Information Security Tips from Westfield Insurance

Secure Shopping

More people are shopping online than ever before. Credit and debit cards are a convenience we take for granted but there are some risks you should consider, especially when making purchases over the Internet.

• When shopping online, type the merchant's URL in by hand instead of following any "convenient" link in an email or instant message. Those links can be spoofed in a phishing attack which looks like legitimate advertising.
• Look for the prefix https in the address line. This indicates that you are on an encrypted connection to the merchant's website. You can also look for the little yellow padlock icon in the bottom right of the browser. Be careful, however. Sophisticated hackers can spoof these signs.
• Read the site's privacy policy carefully and use common sense about the offer. If it sounds too good to be true, it probably is. If you don't trust the company to protect your personal information, shop somewhere else.
• Make sure your own protections (anti-virus, firewall, patches) are up-to-date and running.
• Use a credit card, not a debit card. If your credit card is stolen or the number misused, federal law limits your liability to $50 (as long as you comply with the notification requirements). If a debit card number is compromised, you could lose the entire amount in the checking or savings account to which the debit card is linked.
• Check your statement carefully for charges you don't recognize. Report any anomalies to your bank and report a lost or stolen card immediately.
• Consider keeping a separate credit card with a low credit limit just for internet purchases.

Remember that these rules apply when you are paying by telephone, too. You should always call the merchant (or utility, charity, etc). Never give someone your financial information if they called you – no matter who they say they are, you don't really know who's on the other end of that line.

Shopping online can be as safe as shopping in a physical store or through a catalog as long as you shop responsibly.

Pump-and-dump — bypassing the spam filters

Right before Thanksgiving, we ran a Tip on "pump-and-dump" scam emails – emails containing fraudulent stock tips. A Westfield IT employee forwarded an interesting variation of this scam. This message uses several different techniques in an attempt to circumvent the company's spam filters.

As a scam, notice that the message is urgent and timed. "It's going to explode on Monday Nov 13th". This scammer probably dumped the stock right around that date. Looking at the stock's trading history, this scam probably worked. On 13 Oct, this stock cost less than a penny a share. On the 13th, it spiked up to $1.14. One week later, it was at $0.65 and falling.

Note that the scam part of this message is included as a picture, not as text. It has a lightly tinted background and small little "threads" scattered through the image. To a human, they look like the tiny imperfections that you sometimes see in high-quality paper. We easily ignore them and read the text. Their real purpose is to disrupt the computer's ability to conduct optical character recognition. Not being able to fully read the text, the message doesn't earn as many "points" toward being recognized as spam by the filter.

Second, note that the message is crafted to appear to be a reply even though John has never sent anything to this person. The hacker is hoping that we have a "whitelist rule" that would exempt all return messages from filtering. (That's a common rule for companies that have had problems with good messages getting blocked as false-positives.) Unfortunately, it is trivially easy to spoof an address in an email. With the right editor, you could make your emails appear to come from the President of the United States. And while that's certainly unethical and sometimes illegal, it's almost impossible to trace the culprit. Email was never designed as a secure communications channel.

Third, note that the spammer included a block of text at the bottom of the message. To a human, it's incomprehensible nonsense. To a computer, those are real words in apparently reasonable order. Since the spam filter "weighs" the sales-like content in proportion to all the other content in the message, this nonsense has the effect of diluting the spam score of the message.

As we discussed last week, researchers estimate that there are 9-10 spam messages for every good message on the Internet. Most companies have good tools but at those volumes, some spam will always leak through. If it looks like spam, it probably is. Delete it (preferably without opening the message) and move on.

Spam trends - Updated

If it seems like you're seeing a lot more spam lately, it's not just you. During the past few months, the incidence of spam shot up around the world. In 2001, researchers estimated that about 5% of all Internet traffic was spam - one spam message for every twenty real messages. By 2003, researchers estimated that 50-60% of all traffic on the Internet was spam - one spam message for each good message. In September of this year, that number was up over 80% - 4 spam messages for every real message.

In the past month, two new computer viruses were released both of which are specially designed to generate spam messages. These viruses are very sophisticated and have been very hard for the anti-virus companies to block. (See this TechWeb article for details.) The latest estimates are that there are 9-10 spam messages for each good message on the Internet. All that means that the total volume of spam on the Internet is way, way up.

Good spam filters are generally 95-98% effective at identifying spam messages as spam. That's actually a pretty good ratio and is about as good as any software package can get. Unfortunately, when you pump so much increased volume through a filter with a 2% leakage rate, more spam will inevitably leak through.

Some people have asked if they can tweak that filter to block more of the spam. The cost we generally pay for that effectiveness is that about 0.5% of good messages are incorrectly identified as spam. If you tighten the spam filter, you will get an increase in the false positives. Every company is constantly trying to make sure that they are at the right balancing point.

We are in an arms race with the spammers. Every time the anti-spam vendors come up with a technique to identify spam, the spammers adapt and find another way around the filters. It has been a story of incredible creativity and innovation.

While we are waiting for the spam-filter companies to release their next round in the arms race, there are some things that you can do to keep yourself off the spammers' target lists. Remember that once you're on one list, spammers will sell your address to other spammers. And once that happens, there's little you can do except to wait until your address ages off their lists.

1. Never buy anything advertised in a spam message. If you do, you'll jump straight to the top of their list.
2. Never respond to a spam email, even to complain or to attempt to get off their list. Any reply at all confirms to the spammer that you read the message. Even if you didn't fall for their Viagra scam, they know you might fall for a mortgage scam. Never reply to a spammer. Do not attempt to "unsubscribe" from the list. More often than not, the unsubscribe link is a scam.
3. If you can, delete the spam message without ever opening it. Spammers use techniques such as web-bugs to track whether or not you opened the message. Again, they hope that even if you didn't fall for one scam, if you're the kind of person who opens spam, maybe you'll fall for a different one.
4. Do not use your work email address for internet shopping, chat boards, etc. Sign up for a free email account like Yahoo or Hotmail.

The final recommendation is to remember that spam is just like the physical junk mail in your mailbox at home. We do what we can but at some point you just throw it in the trash and let yourself get on with your life.