While browsing internet, you may end up infecting your PC
I received the following email from Myer in regards to their Myer One (shopping rewards card) promotion. Myer is Australia's largest department store group, and a market leader in Australian retailing. They offer an unrivalled choice in the latest national, international and 'exclusive to Myer' brands across women's, men's, and children's fashion, as well as accessories, cosmetics, homeware, furniture, electrical goods and much more.
In this promotional email, they are advising to use the Myer One card in the mentioned restaurant to get more rewards point which can be used to redeem gift vouchers plus you'll get $10 discount. (See below)
I like Indian restaurants so immediately I "Googled" the restaurant to find out the more details including their menu, specialities, location etc. (See below)
In the Google search results, I was able to find the website of the restaurant, which I clicked to find out more details as mentioned above. What I noticed that the the website URL is redirecting to some other website and It's giving a message that PC is infected. (See below)
As I clicked on cancel, the page redirected to another web-page pretending that it is running a scan and found so many trojans, viruses and malware on the computer. (See below)
Immediately, I closed the window and ran a virus scan on my computer to ensure if the PC has not been infected with something malicious. My concerns are, who to trust in this untrusted Internet world, Myer is quite famous in retail shopping and their Myer One is highly regarded rewards system in Australia, an email from them and Google search results of a malware-hosted website is really scary and proves that end-user is getting infected rapidly and they need security-awareness in how to deal with such suspicious activity plus an anti-virus with up to date virus definitions.
Apple privacy policy is the latest in a series of privacy related issues
Unexpected new privacy rules give Apple and its associated “partners and licensees” the legal right to track, monitor, and store the whereabouts of its customers in real time. Users who do not agree to these draconian measures are prohibited from downloading from the iTunes store.
Apple says that its customers' consent to tracking improves service, although it leaves questions about privacy, security, and safety unanswered.
In spite of a pledge to keep data anonymous, Apple customers have no reason to believe they have any privacy or anonymity. Studies at the University of Texas have demonstrated that customers can be identified by their behavior even when their names are not explicitly stated. Even worse, Apple customers are not told why they are being tracked or who is tracking them.
Refer here for more details.
Cisco Warns Of Rising World Cup Malware
As the world’s legitimate Web traffic increases, so do instances of spam e-mail, Internet-borne malware and general hacker activity. When special or unusual events happen — such as the current Gulf oil spill or the FIFA World Cup soccer tournament in South Africa — communications traffic of all kinds skyrockets. This takes into account text messaging, e-mail, Web searches, cell phone usage, television and Web streaming video, among others.
Cisco ScanSafe SAAS Web security service reported June 18 that after a week of World Cup activities, the global increase in Web traffic is up by an average of 27 percent during World Cup matches.
Japan noted the highest increase (53 percent), followed by the U.K. (37 percent), Germany (32 percent), Australia (20 percent) and Singapore (9 percent). In the United States, the increase worked out to about 8 percent — lower because soccer isn’t the overwhelming phenomenon there as it is worldwide.
Refer here for more details on this news.
The Next-Generation IPS
The network IPS isn't like the firewall -- it's not a must-have security device found in most every enterprise network. Even so, today's intrusion prevention system is still gaining new features and becoming more tightly integrated into the security infrastructure.
The IPS is sharing more traffic attack data with the firewall and gaining virtualization features, horsepower, and enhancements to become more application-aware, as well as to help secure client machines. Compliance has helped keep the IPS alive and well, despite predictions of its demise over the years.
And it could be the federal government that gives IPSes a big boost: The U.S. Department of Homeland Security is currently testing out an IPS system called EINSTEIN 3 that could eventually be deployed across all executive branch civilian networks. Even so, some security experts remain skeptical about the IPS finding a real home in the enterprise.
Refer here to read more details.
Microsoft Launches Centralized Fraud Alert System For Reporting Stolen Data
Microsoft today kicked off a new Web-based mechanism for researchers to securely report stolen credentials, bank and credit card data, or other data they discover, and as a way to quickly alert the appropriate banks, retailers, or government agencies of a compromise.
The new Internet Fraud Alert system is a free, members-only portal of sorts that centralizes the stolen information found by investigators and automatically determines the affected bank or retailer.
Aside from Microsoft, Citizens Bank, eBay, and PayPal are all charter members of new program, which was launched today with the blessing of the Federal Trade Commission (FTC), the American Bankers Association, the Anti-Phishing Working Group, and the National Consumers League.
Refer here for more details.
Staff should lead in preventing security attacks
A company's employees are its best defence against security threats, and should be empowered and educated about technology risks, according to a new report from PricewaterhouseCoopers (PwC).
The consulting firm said in its Protecting your Business report (PDF) that organisations are too complacent about security, and assume that they will not be affected. This lax attitude filters down to workers, who then believe that security is "someone else's problem".
PwC argued that companies should make staff more aware of the security risks, and educate them on how to defend against attacks. "The goal is that all those working for an organisation are alert to the risks, will want to act to protect information and will be actively supported in doing so," said Craig Lunnon, senior manager of HR services at PwC.
Only by assessing employee behaviour, and improving their security awareness, will enterprises be able to invest in effective technology, he added.
Security investments will otherwise be fragmented, or create convoluted systems that staff will often bypass in favour of doing their jobs.
PwC also advised organisations to persuade staff to defend against, rather than cause, security threats, and to ensure that they are aware of their own responsibilities.
If you are running Windows XP or Windows Server 2003, you must update your registry — or someone could run software or commands on your computer as if they were you.
Anyone running Windows XP or Windows Server 2003 needs to update their registry ASAP.
A critical bug in the Help and Support center was made public recently and Microsoft has neither a fix nor an estimate as to when a fix might be available. Worse still, sample code to exploit the bug is readily available, along with a detailed explanation of the flaw, making it especially easy for bad guys to exploit the vulnerability.
The problem has to do with the way HCP:// links are processed. Normal website links, of course, use HTTP, HCP links are used by the Help and Support Center (helpctr.exe).
Microsoft's Security Advisory (2219475) warns "This vulnerability could allow remote code execution if a user views a specially crafted Web page using a Web browser ... "
If the bug is exploited, a bad guy can run software or commands on your computer, as if they were you. The last phrase is important but hasn't been stressed in the articles I've seen on the subject.
Refer here for more details on how to fix this vulnerability until patch is available from Microsoft.
Ensure you have up-to-date virus protection
The Google trends are once again a mix of hot trends, including the Gulf Oil Spill, Michael Jackson, Miley Cyrus, Microsoft and Microsoft Kinect.
Unfortunately, those who are searching for more information on a trending topic are being lured in by hackers who don't provide anything more than an unhealthy dose of malware, a term used for malicious software.
By using clever SEO (Search Engine Optimization) techniques, websites are created that look as if they are filled with information on news topics such as the Gulf oil crisis or supposed pictures of Miley Cyrus in the buff. Unfortunately, the sites can cause a virus to attack your computer and will provide you with absolutely none of the information you are looking for.
Pop-up warnings that inform you that your computer is in danger of facing security issues will often show up when you land on these spammy sites. The warnings are not real and if you click on them, you will download dangerous software on your computer.
There is often a fee for these services and that will threaten the safety of your credit card information as well as your computer if you use it to pay for these fake services.
It is important to have up-to-date virus protection on your computer to help protect against malware.
Medusa
Bad passwords can have catastrophic consequences. That's because passwords play a key role in enterprise security, protecting assets (including email systems, databases and many other types of servers) from unauthorized users (including malicious hackers).
A bad password has one of the following three characteristics:
- It can easily be guessed
- It is likely to appear in a wordlist
- It can be bruteforced in a reasonable amount of time
- All three of these possibilities need a little further explanation.
A number of tools are available for carrying out online attacks, including the open source software Hydra. Arguably, the best one is an open source software tool for the Linux OS called Medusa, written "by the geeks at Foofus.net."
Medusa is described as a "speedy, massively parallel, modular, login brute-forcer" with modules available to support almost any service that allows remote authentication using a password, including: CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, POP3, PostgreSQL, SMTP-AUTH, Telnet and VNC. Medusa has been designed to run faster than Hydra by using thread-based (rather than Hydra's process-based) parallel testing to attempt to log in to multiple hosts or users concurrently.
AT&T Confirms iPad Security Breach
AT&T has confirmed an iPad security breach which computer experts say has exposed over 100,000 early iPad adopters to potential malicious hacking and spam, with those vulnerable including dozens of CEOs, military officials, top politicians and media personalities.
The security breach was discovered by a group calling itself Goatse Security, with the specific information exposed in the breach including subscribers' email addresses along with an associated ID used to authenticate the subscriber on AT&T's network, known as the ICC-ID. AT&T, the sole U.S. provider of wireless service for the iPad , said it had fixed the security hole by Tuesday after being contacted by Goatse Security.
"At this point, there is no evidence that any other customer information was shared," AT&T said in a statement. "We take customer privacy very seriously, and while we have fixed this problem, we apologize to our customers who were impacted."
Please refer here to read more details.
Law Enforcement - and Potential Employers - are Watching What You Say and Do Online
Think twice the next time a contact tries to "friend" you on Facebook or "follows" you on Twitter. It may turn out to be an undercover fed looking to scrutinize your employment history or examine your personal references.
U.S. law enforcement agents are following people into popular social-networking sites, going undercover with false online profiles to communicate with suspects, gather private information and view photos and videos that are restricted to a user's network. Their main intention is to trail and catch criminals, tax evaders and other wrongdoers, as well as gather evidence to support their cases.
Information on social media sites has been used against employees in ways ranging from performance evaluation to legal risk. For example, when an employee files for disability compensation and during the same period posts pictures of physical activity."There are real concerns in terms of how social media can affect your employment status and potential job opportunities by what you do on a daily basis on these sites.
Tips for Job Seeker's Safety
From a job seeker's perspective, one needs to be consistent in one's activities and information posted about employment history, business references and recommendations provided. The slightest conflict in their profiles can make them a potential target for fraud and ruin their online reputation.
Use Good Judgment: Consider how your comments would be perceived before you actually post them, and put logic above emotion at all times. Before you hit 'post,' realize that this will be a permanent reflection of your identity, and it may never be erased. Assume that anything you put on a social networking site will be seen by third parties, and "ask yourself whether you would want that seen.
Know Your Contact: The key is: know your contacts. Do not accept friend requests from suspicious people. Use proper introductions when adding users as friends or connections. Once you connect with somebody, they will have access to your information, and -- depending on who they are -- you might not want them to have that level of access. A good practice is to go through your contact list frequently to ensure you have a tight and trusted network of people.
Do Not Tag Photos: Don't allow individuals to tag your photo, as unflattering pictures could end up costing you or your friends their jobs. A big risk in your friend putting that picture up of you from college doing silly things, and then tagging the picture -- It might also get picked up on a search engine. So, if a recruiter does a search, it could come up. There are settings in social media sites to prevent friends from being able to tag you.
Change Your Passwords: often and do not use the same password for social networking sites that you use for your email accounts and online banking.
Know Your Privacy Settings: Many sites such as Facebook provide users with a great deal of control over who can access their information. Those settings can be confusing, says Navetta, but there are websites like these that explain how to lock down Facebook's privacy settings, including BusinessInsider.com. Note also that Facebook is creating simplified privacy settings for future use.
Be Consistent: Using the same photo, consistent profile language, message and links on all social media sites reduces the chances of identity theft and generates trustworthiness and recognition among employers when conducting background checks. Job seekers also need to think twice before clicking on any links in social media sites, as these links can show up on their online history and result in turning off recruiting and hiring managers.
Avoid Controversial Statements: If you think that somebody could take offense with respect to a political view or offensive language or comments, don't make them on a social media site that can be viewed by others, says Navetta. "Remember: if there is nothing offensive on your site, there is nothing for potential employers to get judgmental about."
Tool could help prevent surreptitious snooping, data-gathering from webcams, microphones, GPSes
Microsoft researchers have developed a sensor widget concept that issues alerts and lets users control what others see from their webcams, microphones, and other live data streams. Microsoft's Jon Howell and Stuart Schechter say their research grew out of concerns that applications are able to access multimedia peripherals even after the user's activities are finished.
The researchers envision a sensor tool that provides an animated representation of how an application is gathering the user's data. The moment the application attempts to access these sensors, three sensor-access widgets will appear within the application, informing the user of the data that is about to be revealed.
The researchers recommend a configuration that lets applications access only webcams, microphones, and global positioning systems after users have had time to notice the application is about to gather data from them. We believe this is an important issue given the emerging class of application platforms that can enforce restrictions on the resources that can be accessed by applications.
Refer here to read more details or refer here to download the research paper.
Privacy Awareness Week
Easy online test looks at 11 situations in you might be subject to ID theft. For each situation, you get a choice of statements. Decide which statement best decribes you and click the box beside it.
At the end, you will receive a score and assessment of your answers for each situation.
Refer here to begin the test and also find some more information in the "book" at the bottom right of each screen, with some tips for you to use.
Danger in the internet café?
University of Calgary (UC) computer science professors John Aycock and Mea Wang have identified a type of computer security threat, called Typhoid adware, that gains access to computers through wireless networks found in Internet cafes or other areas where users share non-encrypted wireless connections.
"We're looking at a different variant of adware--Typhoid adware--which we haven't seen out there yet, but we believe could be a threat soon," Aycock says. Typhoid adware comes from another person's computer and convinces other laptops to communicate with it and not the legitimate access point. Then the Typhoid adware automatically inserts advertisements in videos and Web pages on the other computers.
Aycock and Wang developed several defenses against Typhoid adware. One solution protects the content of videos to ensure that what users see comes directly from the original source, and another solution offers a way to "tell" laptops they are in an Internet cafe to make them more suspicious of contact from other computers.
Please refer here to read more details.
History of Social Network Use Reveals Your Identity
Web browsing history can be used to identify individuals in a membership group on a social networking site, according to researchers at the Vienna University of Technology. The researchers built a Web site to read the Web addresses visited by people who use Xing, a business-oriented social network based in Hamburg, Germany.
They collected data on 6,500 groups containing 1.8 million users, and analyzed the overlap between the lists of names of group members that were publicly available. The researchers estimate that 42 percent of Xing users could be uniquely identified by the membership groups they visited. Xing has begun to add random numbers to mask addresses, but the response might not be enough to foil a similar snooping site, says Stanford University computer scientist Arvind Narayanan.
The next round of Firefox, Chrome, and Safari browsers could have fixes to prevent browsing history from being relayed to Web site owners.
Please refer here to read an interesting research.
