Candy canes from Strangers

Merry Christmas everyone!
It's the morning after the big day and everyone is still sleeping in over here. I'm just taking a look at a few things and I saw this article from the honeypot.

As the author mentioned it's an old scheme, but it's dangerous. In the short list of 'Tips from Mom for the cyberage' - visiting a website based on a spam email is taking candies from strangers. While you're visiting the site for a 'quick peek' at something naughty rather than nice - they're infecting your computer.

One approach would be to take a page from Nancy Reagan - 'just say no'. Another would be to make sure you're properly protected before journeying out into wilds the internet.

Think of being protected like dressing appropriately for a rain storm.

level 1 - If you're going out in the rain - you really skip putting on any special gear. you'll get wet - probably no biggie.
2. you add on a hat to protect your head
3. you add on a rain coat
4. you add an umbrella to your gear
5. you add boots/ rain pants

Like wise in the 'safe surfing' world
Level 1 - you're not really using any protection - just surfing online hoping for the best!
2. you have the firewall that came with the OS turned on (eg. on Microsoft Vista)
3. you use the firewall that came with the computer when purchased (eg. Nortons Firewall )
4. you use an external router between you and the internet
5. your firewall/OS are updated automatically
6. your firewall stops unknown outbound traffic! (eg. ZoneAlarm)

... the list of ways to be safer can continue, at this point it just depends on how paranoid you are. :)

Can I see your ID?

Can I see your ID?
It’s hard to believe now, but those were the most feared words a thirsty 20 year old college student could hear - particularly when trying to buy beer! I can remember trying to look older, trying to look nonchalant, even pre-occupied with something else to get past the watchful eye of the clerk.

Just like the liquor store owner checking the id’s of misguided youths, you need to check the “id” of websites where you shop - or share any personal information. There are some new phishing attacks where fraudsters are re-routing search engine results. Think of it like getting a new yellow pages book every day, and on occasion the number you see in the book is NOT who it is supposed to be!

Leaving that attack aside, here's some easy steps for the home user to follow to ensure safe surfing.

example 1.


2 things to consider for ‘checking this ID’:
1. is your internect connection to this website safe?
2. is the website who you think it is?

All internet traffic travels through many servers and computers you’ll never know or see. Think of the difference between mailing post cards and mailing letters. They both get to their destination, but one can be read very easily along the way. By having a ‘safe connection’, you’re wrapping a virtual envelope around your message. To verify you’re safe, look at your browser – do you see a padlock? It’d either be in the address bar, or on the bottom (or both!). Also, in this example on Mozilla Firefox, there is a yellow color and I can see the letters HTTPS. In Microsoft Internet Explorer 7 and beyond this same area will turn green so you have a good visual all is ok. HTTPS stands for HyperText Transfer Protocol – Secure. Without the ‘S’ even if you logged onto the site your data is not traveling across the wire in a safe fashion.

For websites to be able to use this protocol, they have registered with an independent vendor (think of the internet’s Certificate Authority (CA) similar to a Public Notary) to verify they are who they say they are. There are a few companies that issue these certificates - one is Verisign. Here is what it looks like if you see the verisign logo on a site and follow the link.

To recap: if you have to share your personal information, you're basically ok IF

1. You typed in the website address (URL) in your browser address window
2. There is an HTTPS (secure Hyper-text Transfer Protocol) prefix on the address
3. There is a locked padlock on the bottom of your browser
4. You're using a computer that is virus/malware free
   
   
   

Tips from Mom

Tips from Mom adopted for the re-interpreted for the cyber age

1. Get a good education
a. Attend seminars; read; take action;
b. Know your threat profile
c. Know how to recognize ‘safe’ websites

2. Never ‘talk’ to strangers
a. phishing – never follow links in emails. Motivated bad guys can create websites that look exactly like your bank – with an image over the URL so you can’t tell the difference!

3. Don’t take candy from strangers
a. Cookies are how the websites you use know who you are when you come back. They also maintain data while you’re logged in (these are both good things!)
b. Cookies can also provide data to other people (this isn’t necessarily bad, but could be)
c. Worse than cookies is clicking ‘ok’ to popup from a website you don’t know – this will install a program on your computer.

4. Don’t share your house keys
a. Each time you create a user name for yourself and a password – you’re creating a new ‘house key’ for your personal information
b. Passwords should be complex
c. Passwords should not be shared across websites

5. Take your vitamins
a. Set your computers operating system to update automatically;
b. antivirus program should download new signatures as they are available

6. Lock your doors
a. select a good firewall that meets your household’s needs
b. outbound traffic is as critical to block as inbound
c. use a browser other than Internet Explorer - eg. FireFox

7. Wash your hands when coming home
a. scan for viruses, Trojans, worms, Malware
i. key loggers; data streamers

8. Use a good soap!
a. Research the software tools available and choose wisely
i. Anti-virus
ii. Anti-spyware

Mmm I love Hunny!

Pooh couldn’t ever do enough to get himself some honey! He’d disguise himself as a little dark rain cloud, he’d get himself stuck in honey jars by trying to lick the bottom of the jar and once he ate himself so fat he had to sit stuck in the door of Rabbits home for many days until he became thin again.

When it comes to “honeypots” - hackers are similar, they can't resist. In a nutshell, honeypots are fake customers, websites, or user credentials. Companies and organizations interested in proactively studying the patterns of who is stealing what use this technique to lure in the bad guys and then track the 'honey' to see where it goes. A friend of mine did something similar with email addresses. He started creating a unique email address for himself whenever he signed up for a service. E.g. He played fantasy football, so he created daves_fantasy_football@vendor.com when he started receiving spam on this email address, he KNEW who sold his information!

Here is a great technical paper from Honeyblog written to explore many areas regarding the topic of malware and new black market forming around the internet in China.

It has a lot of detail explaining who is stealing ID's in China, who the thief is selling them to - and ultimately how the fraudsters can make money off of video game credits!


Read more