Temporary Internet Files - the Good, the Bad, and the Ugly

A little bit of time invested into learning about internet security can go a long way in preventing mishaps on your computer. Temporary internet files are not something we should be afraid of, but we should certainly be careful in how much we trust them and how we deal with them.

Temporary internet files are image, text, and formatting files that are stored on your hard drive by the websites that you visit. They are placed there by the websites without your having to do anything. The files are stored on your computer the first time you visit the site so that the next time you go to that webpage you only have to load new information or files that have changed since the last time you visited - files that have not changed are loaded from the temporary internet files folder at a much faster speed than over the internet.

This seems like an incredibly appealing option, especially to those of us still working at home on dial-up connections (my teenage brother-in-law insists I'm "old school" because I don't have DSL - I think he may be right). Storing the temporary internet files on the hard drive significantly cuts down the amount of time it takes to completely load and view a website.

There are a few question areas, however, that need to be considered in any discussion about temporary internet files. First, and arguably the most trivial of the concerns, is that you may miss out on all of the updated information the website has to offer. If your browser loads the files from your temporary internet files folder rather than the updated material from the website, you may miss out on an updated football score, or you may get a different image than the one others are viewing. The system is designed so that things like that don't happen, but the possibility is out there.

Second, storing huge numbers of files can bog down your computer, slowing down its ability to do even the simplest of tasks, such as word processing (a deadly one-two combination if you're working with dial-up!). Fortunately, you can control the number or size of the files that are being stored on your hard drive. Typically under the Tools>Options menu of your browser you'll be able to set the amount of your hard drive you're willing to dedicate to temporary internet files. You may want to set this high or low, depending on your browsing habits and need for speed.

Third, the temporary internet files folder may contain files that contain viruses, inappropriate images or text, and files that could leak personal information to websites. This is obviously a huge concern any time you allow someone virtually unregulated access to your hard drive. Images from an inappropriate website you accidentally stumbled across (it has happened to all of us) may be stored on your hard drive. Corrupted files may be placed there by an unfamiliar website you only visited once. Cookies and other files may potentially spawn popups that cover your screen in a matter of seconds.

Before you grab your pitch fork and storm the beast's castle, let me mention a few things you can do to bring a little control to your temporary internet files folder without destroying it completely.

I already mentioned limiting the amount of your hard drive dedicated to holding files from visited websites. This is the best option for those who may be less concerned about corrupted or inappropriate files being stored and more concerned about the ability of their Jurassic-era computer to perform at a decent speed. Some versions of the popular browsers won't allow you to completely eliminate storing files, but you can limit the resources to 1% of your hard drive or a small number of megabytes.

Some opt to regularly clean out their temporary internet files folder - obviously this will eliminate malignant files and free up some space for your computer; but it will also eliminate files you may want. A quick note about the files that begin with "Cookie:" - cleaning out the folder will not actually delete the cookies. The cookie files in the temporary internet files folder are simple files that point the browser to the actual cookie in the "Cookies" folder on your hard drive. If you are interested in truly purging your system of internet files, you'll need to clean out that folder as well.

In my view, the most judicious option is to utilize available software to manage the content of your temporary internet files. Some files you want because they make your life easier. Some files you don't want because it bogs down your computer and makes your grandmother blush. Software is available that scans your computer and finds all the internet files (including cookies). The software makes recommendations as to whether the file in question is good, bad, or ugly - all you have to do is decide to keep or trash it, then click the appropriate button.

Temporary internet files can make our internet browsing time a quick and convenient experience. Unfortunately, they may also pose a risk to the security of our hard drives. With a little hands-on management we can keep ourselves, our loved ones, and our computers happy, safe, and protected.

Reducing Fraudulent Transations - 5 Simple Ways To Protect Yourself

The money being spent online is steadily growing. With billions of dollars being spent each year online, the opportunity to make money on the internet has never been bigger. Unfortunately, with that opportunity come people who want to make money in less than honest ways. We're going to look at some concrete ways you can identify fraudulent transactions and save yourself a lot of chargeback fees, money and grief.

Get more information from prospective customers.

The more information you have to work with, the better your chances are that you will be able to positively identify fraudulent transactions. At the very least, you need to make sure you get a customer's name, credit card billing address, phone number and the IP address of the computer currently accessing the order form. You should also get a valid email address. This email address should not be one that comes from a free email service.

Fraudulent transactions occur more frequently from certain countries.

The first thing you should know is that certain countries are more prone to fraudulent transactions than others. If you get an order originating from one of the following countries, you should be suspicious and do more digging. Some of these countries include: Ukraine, Indonesia, Yugoslavia, Lithuania, Egypt, Romania, Bulgaria, Turkey, Morocco, Vietnam, Russia, Pakistan, Malaysia, Nigeria, Israel, Iran, Cameroon, Gambia, and Ghana. This doesn't mean that every transaction from any of these countries is definitely fraudulent. But you should be very suspicious.

Confirm the address of the customer.

The first thing I do when I get an online order is to check the phone number of the customer against a reverse phone number directory. The majority of my orders come from the United States and Canada. Phone numbers from these countries can usually be entered into reverse directories to find out the address that phone number belongs to. If I can't get a match for the phone number it servers as a red flag and warrants more investigation.

Lookup the customer's country and city of origin

I've already outlined a long list of countries that should be suspicous to you. How do you determine if your customer placed the order from within one of these banned countries? Simple. You cross reference their IP address with an IP lookup database that can tell you what country they are in. The city they are from and sometimes even ISP they use! If you handle only a few orders a day, you can use an excellent free service at IP2Location.com. If you do handle more volume, IP2Location.com also offers subscription packages at various prices.

Once you determine the country of origin, if it doesn't match the country the customer listed with their billing information be very careful. Yes, it is possible that your customer could be travelling away from home. It is much more likely that their credit card information has been stolen and it is being used fraudulently. A mismatch between the country reported by IP and the billing address is a big red flag.

Don't let customers use free email addresses.

A free email address is so easy to setup at most free email services. The odds of your being able to track down the person that registered that free email address are next to none. If at all possible, block all known free email services. The most common include Hotmail, Yahoo, Mail.com, and Gmail. If you can't block free email addresses in advance, consider a free email address a red flag. A utility you can use to determine if an email address is a known free email is dnsstuff.com. Look towards the bottom left of the page that comes up.

Don't ship a product until you are sure.

If two or more red flags go up, beware. If you ship a product from a fraudulent transaction, you will very likely be slapped with a chargeback from your credit card company and lose the money from the good. Be skeptical of all orders until everything checks out to your satisfaction. If in doubt, refund the purchase. Too many chargebacks will result in the cancellation of your merchant account. Who needs that?

A little diligence can go a long way to helping you prevent loses from fraudulent transactions. With a little knowledge, you can greatly reduce lost profits due to fraud.

Fishing for Fortunes. Scam!

Spelt phishing, but pronounced as above, this despicable act is an effort to batter your bankroll or commandeer your cash.

To put it simply, you can get emails from account administrators, which strongly urge you to update details attached to that account. The issue, though, is the pretence of such mail.

You may not even have such an account as referenced.

It doesn’t come from the account provider.

It can use false S.S.L. references, to present an illusion of trust and security.

It can prompt for immediate action on your part, alleging false log-in’s by persons unknown, and from countries unknown. If action is not taken, they can impress on you, that the account will be suspended or closed. Indeed, anything likely to work can be fabricated, to get you to the webpage suggested in the link or hyperlink. Note the word “suggested”. Likenesses to company logos are used to re-enforce “credibility”.

In fact, these phishing attempts actually look pretty good or realistic. So much so that any qualms of guilt or stupidity, experienced by a “conned party” are groundless.

Experience, specific education or forewarning, is all that prevents this type of charade from widening its base of “victims”.

The goal is to get you to type in your details, complete with credit card number and the rest can be guessed.

Some damage is also absorbed by the organisation or company being misrepresented and they can do little about it but warn their customers what to watch out for, and issue security instructions. Indeed, it is from accounts at reputable companies that most passing trade learn the correct or most secure procedures. It is therefore important to read any material that they offer.

Generally though, reputable companies with a mind to preserve their integrity will tell you to log-in at their main page and proceed from there. Not through a link specific to your account!

Hyperlinks can mask the true domain that you’ll be brought to, with the text linked to www.anydomaindotcom (example, only), a replica or fake page. Only going to secure pages where one believes that “https” will do it, will always help but wholly unreliable. The “s” is an indication of a secure page, but are you at the right domain?

Place your mouse over the link and the domain attached to such a link, should show itself. Viewing the source code is another way but some knowledge of it is necessary.

Another ploy, sometimes deliberate and sometimes “convenient”, is inserting a reference to the “legitimate company” anywhere after the domain name. Ex. https://www.anydomaindotcom/ebay/aagle/. Unwary victims may overlook the fact that “ebay” is not the domain, but see it anyway as a directory or file name. Anyone, anywhere can have a file or directory named like that of a company.

To make matters somewhat worse from an “easy to identify” viewpoint, the source code of the link can be represented as an I.P. address rather than its named counterpart. There are some tools that you can use at http://centralops.net/co/ which you can use to type in the I.P. address and cross reference it with the official account domain presented in the e-mail, or web page for that matter. Opening a second window for investigative purposes and re-sizing both to be side by side can be revealing, and comparisons be made between the alleged source and that of the source code.

www.ebay.com can be put in one window and www.suspiciouslyspurious.com can be put in the other. NOTE; you should be checking domains and ignoring everything that comes after the forward slash at the end of the domain. A similar test can be done for email viruses, where suspicious email addresses can be searched for some degree of authenticity.

If you are phished, try to learn as much as possible about it as phishing attempts and email viruses have some aspects in common. Incorrect spelling is one of them. You must understand that the authors can be from anywhere and not necessarily have degrees in English. Legitimate companies can also be from anywhere, with different primary languages, but do perfect their spellings and general grammar.

Attention to upper and lower case can be another giveaway. This is especially true where particular portions of the text are the design of the author, and not just copied and pasted. Typically, these portions are customised to be customer specific in a general sense, and fonts may even be different or out of place. Such “special” additions are to strengthen the sense of urgency and call to action.

Should you be the recipient of “phishy mail”, you can forward it to spam@uce.gov

DOS Attacks: Instigation and Mitigation

During the release of a new software product specialized to track spam, ACME Software Inc notice that there was not as much traffic as they hoped to receive. During further investigation, they found that they could not view their own website. At that moment, the VP of sales received a call from the company's broker stating that ACME Software Inc stock fell 4 point due to lack of confidence. Several states away, spammers didn't like the idea of lower profit margins do to an easy to install spam blocking software so they thought they would fight back. Earlier that day, they took control of hundreds of compromised computers and used them as DoS zombies to attack ACME Software Inc's Internet servers in a vicious act of cyber assault. During an emergency press conference the next morning, ACME Software Inc's CIO announced his resignation as a result of a several million dollar corporate loss.

Scenarios like the one above happen a more then people think and are more costly then most will admit. Denial of Service (DoS) attacks are designed to deplete the resources of a target computer system in an attempt to take a node off line by crashing or overloading it. Distributed Denial of Service (DDoS) is a DoS attack that is engaged by many different locations. The most common DDoS attacks are instigated through viruses or zombie machines. There are many reasons that DoS attacks are executed, and most of them are out of malicious intent. DoS attacks are almost impossible to prevent if you are singled out as a target. It's difficult to distinguish the difference between a legitimate packet and one used for a DoS attack.

The purpose of this article is to give the reader with basic network knowledge a better understanding of the challenges presented by Denial of Service attacks, how they work, and ways to protect systems and networks from them.

Instigation:

Spoofing - Falsifying an Internet address (know as spoofing) is the method an attacker uses to fake an IP address. This is used to reroute traffic to a target network node or used to deceive a server into identifying the attacker as a legitimate node. When most of us think of this approach of hacking, we think of someone in another city essentially becoming you. The way TCP/IP is designed, the only way a criminal hacker or cracker can take over your Internet identity in this fashion is to blind spoof. This means that the impostor knows exactly what responses to send to a port, but will not get the corresponding response since the traffic is routed to the original system. If the spoofing is designed around a DoS attack, the internal address becomes the victim. Spoofing is used in most of the well-known DoS attacks. Many attackers will start a DoS attack to drop a node from the network so they can take over the IP address of that device. IP Hijacking is the main method used when attacking a secured network or attempting other attacks like the Man in the Middle attack.

SYN Flood - Attackers send a series of SYN requests to a target (victim). The target sends a SYN ACK in response and waits for an ACK to come back to complete the session set up. Instead of responding with an ACK, the attacker responds with another SYN to open up a new connection. This causes the connection queues and memory buffer to fill up, thereby denying service to legitimate TCP users. At this time, the attacker can hijack the system's IP address if that is the end goal. Spoofing the "source" IP address when sending a SYN flood will not only cover the offender's tracks, but is also a method of attack in itself. SYN Floods are the most commonly used DoS in viruses and are easy to write. See http://www.infosecprofessionals.com/code/synflood.c.txt

Smurf Attack- Smurf and Fraggle attacks are the easiest to prevent. A perpetrator sends a large number of ICMP echo (ping) traffic at IP broadcast addresses, using a fake source address. The "source" or spoofed address will be flooded with simultaneous replies (See CERT Advisory: CA-1998-01). This can be prevented by simply blocking broadcast traffic from remote network sources using access control lists.

Fraggle Attack - This types of attack is the same as a Smurf attack except using UDP instead if TCP. By sending an UDP echo (ping) traffic to IP broadcast addresses, the systems on the network will all respond to the spoofed address and affect the target system. This is a simple rewrite of the Smurf code. This can be prevented by simply blocking broadcast traffic from remote IP address.

Ping of Death - An attacker sends illegitimate ICMP (ping) packets larger than 65,536 bytes to a system with the intention of crashing it. These attacks have been outdated since the days of NT4 and Win95.

Teardrop - Otherwise known as an IP fragmentation attack, this DoS attack targets systems that are running Windows NT 4.0, Win95 , Linux up to 2.0.32. Like the Ping of Death, the Teardrop is no longer effective.

Application Attack - Thess are DoS attacks that involve exploiting an application vulnerability causing the target program to crash or restart the system.

Kazaa and Morpheus have a known flaw that will allow an attacker to consume all available bandwidth without being logged. See http://www.infosecprofessionals.com/code/kazaa.pl.txt

Microsoft's IIS 5 SSL also has an easy way to exploit vulnerability. Most exploits like these are easy to find on the Internet and can be copied and pasted as working code. There are thousands of exploits that can be used to DoS a target system/application. See http://www.infosecprofessionals.com/code/IIS5SSL.c.txt

Viruses, Worms, and Antivirus - Yes, Antivirus. Too many cases where the antivirus configuration is wrong or the wrong edition is installed. This lack of foresight causes an unintentional DDoS attack on the network by taking up valuable CPU resources and bandwidth. Viruses and worms also cause DDoS attacks by the nature of how they spread. Some purposefully attack an individual target after a system has been infected. The Blaster worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135 is a great example of this. The Blaster targeted Microsoft's windows update site by initiating a SYN FLOOD. Because of this, Microsoft decided to no longer resolve the DNS for 'windowsupdate.com'.

DoS attacks are impossible to stop. However, there are things you can do to mitigate potential damages they may cause to your environment. The main thing to remember is that you always need to keep up-to-date on the newest threats.

Mitigation:

Antivirus software - Installing an antivirus software with the latest virus definitions will help prevent your system from becoming a DoS zombie. Now, more then ever, this is an important feature that you must have. With lawsuits so prevalent, not having the proper protection can leave you open for downstream liability.

Software updates - Keep your software up to date at all times. This includes antivirus, email clients, and network servers. You also need to keep all network Operating Systems installed with the latest security patches. Microsoft has done a great job with making these patches available for their Windows distributions. Linux has been said to be more secure, but the patches are far more scarce. RedHat is planning on incorporating the NSA's SE Linux kernel into future releases. This will give Mandatory Access Control (MAC) capabilities to the Linux community.

Network protection - Using a combination of firewalls and Intrusion Detection Systems (IDS) can cut down on suspicious traffic and can make the difference between logged annoyance and your job. Firewalls should be set to deny all traffic that is not specifically designed to pass through. Integrating an IDS will warn you when strange traffic is present on your network. This will assist you in finding and stopping attacks.

Network device configuration - Configuring perimeter devices like routers can detect and in some cases prevent DoS attacks. Cisco routers can be configured to actively prevent SYN attacks starting in Cisco IOS 11.3 and higher using the TCP intercept command in global configuration mode.

Access-list number {deny | permit} tcp any destination destination-wildcard ip tcp intercept list access-list-number ip tcp intercept ? (will give you a good list of other options.)

Cisco routers can prevent Smurf and Fraggle attacks by blocking broadcast traffic. Since Cisco IOS 12.0, this is the default configuration. ACLs or access control lists should also be configured on all interfaces.

No ip directed-broadcast

The Cisco router can also be used to prevent IP spoofing. ip access-group list in interface access-list number deny icmp any any redirect access-list number deny ip 127.0.0.0 0.255.255.255 any access-list number deny ip 224.0.0.0 31.255.255.255 any access-list number deny ip host 0.0.0.0 any See Improving Security on Cisco Routers - www.cisco.com/warp/public/707/21.html

Old Cisco IOS versions are vulnerable to several DoS attacks. The "Black Angels" wrote a program called Cisco Global Exploiter. This is a great software to use when testing the security of your Cisco router version and configuration and can be found at http://www.blackangels.it/Projects/cge.htm

Security is not as mystical as people believe. DoS attacks come in many different types and can be devastating if you don't take the proper precautions. Keep up to date and take steps to secure network nodes. Keeping security in mind can minimize damages, downtime, and save your career.

Security Resources:
Black Angels: http://www.blackangels.it/
Cisco: http://www.cisco.com
Microsoft: http://www.microsoft.com/technet/security/current.aspx
Forum of Incident Response and Security Teams: http://www.first.org/
SANS Institute: http://www.sans.org/resources/

Avoid Internet Theft, Fraud and Phishing

Since its birth, the Internet has grown and expanded to unprecedented, unmanageable proportions. Information, software, news, and much more flow freely through its twisted pathways. Online services such as Internet banking save time and money. However, from the depths of its vast expanse have come the dregs of society intent on preying on the new, the naïve, and the less informed.

Phishing is one of the main scams in the present moment. People set up phoney websites and email addresses. Then they spam Email inboxes with official-looking messages explaining that your account with Company X has encountered a problem and that they need you to login and confirm some details. The email addresses are masked to appear official and the links provided in the email all seem to check out. If you click on the link provided then you will usually be taken to a site that looks for all intents and purposes to be official. When you click 'submit' your details will be sent to a criminal somewhere who will do as they please with your information, such as withdrawing money from a bank account or purchasing things in your name.

The scam has been labelled 'Phishing' because the criminals engaging in the activity behave similarly to a fisherman throwing bait out in the hope that they'll receive just one bite from the millions of people that receive the email.

So how do you avoid these online scams? First and foremost, it is important to realise that no legitimate organisation should be sending you a request to fill out your personal details because of some server error or for any other reason. Your bank will never send you an email with content along the lines of "We've lost your bank account number and password... please supply them again for our records". You should also know that no bank is going to require your social security number, bank account number, and PIN number just to log in to your account or retrieve your password. Other sites such as Ebay, PayPal, and the like will not email you asking for these details either.

If you're a little unsure as to whether or not an email is official, scroll down a bit until you find the link that they are requesting you to click and simply hold your mouse pointer over the link text without clicking. Now take a look at the bottom left-hand corner of your browser window. The link text is often the address that the phisher wants you to think you will be heading to but the real address will be revealed in the bottom of the browser. This address will most likely not have anything whatsoever to do with the company that the email is attempting to imitate. It could be a dodgy web site or even just a page on someone's personal computer. If the address doesn't appear in the bottom left-hand corner then you can right-click on the link, select 'properties' from the pop-up menu and then read the address listed in the information box.

To avoid further scams make sure that you have updated firewall and anti-virus software active on your system at all times. This will make it harder for anyone to install key loggers, Trojans, spyware, or other similar devices intended to retrieve your information. Keep your operating system up to date with the latest security patches and updates and be careful where you enter your details. Always look into the reputability of the site that is requesting your details and keep an eye on the lower right-hand corner of your browser. If the page you are viewing has a little padlock symbol appear in the corner, then it means that your details are being secured by some encryption method. You can double click on the icon to get more details if you wish. Sites without the padlock icon don't have encryption, which means that your details are a lot easier for malicious crooks to get a hold of.

Even if you're sure the website is legitimate, it's not a good idea to send your details over an unsecured connection. By the way, email does not count as a secure connection, and neither does any instant messaging program, (such as MSN, ICQ, Yahoo Messenger, AIM etc.) so don't give out personal details that way either.

Another common scam very similar to phishing involves the emailing of promises of great wealth. Seriously, what do you think your chances are of winning the lottery, let alone one that you never even entered? Or of some obscure yet ridiculously rich person in Africa dying and you being legally allowed to pick up their money? Or of a foreign prince wishing to smuggle money out of his country using your account? These emails are all scams. I wish it were true that I won three different lotteries every single day, but if you get in contact with the people sending these messages they're going to do their utmost to clean out your pockets. Unfortunate as it may sound, the 'Please Donate to Charity' emails sent are usually also scams.

If you really want to donate money to a charity, look them up and send it the usual way, don't respond to a multi-recipient email that may or may not be real. You also shouldn't donate to some random charity that no one has ever heard of before. Some of the Internet lowlifes have started up fake charities, 'dedicated to helping Tsunami victims' or similar and are simply pocketing the donations.

Everything in this world can be used for either good or evil purposes and the Internet is no exception. Staying alert and having just a little bit of Internet know-how can keep you out of harm's way for the majority of the time, and allow you access to the wonderful online services available with relative safety.

Corporate Security for Your Home Business

The words Corporate Security may conjure up images of a group of techies working in a wire-filled basement room of Microsoft or HP, combating hackers and terrorists online using words like algorithm and encryption. If you own your own business, do not allow yourself to think that security is only for big corporations. Every company, big or small, technological or traditional, has two major security concerns: protecting information, and protecting hardware.

Corporate Security: Information

Information is the commodity that makes companies unique. That information could be a process your company does better than others; or it could be how to make the unique product you sell; or it could be a collection of information that you have that others want access to. In any case, protecting the information that makes your company viable could mean financial life or death for your venture. There are three simple corporate security solutions you can implement to decrease the likelihood that your information will be leaked or lost.

Make back ups often. If you are like 90% of computer users out there who use Windows, pressing [ctrl] + S is a habit well worth forming. Besides information, time is one of your most valuable resources, so you can’t afford to lose hours of work every time the system crashes. Save your work as often as you stop typing. Making additional copies of master files in other places beside your hard drive will mean you won’t lose everything if your hard drive becomes corrupted. Keep these discs in a safe place where you can easily access them if you need to.

Keep secret passwords secret. This may seem like a no-brainer, but too often we think of passwords as annoyances slowing us down. Systems are password-protected to ensure that only those persons who should be allowed access are granted access. If you are working out of a home office and have little face-to-face interaction with clients or customers, you may be tempted to leave your system unlocked or pin a list of your user names and passwords near the computer. Remember that children are both curious and smart, and in only a few clicks of the mouse they can accidentally erase important files. Do yourself the favor of memorizing your passwords and changing them on occasion.

Maintain an up-to-date computer system. Computers that run slower also have the terrible tendency of getting overloaded and shutting down. The internet is one of the biggest culprits of bogging down your processing speed, but running several programs at the same time will also do it. Keeping your processor and memory up-to-date will help ensure that you are able to perform all the tasks that are required of you without having to spend a lot of time waiting for your computer to catch up.

Corporate Security: Hardware

Chances are good that IBM’s annual technology budget is quite a bit larger than your home business’s budget. Between putting food on the table and covering the operating costs of your business, purchasing new equipment might seem like a luxury you’ll never have. Protecting your computer system from viruses, spy ware, and malicious software is one of the most cost-effective ways to ensure your computer will last as long as you need it to.

Know what is on your computer. Viruses can come through email, discs, or the internet, and are typically well-hidden on your hard drive. Perform systematic checks of the temporary internet files, cookies folder, and the rest of your hard drive to ensure that you have not accidentally picked up a virus. Software can be purchased that filters spam and helps you manage the internet files and cookies that are downloaded automatically on your computer. A proactive approach in combating viruses and spy ware is usually the most effective way to make sure your hardware stays protected.

Though corporate security solutions may seem like a luxury your home business can not afford, protecting information and hardware are priorities that all companies should have. Following these simple, inexpensive solutions to common security concerns your company may have will go a long way in helping you succeed.

Social Engineering - The Real E-Terrorism?

One evening, during the graveyard shift, an AOL technical support operator took a call from a hacker. During the hour long conversation the hacker mentioned he had a car for sale. The technical support operator expressed an interest so the hacker sent him an e-mail with a photo of the car attached. When the operator opened the attachment it created a back door that opened a connection out of AOL's network, through the firewall, allowing the hacker full access to the entire internal network of AOL with very little effort on the hacker's part.

The above is a true story and it is an excellent example of one of the biggest threats to an organisation's security - social engineering. It has been described as people hacking and it generally means persuading someone inside a company to volunteer information or assistance.

Examples of techniques employed by hackers include:

• Unobtrusively observing over your shoulder as you key in your password or PIN.
• Calling helpdesks with questions or being overly friendly
• Pretending to be someone in authority.

Social engineering attacks can have devastating consequences for the businesses involved. Accounts can be lost, sensitive information can be compromised, competitive advantage can be wiped out and reputation can be destroyed.

By implementing some simple techniques you can reduce the risk of your organisation becoming a victim or, in the event that you are targeted, keep the consequences to a minimum.

• Make sure that all staff, especially non-IT staff, are aware of the risk of social engineering and what to do in the event of such an attack.
• Conduct regular security awareness training so that all staff are kept up to date with security related issues.
• Implement a formal incident reporting mechanism for all security related incidents to ensure there is a rapid response to any breaches.
• Ensure that the company has security policies and procedures in place, that all staff are aware of them and that they are followed.
• Put an information classification system in place to protect sensitive information.

Conduct regular audits, not only on IT systems but also on policies, procedures and personnel so that any potential weaknesses can be addressed as soon as possible.

Dialing Up a Scam: Avoiding the Auto-Dialer Virus

For many, the daily walk to the mailbox evokes mixed feelings: The glee that your favorite monthly magazine – or a friend’s hand-written letter (quite a surprise in the e-mail age) may be waiting is countered by anxiety of how many bills the postman left you.

Now, imagine coming across your phone bill, thicker and heavier than normal. When you open it, instead of “statement stuffers” from the phone company’s marketing department, the bill is dozens of pages long ending in a one-month total of almost $5,400.

A quick glance at the details reveals hundreds of calls to the same 1-900 number. “A mistake,” you insist. After all, you're the only person in the house and you have never called a 900 number before. Actually, this is no mistake. In this true story, the homeowner had fallen victim to one of the oldest computer scams around: the "Auto-Dialer" virus.

How Did This Computer Security Nightmare Begin
-----------------------------------------------------------
What is an “auto-dialer”? Some time ago, the phone companies came up with a feature that allowed merchants to reach a broader range of customers by allowing consumers to make payments via your phone bill. If you did not have a credit card, you just dialed a 900 number, connected by voice or modem (for Internet sites). Every minute you used the service, you were charged a fee ranging from $1 to $5 or more per minute. At month’s end, the charge appeared on the phone bill. Many services were legit: Consumers called weather, horoscope and gambling services offering this feature. But many merchants sold expensive phone or online adult content.

How Did An Auto-Dialer Get Installed
-----------------------------------------------------------
But how did $5,400 in charges end up on the person’s phone bill? Although many of these services require the user to physically dial the number or connect to the online site by instructing the modem to dial the number, this can happen without the user’s knowledge. In the above case, the person’s computer was infected with an auto-dialer virus. Somewhere during his Web travels, he connected to a site that popped up a rather confusing message instructing him to "Hit OK" to make the message go away. What this person didn't know was he was agreeing to download,install, and execute an adult content auto-dialer.

Behind the scene, the auto-dialer installed itself, checked for the presence of a modem and dial tone, and then proceeded to dial an overseas 900 number over and over again. Even though the person surfed using an always-on broadband Internet connection, the modem remained so he could send and receive faxes. One problem: When he wasn’t using the modem, it remained plugged into the phone jack. Why should he have unplugged it? It's not like it could hurt anything, right? Wrong.

How To Protect Yourself
-----------------------------------------------------------
Unfortunately, there is no single solution to avoid these types of malicious acts. A short list of protective measures would include:

1) If you no longer need a modem in your computer, remove it. Or at least disconnect the phone line from the modem;

2) Install anti-virus software such as Trend Micro or Symantec's Norton Anti-Virus. Many are designed to prevent this kind of malicious software, or “Malware.” More importantly, make sure your subscription for new virus patterns is current and configured to automatically download and install updates;

3) Install and regularly run Adware protection solutions such as LavaSoft's Ad-Aware or SpyBot Search & Destroy;

4) And do not, under any circumstances, blindly hit “OK” to pop-ups or similar annoyances without first making sure what you are agreeing to.

This tale is not fiction; in fact, it happens frequently, to businesses and consumers, kids and adults. But even the least savvy among us can thwart such an attack. A neighborhood teenager recently avoided potentially thousands in fees when an auto-dialer was downloaded and installed. How? She had unplugged the modem.

Be Aware of Phishing Scams!

If you use emails actively in your communication, you must have received various messages claiming to be from Ebay, Paypal and a number of banks. A recent email as if from U.S. Bank Corporation that I received contains the subject "U.S. Bank Fraud Verification Process" and in the body of the mail it says "We recently reviewed your account, and suspect that your U.S. Bank Internet Banking account may have been accessed by an unauthorized third party. Protecting the security of your account and of the U.S. Bank network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features. To restore your account access, please take the following steps to ensure that your account has not been compromised:". It continues with a link to a webpage, which looks very similar to original web page of the bank.

The misleading web site appears authentic with familiar graphics and logos. The wordings are professional right down to the legal disclaimer at the bottom of the page.

If you happened to be holding an account of the claimed bank, followed the instructions of the email and input your account, pin, password, etc. you are doomed. You just have handed over access to your account to a con artist, who, in a matter of days, will drain off all the money available in that account.

This new scam, which is proliferating in a very rapid pace, is called "Phishing". Phishing is a form of identity theft, where a con artist with the help of official looking email containing link to phony web pages capable of harvesting information, tricks an unsuspecting victim into divulging sensitive personal data. Scammers use these data to bilk victims out of their savings.

One of the most common phishing campaigns being waged has targeted users of Web auction giant eBay and its PayPal division with financial services giant Citibank serving as another popular target. However, recently, every major bank has been hit with this scam. Crooks send out huge amounts of emails with an expectation that some of these email address owners may have online access to their accounts at the bank.

The term "Phishing" is a deviation of the word "Fishing". In hackers’ lexicon, in many words, "F" becomes "Ph". The term derives from the fact that scammers use sophisticated bait as they "fish" for users’ personal information.

According to Gartner, a research firm, illegal access to checking accounts gained via phishing has become into the fastest growing type of consumer theft in the United States. Roughly 1.98 million people reported that their checking account was breached in one way or another during the last year and US$ 2.4 billion were defrauded from the victims!

Gartner also estimated that 57 million U.S. Internet users have received phishing emails and 3 percent of them may have fooled into revealing their personal sensitive information.

The Anti-Phishing Working Group has also spotted a dramatic increase in reports of phishing attacks in recent months. Since November, 2003 phishing scams increase by about 110 percent each month. In April alone, the group identified 1125 unique phishing scams, a sharp lift of 178 percent from the previous month.

MessageLabs, a company that watches phishing scams closely, has noted an even more dramatic increase in number of phishing emails. It claims to see phishing messages jump from just 279 in September, 2003 to a staggering 215,643 in March of 2004.

The scammers also started to use more sophisticated technologies in recent months. The latest generation of phishing scammers uses several methods to trick users, including pop-up graphics to mast the true web URL of the phishing site and the installation of Spywares and Trojans on victim’s computer. The perpetrators also take advantage of security bugs in web browsers, in which the URL in the address bar appears to be for one site but is, in fact, a link to a totally different site.

A new Windows worm under the name "Korgo" is able to infiltrate into victim’s system with a key logging Trojan, steal information that the victim input in web forms and secretly transmit to designated server. There are a number of variants of this worm and they are spreading rapidly. However, Microsoft in April came up with a patch to seal this glitch. Many computers without the patch are still vulnerable to this potentially dangerous worm.

A U.S. Treasury report provides consumers with steps to prevent and report phishing scams:

• Do not respond to or open any e-mail that warns that an account is about to be closed. Contact the company directly by phone and inquire of this e-mail.
• Do not submit financial information unless there is a symbol for a locked padlock on the browser's status bar. Also look for the https:// at the beginning of the Web address. If both of these signs are absent, the Web site is not secure.
• Always review your bank statement and credit card statements immediately upon receipt.
• Verify the domestic telephone number listed on the Web site through directory assistance or other reliable sources and call the number. Many phishing attacks have originated outside the U.S. and don't have a domestic number.
• Report suspicious activity or if you have been defrauded to the FTC and the FBI.
• Phishing e-mails can be forwarded to uce@ftc.gov. Complaints can be filed at www.ftc.gov. Phishing attacks can also be reported to the Internet Fraud Complaint Center at www.ifccfbi.gov.

Other cautionary measures you should take in order to protect yourself are:

• Since most of the phishing emails come through spam, get a spam filter and install on your computer.
• If you suspect a phishing attempt, report immediately to the bank. Every bank web site has a link or a toll-free number to report scams. Don't be ashamed if you were tricked into divulging account information. If you report it immediately, your account will be protected until you receive a new PIN.
• Change your password and PINs regularly. Banks advise that you use separate PINs and passwords for different accounts, that way if one gets compromised, your entire financial life won’t be revealed. - If you are a frequent user of EBay, download its Web browser toolbar, a small program that runs with a user's Web browser. It flashes red when the user visits a possible spoof site. The toolbar uses a database of spoof site URLs, submitted by customers and is updated quite often.
• Check your computer frequently for possible Trojan virus.