Information Security Tips from Westfield Insurance

Lock your doors, here comes the Conficker worm!

You can hardly look at any news source anymore without being bombarded by articles about security incidents, privacy breaches, worms, viruses, zombies, botnet's or a host of other Information Security related headlines.  The media really eats this Information Security stuff up.

This week’s news continues this trend.

Get ready for the “Conficker.c” worm that has already infected 5 to 10 million computers worldwide and is waiting for April 1, 2009 to awaken.  The experts predict that the payload, which is what the worm will do when it is activated, will somehow involve people being separated from their money.  This assumption is based on the knowledge that many of this worms predecessors have been targeted at convincing their helpless victims to purchase what they think is "anti-virus software" to protect their computers from the very worm that they are already infected with.

It really is all about money these days. Microsoft has even jumped in and offered a $250k reward for information leading to the capture and arrest of the worm writer.

Over the last few months the news has been filled with companies getting "hacked" and loosing their customer privacy related information (SSN & Account numbers, etc...). There have also been several companies that have just simply lost information through carelessness and bad security practices.

And over the next few months I am sure that we will continue to hear about more about companies losing information, more virus and worm scares that threaten society and more about victims who have lost money due to identity theft, phishing attacks or more worms.

I have been in the Information Security profession for a long time and while Information Security threats are ever changing, fast paced and have grown to ever increasing scales, there are some simple and basic things that companies and people can do to significantly reduce their exposure to these threats. 

Not surprisingly, they are really just common sense, don't change much over time and you already know how to do them.

• Patch your systems and do it all the time. The Conficker.c worm exploits a vulnerability that a patch was released to mitigate in October 2008.  New patches are being released all the time.  I guarantee viruses and worms will be written to exploit them.

• Have basic protections in place like a personal firewall that blocks nonstandard traffic and antivirus software that is regularly updated and is configured to regularly scan your computer.  We hear this all the time.  Are you doing it?

• Don't download and run pirated software or software that does illegal things.  This includes peer-to-peer file sharing as well as pirated versions of your favorite tax software.

• Be suspicious of everything.  And even more so if someone or something is trying to help you or give you something for free.  Nothing is free.  Come on, you know that don’t you?

 The bottom line is simple. Protect the information on your computer the same as you would protect your physical property.  Lock your doors and windows.  Don't let strangers in your house even when one comes to the door and wants to give you $100 dollars.  Change your locks if you think that someone has been inside your house.  Don't accept (or seek out) stolen property.  If you receive a recall notice for your car because of failing brakes, make a point to get them fixed as soon as possible. 

Security is security. Use the same logic with computers and information that you use to determine what you should and should not do with your valued physical possessions.  Applying this logic will avoid the majority of the Information Security problems that you hear about in the news.

Post-holiday phishes

I trust everyone had a good holiday break and hope you have a good new year. With the way 2008 ended, many people are making plans for the future. Unfortunately, some of those planners include phishers and social engineers. And as I'm sure you've seen, they are getting more and more creative and professional in their scams. The days when you could delete a message just because it was poorly written are long gone. Today's scams are targeted, well-written and spell-checked.

In particular, we are already an increase in phishing messages that reference the recipient's holiday credit care spending pattern. The messages will claim to be requests for confirmation, reports of transactions and even a few of the traditional "your account has been frozen" scams. During the holiday season, many people have more transactions and shop with more different merchants; the scammers are attempting to exploit any confusion over those transactions in order to trick you into disclosing your account information, passwords, etc. If last year is any indication, expect that phishing campaign to accelerate during this week and last until the middle of next month or so.

We are also seeing a number of scams related to the economy. The number of work-at-home scam messages is up dramatically. As you may remember from prior tips, these scams promise easy money either for helping transfer funds or to conduct "quality control checks" on merchandise. In the first case, you become part of a money laundering operation, in the second, a fence. Either way, you're like to get a visit from some federal law enforcement agency. If it were that easy to make money, they wouldn't need to be sending out random emails about it.

Interestingly, the old "Nigerian fraud" is back in large numbers. These are fairly transparent messages alleging that someone needs your help to get money out of a foreign country (usually in Sub-Saharan Africa) and offering you a percentage if you will allow the person to transfer the money through your bank account. Foreign lottery scams are also back in significant numbers. I believe that by now most people know that these messages are scams but in times of financial difficulty, sometimes hope trumps common sense.

If an email asks for your personal information or if it contains an offer that looks too good to be true, trust your intuition and delete the message. To learn more about how to identify common scams, check out some of the links in our archived Tips on phishing. Have a safe New Year.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

Gustav scams

We wrote several years ago about Hurricane Katrina scams - people trying to exploit our sympathy for the victims of the tragedy by setting up fraudulent websites and fake charities. The FBI and FTC have recently announced a number of similar scams related to Hurricane Gustav. More than 300 Gustav-related internet addresses were registered in the hours immediately before and after Gustav hit the Gulf Coast. Many of them include keywords such as "help", "victims", "survivors" and "aid". There might be a few legitimate sites mixed in among these but the vast majority are scams. They are sites set up to con good people out of their contributions - or perhaps just trying to bait you into visiting their virus-laden website. Either way, if you're going to give to the victims of a disaster like Hurricane Gustav, you need to do your homework before sending in that check.

• Never respond directly to an email request for money. If you think the request might be legitimate, ask for written information about the charity including their official name, physical address and telephone number.
• Contact the charity directly and be sure that they know about the solicitation and have authorized the use of their name. (You'd be amazed how many people claim to be collecting for the Red Cross but just pocket the cash - or pass on some miniscule percentage of the contribution.)
• Be especially cautious about suspiciously similar names. Many of these scam sites will attempt to mimic the legitimate charities.
• If you don't remember making a pledge, you probably didn't. Don't let yourself be pressured into sending anyone money.
• Avoid cash donations. Don't give out your credit card number either. Checks are best because they leave a paper trail - better for the FBI if it's a scam and better for you if it's legit so you can claim the tax deduction with the IRS.
• If you've already made a donation to a "charity" that you now believe was fraudulent, contact your local FBI office so they can investigate it.

For more, go the the FTC's Consumer Protection website.

Domain registration "alerts"

Westfield has recently started receiving "alerts" about internet domain registrations from a company in Asia. This company claims to have received an application for internet domains that are close to Westfield's main domain, westfieldinsurance.com, but carry different suffixes such as westfieldinsurance.net.cn, westfieldinsurance.hk or westfieldinsurance.asia. The email claims that the company "discovered" that the brand keyword matched our company's name and trademark and asks someone to contact them "before we finish the registration" for the other company.

On the Internet, the domain naming system treats every combination of domains as a unique destination. Owning example.com gives you no special rights to example.org. And while you may be able to make a case for trademark infringement, the domain naming system has a strong bias in favor of "first-come, first-served." If a domain name is important to your brand, you need to act to protect it.

If you're not already monitoring internet domain registrations that are similar to your trademark and business, you really should start. There are several good monitoring services out there, some that will send daily alerts for free. Remember, however, that you can't commandeer every possible variation of your domain – there are just too many possibilities. Get the domains that you think are most important and monitor the rest.

The message from the Asian company, however, is a scam. We have traced two different types of these messages so far. In the first case, it was a straightforward con for a credit card number. In the second case, it was an actual domain registrar using questionable tactics to generate business. In both cases, we investigated the company - a Google search on some keywords from the email will often return examples of others who have run into the same con - and decided not to respond to their phishing attempt.

If someone registers a domain name similar to yours, look at the domain registration. (There are several excellent lookup tools on the web. I tend to use whois.domaintools.com). If the other person registering the domain appears to be a legitimate business that just happens to have a similar name to yours, don't worry too much about it. We regularly bump into the the Westfield Group that owns Westfield Shoppingtown Malls (an Australian firm). We also know about domains registered to a car repair shop on a Westfield Road in Indiana. There's no connection and no evidence of fraud – and they got to the domain first. As long as they keep the domain out of the phishers' hands, I can live with that. I also don't worry too much about the domain resellers who buy the domain name then "park" it with some generic ads. (Here is an example.) As long as there's no evidence of misuse and no obvious confusion with my brand, I'm willing to let most of those sit.

AntiVirusXP2008 warning

Last month, we wrote about scareware and hackers using fake update notices. In the past few days, we've seen a sudden increase in one of these attacks coming from one of the former Soviet republics. This group is exploiting a "DNS hole" to hijack visitors who are attempting to visit legitimate websites (such as a hotel in a common vacation destination like Hilton Head). The hacker redirects the victim to the hacker's virus-infected website, then automatically loads a virus onto your computer. From what we've seen so far, this virus first disables your existing anti-virus program, then slows down your machine and finally starts to present you with a false warning that your computer is badly virus infected and needs to run AntiVirusXP2008 to clean it up (for only $50 which they want you to send to them in Russia). The warning message lists hundreds of "infected" files on your machine. Many of those files are, in fact, on your machine but are legitimate files needed by the operating system.

At Westfield, we normally have to clean up about one infected computer a month. It's jumped to 6 in the past week. Worse, this virus has proven particularly difficult to clean out. Our IT department has found it necessary to completely reimage the machine in order to fix the problem.

At home, fix your firewall, update your antivirus and patches and practice safe surfing. If google or yahoo (or your existing antivirus program) give you a warning that you are about to go to a sight that might contain malicious code, heed the warning. Do not override it just because you think that you're going to a "safe" site like the hotel.

At work, shut your computer off every day. (Your IT department probably pushes updates to your computer's defenses every day but many of those updates can't take effect until you restart your computer. If you leave your computer on for an extended period, you will be missing those critical updates.) And, of course, practice safe surfing.

If you get one of these pop-up warnings, never allow it to scan your computer. If you think you might have triggered one of these scams, call IT.

Fake update notices

A few months ago, we started seeing a new trend where the hacker seeds the internet with websites which will trigger a fake Microsoft alert. When you open the website, you also get a pop-up box which looks just like an authentic Windows pop-up and tells you that you need to update the software on your computer. The security guys are always saying that you should keep your computer fully patched so many people click the link, thinking that they are protecting their computer. According to Tad Heppner of McAfee Labs, clicking on the box prompts an executable window requesting users to install the updates but actually leads to "a true malware cocktail."

Spoofing of the Microsoft Malicious Software Removal Tool (MSRT) is particularly common but all the Microsoft updates have been spoofed in one form or another.

In one recent case, the spoof was triggered by infected 'friend' requests on MySpace. Users triggered the trap when they went to check on the profile of the person trying to befriend them. If you are a MySpace or Facebook user, beware of friend requests from people you don't know and be cautious when surfing other people's profiles.

If you get a request to update software on your work computer, ignore it unless you also received an email from your IT department explaining the update. If you receive the pop-up on your home computer, go to your Control Panel and look for the Security Center. Once there, initiate the check for updates yourself rather than trusting the pop-up. Never click a pop-up that shows up on your computer unexpectedly.

Phishers spoofing the HR Department

Phishers and hackers continue to get more creative and more sophisticated in their attacks. A recent trend is to write very specialized attack messages targeting rank-and-file employees. One example is a personal email that appears to come from the company's HR manager. The message included the HR manager's name (it was posted on the company's website) and asked the employee to review a .pdf attachment to confirm vacation accruals. The attachment was a malicious trojan.

Luckily, many of these attacks are blocked by our anti-virus software but some will always get through. Be on the lookout for these kinds of scams. If you see a message that looks suspicious, do not open it, even if it appears to come from someone you know. If you're unsure about the message, call the alleged sender and just ask if he/she really sent it.

If you run a business, make sure that your staff know about these scams, too. Make sure you set a culture of security where it's safe for the employee to call you and confirm a message's legitimacy. (If you're the one writing the messages and you're getting a lot of calls, check out "How not to look like a phish".)

based in part on a CSO Online column

Phoner/toner scams

There has been a recent resurgence of the so-called "phoner/toner" scams. They are popular because they are highly effective, very profitable and, while deeply unethical, not technically illegal (which makes them relatively safe scams from the criminal's point of view).

In this scam, you will get a very friendly call from someone who knows your name (possibly because they called your number late last night just to see whose name came up on the voicemail) and who may even claim to be from your own IT department. After a minute of friendly chatter, he/she will ask for the number on the printer behind you, perhaps saying that "it's part of our inventory of systems". The scammer is betting that most people today have a printer very close to their desks.

Several weeks later, you will receive an unsolicited replacement toner cartridge in the mail. You don't remember ordering toner but who keeps track of things like that? And if you didn't order it, one of your co-workers probably did. So you open the box and tuck the toner away for a rainy day.

Weeks after that, the scammer sends an invoice for five to ten times the market price for the toner cartridge. The scammer is counting on the fact that most finance departments will just pay small invoices and even if they don't, they'll forward the invoice to you for approval. You remember receiving the toner and, since most of us assume we are dealing with honest people, you are likely to approve the payment without checking the price. The great thing about this scam is that it's not illegal to charge too much for a product. Under US law, it's "buyer beware". If you agree to pay five times what something is worth, that's between you and the seller.

If you don't pay, expect a series of followups demanding payment. If you call about the invoice, the scammer will likely offer to play back a tape recording of your employee saying "yes" to a request for toner. The scammer likely did get your employee to say "yes" to something and then cut-and-pasted the sound clip in front of a different question.

If you get one of these scams, first refuse to answer the question. No one should be asking about your systems without cause - even something as seemingly innocuous as your printer models. Second, alert your Receiving folks to watch for toner or other office supplies coming from someone other than your regular supplier. If you can identify the shipment in time, refuse to accept delivery. Third, do not pay the scammer. Do not pay any return or restocking fees either. Under Federal Trade Commission rules, any unordered merchandise can be considered a gift. You didn't order it. You have no obligation to give them money. (You might, however, want to have your legal counsel send the scammer a cease-and-desist letter. You should probably also double-check your state laws. Ohio gives even stronger protection and permission to consider the unordered package a gift.)

Email alerts about cell phones are a hoax

Ignore any email warning you receive that your cell phone number is about to be released to telemarketers unless you sign up for the Do Not Call Registry. These "warnings" are a hoax. Please DO NOT "help others by passing this on to all your friends." Your friends will not thank you for perpetuating the hoax.

Under existing federal law, telemarketers who use auto-dialers (in other words, almost all telemarketers) are prohibited from calling cell phones. There is no legislation pending to change that law.

These hoax warnings have been around for years. They tend to resurface every time the cell phone companies talk about creating a cell phone directory. Adding your number to the Do Not Call Registry will not keep your number out of the directory nor will it prevent anyone who gets your number from calling you.

If you want to sign up for the DNC Registry anyway, call 1-888-382-1222 from the phone that you want excluded or go to www.donotcall.gov. Despite the panicked tones of these hoax emails, there is no deadline for doing so.

New Scams - continued

Last week, we highlighted two of the recent explosion of new scams and frauds. Here are two more examples. Always be alert for suspicious messages and never give out confidential information unless you are absolutely sure who's on the other end of the line.

Dept of Justice spams
The US Department of Justice announced a number of fraudulent emails claiming to be from the DOJ and alleging that the recipients (or their businesses) have been the subject of complaints filed with the DOJ and/or the IRS. The message often contains a "copy of the complaint" as an attachment and offers contact information to resolve the issue. Do not open the attachment. It's a trojan horse and will load malicious software onto your computer. Don't call the contact information either. You'll just open yourself up to a social-engineering scam as the person attempts to scare you into revealing confidential information. The DOJ does not send out email notices for these issues. Read more here.

MySpace worm
Many thousands of MySpace.com websites were successfully attacked by a new and particularly complex computer worm. In this attack, MySpace visitors who are browsing an infected page are redirected to a fake login page that attempts to steal the visitor's username and password. According to one researcher, about one in four falls for the scam. The hacker then changes the code on their MySpace page to trap even more visitors. The redirect works against some recent vulnerabilities in MS Windows and Internet Explorer. The same attack will also install software onto your computer, turning it into a part of a hostile botnet and possibly exposing all the personal information on your computer to the hacker.

Protect yourself by keeping your computer fully patched. By the way, the same research showed that many people choose weak passwords on MySpace, thinking that there's nothing to protect. Remember that hackers use this as an avenue into your personal information. Pick strong passwords even for websites like MySpace. Read more here.

Next week, we'll have an update on the State of Ohio's recent security breach and the relative merits of their "identity theft protection service".

New Scams

In the past few days, there have been a surprising number of new electronic scams discovered or announced. These kinds of attacks seem to come in waves but right now it seems like we're facing a tsunami. Here are just a few examples of recent scams. Be on the alert for messages that seem fishy and never give out confidential or personal information unless you are absolutely sure who you are talking to.

Fake "Red Cross" calls targeting military spouses
In this scam, a caller with a young-sounding, American accent phones a military spouse and identifies herself as a representative from the Red Cross. She says that the spouse's husband was hurt while on duty in Iraq and was medevaked to a hospital in Germany. She says that they can't start treatment until some paperwork is finished and they need the spouse to verify her husband's SSN and date of birth.

This is an out-and-out scam. The military does not need any additional information before they can begin treatment. They already know the member's SSN, date of birth, medical history, etc. The American Red Cross also won't initiate this kind of call. Notices of injuries, etc. come through official channels – usually the commander or first sergeant. Read more at redcross.org.

Fake Microsoft patch email
In this scam, users receive an official-looking email claiming that you have received a notice about a new Microsoft patch because you're signed up to an official Update mailing list. The email includes your name and sometimes your company in the body of the email. After scaring you about the dangers of this new vulnerability, it provides a link to microsoft.com and instructions on how to download the patch. The link instead redirects you to a fake site and downloads malicious software onto the affected computer.

This particular scam seems to have been targeted at users with high-level IT accounts, perhaps in an attempt to trick them into loading this new "security patch" onto all the computers in their network. Whether you're an IT administrator or not, always be suspicious of unsolicited emails and never follow a "helpful" link in an email. Read more here.

Next week, we'll highlight two more of these recent examples.

Sober worm resurfaces

Symantec, a computer security company, recently announced that they have seen a significant increase in message traffic containing a new variant of the old Sober worm. This email (generally written in either English or German) hides the malicious code in an attachment and uses social engineering in order to con the user into opening it.

The known English versions of the message read either
You notified us that you have forgotten your password. We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file.
or
Your eMail has occurred an unknown error on our Server. Please read your mail and check the text. The full email is attached!

More variations of the wording of the scam email are likely to appear over time. The message can seem to come from anybody and could appear to come from a trusted institution like your bank. The attachment could be under several different names but so far have all been .zip files. (.Zip files are sometimes not as well screened by anti-virus programs.)

While this is probably not going to be a particularly dangerous worm, it is a reminder to:

• Never open attachments in unexpected emails
• Always keep your anti-virus software up to date.

The Sober worm was first released back in October 2003. Variants remained in circulation and caused significant damage for several years. The last major variant of this worm was in 2005. The hackers sending out this worm typically set it to take over PCs, send spam, download keyloggers, install rootkits, etc.

Automated ACH scam

A US Airman assigned to a Colorado Support Squadron recently discovered a new scam that exploited a hole in his bank's ACH (automated clearinghouse) process. This is the process by which banks move money around to settle all our checks, credit card and debit card transactions, mortgage payments, etc.

In this scam, the thief randomly generates account numbers and attempts to deposit a single penny into the account using the ACH system. When one of these tiny deposits clears, the scammer knows that he/she has found a live account and immediately processes a withdrawal from the account. According to one bank's representative, this has been a recurring attack. In each case, the scammer makes only a single, fairly small withdrawal from the account - $124.90 in this case. Presumably, that's small enough that it won't overdraw most bank accounts immediately and that it might get overlooked if you don't reconcile your checkbook regularly but it's large enough to make money for a scammer conducting thousands of these attacks.

The scammers particularly like to make their initial transactions at the start of the month, knowing that their scam will likely go undiscovered until the end of the month when the bank statements are sent out. From the available evidence, this attack was automated and is likely to become more common, at least until banks are able to address the lack of real-time validation in the Federal Reserve's ACH system. Read more at Air Force Link.mil.

The only defense against this kind of attack is to watch your bank account carefully. Reconcile your statement monthly and consider checking your account online a couple of times during the month to see if there are any unrecognized transactions. If you find one, contact your bank immediately.

Remember that a Bank error in your favor is only a good thing in Monopoly. Any unknown transaction, positive or negative, should be treated with suspicion.

VIP Cons

Recently, four Westfield folks went into Cleveland together for a Cavalier's game. As they pulled into the arena's parking garage, they noticed that several of the parking spaces had been marked off with traffic cones. One of the parking attendants removed one of the cones and waved them into a very close parking spot on the same level as the pedestrian bridge to the game. They assumed that it was some sort of VIP treatment that came with their tickets. They locked coats and purses in the trunk, then went in to enjoy the game.

Over the next three days, all four reported that their corporate credit cards had been used for fraudulent transactions. Police believe that the car was "marked" by a confederate working as a parking attendant based on the make of their car and their professional appearance. He waved them into the "VIP spot" so his confederate would know which cars to target. The criminals either picked the lock of the car with a slim-jim and popped the trunk from the inside or recorded the electromagnetic code of the trunk's remote so they could open the trunk themselves.

When the four people each checked their wallets, only these corporate credit cards had been stolen. Personal cards, personal checks and cash were untouched. It's human nature to pay more attention to our personal accounts than to a faceless corporation's account. Intelligent criminal exploit that trait and selectively target who and what to steal so they can go undetected as long as possible.

The bank did an excellent job of handling the fraudulent transactions but we all pay when the criminals get away. It is extremely unlikely even with this evidence that criminals will be caught or prosecuted. Sometimes the best we can do is to avoid being targets in the first place.

• If someone's offering you a service that seems too good to be true, it probably is. Be extra cautious (and a little bit suspicious) when someone is giving you unexpected special treatment.
• Keep your valuables with you whenever possible.
• Watch your credit card accounts (personal and corporate) carefully.
• Always lock your vehicle.

Ask before responding to Phone Surveys

Imagine that you received the following voicemail:

My name is Lillian and I am calling from ABC Company on the morning of Tuesday, February 26. We are conducting a paid study about the types of software used in the Insurance industry. We're offering $200 in compensation for your time, so if you are interested in participating, you can reach us at 1-800-555-2672, that was 1-800-555-2672. When you call you can ask for reference code p as in pork 8515, that was p as in pork 8515 and this is for a paid survey that pays $200 to answer questions about software. Thank you very much and hope to hear from you soon.

Sounds like a great deal, right? $200 for just answering a few questions. You won't be buying anything so it's not like it's a kickback, is it? And you would never answer any questions about confidential data. Why not call them back?

Although there are some legitimate marketing research firms, this caller was not one of them. These scams can take one of two forms. Most likely, they are vendors trying to get an unethical edge over their competition or an unfair advantage in their negotiations with your company. Sometimes, they are social engineering cons - the caller is trying to pull information out of you in order to sound more like an insider when he/she makes the final scam call against one of your co-workers. Sometimes these scammers claim to be from a vendor, other times they claim to be conducting "research" for a university, etc.

Either way, these callers are trying to con you out of information that they don't think they could legitimately get. If it was a legitimate business request, they wouldn't be so eager to bribe you for your participation. When someone emphasizes the money as much as this caller did, something's not right. You should participate in surveys because it's in your company's best interests, not because one person in the company was bribed.

Do your staff know how to respond to survey requests like these? Do you have a policy that requires them to check with your Legal Department or some other group who can validate the request and make sure that all the required non-disclosures are met? Does your policy allow the response to phone surveys or do you require that all surveys be submitted (and replied to) in writing? If compensation or a gift is offered, who does the employee report it to? Is it personal compensation or remitted to the company? Do your staff know how to tell the legitimate from the questionable requests?

Real researchers follow a code of ethics about their surveys. They will give you more upfront information before inviting you to participate in the study and will provide the credentials necessary to prove their identity. They may offer to compensate you for your time but will do so in ethically appropriate ways. They understand your concerns about proprietary information and will work with you to make sure that your information is properly protected. They will provide their Privacy Policy on request and can show you that they live up to it.

Westfield occasionally conducts surveys either directly or through a third party. Our surveys will always be announced as "on behalf of Westfield Marketing Research". Our surveys should never come as a surprise to an Agency. If you receive a survey request claiming to be from Westfield and you are at all suspicious, call us at 1-800-243-2562 or check on Agents Web Passport to confirm the survey.

"Storm Warning" email worm

Hackers are trying to exploit the storms which have been hitting Europe. F-Secure, a Finnish data security firm, announced the identification of the "Storm" email worm in emails with the subject line "230 dead as storm batters Europe." The file attached to the message contains a virus that creates a backdoor into the computer. This allows the hacker to later either steal data or to use the victim's computer to post spam messages to other victims.

This is part of the growing evidence that hackers are conducting real-time attacks, trying to take advantage of our curiosity and compassion during breaking new stories. Security experts estimate that thousands of computers have already been affected, mostly personal computers. Most corporate systems (including Westfield's) have already been configured to block this virus but the hackers know that many personal users are not as diligent at keeping their anti-virus software up-to-date.

• Do not open unsolicited emails.
• Keep your anti-virus software up-to-date and run it regularly.

Read this Reuters article for more.

Pump-and-dump scams

For the past few weeks, we've been discussing "spear-phishing" attacks – targeted messages that are highly personalized in their attempts to con you into clicking on their link. This week, we will discuss variations on the "pump-and-dump" stock scam emails.

First, some background. Pump-and-dump scams have been around for as long as there have been stock markets. In this scam, the crook buys shares of some small, low-liquidity stock. He then starts rumors that this stock is "on it's way up" and "about to explode on Monday". The rumors are often crafted to appear to be insider tips. They play on the greed and vanity of the recipients. When the victims begin to invest in the penny-stock, the price does go up - temporarily. The scammer immediately sells his shares at the inflated price. After a few days, the price returns to normal and the victims are left holding shares of a stock worth only a fraction of what they paid.

One popular version of this scam is designed to look like a misdirected email. The message starts "Hi. I hope this is your email. It was great to meet you the other day and I hope you're enjoying New York. The deal I was speaking about yesterday involves a company know as [company name]. It's already headed up..."

Another opens "Hey, girlfriend. Remember that hot stock exchange guy that I'm dating?" before dropping the fraudulent tip. In both cases, the wording of the "tip" is designed to look like it was intended for someone else and that you got the message because the sender mistyped the email address. In fact, these are mass-mailed spam.

You can read more about this particular scam at www.nasd.com.

Never respond to an unexpected message and never follow the advice of a spammer. It doesn't matter how good the alleged tip looks. If you're going to invest in the market, do your homework. Invest in companies with good fundamentals whose business you understand. Don't invest on "momentum" or insider tips.

New phishing attacker pretends to be a journalist

Last week, we began a series on particularly targeted phishing attacks - scams using personalization to try to convince you to click on their link. A recently reported case targeted workers at a specific bank and was based on correct email addresses and personal names. The email read:

"Dear John, I am a reporter for Finance News doing a follow up story on the recent leak of customer records from ABC Bank. I saw your name come up in the article from Central News and would like to interview you for a follow-up piece. If you have time I would greatly appreciate an opportunity to further discuss the details of the above article. Regards, Gordon Reily."

The message included what appeared to be a link to the Central News story. The URL included the bank’s name in its characters.

The names in this copy have been changed but the rest of the message is unchanged. Note that there are no misspellings, grammatical errors or typos in the message. It is personalized, professional and has all the earmarks of a legitimate message. This message will sail right through the spam filters.

The message appeals to the natural vanity or curiosity of recipients. A high proportion of readers want to see their own names in print and click on the link.

The link in the email actually took the reader to a website in China. Clicking on the link automatically installed a keystroke logger on the user's machine. The clear goal was to compromise the computer account of a bank employee – an insider who likely has deep access to accounts and customer information. Hackers know that even if the first employee didn't have direct access to sensitive information, they can use the compromised account as an entry point to attack other points of the company's network.

In this case, the bank was able to quarantine its infected computers and blacklisted the chinese website but similar attacks are occurring every day. Hackers are using increasing sophistication in their attempts to compromise the accounts of employees at financial institutions like Westfield. Never click on the link in an unsolicited email. If you are unsure about the message, forward it to InfoSec for investigation.

Read more at CSOonline.

Pink slip scam

Email scammers have been developing some creative new attacks lately which play on human fears, insecurity and/or vanity. We will be discussing several of these attacks over the next few weeks. First, a scam using fraudulent pink slips.

In this attack, the phisher sent emails to some employees at the target company telling them that they had been laid off. The subject line read "Urgent – employment issue". The from: line was successfully spoofed so that the message appeared to come inside the company. Other content in the message was consistent with the target company's operations (a hospital) and reinforced the victims' belief that this was a real message.

The message included a link to a website where the victim could get career-counseling information. Concerned about their employment status and being justifiably upset over being laid off by email, at least two employees at the target company clicked on the link. In fact, opening that website loaded a keystroke logger on the victims' computers.

Spam and phishing attacks are being increasingly customized to the specific company under attack. Because the content is so customized and because this particular message was so intimidating, the scammer knew that he/she could send out far fewer fraudulent messages and still find an unwary victim. Such low volume, highly targeted attacks are almost impossible for the spam filters to identify and block ahead of time. You must remain on guard when you see a suspicious message.

No reputable company will notify you of any such personnel action solely by email. If you receive a message that concerns you, talk to your manager or to HR department directly. Never click on any link in a suspicious email or IM message.