Search

Phishing scams can now occur through traditional mail, not just on the internet. The State Office of Criminal Investigation of Lower Saxony in Germany has warned about fake letters from banks that contain personalized information and official logos, making them appear authentic. These letters prompt recipients to scan a QR code, which leads them to a fake website where their login credentials are stolen. To stay safe, individuals should be cautious of unexpected letters, verify their legitimacy with their bank, and avoid scanning unsolicited QR codes without verifying their trustworthiness. If a QR code phishing scam is encountered, the account provider should be immediately informed, account access should be blocked, and passwords should be changed. [Extracted from the article]

Phishing scammers are targeting LastPass users through phone calls and emails, impersonating the password saving service. The scammers alert users that their account has been accessed from a new location and instruct them to press certain numbers to stop the hacker. They then ask for the user's email address and send a phishing message to steal their login information. Once the scammers have the master LastPass password, they lock the real user out and gain access to their saved information, including banking and medical details. LastPass has been frequently targeted due to its large user base and all-in-one personal data setup. The company has experienced high-profile hacks in the past and has shut down the site used for the latest phishing attempt. However, it is likely that the scammers will try again with a different URL. [Extracted from the article]

To counter rising threats, Google has redesigned the Chrome browser's built-in protection scheme with the revamped Safe Browsing. "A real-time check will result in only the current "known" verdict for the URL", according to information from a Google PR representative. [Extracted from the article]

But in the wake of this Experian leak, you should pay extra attention in a few specific situations: Receiving calls or messages from so-called Experian representatives. You could receive a phone call, text message, or email from someone who says they represent Experian, claiming you must respond to a matter or verify personal information. DEPARTMENTS Experian, one of the biggest consumer credit reporting bureaus, likely put your full credit history into the hands of identity thieves last year. [Extracted from the article]

Known as open redirect links, the structure of the link begins with a primary domain, then includes a string of analytics data and a final destination site. But as Microsoft describes in a post on its security blog (go.pcworld.com/phcm), this phishing strategy uses open redirect links to exploit an average end user's security training. But on Tuesday, Microsoft shared details on a kind of phishing attack it's seeing more frequently: Email with links that contain a known website at the start, but actually redirect to a malicious page. [Extracted from the article]

The article focuses on computer security treats and software tools to protect against them. It states that malware, spyware, and viruses are still prevalent and can be found in all parts of the Internet. It mentions several antivirus products, including Bitdefender Internet Security, G Data Internet Security, and Norton Internet Security. It comments on software tools that also protect against malware including the freeware utility Sandboxie and OpenDNS. It also mentions that many wireless routers do not turn on security by default and recommends enabling encryption. It talks about the importance of firewalls to protect against hacking attempts and talks about methods of protecting against phishing and scam websites. It also comments on parental controls and search engine filtering. INSETS: Turn On Wi-Fi Encryption;Password-Protect Your Smartphone and Tablet;Install Security Apps on Your Phone and Tablet;Use a Strong Wi-Fi Security Password

The article provides information on the upgrades made by Microsoft and Mozilla to their browsers. Both companies have come out with nearly simultaneous major versions of Internet Explorer (IE) and Firefox, respectively. Firefox 2 offers no radical changes compared with version 1.5. A built-in antiphishing tool makes its first appearance, but most other changes simply refine many of the same features that are new to IE 7. Microsoft had further to go to bring IE up to par with the competition and so IF 7 is a more thorough overhaul of its predecessor.

The article discusses several security risks and how to avoid them. In order to prevent botnets, avoid unknown sites and never click links in unsolicited e-mail. Also remain suspicious of e-mail attachments. One could avoid the risk of data stealing by using a firewall that can block unknown programs from communicating with the Net to keep keyloggers from phoning home. This can also be prevented by cycling passwords and not using the same name and password at multiple sites. Phishing can be avoided by not trusting an unsolicited e-mail message from any company and using antiphishing toolbars.

This article provides ideas to ensure online social networking security for the identity and personal data of users. It expresses some concern over phishing attacks that affect the privacy of users. It advises users to refrain from posting things online that they will regret later. The adverse consequences of posting inappropriate online comments are stressed. In addition, the article discusses the concern over the permanence of accounts and account data on online social networks. It notes that Facebook does not seem to provide a method for completely deleting an account.

This article looks at the top Internet security threats and offers some preventive measures against security attacks. As the most widely used browser, Internet Explorer (IE) provides the biggest payoff for malicious hackers who set out to exploit its flaws. Regardless of which browser is set as the default on a system, always keep Windows updated to minimize the risk. When one take the bait, the phisher harvests the data, and either sells it to someone else, or uses it to drain one's account right away. Both IE 7 and Firefox 2 include new antiphishing settings that can compare links to databases of known phishing sites before displaying the page. Any program that users download and run on a system could potentially result in a lethal infection or zombification.

The article looks at spammers hijacking email accounts to bounce spam email to the account holder's contacts. Topics discussed include spammers' use of spoofed email headers to make it appear as though spam messages originated from a hacked account and how to treat a computer infected with a botnet. Recommendations are presented related to computer security practices including using a primary email address to communicate only with trusted associates and using a throwaway free email account when sharing an email address in a public forum.

The article discusses the rising danger in computer security in 2012 as the growing number of mobile devices offer malicious hackers new avenues in which to expand their cybercrime. It says that mobile infections will continue to increase in 2012 as the number of devices increases further especially on Android products. The author adds that attackers hacked accounts and distributed phishing come-ons, malware and other scams to Facebook users, the danger of which spread via scripting flaws, comments, photo tags, links and wall posts. The thriving threats on personal computers (PC) are also discussed.

The article offers tips to avoid mobile malware. One example of malware is the DroidDream Trojan horse, which infected thousands of smartphones. The Android platform is the preferred target for malware makers because it lets users to load custom applications. Smartphone users are advised to avoid unfamiliar applications and conduct thorough research before downloading for their protection. There are mobile antivirus software such as Lookout Mobile Security that offer protection from phishing attacks. Security companies such as AVG, McAfee and Symantec offer a downloadable mobile application for protecting smartphones.

This article reveals several ways of phishing developed by computer hackers. It notes that computer hackers added theft of log-in credentials to games and personal passwords to online social networks in their phishing activities. It highlights the use of rogue antivirus products as phishing instruments. In addition, the article warns about a seemingly personalized e-mail message, containing a fake online chat option. It advises to use a strong browser and antimalware software to prevent phishing attacks.

The article discusses phishing attacks that spread through the microblogging service Twitter. In January 2009, a hack compromised the accounts of several high-profile users, including U.S. President Barack Obama while in April 2009, a Twitter worm surfaced and Twitter shut it down fairly quickly. Aviv Raft of RSA announced "A Month of Twitter Bugs" during which researchers plan to disclose a Twitter vulnerability daily. According to Raft, his goal is to improve the service and address all social networking flaws. Examples of Twitter phishing attempts are presented. An advice when using Twitter is also offered.

This article focuses on the people-driven security features being integrated into anti-malware, spam blocking and filtering programs. OpenDNS's Domain Tagging, introduced in February 2008, is a free Web-filtering service allows subscribers to block sites in their choice of categories. OpenDNS's PhishTank, launched in 2006, identifies phishing sites based on user submissions and community analysis. Mozilla's upcoming Firefox 3 browser, however, will use the Google blacklist to block known malicious sites.

The article provides computer-related news briefs on topics including smartphone tracking applications for Android and Blackberry devices, a protection plan for unlocked chips by the company Intel, and an initiative by Internet companies including Google, Microsoft, and Facebook to prevent phishing.

The article discusses scams on the social networking site Facebook, made up of malicious applications for everything from phishing to spam to a first step toward installing more dangerous malware onto one's personal computer (PC). The author suggests for Facebook to test programs before allowing its users to add them, then mentions Facebook's security page at facebook.com/security, which features advice and warnings about ongoing scams. The author recommends to wait it out before approving a photo-tagging comment for a Facebook application.

The article reports on Webmail accounts as a major target of attackers' scam e-mail. It is noted that scammers are accessing such accounts to send e-mail messages to the victims' entire contact list, often touting a Web site or even asking for money directly. Among the victims was former accountant Maureen Arnold from Apache Junction, Arizona. A report from the Anti-Phishing Working Group claims that the most common types of tog-ins stolen by keylogger malware are for financial Web sites and Webmail.

The article reports that spamming incidents have increased amid the 2009 economic crisis. According to security software vendor Symantec, spam declined by 1.3% to 73.3% of all electronic mails in February, but jumped to as high as 79.5% at the start of the month. The trend is to use links to well-known search engines. Symantec also reported that phishing incidents likewise increased.

The article discusses a MessageLabs Intelligence report on security issues and threats, which cites a popular tactic in 2008 among cybercriminals involving the use of fictitious accounts on social networking sites to post malicious links, which usually led to phishing sites. Scammers would then exploit the phished personal information, such as user names and passwords, to access legitimate accounts in order to post comments on the pages of the victims' friends that contain spam or links to phishing scams. According to the report, January saw the emergence of spam messages that mimicked notification electronic mail (e-mail) from two major social networking sites.

The author relates the Internet fraud he encountered. He notes the six phishing expeditions he encountered, including a message that gave him a bank account number and a personal identification number (PIN) so that he could confirm his account balance at Habib Bank Ltd. He also encountered four phone calls on his unlisted BlackBerry phone and on his office phone, alerting him that his car warranty was about to expire, but he do not have warranty coverage on his car.

The article reports that technical drawbacks in web browsers could enable phishing without electronic mail messaging. According to researchers at security firm Trusteer Ltd., a new type of attack could help criminals steal online banking credentials by replacing the electronic message with a pop-up browser window. It states that a technical defect in the JavaScript engines of all of the most widely used browsers could help attackers to convince victims of the legitimacy of the pop-up notice.

The article focuses on the disadvantages of using Internet Explorer (IE) 7 developed by Microsoft and the OneCare antivirus application. IE 7's troubles continue with a proof-of-concept phishing exploit published by security researcher Aviv Raff. Using it, an attacker could fool users and IE with an e-mail or Web link to a doctored error page that, when refreshed as directed, would send users to a phishing site disguised as a legitimate destination. Meanwhile, Microsoft has patched a problem with the way its OneCare antivirus application was handling Outlook (.pst) and Outlook Express (.dbx) e-mail files.

The article offers information on the emergence of an online threat that takes advantage of Web site programming flaws to try to access its online accounts. Google recently fixed such a flaw that malefactors could exploit to steal a Gmail user's full contact list. The threat used the arcane-sounding "cross-site request forgery" (CSRF) strategy. The ploy is similar to cross-site scripting (XSS) attacks, in which attackers booby-trap a trusted site by rigging it with links that take the visitor to malicious destinations. But whereas XSS attacks exploit the trust that a user has for a site, CSRF attacks exploit the trust a Web site has for a user, according to WhiteHat Security chief technology officer Jeremiah Grossman.

The article offers an update on the alarming number of phishing sites that emerged on the Internet and the efforts of computer security experts to battle online fraud. Last October 2006, both Mozilla and Microsoft released new versions of their browsers that use blacklists to block access to known phishing sites. In response, resourceful phishers are flooding new fake Web sites onto the Internet too quickly for them all to be shut down or blacklisted. According to security experts, Rock Phish pioneered many of the techniques that have contributed to the dramatic increase in phishing sites in recent months.

The article reports that SMiShing, a term coined by researchers for the McAfee security software firm, describes a form of phishing in which the bad guys send an SMS (short message service) message to a person's mobile phone. The first such messages purported to come from dating-service Web sites. Victims would receive a message announcing that the site intended to charge them $2 a day unless they visited the URL listed in the message and followed the steps outlined there to unsubscribe from the service.

The article considers several trends in the computer industry. According to McAfee Avert Labs, short message services-based phishing attacks, or SMiShing, are on the rise. One example of SMiShing is getting a message saying that the user signed up for a service and will pay $2 a day unless he/she visit a Web site and unsubscribe. The beta program Google Apps for Your Domain will enable small offices and Web site administrators to trade their e-mail systems for Gmail. Hewlett-Packard is pushing a legislation about pretexting, the illegal practice of obtaining phone records, credit card data, or other information under false pretenses.

This article offers advice on avoiding a cross-site scripting attack. Lance James, chief scientist at Secure Science, a company that tracks cybercriminals who engage in theft of financial information, recommends using the Netcraft Toolbar, which comes in versions for both Internet Explorer and Firefox. James said it is very aware of phishing and has a great repository of phishing sites. Netcraft's Toolbar looks for suspicious URL anywhere within a Web address. Rich Miller, Netcraft analyst, said in general, if a URL looks really strange, particularly with nontraditional characters on the end of it, one has to be careful.

The article focuses on the backup services and antiphishing tools offered by AOL, McAfee, Microsoft and Symantec. Microsoft has launched Windows Live OneCare, which combines antivirus, antispyware and firewall tools with Windows' defragging and clean-up utilities in one easy-to-use interface. McAfee's Total Protection came out in public beta, with a final version scheduled for late summer. Symantec's Norton 360 should appear by March 2007 and AOL unveiled a members-only beta of its Total Care suite.

The article presents information on the security software developed by Internet service providers. America Online's (AOL) Safety and Security Center has combined the company's spam-protection, parental-control, pop-up-blocking and antiphishing tools together with the firewall, antivirus and antispyware components of McAfee's suite. AOL blocks many Internet threats at its servers as well as phishing attempts and spam before it reaches its customers. Meanwhile, Earthlink has purchased the antispyware software company Aluria in 2005 which led to the creation of an all-in-one security package called Protection Control Center.

The article discusses the results of a study on the existence of browser plug-ins and other tools that can detect phishing sites in the U.S. in 2006. Browser plug-ins provides a visual warning when an Internet user is on a site that is trying to pass itself off as something it is not. Some browser plug-ins assemble a list of fake sites based on reports from users who have encountered them. There are other plug-ins that analyze the address of each site in order to check if it is misleading. Other options, such as the EarthLink Toolbar with ScamBlocker, are also available. Such option alerts a user with a pop-up message when he visits a site that has hosted phishing attacks.

The article describes security appliances that protect a computer from viruses, spyware and other threats. Both the Netgear's WGT624SC Super G Wireless Router and TrustEli's Eli Security Appliance devices include software to protect against viruses, spyware, phishing attacks and a spam plus a firewall and software that filters objectionable web content. The Spam Cube has limited functions compared to the two appliances. It filters spam and scans email for viruses. The Spam Cube is the easiest to set up among the three. Just plug its one end into a broadband connection and the other into the network gateway. The appliance suspects messages by adding a SPAM or VIRUS label to the e-mail subject line.

This article offers tips on updating Microsoft Office application programs. It provides details about installing downloadable patches for having optional updates available for each program. It also gives information on how to use PowerPoint's Slide Master feature as well as Outlook's antiphishing technology.

This article offers advice on protecting computers against video attacks. Microsoft just patched a hole in the way that Windows Media Player (WMP) handles AVI videos, a flaw that could permit an attack program to infiltrate computers. To display the AVI files, WMP uses a playback technology called DirectShow, a component of Windows DirectX that enables hardware acceleration features and allows applications to display graphics. Without the patch, DirectX versions 7 through 9.0c running under Windows 98 through XP Service Pack 2 are vulnerable to the flaw. A researcher at eEye Digital Security identified a way that a bad guy could booby-trap a seemingly benign AVI. The attacker could then embed the poisoned file in a Web page and set it to autoplay in the background, or send it to unsuspecting users as an attachment or a link in an electronic mail message. INSET: Skype Patch.

Presents an update on the Internet industry as of January 2006. Description of the secure phish; Impact of the competition from Internet telephone providers on the business of traditional telephone carriers; Information on the PhysX chip from Aegia.

This article presents information on spear phishing. According to Peter Cassidy, secretary general of the Anti-Phishing Working Group, spear phishers act much like marketers, drafting a message and then directing it to just the right people. He said that these phish attacks make better use of social engineering to trick people who are tuning out the widespread spam of typical phishing attacks, but who might not expect an e-mail aimed at a smaller company or organization. Based on the Global Security Index report of IBM, intercepted spear-phishing attempts exploded to more than 600,000 cases in June 2005.

This article offers a couple of tips to counter phishing. A user probably knows the best defense against phishing: Do not click any of the links within a suspicious message. Instead, type the URL into browser's address bar, log in as normally would, and then check to see whether the account has problems. But some companies have to find better ways to communicate securely with their customers. Some businesses are using small dedicated applications to get messages to customers, says Anne Holland, publisher of MarketingSherpa. If banks can get people to download an application for banking and keep that on their computer, that might get past phishing, she added. Another option is for a firm to post messages to customers in a secure portion of its Web site. Some bank sites can detect when a phishing site tries to download the site's graphics.