minnesota.  The dynamic duo, from Vietnam, are believed to be the masterminds behind a major scheme using counterfeit credit cards and taking advantage of online auctions and online stores.

It is believed that Apple, Dell, Verizon, Amazon, Paypal, eBay, and even Rosetta Stone lost money due to these alleged cybercriminals.

Investigators believe they have uncovered 180+ eBay accounts and roughly 360 PayPal accounts that were established by this ring under false information.  The tally of their evil looting?  Possibly $1.25 million.

How did they pull it off?  With money mules that wired them the money.  Mules are people that might be people duped into "work at home" schemes and have no idea they are part of a mule ring.  Some mules know exactly what they are doing.  The mules are believed to be US based and the scam ran in the U.S., Vietnam, and Canada.


Sources:


"Cyber crime trail leads to Winona State students - Feds say a transnational cyber crime ring based in Vietnam has ties to two exchange students", Dan Browning, Star Tribune, January 3, 2011.


"Foreign-exchange Students Linked to Vietnamese Cyber-Crime Gang", Camille Tuutti, The New New Internet, January 3, 2011.

" 'Operation eMule' Feds Bust Duo with 500+ eBay, PayPal Accounts", John Leyden, The Register, January 5, 2011.

Facebook gets tough on email scams

In a positive move, Facebook filed lawsuits this week against the scammers hitting it's site and it's users.

The three lawsuits filed name people and a company and accuse them of tricking Facebook users into visiting internet marketing websites.

In one of the scams, they created fake "dislike" buttons that then hijacked the user's account and sometimes their money.

There was a fake "Facebook Gold Account" offering slick features but really just took their data and sold it.

A reminder to us all that when something seems to good to be true, it probably is!

Sources:
"Facebook sues over free gift card, 'dislike' button scams", Robert McMillan, MacWorld, October 21, 2010.

Do your kids download free movies, ringtones or songs? You may get more than what you asked for. Cybercreeps hide their evil behind free downloads.

Do your kids download free movies, ringtones or songs?  You may get more than what you asked for.  Cybercreeps hide their evil behind free downloads.

Do you follow Celebrity news of actors, actresses, athletes, royalty?  

Does anyone at your home or office click on ads they see online?

If so, you or your kids or employees may be opening the door to cybercreeps and cybercriminals.

Anyone at your home following Lady Gaga on Twitter?  When McAfee, the internet security software firm, did a search in May for "Lady Gaga" on Twitter, they were led down a dark path of pornography and other adult animated content.

Got Justin Bieber fans in your house?  If your kids went to YouTube on July 4, they were redirected to porn sites.

Cybercriminals love to hide their evilness behind music and movie sites.  According to McAfee's report, especially behind "free" downloads.

When the word "free" is added to the search for music ringtones, there was a 300% increase in the riskiness of sites returned by your favorite and popular search engines.  Think Google or Bing.

McAfee's report called "Digital Music & Movies Report:  The True Cost of Free Entertainment" also noted that fan clubs have ads that may be hiding malware.  Not to be left out, YouTube and Twitter also had malicious code hiding behind links and comments when it came to fan clubs and celebrity news.

"It is fairly common to find multiple fan sites built by cybercriminals with the express purpose  of attempting to corral traffic to sell ads or infect users." Source:  McAfee Report.

It is estimated that roughly 7% of the websites providing unauthorized content, such as a free movie that should not be free, are directly linked to known cybercrime organizations.  

Even sites like the New York Times and Yahoo! Inc have had ads with malicious code sneak through their processes.  This is called "MALVERTISING".

How They Trick You:

The sites look very professional

Some sites give you a free trial period

Once they are in your computer, they may "FINGERPRINT" your computer by capturing your  software versions and other pertinent information that can be sold to 3rd parties. 

5 Easy Steps to Protect Yourself:
Keep your browsers and antivirus software up to date

Think twice or avoid clicking on links or ads altogether.  If you are really interested, go to a search engine, type in what you want to look at plus the word, "scam" and see what pops up before you click.

Tell your kids to avoid using the word "free" when searching for something and have them ask you for permission to download files to the computer

Only download music, ringtones, and movies from commercial companies

When in doubt about a company, check with your Better Business Bureau

Sources:
San Jose Business Journal, "McAfee: Digital music, video cyberthreats growing", Elizabeth Kim, September 14, 2010.

McAfee Press Release, Business Wire, September 14, 2010.

McAfee Report, "Digital Music & Movies Report:  The True Cost of Free Entertainment", by Paula Greve.

Guest Post - Ashesh Mamidi - The New Target of Cybercriminals - Small Business

This is a guest post from intern Ashesh Mamidi.


Research Outline

Topic: Small businesses

Research by: Ashesh Mamidi

Date: 07/20/2010

TEASER/TITLE: The new target of cyber criminals


SUMMARY PARAGRAPH:

Small businesses today have shifted from paper records to electronically stored information.  This so-called digitalization process has helped small businesses attain a dramatically more efficient way of doing business. On the other hand, this has also opened new doors for cyber criminals to penetrate a small businesses' data system.  This trend could result in massive financial and retail security fraud and breaches over the next decade.

Criminals will find new avenues to get malicious software onto a small business' computer systems.  There will be attempts to embed malicious software into the downloads of software from reputable vendors.  If software isn't authenticated, then attempts will be made to intercept software being downloaded and replace it with malicious versions.  This is a wake-up call for small businesses because security issues with the Internet will cause dramatic loss of revenue for these entrepreneurial enterprises in the years ahead.

These small businesses are the easy targets for the cybercriminals and more than money, the criminals are interested in the intellectual property which they can use elsewhere to gain financially.


KEY FINDINGS:

• Criminals are targeting companies that have PII: Personally Identifiable Information (PII) is at risk. The breakdown of identity theft cases is as follows (2009):
• 26% credit card fraud, 18% utilities fraud, 17% bank fraud, 12% employment fraud, 5% loan fraud, 9% government fraud, 13% other.

• Criminals are targeting company bank accounts


• Criminals target other information:
• Data about them or their customers such as Credit card, Social Security and bank account numbers.
• Loss of intellectual and financial property – It is estimated that losses can range from $20 to $90 billion annually to upwards of $240 billion a year.
See statistics at:
http://www.ojp.usdoj.gov/ovc/ncvrw/2005/pg5i.html

METHODS DEPLOYED TO BREAK THE “LOCKS”:
• Virus - Studies in December 2007 have shown that the effectiveness of antivirus software has decreased in recent years, particularly against unknown or zero day attacks. The German computer magazine c’t found that detection rates for these threats had dropped from 40-50% in 2006 to 20-30% in 2007. In general antivirus software removes only one-third of all the viruses.
.
• Malicious software – It gives partial to full control of the computer to do whatever the malware creator wants. The damage done can vary from something slight as changing the author’s name on a document to full control of the machine without our ability to easily find out. Malicious software lurks behind emails, links on social networking sites, and in legitimate downloads.



RECOMMENDATIONS:

SOFTWARE PROTECTION:
• Consider Anti-virus software like Shield Deluxe-Antivirus Protection, Trend Micro Antivirus Internet Security 2010, Norton Antivirus 2010and anti-malware software like Avira, Threatfire, Combofix etc.
• Discuss Implementation of Several Packages: Combining Anti-Virus, with Anti-Spyware, Intrusion Prevention Service, and Application intelligence can deliver stronger network security protection against a comprehensive array of dynamic threats. The combination helps combat viruses, spyware, worms, Trojans and software vulnerabilities such as buffer overflows, as well as backdoor exploits and other malicious code. This provides application layer attack protection not only against external threats, but also against those originating inside the network. The lower layer technologies like SSL/TLS, firewall and IPSec support application layer security.

CLOUD or SaaS: In-the-Cloud security services may offer an easy and affordable solution for small businesses, especially for those that cannot afford an extensive, dedicated IT staff. Some cloud computing services offer better business continuity options and more sophisticated technology than small business do-it-yourself teams can do.

INTERNET USE POLICY - An internet acceptable use policy clearly defines how employees should and should not use the internet at work. For example:
• Instructions on what to do before downloading material, checking the size of the file and its source.
• A warning to abide by any copyright and licensing restrictions on internet-sourced material.

CONTENT FILTER - Content filtering is the technique whereby content is blocked or allowed based on analysis of its content, rather than its source or other criteria. It is most widely used on the internet to filter email and web access; basically used to filter spam.

SEPARATE COMPUTERS: Keep business and home computing separate.

EMPLOYEE AWARENESS – Phishing, a method of capturing confidential information over the internet, mainly takes place by using emails which appear to be coming from a trusted website source. Things to do for employee awareness and email protection:
• Ignoring suspicious mail which ask for personal information
• We should never try to give credit or debit card information in response to emails.
• Change the password regularly.
• Use strong passwords

SAFE INTERNET CONNECTIONS: Wi-fi safety such as using secure sites (a site whose web address starts with https instead of http is always secure), making sure that no one is watching you when you enter personal information or when entering PIN code at an ATM, being careful while sending sensitive data when using a public wi-fi hotspot.


BACKGROUND:

Small businesses are a target now more than ever before. Malicious security threats—particularly those executed via the Web—are abundant as an unprecedented number of botnets, Trojan horses and self-replicating worms, created and executed by organized criminal networks, are unleashed on networks to steal personal and financial information.  In 1999, it is estimated that Fortune 1,000 companies sustained losses of more than $45 billion from theft of proprietary information, with insiders to the organization being seen as a higher than average threat. Borrowing software from work for personal use accounts for some of the $12 billion lost to software piracy worldwide.

A lagging economy has caused many companies to rein in their IT budgets, opening small businesses up to attacks simply because they lack the money and staffing for proper security infrastructure.

The lack of resources paired with a lack of awareness about security issues create gaps in small businesses security policies regarding behavior and best practices.




ANALYSIS:

DATA BREACHES: 47% of Small Businesses have lost confidential data in the past and huge percentage of loss came from deliberate theft (52%) as opposed to accidental data loss. Of this figure, 24% was attributed to people outside the organization, and insiders were found to account for 16% of illegal data loss, with loss through partners at 15%. 30% of firms who don't password protect their laptops, are running the very real risk of harming their businesses and reputations through losing confidential data by accident.
Statistics referred from:
http://www.newstatesman.com/technology/2010/06/cyber-attacks-businesses-risk

LACK OF PROTECTION: Nearly one-fifth of small businesses don't even use antivirus software. Sixty percent don't use any encryption on their wireless links, and two-thirds of small businesses don't have a security plan in place. The majority of small businesses and even some medium size businesses do not have the dedicated IT support needed to monitor their computer networks and protect themselves from attack. Finally, many small business owners understandably lack the expertise to deploy the software or hardware solutions available to address ever-changing security challenges.

BUSINESS BANK ACCOUNTS HACKED: Vulnerable businesses, have sustained tens and even hundreds of thousands of dollars in losses, with little hope of recovering the money. Some have filed lawsuits against banks, charging that they failed to detect and stop transactions that were patently fraudulent. For example, Hillary Machinery Inc. filed a lawsuit against its bank, PlainsCapital, after online crooks used stolen credentials to transfer more than $800,000 from its account last year. The bank later recovered about $600,000 of the stolen funds but has so far refused to compensate the Plano, Texas-based manufacturing firm for the remainder.

Statistics referred from:
http://www.computerworld.com/s/article/print/9168458/Cyberattacks_raise_e_banking_security_fears?taxonomyName=Security&taxonomyId=17


IMPLICATIONS:

Businesses of every size rely on the Internet. Innovative use of the Internet can confer a competitive advantage on small and medium sized businesses. That edge can be dulled or even eliminated by cybercriminals and other threats. A single breach in which a business owner or their customer’s data is stolen could literally destroy a small business. Less dramatically, but perhaps as importantly, common Internet risks like spyware and malware can damage computer software and wreak havoc on productivity. So can employee access to non-work related web sites. Blocking certain websites in a work environment is easy to do and greatly reduces risk.

Such cyber thefts have led multiple businesses to file lawsuits against their banks and prompted government regulators to call on financial institutions to improve their security systems.


RECOMMENDATIONS:

There is no one size fits all approach and every business will have its own risk exposures. If you are a business owner, consider having your business evaluated for risks of cyber attack or data loss. Business owners need to stay on top of the threat by implementing a sound data loss and privacy plan.

SOURCES:

1) "Small Business IT Channel News for VARs and Technology Integrators--ChannelWeb." Channel News, Technology News and Reviews for VARs and Technology Integrators--ChannelWeb. Web. 19 July 2010. .

2) Statesman, New. "New Statesman - Cyber Attacks Cost Small and Medium Businesses £200,000 Annually." New Statesman - Britain's Current Affairs & Politics Magazine. Web. 19 July 2010. .

3) "U.S. Small Businesses Vulnerable to Cyber Attacks, Says VirnetX Research Director -- SCOTTS VALLEY, Calif., Feb. 10 /PRNewswire-FirstCall/." PR Newswire: Press Release Distribution, Targeting, Monitoring and Marketing. Web. 19 July 2010. .

4) Parental Controls, Internet Filter, Online Safety Software and Services | CyberPatrol. Web. 19 July 2010. .

5) Vijayan, Jaikumar. "Cyberattacks Raise E-banking Security Fears - Computerworld." Computerworld - IT News, Features, Blogs, Tech Reviews, Career Advice. Web. 19 July 2010. .

6) 23, Folino |  Nov. "Is Your Small Business Cyber-Secure?" Small Business and Small Business Information for the Entrepreneur. 23 Nov. 2009. Web. 19 July 2010. .

7) Goldman, David. "What Cybercriminals Do with Your Information - Sep. 16, 2009." Business, Financial, Personal Finance News - CNNMoney.com. 16 Sept. 2009. Web. 19 July 2010. .

8) "Cyber Liability : Connecticut Business Litigation Blog." Connecticut Business Litigation Blog : Connecticut Business Lawyer & Attorney : N. Kane Bennett : Raymond & Bennett Law Firm : Hartford, Middletown, Glastonbury. Web. 19 July 2010. .

9) Thompson, Steve. "FBI Warns Small Businesses about Rising Cybercrime Dangers." Merchant Account & Credit Card Processing Guide - MerchantAccountGuide.com. Web. 19 July 2010. .

10) "Create an Internet Usage Policy | Business Link." Business Support, Information and Advice | Business Link. Web. 19 July 2010. .

11) "Content Filtering." Wikipedia, the Free Encyclopedia. Web. 19 July 2010. .

12) "Network Security, Firewall & Wireless - Gateway AV, SPY & Intrusion Prevention Service - SonicWALL, Inc." SonicWALL - Select Your Region or Country. Web. 19 July 2010. .

13) http://ezinearticles.com/?What-is-Phishing---Email-Phishing-Protection-Tips&id=4213593

A Real and Growing Problem - Cyberscumbags Hijacking Social Media Accounts

See Charlotte's CBS Story - 1 person knows 2 victims:  http://www.wbtv.com/Global/story.asp?S=12396739


Our Word for the Week:  KOOBFACE.

Koobface is Facebook scrambled.   This malicious software targets users of social networking websites such as Facebook, MySpace, and Twitter.  It’s purpose is to infect your PC and try to collect information about you or others via your computer such as credit card numbers, bank account information, and other details.  

A SCAM YOU NEED TO KNOW ABOUT:

1.8 Million!  That is the number of hits you get when you type in “What To Do If Your Account Was Hacked” on Google.

Cybercreeps are using every trick in the trade to take money from you and your friends.  A scam you need to know about involves cybercreeps hijacking your Facebook, email, or Twitter accounts to get to your friends.  

Picture this Scenario:

Your heart pounds and you can barely comprehend the message you got from your friend.  Your friend just sent you a message online -  The message mentions real and personal facts about their life such as a sick Dad or a trip they are on.  You say something supportive and then your friend mentions she or he needs a small sum of money in a pinch and quick.  You want to help your friend but if you are not careful, you will find yourself in the middle of a scam. 

This is scary.  It is happening to very internet saavy people.  Theresa had a social media professional contact her to ask for help.  Cyberthugs had hijacked her Facebook account and email.  Not only were they sending messages asking her friends for money, they also began setting up new accounts and profiles in her name!  The kicker is, she could not get immediate help at Facebook or her email service provider so the cyberscumbags had her account hijacked for weeks.  Her accounts are essential to her business.  The social media professional believes she was targeted because her list of contacts is so large.  This is not just annoying, it’s impacted her business.  She wants me to educate others about this.  She and I both agree that if it can happen to a social media expert, it can happen to anyone.

How to tune your antenna to spot this scam:

1.    SHOW ME THE MONEY:  Anyone that needs money wired to them quickly, it is most likely a scam.

2.    E-CHAT ONLY CONTACT:  Only communicating with you via online and not willing to let you call them.

3.    GRAMMER:  Bad grammar is usually a dead give away.

4.    TRUST BUT VERIFY:  Ask a few questions that may not be easily found on their accounts such as, “Where did we first meet?” or, “When I last saw you, what did we talk about?”

A NIGHTMARE COME TRUE.  READ ABOUT A SOCIAL MEDIA EXPERT'S EXPERIENCE:

Caitlin runs a Social Media business.  Facebook, Twitter and Email are her lifeline to her customers and colleagues.  She's as saavy and connected as they come.  She knew social media sites are risky but figured, when the time came, if she needed help, she could get it.  

She had no idea how at risk she really was.

About 3 weeks ago, she sent out a couple of emails.  She then linked her Facebook and Foursquare accounts using a service.  

About 10 minutes later she could not get into her email on her phone.

It was not long before her phone started ringing non stop.  A friend called her and said, "I think your account has been hacked, I'm getting weird emails."

Frantically, she tried to get into her email account and could not.  Her Mom contacted her and read her the emails, "I'm stuck in London.  I need help getting home.  Please email me back if you can help me out."

Friends start calling her and were worried.

She went to Facebook and posted on her Facebook account that something was wrong with her email and not to respond.

Then the hackers took over Facebook and started spamming her friends.  They had conversations with up to 30 people.  They chatted with her network pretending to be her. 

That's when they started asking for money.

The story takes an ugly turn.  

Caitlin had not shared with her network of friends and customers that her Dad is in poor health.  She confided in a few about his condition, some via email. 

The cyberscumbags trolled through her email and learned that her Dad is in poor health.  They used this information to appeal to people's hearts and emotions.  They started telling people her Dad died.

Caitlin tried to contact Twitter, Facebook, and Gmail to get help.  She was faced with a bureaucracy of forms to fill out.  She could not find a human being.

Caitlin begins to worry about her business reputation.  She's spent 2 years building her blog and was worried they would take over that.

Frankly, she was helpless.  

When I talked with her and asked her what help she received, she said, "Only 2 people helped me.  Richard (who is a colleageue) and you.  Not one person from any of the companies got back to me."

To make matters worse,  Facebook kept rejecting her forms to ask to be let back in.  

She did finally get control of her Facebook account - 3 weeks later.  

In the meantime, the hackers opened up a Microsoft email for her and forwarded her gmail account to that new account.  

It took her 2 days to get into her original account.  

When she got in, they had ransacked her email and removed all financial information from her email.  These cybercreeps had the audacity to pull emails out of her account about her personal life.  

The cybercreeps contacted people on Facebook they directed them to new email account that they had created under fraudulent circumstances.

She contacted Microsoft to ask them to shut down the account and nobody every got back to her.

What upsets Caitlin the most?  "They did not take advantage of me.  They took advantage of my network.  The people that were really harmed, was the secondary group that are not as close to me but still care about me."

Thankfully, nobody lost any money.  2-3 people almost did send the money but Caitlin got to everyone before they did.

Caitlin sums up the experience in two words, "Total nightmare."

"I was literally sitting there watching them take over my life.  I had friends calling me saying they were talking to the hackers online."  

Caitlin filed a report with the FTC and local law enforcement.   

"I really hope people understand the house of cards that we have in the social networking sites.  There is nothing you can do, there is nobody you can call.  Law enforcement is really more interested in what they are doing to my banking account vs. my Facebook account."

People with LARGE networks are the most at risk for this type of hijacking.

"I used to use the same password for Facebook and Gmail.  I think they may have cracked my Facebook password somehow.  I will never trust the social media space the same way.  I really had an eye opener.  Like a lot of people, I had a false sense of security that if I really needed someone that I could get someone to help you.  I look at what I put online differently.  This is really at an risk thing."  

Caitlin also added, "I went to all of my clients and told them to change all their passwords."

When I asked her how she felt now and if she felt her accounts were finally clean and free of cybercreeps she said, "No, I don't trust that my accounts are completely clean."

HOW TO AVOID THE H.A.C.K.:

1.   H: Have a routine in place to regularly change your social network passwords.

2.   A: Always antivirus.  Sometimes your account may be easy to hijack via a virus on your computer. 

3.   C:  Choose a different password for each of your accounts. 

4.   K:  Keep private details of your life off of social media accounts.  It’s harder to act like you if they can’t read it in your profile.

WHAT TO DO IF YOU OR A LOVED ONE HAS BEEN HACKED:

FACEBOOK:

To report this kind of scam to Facebook, visit: http://www.facebook.com/help/contact.php?show_form=419_scam

Facebook write up on the hacked account and money transfer scheme:

http://www.facebook.com/help/?page=420#!/help.php?page=1010

How to report your account as hacked:  http://www.facebook.com/help/?page=420

TWITTER:

http://help.twitter.com/forums/10713/entries/31796

GMAIL: 

http://mail.google.com/support/bin/answer.py?hl=en&answer=50270

See also:  http://www.eztechtips.com/has-my-gmail-account-been-hacked/

DO YOU HAVE A VIRUS?

It is possible that this scenario might have happened through a computer virus.  

Stop using your home and work computer until they are checked out.  Call your computer support desk or seek out a local expert to assist you with your computer to find and isolate the virus.

Microsoft provides free virus and spyware removal support to Windows customers who think they have an infected computer.

Call:                    1-866-PC Safety for phone support.

Online:           Microsoft customers can also visit http://safety.live.com for 

free online virus and spyware removal.

Apple provides help to computer users that believe their Mac may be infected.

Call:                    1-800-APL-CARE (1-800-275-2273)

Online:         Set up a phone appointment 

http://www.apple.com/support/expert/ or, 

request an in-person appointment at your closest 

Apple Store’s Genius Bar:  

http://www.apple.com/retail/geniusbar/ .

BANK ACCOUNTS / CREDIT CARDS:

Check your banking and credit card balances regularly after something like this occurs.

I recommend online alert services where you can set up alerts to notify you if a transaction takes place or if a transaction is over a certain amount.  Go to your online banking and credit card page for more information.

CREDIT REPORT:

As a precaution, also FREEZE the credit file.  Request alerts on your credit reports.  .

Online:

Equifax:                  http://www.equifax.com

Experian:                    http://www.experian.com/

TransUnion:                  http://www.transunion.com/

North Carolina offers a free credit freeze for victims of identity theft - Go to the following website for more information:

http://www.ncdoj.gov/News-and-Alerts/Alerts/Freeze-your-credit-for-free.aspx.

LAW ENFORCEMENT / AUTHORITIES:

Engage authorities.  They are committing fraud.

a.  File a report at the FBI's IC3.gov. 

b.  Contact the Federal Trade Commission.  

Federal Trade Commission:

Call:                    877-IDTHEFT or 877-438-4338

Online:          http://www.consumer.gov/idtheft

PRIVACY RIGHTS:

You may also want to review your Privacy Rights at www.privacyrights.org for more information.

Guest Post - Nick Volpe - Summary of What's Hot in the Security Headlines

Guest Post from Nick Volpe.  Spring Semester Intern at Fortalice®, LLC.  Attending Immaculata University.

Facebook Expect to Launch Location-Aware Feature

It seems as if Facebook has long been put into the hot seat over its data privacy features. More specifically, what settings Facebook deem are appropriate defaults have come under scrutiny with less sophisticated users not knowing what information from their profile is available to whom and how to change that selection of information. In April 2010, Facebook will begin to allow its registered users to share their geographical location with their friends in their news feeds. The supposed location-based feature(s) are expected to be unveiled in late April at Facebook’s annual f8 developer conference in San Franscisco. According to company reports, the feature will be opt-in allowing users to choose if they wish to participate or not. Given the companies track record on security, however, users should be vigilant and check changes to privacy policies and settings. The news comes after popular micro blogging competitor, Twitter, announced a similar location-based feature for their offering. Officially, Facebook will neither confirm nor deny the anticipated announcement.

Sources:

AllFacebook.com: “Facebook Prepares To Release Location Service At f8” by Nick O’Neil http://www.allfacebook.com/2010/03/facebook-prepares-to-release-location-service-at-f8/
NYTimes.com Bits Blog: “Facebook Will Allow Users to Share Location” by Nick Bilton http://bits.blogs.nytimes.com/2010/03/09/facebook-will-allow-users-to-share-location/
PC Magazine: “Report: Facebook to Add Location Info to Updates” by Brian Heater http://www.pcmag.com/article2/0,2817,2361237,00.asp

New Statistics Show About 12% of Employees Willingly Violate Company IT Policy

One of the biggest and most difficult to address points of failure in terms of IT security problems is employee error. According to a new survey conducted by firm Harris Interactive, 12% of the United States workforce claimed to have willingly violated their companies IT policies. The employees are something that IT departments need to worry about maybe even more so, in some sense, than antivirus and malware infection in the network. IT departments and companies simply are not tough enough on enforcing their policies as they should be thus making employees the largest cause of corporate data loss.

Sources:

Ars Technica: “Bad employee! 12% knowingly violate company IT policies” by Jacqui Cheng http://arstechnica.com/business/news/2010/03/bad-employee-12-knowingly-violate-company-it-policies.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss
Pivotal Payments: “12% of employees intentionally breach corporate IT policy, study shows” by Kristen Lawrence http://www.pivotalpayments.com/ca/industry-news/12-of-employees-intentionally-breach-corporate-it-policy-study-shows-19667517/                                                               

Highly Marketed Identity Protection Agency LifeLock Fined by FTC

The identity protection industry is highly lucrative and popular amongst individuals that aim to keep their confidential information private. There are firms that, for a monthly fee, claim to protect your identity by closely monitoring credit reports and other identifying accounts and information in order to protect your identity or at least attempt to do so.
LifeLock, one of these identity protection services, was fined by the US Federal Trade Commission for false advertising. The company guaranteed its clients that for as long as they paid, their identity would never be stolen and they would not be susceptible to fraud. As it turns out, you really can’t guarantee that a person’s identity can’t or won’t be stolen. There are simply too many factors in that. Ironically, the CEO of LifeLock, who freely gave out his social security number publicly as a testament to his service, fell victim of identity theft himself.

Sources:

Total Bankruptcy: “LifeLock Fined for Inappropriate Identity Theft Protection Claims” http://www.totalbankruptcy.com/blog/lifelock-fined-for-inappropriate-identity-theft-protection-claims/
Ars Technica: “LifeLock fined $12 million over lack of life-locking ability” by Jacqui Cheng http://arstechnica.com/tech-policy/news/2010/03/lifelock-cant-guarantee-id-theft-prevention-after-all-settles-with-ftc.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss