Subscribe
Printer Friendly
Share this PageJanuary, 2009
Did that get your attention? Scammers are hoping it will.
Breaking News Malware Emails
An ongoing strategy of scammers is to send out spam emails with shocking or titillating subject lines. They've decided the recent nomination of Barack Obama is a perfect topic and Symantec has reported that emails are showing up that read something like this:
Sample Emails
Subject: Breaking news
Barack Obama refused to be the president of the United States of America
Yours Sincerely,
Cecily Lynn
Subject: What is going on with our country?
Yours faithfully,
Rodney Lynch
The link in the actual emails (we're not linking to anything in the examples above) point to the following site:
What is the Threat?
The site instantly attempts to bypass any browser security and install malware on your computer. If that fails, any link on the site will download and install malware software. The software is called W32.Waledac. Here's what it does, as described from the Symantec web site:
Rest assured that we detect this piece of malicious software under the name W32.Waledac. This particular piece of malware is capable, among other things, of:
- harvesting sensitive information on your computer
- turning your machine into a spam zombie
- establishing a back door on your computer that will allow it to be remotely accessed
How Can I Protect Myself?
Resist the Impulse to Click - scammers will try to provoke an emotional response in order to keep us from thinking about what we're doing. When you see an email like this, think for a moment if it's even reasonable. Ask why someone would send an email like this. What's the point?
Keep Your Software Up to Date - we've recently talked about keeping your Windows systems updated. The same goes for browsers, email clients, or anti-virus software. If you're software is up-to-date, you're more likely to avoid being hurt by scams like this.
By the way, Obama certainly didn't refuse to be president. I watched the inauguration myself and my thoughts and prayers are with him. Whatever your political affiliation or citizenship, we should all hope and work for his success.
The Worst Outbreak in Years
Using a flaw in the Windows Server service that was detected and patched months ago, a single worm has managed to infect nearly 9 million PCs in just over two weeks — and the rate of infection is increasing by the day. In just four days, the "Downadup" worm (which is also sometimes referred to as "Conficker,") spread from an estimated 2.4 million computers to 8.9 million. It has been described by many security experts as the worst outbreak of malicious software in years.
In October, Microsoft sent out a rare emergency security update for all of its operating systems, including Vista, XP, and Windows 2000. Unfortunately, this update seems to have been ignored by a large portion of PC users, leaving millions vulnerable to Downadup.
Full Dangers Still Unknown
Right now the intentions of developers responsible for the malicious software remains unclear. For the time being, the hackers have only bothered to send out a fake security security program, which creates pop-ups designed to annoy users into paying for a worthless program. But Downadup could potentially hijack millions of computers and use them as bots capable of carrying out whatever commands the hackers send them.
That the whole problem could have been averted if users had just bothered installing a patch Microsoft issued long ago, underscores the importance of setting your operating system to automatically download and install security updates. Those with infected computers undoubtedly let the patch languish for months in an update queue, alongside much less essential software updates.
How to Update Windows Automatically
Windows XP
To set your PC to update automatically in Windows XP, simply access the Control Panel in the start menu, click "Automatic Updates," and choose "Automatic."
Windows Vista
For Vista, open Windows Update in the start menu, select "Change Settings," and then select "Install updates automatically."
How to Remove the Worm
Your computer might not be showing any signs of infection or you may have seen some odd behavior.
From Microsoft:
If your computer is infected with this worm, you may not experience any symptoms, or you may experience any of the following symptoms:
- Account lockout policies are being tripped.
- Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
- Domain controllers respond slowly to client requests.
- The network is congested.
- Various security-related Web sites cannot be accessed.
If your PC has already been infected by Downadup, first install the emergency update, then run the latest edition of Microsoft's Malicious Software Removal Tool to remove the worm from your computer.
More information about the worm is available from Microsoft. You can also read more on Computerworld.
The British newspaper Mail Online reports that a local postman was scammed out of his life savings by an an attractive female "friend" he met on the popular online community site MySpace.
Saving the Damsel in Distress
The postman, Shane Symington, seems like a nice fellow who was simply trying to help a fellow human being. He befriended an American woman named 'Angela Gates' on MySpace in 2007. After a few weeks of friendly banter, the woman began asking for money to pay for her mother's funeral and for medical expenses.
What could Shane do but rush in and save her from her predicament? She needed him!
In order to hit every soft spot Shane had, 'Angela' also told him she needed more money to pay for legal fees that would allow her to inherit a $2 million piece of property. Anyone who's studied Advanced Fee Fraud scams will recognize this kind of story.
Damsel Turns Out to Be a Dude
Unfortunately, it appears Shane hadn't studied much about scams. It turns out this attractive, bikini-clad and potentially rich American woman was really a Nigerian man. Surprised? I doubt it.
After emptying Shane's bank account the Nigerian man even contacted Shane and admitted his fraud, but the story doesn't end there.
From the Mail Online:
He was then contacted by another woman, again from America, claiming she had also been caught in the scam.
He said that he then helped pay her legal expenses and the cost of hiring two ex-FBI agents in an attempt to regain the lost money for both of them.
Mr. Symington said that he now believes that these people are also involved in the scam. He said that he had paid out more than £30,000 to them, bringing his total losses to more than £130,000.
Ouch!
The lesson to learn here is that when this scammers find a victim, they hit them with multiple scams from multiple people until they have milked their target completely dry.
What does Shane have to say about all of this:
I feel sick from it all, I feel disillusioned, they have just played on my good nature. I've lost my life-savings, I have two loans and credit card debts, I'm in huge debts because of all of this.
You just can't trust anyone on the internet. I want to warn people but I know I won't be the last to fall for something like this.
The police in Hampshire working the case said that there's little they can do to recover the money because of the current political situation in Nigeria.
What Can We Do?
These stories are hard to read. We can't believe someone can be so easily manipulated. So what can we do? I suggest you help your friends, relatives, and neighbors by educating them about these kinds of scams. Shane said it best - "I won't be the last to fall for something like this."
Don't let it happen to someone you know.
Read the whole story (w/ pics of the lovey 'Ms. Gates' on the Mail Online web site.
It's a new year and — what do you know — there's a new tactic in the endless quest for new and improved phishing schemes from scammers.
Here's How It Works
Researchers at Trusteer recently released a security advisory detailing this new phishing technique. Rather than using email to lure unsuspecting victims into clicking over to a fake web site, this technique uses what Trusteer is calling "in-session" attacks. Here's a typical scenario:
- A user opens a browser and logs into their banking web site
- Leaving that browser session open, they open another browser window to check on their Webkinz or some other web pursuit.
- After a time, a pop-up window opens — supposedly from their bank web site — asking for them to re-enter their username and password.
- Since the user has recently logged in to the targeted web site, they are more likely to enter their info.
That's it! Their login credentials are now in the hands of the scammers.
What Makes It Possible?
A few things have to be in place for this to work. First, the scammers need a compromised web server in order to install the malware. Fortunately, there are lots of those around. Second, the malware has to be able to determine which other sites the user has visited. This is possible based on a vulnerability in the JavaScript engine used by Internet Explorer, Firefox, Safari, and Chrome.
From Trusteer:
The source of the vulnerability is a specific JavaScript function. When this function is called it leaves a temporary footprint on the computer and any other website can identify this footprint. Websites that use this function in a certain way are traceable. Many websites, including financial institutions, online retailers, social networking websites, gaming, and gambling websites use this function and can be traced.
How Can You Protect Yourself?
Well, the planets have to align a bit to pull this scam off and it's likely the JavaScript vulnerability will be patched in the near (hopefully) future.
Until then, Trusteer recommends the following preventative measures:
- Have an up-to-date anti-virus installed
- Be suspicious of any pop-ups asking you to login
- Log out of banking or other sensitive sites before heading over to Pogo.com for your bingo fix.
and most of all...
Learn more about this attack by downloading Trusteer's security advisory.
Of all the worries that parents of young children face, few would rank the prospect of their 7-year-old opening up six credit cards and running up $35,000 in debt as one of the most pressing. But increasingly, parents and young adults are struggling with a very similar reality these days — only the children themselves aren't to blame, identity thieves are.
Last week, two stories of childhood identity theft hit the headlines...
- In Florida, a woman was accused of opening up a Capital One credit card under her daughter's name, and then using the card until the girl's father began to notice collection notices being sent to their home.
- In California, a man was discovered to be using the identity of a 4-year old who died in 1984. He was caught after using the deceased child's name to buy a home, a car, and to obtain several credit cards.
A Growing Problem
According to the Federal Trade Commission, there were more than 34,000 incidents of childhood identity theft reported between 2005 and 2007. The figure makes up about 5 percent of all identity thefts.
Chiefly to blame is a credit check system that at no time makes an effort to verify the age of individuals. With nothing but a Social Security number, thieves are often able to gain a credit history by finding creditors who don't require a photo ID or birth certificate. The first age that goes into a system like Trans Union, Experian, or Equifax, becomes permanently associated with the applicant's name and Social Security number.
Here's how John Moira, the father of the girl who had her identity stolen by her mother, describes it:
"My heart dropped, I couldn't believe it," said John Moisa, who became suspicious when he received correspondence from the credit card company addressed to his daughter. "At first I didn't think about it until my mom said she was getting collection calls at her house."
Moisa called the credit card company, which wouldn't initially talk to him until he faxed proof of his daughter's age. Moisa said he's spent the past several months trying to repair the girl's credit.
"It was unpaid, past-due bills, so it didn't look good," Moisa said.
Parents Are the Best Protectors (and Most Likely Culprits)
Some experts estimate that around half of childhood identity theft is committed by parents and relatives with access to a full range of information and documentation associated with a child. Other reports point to teachers, administrators, coaches, babysitters, and others with easy access to documents and records. (Some teachers have even been known to have pupils write their social security numbers on all homework and tests, exposing students anyone who bothers sifting through the school's wastepaper baskets.)
With a down economy, parents and family members might be more likely to turn to identity theft as a way getting their hands on additional credit.
"The majority of cases involve parents who may be going through a tricky time, going through a divorce and looking for additional credit," said Purl, Chief Operating Officer for Grand ISS, a St. Petersburg-based investigative security firm.
Purl said with more people out of work, identity theft cases involving young children are likely to increase.
"I think we're going to see more crime in general, as money is more tight for people. We've seen that with credit card fraud and white-collar crime. It's an easy way to make money," Purl said.
How Can We Protect Our Kids?
It's becoming increasingly important for parents to help their kids get savvy about giving away personal information on the internet, or over the telephone. Beyond that, responsibility falls on parents to be vigilant about who they send copies of birth certificates to, and to notice things like debt consolidation notices coming in the mail addressed to their children.
For more on how to prevent childhood identity theft and what to do if you think your child has been targeted, check out this fact sheet from the Identity Theft Resource Center - www.idtheftcenter.org.
We're stepping a bit outside our normal comfort zone of covering scams, fraud, identity theft, and whatnot to present an offer that we think will be valuable to our readers.
For a limited time Suze Orman is making her latest book "Suze Orman's 2009 Action Plan | Keeping Your Money Safe and Sound" available for free via the Oprah Winfrey web site.
NOTE: Offer expires at 11:59 p.m. CT on Thursday, January 15
Why Should You Read This Book?
I have to admit that I haven't read the whole book yet. I wanted to get this posted so you would have time to download it before the offer expires.
What I have read, however, speaks directly to these ugly economic times. I see my friends in the U.S. and elsewhere struggle with layoffs, home foreclosures, business failures and every other kind of stressful situation. Unfortunately things don't look like they'll be improving anytime soon and we're all wondering how we're going to survive this downturn.
I think Suze says it best in her Introduction:
I bet you are scared. Angry, too. And confused. These are absolutely rational and appropriate responses to the global credit crisis that erupted in 2008 and continues to send tremors through every household in America. And I do mean every household. No matt er how conscientious you have been with managing your money, the events of 2008 have battered us all.
The one in 10 homeowners who are at risk of facing foreclosure on their homes are obviously scared, but so too are the 9 out of 10 homeowners who can afford their mortgage but are watching plummeting home values jeopardize their financial security.
It’s not just the overreaching Wall Street firms who are paying the price for those risky investments. Every U.S. taxpayer is now on the hook for a massive bailout — bailout engineered by the same players in the federal government that had turned their back on regulating the very practices at the root of today’s financial crisis. Angry? You should be.
In any case, the book is free until January 15th, so it won't cost you more than a minute or two of your time and a few bytes flowing over your internet connection.
I think it will be worth your while. Take care out there...
Go the the download page on the Oprah Winfrey website. Once the offer expires you can buy the book for less than $10 on Amazon
In case you want to learn more about the book, I've provided some Amazon reviewer comments and the table of contents:
Amazon Reviews
Suze hit it big with this book for many people. She wrote a precise book on how to handle 2009 proactively with specific "what to do" situations and how to assess financial challenges into correct decisions. Picking this book on Borders out of curiosity, I learn a lot from security precautions you should take from local banks. That alone pays the trip and the well deserved $10 I paid over a Dolce Latte over the quick read.
This is hands down Suze Orman's best book. Upon reading every word and turning every page I felt confident that I am on the right track. Following Suze's advise over the years has provided me with the education required to be prepared for what lies ahead. The Expenses breakdown chart is a very helpful tool to see where you can cut back. I also loved the format in which this book was written, it can be used as a reference tool and you can read based on your area of concern be it credit, 401k, retirement etc. I think everyone should not only read this, but live by it!
See the rest of the reviews on Amazon
Table of Contents
2009: The New Reality
A Brief History of How We Got Here
Action Plan: Credit
- Falling credit lines
- Rising interest rates
- FICO scores under pressure
- Repayment plan
- Debt consolidation
- Borrowing from 401(k)
- Borrowing from home equity line of credit
- Bankruptcy
- Collection agencies
- The case for stocks
- Allocation strategies
- 401(k) loan/early withdrawal
- IRA rollover
- Retiree income strategy
- Roth IRA conversion
- FDIC insurance
- Money market deposits
- Eight-month emergency fund
- Credit squeeze
- Expense/income worksheet
- Finding ways to save
- Needs vs. wants
- Insurance saving tips
- Car loans
- Dif?cult choices
- A challenge from Suze for 2009
- Mortgage-modi?cation options
- Short sales
- Foreclosure
- Home equity line of credit
- Home values
- First-time-buying tips
- Pre-retirement strategy
- Vacation homes
- 529 allocation strategy
- What you can afford
- Federal loan strategy
- Stafford student loans
- PLUS parent loans
- HELOC loans/401(k) loans
- Private student loans
- Repayment
- Consolidation
- Job-loss strategies
- Hope for the best, prepare for the worst
- Health insurance
- Life insurance
Action Plan: Retirement Investing
Action Plan: Saving
Action Plan: Spending
Action Plan: Real Estate
Action Plan: Paying for College
Action Plan: Protecting Your Family and Yourself
The Road Ahead
For the second year in a row, malware has been discovered in major-brand digital photo frames, carried by some of the nation's biggest retailers.
Software that came pre-installed in frames manufactured by Samsung, Element, and Mercury, was found to enable the "Autorun" function in Windows, allowing it automatically install malicious code to a PC whenever it is connected. The nature of the malware varied with the device, and it isn't even yet clear in some cases whether the malicious code was put there intentionally, or if it simply replicated itself from an infected computer used in the manufacturing process.
This problem isn't just contained to digital frames though. In past years, a variety of electronic gizmos—from flash memory sticks to satellite navigation devices—have all been found to pose security threats.
Peripheral Devices And You
What do most of the popular electronic holiday gifts such as digital cameras, music players, photo printers or even cell phones have in common? They're all "peripheral devices"—meaning that they have to be connected to a personal computer in order to become fully functional. Without these devices, our home computers remain just that—stationary libraries of songs, photos, and other data, inaccessible to us when we're outside of the house.
What many consumers don't know is that anything capable of downloading data given to it by a computer, is also capable of replicating its data onto that PC in the process. So before you plug a new device into your USB port, there are a few steps you should take to keep your computer safe.
Digital Photo Frames Can Contain Malware
What You Can Do
As always, the best way to protect your computer is to have a good, up-to-date anti-virus program installed and running at all times. These programs can identify almost any potential threat and neutralize it immediately upon connection of a device to your computer.
Staying away from cheap brands you've never heard of before (like those $15 drug-store digital cameras or MP3 players,) is also something many experts recommend. But top-notch anti-virus software should be enough to protect you—even from those yPod and Suny products you might find at the flea market.
Medical identity theft is a growing problem. Experts estimate that between 200,000 - 500,000 people are already a victim of this crime - and most don't even know it.
The World Privacy Forum has been a pioneer in identifying and researching medical identity theft issues. Here's how they describe the problem:
Medical identity theft occurs when someone uses a person's name and sometimes other parts of their identity -- such as insurance information -- without the person's knowledge or consent to obtain medical services or goods, or uses the person’s identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim’s name.
Medical Identity Theft Basics
So how does medical identity theft occur and how can it affect you? Here's a video from CBS' The Early Show that explains the basics:
Medical Identity Theft
How Can You Protect Yourself?
The World Privacy Forum has great information on detecting and preventing medical identity theft. Here are the things to watch:
- Closely monitor any "Explanation of Benefits" sent by an public or private health insurer
Health insurance companies often send out notices in the mail that describe recent medical events. Pay attention to these and contact your health care provider if they don't look familiar.
- Pro-actively request a listing of benefits from your health insurers
- Request a copy of current medical files from each health care provider
Look over these files to make sure that all the information is familiar. Report any errors or strange information to your health care provider.
- Correct erroneous and false information in your file
- Keep an eye on your credit report
Medical expenses should eventually show up on your credit report - especially unpaid accounts that were created by an identity thief.
- Request an accounting of disclosures
This is a benefit of HIPAA (the Health Insurance Portability and Accountability Act). This relates to all of the documents you now sign when going to your doctor relating to privacy and information sharing. You can request a list of all the times your medical information has been shared along with the reason for sharing.
More information from World Privacy Forum.
Special Offers
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion.
Subscribe to Breaking News
Subscribe to Fight Identity Theft and receive top stories and breaking news via email.
Recent Blog Entries
Blog Archives
- November, 2009 (1)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (36)
- Government (20)
- Identity Theft (36)
- Junk Mail (5)
- Phishing (10)
- Privacy (18)
- Scam (29)
- Technology (47)
- Telemarketing (2)
- Viruses (10)
- Visitor Stories (1)
- Worms (10)
