Information Security Tips from Westfield Insurance

Phoner/toner scams

There has been a recent resurgence of the so-called "phoner/toner" scams. They are popular because they are highly effective, very profitable and, while deeply unethical, not technically illegal (which makes them relatively safe scams from the criminal's point of view).

In this scam, you will get a very friendly call from someone who knows your name (possibly because they called your number late last night just to see whose name came up on the voicemail) and who may even claim to be from your own IT department. After a minute of friendly chatter, he/she will ask for the number on the printer behind you, perhaps saying that "it's part of our inventory of systems". The scammer is betting that most people today have a printer very close to their desks.

Several weeks later, you will receive an unsolicited replacement toner cartridge in the mail. You don't remember ordering toner but who keeps track of things like that? And if you didn't order it, one of your co-workers probably did. So you open the box and tuck the toner away for a rainy day.

Weeks after that, the scammer sends an invoice for five to ten times the market price for the toner cartridge. The scammer is counting on the fact that most finance departments will just pay small invoices and even if they don't, they'll forward the invoice to you for approval. You remember receiving the toner and, since most of us assume we are dealing with honest people, you are likely to approve the payment without checking the price. The great thing about this scam is that it's not illegal to charge too much for a product. Under US law, it's "buyer beware". If you agree to pay five times what something is worth, that's between you and the seller.

If you don't pay, expect a series of followups demanding payment. If you call about the invoice, the scammer will likely offer to play back a tape recording of your employee saying "yes" to a request for toner. The scammer likely did get your employee to say "yes" to something and then cut-and-pasted the sound clip in front of a different question.

If you get one of these scams, first refuse to answer the question. No one should be asking about your systems without cause - even something as seemingly innocuous as your printer models. Second, alert your Receiving folks to watch for toner or other office supplies coming from someone other than your regular supplier. If you can identify the shipment in time, refuse to accept delivery. Third, do not pay the scammer. Do not pay any return or restocking fees either. Under Federal Trade Commission rules, any unordered merchandise can be considered a gift. You didn't order it. You have no obligation to give them money. (You might, however, want to have your legal counsel send the scammer a cease-and-desist letter. You should probably also double-check your state laws. Ohio gives even stronger protection and permission to consider the unordered package a gift.)

Managing multiple passwords

These days, keeping all your passwords straight can be an almost impossible task. Every website and application needs a password. Do you pick the same password and use it everywhere or do you write them down? If you use the same password, you'll lose them all as soon as any one of those systems gets compromised. But if you write them down, you lose them all when your sticky-note gets lost or stolen.

Here's a trick for making semi-customized passwords that will be easy to memorize but still unique to each site.

Pick a "static" password. (For this example, I'll use "Bluebird" but a passphrase is much better.) Now look at the website or application that you're signing onto. Make up a personal rule about the website name such as:

1. The first digit of my password will always be the second letter of the website's name.
2. The second digit of my password will always be the number of characters in the website's name.
3. The third digit will be a dash.

The password at Amazon would be "m6-Bluebird" and at eBay would be "b4-Bluebird". The password on your home Dell computer might be "e4-Bluebird". A password in this pattern is reasonably strong because it has all four character classes (uppercase, lowercase, number, punctuation) and because it doesn't follow the predictable tendency for English speakers to capitalize the first letter and put the number(s) at the end. Best of all, every password is different but you only have the one phrase to memorize and one rule.

There are a couple of limitations to this technique.

• You must be the only person who knows your exact rules. Do not use the exact rules above. Make your own choices about which letter, punctuation, etc.
• Some systems won't allow special characters (like the dash) or may have size limits on the password. Unfortunately, there's no easy way around those problems. Make the best choice you can given the limits of the system and write down only enough to remind yourself what's different (such as "401k - no dash"). If it's an important system (like your online bank), lobby the company to allow stronger passphrases.

Firewalls

A firewall looks for and attempts to stop forbidden communications between two computers. Firewalls work by examining each piece of traffic entering or leaving the network and blocking those which do not meet specified criteria. If the communication is an allowed type (for example, Windows passing your user name and password to the company network during login), the message is allowed through. If the communication is unrecognized (for example, a virus attempting to impersonate Lotus Notes but really sending your password out to a hacker), the traffic can be stopped.

There are two kinds of firewalls: "personal" or software firewalls and "network" or hardware firewalls.

• Software firewalls are relatively easy to install and provide good protection. They filter traffic entering or leaving a single computer. Software firewall programs (such as ZoneAlarm, Norton or Comodo) can be downloaded from the Internet and may be available in a free version for home users. (Note: If your home computer's operating system is Windows XP or Vista, it has a built-in software firewall but Windows has not traditionally performed well in bench comparisons. Most security experts recommend replacing or at least supplementing the Windows firewall.) For more on personal firewalls and how they work, see the first page of this article.
• Hardware firewalls require you to buy and connect a separate piece of equipment, but they provide stronger protection. They plug in between your internet connection (such as the cable-modem or DSL line) and the computer. Hardware firewalls are often built into routers, allowing multiple computers to share a single, protected connection to the internet. Hardware firewalls often also have the ability to perform network address translation (NAT) which hides the specific IP address of your computer and makes it much harder for a hacker to launch an attack against you. Hardware firewalls are available at many electronics retail stores, usually starting at $50-$75.

CERT (the Computer Emergency Readiness Team) strongly recommends the use of hardware firewalls, especially if you have a broadband or "always on" connection. See "Before You Connect a New Computer to the Internet" for more information.

Some firewalls will display a pop-up box asking if you want to allow the message. If you see one of these pop-ups, never allow the traffic unless you are sure that you know exactly what it is doing. Remember, the firewall won't do any good if you give permission for the virus to send out your password.

Hackers do it for the money

Every so often, people ask me "why do they do it?" Why do the hackers put so much time and energy into committing crimes and sending spam? Why can't they channel all that innovation for good?

The stereotypical hacker used to be a pimply-faced, pizza-eating kid working late at night in a caffeine-induced frenzy for guts, glory and bragging rights – kids breaking into systems just to prove that they could or writing computer viruses to delete hard drives for the cheap thrill of vandalism. There are still some of those folks out there but the vast majority of hackers and spammers are now in it for the money. They are organized, well-educated and they're making big bucks.

According to McAfee CEO David DeWalt, cybercrime has become a $105 billion business and is now larger than the value of the illegal drug trade worldwide. Unfortunately, computer crimes are relatively safe crimes. Hackers hide behind multiple networks and their digital footprints. Many hackers run at least part of their scam through a foreign country – often one with poor relations with the US, significantly increasing the difficulty in prosecuting any case against the criminal. Law enforcement's ability to find, prosecute and punish cybercriminals has not kept up with the growth of the criminal activity. And even if you do get caught, DeWalt noted that "If you rob a 7-11 you'll get a much harsher punishment than if you stole millions online."

And even if the hacker can't make any money off you directly (by stealing your personal information or using your computer as a point-of-entry into the corporate system), they can still hijack your computer's processing power to attack other systems. The hacker sees your computer as an asset.

Take spam as another example. If we all stopped buying, the spam problem would dry up in a matter of months. Yet 98% of all message traffic on the Internet is now spam. Who buys that junk? According to a study from several years ago, a spammer only needs to make one sale or con per 100,000 messages in order to make a profit. With those odds, they don't even have to be good scams. They just have to find the one gullible person among your 100,000 closest friends.

• Keep your personal computer protected at all times with anti-virus, anti-spyware and firewall – and keep them all current. Keep your computer patched at all times.
• Pick strong passwords and never give them out to anyone no matter how good their story is.
• Be alert for phishing scams.
• Never buy anything from a spammer.