Information Security Tips from Westfield Insurance

The Problem with Honest People

The problem with honest people is that they don’t think too seriously about how the things that they do or information that they share could be misused or be used against them.

It’s not the nature of good people to think like bad people.  I can hear people saying: “No one cares about my information.  I don’t have anything that people would want to steal.  Bad things happen to other people, not me.  I am just one person in a million; there are better targets out there.  etc…”   It’s not until something actually happens to them, or someone that they know, that they realize the truth.

Please! Please! Please! All you honest and good people living in modern world, think a little bit more about it!  What could a malicious person do with your information if they wanted to?  Even the simple messages you post on Facebook or Twitter.  Malicious people do exist.  I see it regularly in my career as an Information Security professional.  Only in hindsight does the light bulb go off for the victim.  Also, the victim might not be the person who’s information is misueed, many times one person’s information is misused to victimize another who trusts them.  Social networking sites are a ripe field for this kind of information to be harvested.

Here are some tips I ran across that talk about basic security precautions on social networking sites.  These are just some common sense things that can help reduce the probability and impact of information misuse: http://www.bankinnovation.net/profiles/blogs/10-ways-to-prevent-social-1

Even if you don’t think that YOUR information will be stolen or misused, don’t give anyone the opportunity to prove you wrong.  Keep being honest but be "Information Misuse" aware!

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust

At the Nexus of Social Networking and Business

In a recent blog post I suggested that, while social networking (e.g., facebook, myspace, twitter, orkut, LinkedIn, etc.) is here to stay, one needs to be somewhat circumspect in using them.  I focused mostly on “apps” within these social networking communities.   These apps often want access to your personal information or want you to install or run some program at their behest.

As a follow-up, I’d like to discuss some general ways in which you can improve the likelihood that you will not get your personal or business systems hacked while still being able to enjoy the fruits of these dynamic, fast-growing communities.

• Think before you click on anything asking:

- for access to your personal information (on various sites, they may be called “applications”, games, “e-cards”, “gifts” like a virtual cup-of-coffee, virtual bouquet of flowers, a snowball).  Do you trust the requestor?  Do you even know their privacy policy?

- you to install some “missing piece of software” (e.g., a dll, driver, codec) and perhaps offering to forward you to the site where you  can install it now and then proceed with your original task.  Do you know the software provider?

• Review your privacy settings periodically, there are many recommendations  in this regard in the mainstream media (see table at bottom).

• When the social network provider notifies you that their privacy policy has been changed – READ the new privacy policy!  There have been cases where the provider has retroactively instituted new default access rules rendering previously private parts of user profiles open to the public!

• Don’t lend the use of your computer (laptop, desktop) to anyone that might be reckless with it.  If the borrower surfs to an infected web site and your account on the PC becomes infected then they have unwittingly put your personal information at risk.  To mitigate the danger – always create a separate account for other users (either one account per person for regular users, or) a shared guest account for people that just want to use a browser for short time.  When creating such accounts do be sure they are not endowed with any administrative powers.  Delete all the files they leave behind and perform a virus/spyware scan.  Don’t think of it as being distrustful, think of it as good hygiene.

• Taken to its logical extreme, you might seriously consider having a completely separate system for when you are working on your high privacy stuff (employee personal info., online banking, personal/business financials,  tax returns, medical bills/records, …).   This will almost guarantee that your private information stays that way. **

Although it may sound like I need to lighten up, if you read some of the horror stories about people that have  experienced ID theft, you may decide I am not being adamant enough!  Of course, you have to find a happy medium for your circumstances.  Hopefully, the list above will help you make more informed decisions before you click.

--------------------------

Site Policy	Privacy Recommendation
facebook	High level: NY Times Very detailed: AllFacebook
MySpace	For better privacy control, switch from profile 1.0 to profile 2.0.  MySpace recommendation
LinkedIn	Walk-through: Network World LinkedIn recommendation
twitter	Creating a non-public  twitter account

** If you are computer savvy enough to know about virtual machines (VM) – you can get much of the same degree of isolation using a separateVM, instead of a separate piece of physical hardware.

The Overly Eager Bird Catches a Worm

The social network phenomenon has shown many benefits.  These sites, such as facebook (FB), have great potential for people seeking friends to hang out with online.  Businesses too are finding it desirable to create a company presence on FB, myspace, twitter, etc.  Given their explosive growth, however, these sites have also attracted an unsavory element looking to exploit such new fertile ground.

Do you recall, back in the early 2000s, when email phishing was a relatively new phenomenon?  Eventually people became savvy about not following links that arrived in email messages from businesses with which they had no established relationship.  You see, in order to compromise your system, eventually the bad guys have to get you to act on their behalf ... so at some point, they have to present you with some “stuff to click on” ... thereby tricking you into giving your operating system (Windows, MacOS, linux, etc.) the go-ahead to install their evil code.

In a similar vein – have you noticed that when you go to play a game on a social site, say FB, you are presented with a dialog-box saying something like "This application requires access to your FB profile.  Do you wish to grant access?”  This is the FB security layer warning you that this application is trying to access your FB profile.  This is like a stranger asking to look through your wallet and record whatever they feel like while they’re in there browsing.  Alarm bells should be sounding in your head!  Let’s see ... a game that’s all sorts of fun to play and has really nice graphics, and which must have taken some people a lot of time to develop, all apparently, “for free”!  Too good to be true?  Gee whiz -- that's a little like those emails I occasionally get from "banks" promising to consolidate all my debt into a "Zero down, 0% APR loan” ... too good to be true indeed.

So, while most FB applications/games are not bogus fronts for bad guys that want access to your personal information, it is also true that some of those ostensible applications are in fact phony.  So be very careful before deciding to unleash these apps on your private information.

In another example of social networking abuse, there was recently a worm blazing its way through FB accounts called KoobFace ("facebook" spelled sideways, sort of).  KoobFace arrives as a FB message from a FB friend in your FB inbox.  When you open it, you are told to check out a YouTube video.  When you click on the link to the video you are sent to a fake YouTube site.  When you try to start the video playback, you are told that your system is missing an important piece of video playback software called a codec (engineering speak for coder-decoder).  It asks if you want to install the missing codec.

Let’s step back here.  At the request of a site that looks like YouTube, you are about to install and run some piece of software!  Are those internal alarms bells clanging loud and clear yet?  They should be.  The supposed missing codec is really a worm.  If you OK installation -- your system is infected.  The worm begins executing immediately, making a few "adjustments" to your Windows Registry to make sure it gets restarted whenever you reboot.  It then proceeds to wander about in your browser cookie cache finding out which social networking sites you belong to.  For each site, it authenticates and then sends messages, in your name, to all your friends!  Of course, those messages are just more infect-o-grams like the one you fell for.  And so the worm turns...

The lesson here is: think twice before accepting requests to "access" your social networking profile(s) from applications, games and gifts.  Moreover, think three times about saying yes when some web site that you have followed a link to recommends you OK installation of software you supposedly need!  If you believe you really might be running an old version of a plug-in, anti-virus program, etc., you should still always refuse the unsolicited pop-up style request.  Instead, you should explicitly type in the URL for the software maker and check if there you are missing codecs or updates to the software.  If there are updates then update your software and retry playing the video. 

If your software is already up-to-date, or if you get the pop-up again after updating, then assume the pop-up is malicious and just skip playing it!  It cannot be worth the inherent risk.  You might even go the extra step to inform the sender of your suspicions.  For example, in this particular case, the “sender” would be surprised you even got an email from them!  You’ll recall, in our scenario, it was the worm that sent it.  This is often how people find out their system is infected so you are doing them a big service.

To read further, here is a link to a technical explanation of how the koobface worm works.

How to Stay Clear of Census Scams

Every ten years Uncle Sam asks each of us to provide some information through a Census, in an effort to distribute billions of dollars into appropriate infrastructure and services projects each year. It's purpose is important, however it also opens the door to scammers and criminals alike, who can't wait to take advantage of situations like this.

How will you be counted?

A form will be sent to your home via the mail, which will ask 10 questions, and no it isn't available on the Internet for 2010. These questions are aimed at determining the number of residents per home, and a minimally invasive set of information about each resident. You won't be asked to share your social security number at any time. It's very important that you fill out the form and send it back, or a "Census Taker" may visit your home to gather your answers in person.

What should you be aware of?

Legally you must provide the answers to the Census, whether via the form, a Census Taker who visits your home, or both.

Scams which may pose as the 2010 Census are sure to be in abundance. These scams may come across as emails, websites, telephone calls, or even people knocking at your door.

Do we have any tips for protecting your information?

• Online Information

Read through the 2010 Census website, and contact them if you have any questions or concerns.

Remember, the 2010 Census will never ask for your information online, via email or a website.

• The Form

Know how to identify the census form, any request will be clearly marked as coming from the U.S. Census Bureau and as OFFICIAL BUSINESS of the United States.

• Census Taker

A Census taker may visit your home even if you mailed the form back. Your form may have gotten lost or not arrived yet, you still need to provide the Census Taker with the answers shown on the form you received.

Identifying a Census Taker can be confusing, remember they will not ask to enter your home, if they do, be wary.

It's a good idea to ask to see 2 forms of identification, the first will be a badge with the persons name, and the second could be any form of photo identification, like a drivers license, or state id.

If a census taker contacts you via the phone, you still need to provide the information which is on the official form, but it's a good idea to gather the persons name, the office they work from, the date and time they called, and a phone number to reach them back on. Most scammers won't provide you this information.

• The information you share

Remember you only need to provide the answers to the questions which are on the form, you don't need to provide any other information.

Post-holiday phishes

I trust everyone had a good holiday break and hope you have a good new year. With the way 2008 ended, many people are making plans for the future. Unfortunately, some of those planners include phishers and social engineers. And as I'm sure you've seen, they are getting more and more creative and professional in their scams. The days when you could delete a message just because it was poorly written are long gone. Today's scams are targeted, well-written and spell-checked.

In particular, we are already an increase in phishing messages that reference the recipient's holiday credit care spending pattern. The messages will claim to be requests for confirmation, reports of transactions and even a few of the traditional "your account has been frozen" scams. During the holiday season, many people have more transactions and shop with more different merchants; the scammers are attempting to exploit any confusion over those transactions in order to trick you into disclosing your account information, passwords, etc. If last year is any indication, expect that phishing campaign to accelerate during this week and last until the middle of next month or so.

We are also seeing a number of scams related to the economy. The number of work-at-home scam messages is up dramatically. As you may remember from prior tips, these scams promise easy money either for helping transfer funds or to conduct "quality control checks" on merchandise. In the first case, you become part of a money laundering operation, in the second, a fence. Either way, you're like to get a visit from some federal law enforcement agency. If it were that easy to make money, they wouldn't need to be sending out random emails about it.

Interestingly, the old "Nigerian fraud" is back in large numbers. These are fairly transparent messages alleging that someone needs your help to get money out of a foreign country (usually in Sub-Saharan Africa) and offering you a percentage if you will allow the person to transfer the money through your bank account. Foreign lottery scams are also back in significant numbers. I believe that by now most people know that these messages are scams but in times of financial difficulty, sometimes hope trumps common sense.

If an email asks for your personal information or if it contains an offer that looks too good to be true, trust your intuition and delete the message. To learn more about how to identify common scams, check out some of the links in our archived Tips on phishing. Have a safe New Year.

Get ready for a Storm of holiday-related scams

For the past year or so, we've seen a significant uptick in attempted scams and frauds around every holiday. Many of them trace back to the Storm Warn gang, a crime ring based out of Germany that sells hacker software. Their last big attack was at the Fourth of July and tricked many thousands of users into downloading the 'storm-bot' trojan by offering a fake video clip of "the largest fireworks" celebration in the nation. Victims found their computer hijacked as part of a bot-net or had keystroke loggers and other malicious software loaded onto their computer.

If past patterns hold true, we can expect to see a dramatic rise in the volume of spam and phishing attempts during this holiday season. Some of their cons last holiday season included dedicated sites like the Merrychristmasdude.com website (a site offering suggestive holiday-themed photos along with a very malicious download) and spam emails such as the Happy New Year phishes. This group develops very sophisticated software with hundreds of variants that attempt to evade and outrun standard anti-virus software.

To combat these scams, first be suspicious. Never open unexpected messages or attachments.

Second, keep your anti-virus up to date at all times. Set your anti-virus to automatically update itself as often as the software allows. And if you're particularly suspicious about an email or website, force a manual update before clicking the link. Remember that if your kids have a computer at home that runs under parental controls, their computer may not be able to complete the update under the restricted ID. Their computer may be at risk until you log on under your parental ID so the updates can take hold.

Finally, keep your firewall turned on and be very suspicious of any 'free' video or other offer sent through the internet. In particular, be cautious about electronic greeting cards. While some are legit, many are frauds. See this tip for some thoughts on how to sort out e-card invitations.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

OnGuard Online

As the holidays get closer, many of us will turn to online shopping. Done right, online shopping is about as safe as catalog shopping - and much more convenient. If you don't take basic precautions, though, you could lose your shirt. Take the time to learn about the kinds of scams and cons that are used online.

The Federal Trade Commission hosts a terrific site with lots of content on identifying and deflecting these kinds of scams. If you haven't already been out to visit www.onguardonline.gov, I strongly recommend the site. It has some excellent overview material on security at the personal and small business level. The site also has a set of games covering a variety of topics like spyware, online auctioneering, peer-to-peer, phishing and spam. Test your knowledge of internet security and safe shopping. It's well worth the time to visit the site.

The site's material comes from a number of public and private sources but is all released for public use. If you run your own personal website, you can post their games, videos and handouts to your own site and help spread the word. (Instructions are here.)

Addendum:
This tip has inspired me to create a more permanent set of links to some of the better games and awareness quizzes that I've run across. I'll try to get them posted in a permanent sidebar on the blog but in the meantime, here are a few good links.

• CMU Anti-Phishing Game - Learn to identify fraudulent URLs
• Mission:Laptop Security - Protect your laptop while traveling
• Anti-phishing Father's Day card - Flash video on phishing
• Auction Action - Test your knowledge of online auctioning
• P2P Threeplay! - a quick quiz on file-sharing
• Invest Quest|http://www.onguardonline.gov/games/invest-quest.aspx - a simple quiz but the 'disclaimers' are pretty funny

Spam, phish or secure mail?

For several years now, we've been telling everyone that email is a postcard – everything in the message is exposed to anyone who wants to read the message as it flashes by. A couple of companies have figured out how to solve this problem and their solutions are finally hitting critical mass. If you have a secure mail solution, you can finally put your message in an 'envelope' and keep outsiders from reading it.

The problem is that we've also told you as a reader to delete any message that appears suspicious or that asks you to click through some "convenient" link. The 'envelope' around a secured message looks a lot like a phish. (See "How it works" below.)

Here are some tips on telling the difference between a secure mail message and a spam or phish.

• In a legitimate message, you will still be able to read the subject line and the sender. If you are not expecting a message from that sender, be suspicious.
• Once you start working with a business partner who uses a secure mail system, all secure messages from that company should look basically the same. If the logo, the layout or the text look different, be suspicious.
• A legitimate message will take you to the sender's website to verify your login. A phish will try to take you someplace else to steal your password. If the message alleges to come from someone at redcross.org but the link is trying to take you to yahoo.com, be suspicious.
  Reminder: The only part of the domain that matters is the part immediately before the top-level domain (.com, .org, etc). Ignore everything to the left or right of the dots. In the link voltage-pp-0000.westfieldgrp.com/mail/32/, only 'westfieldgrp' matters for verifying the legitimacy of the message. The rest is set up by the company's IT department to point to specific places within the company's domain.
• Legitimate messages are written by professionals. Scam messages want to panic you into acting without thinking and often use phrases like "URGENT" and "log in now or your account will be closed". If the language seems inflammatory, be suspicious.

If you are suspicious, call the sender and confirm the message. Please do not just delete these messages, though. There's a fair chance they are legitimate and you wouldn't want to lose good messages.

How it works
There are several ways to put your message in the secure 'envelope'.
One technique doesn't actually put the content in email at all. What you really send is a placeholder saying "You have a message waiting. Please sign in at my website to read it." The message content stays on the sender's webserver and never actually travels by email. Some large financial and medical institutions use this kind of secure messaging.
The other way is to pull the content off the message, encrypt it and reattach it to the message. The content travels by email and but can't be read except by someone who knows the password. (If you don't already have a password set up, you will be asked to verify your identity and create one.)
A third technique is Transport Layer Security (TLS), a method that protects the message from one email server to another. This requires some setup between the two companies but is otherwise invisible to both the sender and the reader. These messages can't be easily mistaken for a phish so we won't discuss them in this tip.
An example of that second kind of 'envelope' – the encrypted attachment solution - is attached below.

How to spot an email scam

PC World magazine put together a short tutorial on recognizing eleven common email scams. Each page includes an actual example, most culled from recent messages being sent out by the notorious Storm Warn gang, a group of hackers based out of Germany who not only run the scams themselves, but also sell their hacker toolkits to others.

Some of the scams seem pretty obvious (like number 10, the IRS scam) but others are very sophisticated in their tactics such as number 9 where the hacker is impersonating an indignant eBay customer accusing you of not responding to his question or number 11 where the hacker took the time to personalize the attack based on the victim's alumni listing.

Number 5, the NFL stat-tracking software, is particularly effective because the webpage is so professionally done. And there really are some good free software programs out there. (Well, not completely free since they're ad-supported but for an avid fan a few ads might not be too much to pay.) The problem is that there are a few very dangerous landmines hidden among the legitimate tools. Short of completely rewriting the code yourself, there is no way to tell the safe ones from the scams.

Never download "free" software unless you are completely sure of the reliability of the source and never load any software onto your work computer yourself. Always call your IT department.

Fathers Day card from the FTC

I normally tell people to avoid ecards like the plague. Once upon a time, they were fun and cute. Now, they are too often loaded with phishes and viruses. Very few ecard announcements are legitimate anymore.

That said, here is a Fathers Day ecard from the Federal Trade Commission on phishing and other information security tips. This is a great card. (And, yes, I will certify that it's legitimate. The music's a little hokey, though so you might want to turn down the volume before you play it.)

Take a few minutes to check it out and maybe forward the link on to someone who taught you how to stay safe.

www.ftc.gov/dad

Phishers spoofing the HR Department

Phishers and hackers continue to get more creative and more sophisticated in their attacks. A recent trend is to write very specialized attack messages targeting rank-and-file employees. One example is a personal email that appears to come from the company's HR manager. The message included the HR manager's name (it was posted on the company's website) and asked the employee to review a .pdf attachment to confirm vacation accruals. The attachment was a malicious trojan.

Luckily, many of these attacks are blocked by our anti-virus software but some will always get through. Be on the lookout for these kinds of scams. If you see a message that looks suspicious, do not open it, even if it appears to come from someone you know. If you're unsure about the message, call the alleged sender and just ask if he/she really sent it.

If you run a business, make sure that your staff know about these scams, too. Make sure you set a culture of security where it's safe for the employee to call you and confirm a message's legitimacy. (If you're the one writing the messages and you're getting a lot of calls, check out "How not to look like a phish".)

based in part on a CSO Online column

Fake check scams

Earn millions! Help a damsel in distress! Win the lottery! Work at home! Whoops, I overpaid – please send back the overpayment!

These are just a few of the scams out there. The average adult American receives 4½ emails, phone calls or pieces of mail per week attempting one of these scams. Thirty percent say they receive 10 or more a week and 18% admit that they or a family member have fallen for one of them.

The National Consumers League (NCL) recently launched a website fakechecks.org to help educate consumers about check-fraud scams like these. The website includes a "fraud test" and some great videos that show exactly how these six scams work and how to recognize them when they come in . Take a few minutes at home to see how many of these you would fall for. And remember, this is what these scammers to for a living. Some of them are very good at building a rapport and sounding trustworthy. They play on our inherent trust and desire to be helpful and courteous.

Remember also that in a check fraud scheme, the victim is responsible for the lost money and any overdraft or returned check fees. The fraudster ought to be responsible but given the odds of catching him/her, that is dangerous wishful thinking. The bank has no responsibility if you fall victim to check fraud like the ones above.

If you are a victim who recently wired money to fraudsters, report the incident immediately to the security department of the business that handled the wire transfer. If the payment hasn't been processed yet, they might be able to get your money back. If it's an older scam, report it at fakechecks.org.

How not to look like a phish

Phishing is an increasing and serious problem. Luckily, consumers and even some tools are getting better at identifying and deleting them. Unluckily, many legitimate messages get thrown away because they look too much like phishing messages. TRUSTe and Ernst & Young recently published a white paper on "How Not to Look Like a Phish". Here are a few thoughts that can help you keep your messages from looking too much like a phish:

• Don't request personal information from customers via a hyperlink in an email. If you need information (such as an updated address), tell the customer to go to your company's website and log in. Don't provide a "convenient" link.
• Personalize the email whenever possible. This proves that you know your customer's name. For example, use "Dear John" instead of "Dear Sir".
• Don't get your customers in the habit of linking through someone else to get to you. For example, if you are going to provide a link in the email, if should look like www.yourdomain.com, not www.somebodyelse.com?redirect=www.yourdomain.com;. Never use the IP address in the link. http://12.168.68.50 will still take you to westfieldgrp.com but customers can't be expected to know that or to recognize when the address has been tampered.
• Be very cautious about using click here links. You may think they read better but customers should rightly be suspicious of any attempt to obscure the destination of a link. Written-out addresses are better.
• Use simple and intuitive domain names and directory paths. The longer the address line, the more likely it is for something to be spoofed and the harder it will be for your customers to recognize the falsification.
• Proofread and spell-check all your communications. While more phishers are improving their English, many users still rightly assume that a grammar or spelling mistake is evidence of a possible phish by someone whose native language is not English.
• Avoid messages with an urgent, threatening or time-sensitive tone. (I had an example in here but it made this message look too much like a phish and got blocked. Don't say anything about passwords and account cancellation.)

For the full report, go to truste.org.

CMU Anti-Phishing Game

How good are you at identifying a phishing con? Do you delete the message or do you take the bait? How often can you get hooked?

Carnegie Mellon's Usable Privacy and Security Lab (CUPS) has developed a game to teach people how to identify several common clues that a message is a phish. The game takes about 10 minutes to play and is suitable for all ages. You will play PHIL, a "young fish living in Interweb Bay" as your father teaches you how to find food (legitimate links) and avoid dangers (fraudulent links) .

The game focuses on how to dissect the URL in the phishing message in order to sort out the scams from the good messages. According to the researcher who developed the game, users improved their accuracy in spotting fake sites from 69% before playing the game to 87% after.

Phishing works by tricking you into following a link and volunteering the confidential information to a scammer. Phishers will attack both your personal and work accounts. Phishers have recently been very effective at mimicking trusted sites such as the Better Business Bureau. The only way to protect yourself is to be alert to the scam. There are plenty of other scams out there but this game hits some of the most common tactics.

The game can be found at cups.cs.cmu.edu/antiphishing_phil/ quiz/ .

Phishing for senior executives

Last week, Westfield's top executives were targeted with a very specific phishing email alleging to be from the Better Business Bureau. As you can see below, this phish uses the BBB's official logo and colors and follows the format and structure of a legitimate message. When the victim clicks on the "convenient" link in the message, it installs a trojan downloader onto the computer. The downloader then starts loading up the computer with keyloggers, back doors and other spyware. If not caught in time, the hacker will have complete control of the computers of the top executives of the company.

This was not a wide-spread spam attack. The phishers knew exactly who in the company would normally receive these kinds of complaints. They knew the correct names and email addresses of their targeted victims. They also spoofed the return address so the email appears to have come from someone at bbb.com – a registered alternate to their main address, bbb.org. This was a well-crafted phish.

Nevertheless, there are a few clues that this was a phish.

1. Float your mouse over the bold blue link in the message BUT DO NOT CLICK THE LINK. Look in the gray bar at bottom left of your computer screen and you should see the link's destination. In this case, the link goes to http://document-repository.com/redirect.htm?... The BBB's real website is bbb.org. While there are sometimes legitimate reasons for an organization to use an alternate internet domain, it is more often illegitimate. If you see a mismatch, be very suspicious.
2. The case number in the subject line does not match the case number in the body of the message. The odds are that the "case number" in the subject line is a code used by the hacker to see which messages were successful and which were blocked.
3. The date of the complaint is 14 May 2007 but the message was sent in late August. Even the BBB isn't that slow.

If you are an executive or work in close support to an executive, recognize that you are a special target. Hackers know that you have exactly the kind of access and permissions that they most want to target. They believe that you don't have a lot of time to stay current on technological threats. And they know exactly who you are - with all the automated databases and executive listings, there is no anonymity. Hackers (or anyone else) can by listings with your name, title and email address. See here for an example. And yes, this company requires you to sign a written statement promising to abide by the CAN-SPAM law but the kind of person who will steal credit card numbers, fraudulently register internet domains and send out a phish is probably willing to forge a signature on their form.

Always be suspicious of any unsolicited email asking you for information or to follow a link. Double-check the link before clicking it and never disable your anti-virus and anti-spyware protections.

"You've received a greeting ecard" trojan horse

I still remember the first time someone sent me an electronic greeting card. It was kind of hokey but it really brightened up my day. Sending one back was convenient, fun and best of all, free. Unfortunately, someone has recently launched an aggressive campaign that combines the worst aspects of spam and malicious software and is exploiting the popularity of e-cards. The hacker is using pre-packaged software to spam millions of messages across the internet that read with some variation of "You have received an ecard from" a school mate, a colleague or a family member.

If you open the message, you'll see a standard text-only message describing the e-card and offering you a link to a website where you can download your e-card. The messages claim to be from any of several legitimate ecard websites but in the versions that I've seen, the link is a raw IP address (such as http://12.345.67.89), not a domain name (www.example.com). Other versions may get more sophisticated and cover the IP address with a fraudulent domain. The IP addresses trace back to hundreds of different owners. My suspicion is that these are individual machines which have been hijacked as part of someone's botnet.

Opening the email won't do anything immediately bad to your computer (other than waste your time) but following one of the links is another story. Do not under any circumstances follow these links. Merely opening the page will trigger the download of a particularly nasty computer trojan horse which will then attempt to download even more malicious software onto your machine.

If your anti-virus program is up-to-date and running, it should catch and stop this trojan. However, if you get any kind of alert or think that you might have triggered one of these downloaders, you should run a full virus scan on your system. Call your IT department for instructions. Never open a message from an unrecognized sender and never open an attachment or follow a link in a message that you were not expecting.

Note: If you think the email card might be legitimate, you can check by opening a browser and typing the address of the greeting card company (for example, www.hallmark.com or www.bluemountain.com) and follow the instructions on the site to 'pick up an e-card'. This will usually involve entering the email address of the sender and a confirmation number from the email. If the message was legit, it will show up on the website. As long as you type in the address yourself (rather than following a possibly faked link) and you're going to a major company that you trust, it should be safe to check.

Anti-Phishing Toolbar Review

Phishing is a continuing and serious problem for all of us. In the past few months, a number of companies have come out with anti-phishing toolbars – applications that you add to your internet browser and/or email program to help identify and block phishing websites and other web-based scams. Several of these tools are available for free.

Despite all the marketing hype, a recent independent study of these tools found them to be of only limited use. This study, conducted by four researchers at Carnegie Mellon University, found that even the best of the available anti-phishing toolbars only identified about 85% of fraudulent websites in their test. Worse, the toolbar created a false sense of security among users. Users tended to assume that the toolbar was working and that the website was safe even when it was not.

The anti-phishing toolbars also had problems with false-positives – good websites which were incorrectly identified by the tool as a probable phishing site. While 85% is a good start and shows that a technology solution might be someday possible, it is not yet safe to rely on these toolbars to identify phishing websites. Remain cautious whenever visiting a website that asks for any personal information.

For more, here are links to the full study (including descriptions of each of the tested toolbars) and a ComputerWorld article about the study.

Phishing IQ Test

When was the last time you got an urgent email warning you that your account was about to be disabled unless you reregistered the account? Did you fall for it? How good are you at sorting out the phishing emails from the legitimate requests?

With the huge increase in spam recently, it's a guarantee that you either have received or soon will receive a phishing email – and you probably have received several in the past week alone. Take this test to see how good you are at sorting the good from the bad.

Note: According to the makers of this test,
       19% of phishing emails are incorrectly identified as legitimate by the test takers
       48% of good messages are incorrectly identified as phishing.

Remember, never follow the "convenient" link in an unsolicited or unverified email. If you think it might be a legitimate message, contact the sender directly.

New phishing attacker pretends to be a journalist

Last week, we began a series on particularly targeted phishing attacks - scams using personalization to try to convince you to click on their link. A recently reported case targeted workers at a specific bank and was based on correct email addresses and personal names. The email read:

"Dear John, I am a reporter for Finance News doing a follow up story on the recent leak of customer records from ABC Bank. I saw your name come up in the article from Central News and would like to interview you for a follow-up piece. If you have time I would greatly appreciate an opportunity to further discuss the details of the above article. Regards, Gordon Reily."

The message included what appeared to be a link to the Central News story. The URL included the bank’s name in its characters.

The names in this copy have been changed but the rest of the message is unchanged. Note that there are no misspellings, grammatical errors or typos in the message. It is personalized, professional and has all the earmarks of a legitimate message. This message will sail right through the spam filters.

The message appeals to the natural vanity or curiosity of recipients. A high proportion of readers want to see their own names in print and click on the link.

The link in the email actually took the reader to a website in China. Clicking on the link automatically installed a keystroke logger on the user's machine. The clear goal was to compromise the computer account of a bank employee – an insider who likely has deep access to accounts and customer information. Hackers know that even if the first employee didn't have direct access to sensitive information, they can use the compromised account as an entry point to attack other points of the company's network.

In this case, the bank was able to quarantine its infected computers and blacklisted the chinese website but similar attacks are occurring every day. Hackers are using increasing sophistication in their attempts to compromise the accounts of employees at financial institutions like Westfield. Never click on the link in an unsolicited email. If you are unsure about the message, forward it to InfoSec for investigation.

Read more at CSOonline.