SOMETHING VISHY IS HAPPENING: APRIL 28th 2008
Internet scammers are turning to the phone to craft more convincing phishing attacks in order to trick Web users who have learned not to click on links in unsolicited emails.
Vishing (Voice phISHING) is the voice counterpart to phishing. Whereas phishing attacks try to lead you to counterfeit Web pages to trick you into submitting personal information, vishing attacks attempt to deceive you into revealing that same sensitive information, like your credit card details, bank account details, or social security number, over the phone.
Identity thieves typically ask potential victims to call a phone number attached to a VoIP (Voice over Internet Protocol) account. Using VoIP technology scammers can establish a number with a local area code while running their scam oceans away. In the past few years, inexpensive VoIP technology and open source callcenter software has made it cheap for scammers set up their own call centers, often employing staff who may be unaware that they are working for a criminal gang.
A scam might work like this: You get a message urging you to call your bank to reactivate your credit card or you will not be able to use it. Upon calling the phony telephone number, you are greeted with 'Welcome to the bank of...' and led through a series of voice-prompted menus that ask for account numbers, passwords, and other critical information.
You might get the initial message by email, like a traditional phishing scam, or you could be contacted over the phone. The call could either be a "live" person or a recorded message directing you to take action to protect your credit card or other financial affairs. Sometimes the criminal already has some personal information on you, creating a false sense of security. Another twist on vishing attacks involves sending the initial message as a text messages to your cell phone.
Security experts fear that vishing in the time to come could prove more effective than traditional phishing because the voice-based attacks have not yet been as widely publicized, although the U.S. Federal Bureau of Investigation (FBI) warned of an "alarming" rise in the number of vishing attacks in January 2008.
Vishing is difficult for authorities to trace, as scammers can mask the number they are calling from. And in some cases, the VoIP number belongs to a legitimate subscriber whose service is being hacked. Furthermore, vishing scams are often outsourced to other countries, which may render sovereign law enforcement powerless.
To protect yourself from vishing scams, don't reveal any personal information if someone purporting to be your credit card provider or your bank calls you up unsolicited. Hang up and contact the financial institution directly, using phone numbers included in statements or telephone books.
Also, never call a telephone number provided in an email or a text message. Call the number on the back of your credit card or on your bank statement instead. ------------------------------------------------------------------------------
ATTACK OF THE ZOMBIE PC: APRIL 22nd, 2008
A zombie PC is one that has been infected with malware that allows a cybercriminal to take control of the machine from afar.
It can be remotely controlled by the creators of the malware that drives it, hence the name.
Once a computer has been infected, it waits for orders from the cybercriminal, who typically turn the zombie computers into massive bot networks.
A botnet is a network of thousands or millions of zombie computers and they are used to launch denial-of-service (DoS) attacks and spew out all sorts of spam, phishing and virus attacks. Botnets have emerged as the number one source of spam and experts reckon that up to 90 percent of all spam is relayed from zombie computers.
During the second half of 2006, researchers observed an average of 21,707 new active bot-infected computers per day in the Europe, Middle East and Africa (EMEA) region. More than 2.3 million bot-infected computers in the region were identified as being active at any one time, a 130 percent increase from the 1 million seen during the first half of 2006.
At the end of 2006 Microsoft named botnets as the world's main cyberthreat. At that time China accounted for 26 percent of the world's bot-infected computers, a higher density than any other nation. Beijing was the city with the most bot-infected computers in the world, accounting for just over five percent of the worldwide total.
In June 2007, the FBI notified more than a million US computer users that their PCs had been hijacked by criminals.
During 2007 botnets helped keep spam output at consistently high levels and global spam reached rates as high as 96 percent of all e-mail traffic. According to experts, the global spam rate averaged around 80 percent of all e-mail traffic throughout the year. The most disruptive botnet in 2007 was the Storm worm botnet, which researchers estimated contained more than one million infected machines.
In February 2008, researchers found that six botnets were responsible for 85 percent of all worldwide spam. The Srizbi botnet was believed to be the largest single source of spam, accounting for 39 percent of junk mail messages. The Rustock botnet came in second, responsible for 21 percent. The US continued to pump out the most spam, being the source of 15 percent of all spam.
Also in February 2008, a US teenager pleaded guilty to running a botnet of computers that included US military computers. Later that same month, Canadian police arrested 17 people suspected of running a botnet of up to one million zombie PCs, spanning 100 countries around the globe.
It's not easy to tell if your PC has been zombified. Cybercriminals try to keep it invisible to you that your machine is infected and it's uncommon for a zombie PC to display many obvious sign of trouble. Furthermore, a botnet normally doesn't deploy any single zombified computer constantly, making it even harder to pinpoint a troubled machine. And even though the usual malware warning signs like computer slowdowns and odd behaviour also apply to zombies, they could just as easily be signs of lesser problems.
But if e-mail bounces back to you with a message that you've been blocked, it is very likely a result of your PC having become a zombie PC. E-mail bounces back if your e-mail address is included on one of the spam blacklists that some ISPs use to block the IP addresses of known spammers. More than 100 such blacklists exist, and if you're on one or two such lists, most of your mail will get through, but some will not.
You can minimize the risk of having your computer turned into a zombie by using updated antivirus and firewall software at all times and avoid opening suspicious files. Also, always keep Windows and other software up to date and watch your firewall software for strange outgoing traffic.
------------------------------------------------------------------------------
VISTA SERVICE PACK IMPORTANT INFORMATION: MARCH 24th, 2008
If you have purchased a machine with Windows Vista installed or you have upgraded your machine to Windows Vista then please take a moment to read the following.
Microsoft has admitted that Windows Vista service pack one (SP1) renders useless a number of well-known third party security products.
Redmond said in a knowledge base article yesterday that due to "reliability" issues with Vista SP1, it has been forced to prevent some security products from running after the service pack is installed.
So, customers who currently have versions of Jiangmin KV Antivirus or Trend Micro's Internet Security on their Vista computers will no longer be able to use the software, which are suppose to safeguard their machines against hackers and malware, after SP1 is installed.
The two other security products deemed by Microsoft to make Vista SP1 "unreliable" are versions of BitDefender AV and Zone Alarm Security Suite.
It added that it has put a block on Fujitsu's Shock Sensor utility, which protects laptop hard-drives against sudden shocks.
Microsoft also pinpointed a number of products that simply won't work after the service pack, which is expected to be available for download to everyone by the middle of next month, has been installed.
Versions of Iron Speed Designer, Xheo Licensing, and Free Allegiance software are on that particular blacklist.
Meanwhile, Novell's ZCM Agent and the New York Times reader software are among the products listed as having severely reduced functionality post Vista-SP1.
Microsoft said in the article: "A program may experience a loss of functionality after you install Windows Vista SP1. However, most programs will continue to work as expected after you install Windows Vista SP1."
This latest embarrassing cock-up comes just days after Microsoft snatched back a key pre-requisite update for Vista SP1 from its Windows Update website.
It was forced to suspend distribution of its servicing stack KB937287 update after customers complained that their PCs wouldn't boot up properly once it had been applied. ®
If you would like to read more on this please visit -
http://support.microsoft.com/kb/935796 |
