Tech items are wish-list toppers again this year, and if you’re among the millions planning on giving devices, don’t forget to include the safety, privacy and security tools and education that are needed to ensure the recipient is protected. This festive tip sheet from McAfee helps identify areas to think about.
Linda
Comments Off | 
Linda's Blog | Tagged: ecommerce, flashdrives, Internet Safety, Malware, McAfee, Privacy, safety, Security, smartphones, Technology | 
Permalink
Posted by Linda Criddle
Many free AV apps exist for the Android market but new comparisons by AV-TEST, a globally recognized security institute out of Germany, uncovered sobering security failures when they took the AV products through their paces.
The products to come out best were for-pay services from “Kaspersky and F-Secure, which detected at least 50% of all malware samples already in inactive state.”
Among the free options “Zoner AntiVirus Free was best with 32% detected malicious apps. All other scanners detected at best 10% of the apps; some didn’t detect anything at all.” Commenting on the results AV-Test said, ‘the circulation of obviously near to useless security apps endangers those, who trust them.’
AV-TEST’s test results are shocking, particularly as the advice given by security experts is that all smartphone users need anti-malware software in place. Yet those who diligently installed one of these free programs, has an entirely false sense of security.
The program with the lion’s share of installations is Antivirus Free by Creative Apps who, along with GuardX Antivirus and LabMSF Antivirus beta, failed to identify any malware in either the manual or real-time on installation scan.
Not only should these ineffectual products be purged from the Android market, there should be a howl of protest from consumers insisting that apps claiming to protect consumers actually do so – and be required to show how well they protect in their descriptions.
Below are two tables from the research, click here to read the entire report.
Linda
Comments Off | Linda's Blog | Tagged: Android, anti-virus, Internet Safety, internet security, Malware, mobile phone, mobile security, Security, smartphone | Permalink
Posted by Linda Criddle
In a particularly advanced two prong click fraud scheme, 7 men are charged with infecting 4 million computers worldwide – 500,000 in the U.S. alone. Once infected, the criminals would redirect users search results to websites that would pay the criminals a referral fee, so the more searches they redirected, the more money they made. The second method used was to replace legitimate ads on websites with ads from companies that paid for referring clicks.
In a statement by Janice Fedarcyk, assistant director in charge of the FBI New York office, “They victimized legitimate Website operators and advertisers who missed out on income through click hijacking and ad replacement fraud.”
Hijacked sites included The Wall Street Journal and ESPN. An article in the New York Times included the following illustration of how ESPN ads were swapped; the page shown on the left has a legitimate Dr. Pepper ad, while the ad on the right is for a timeshare company that paid for clicks.
Called the biggest cybercriminal takedown in history, the FBI worked with international law enforcement agencies, security companies, and security experts for over two years to crack the case.
This malware that infected both the Windows and Mac operating systems did not target consumer information; it was designed to defraud advertisers and website companies, but in order to avoid detection by antivirus software the malware blocked antivirus updates. This means that infected users were (and are) vulnerable to other malware.
What this means to you:
Although the FBI has replaced the malicious servers involved, infected users remain infected with the DNSChanger malware, and any other malware that was able to crawl into computers while security software updates were blocked. If you’ve seen unlikely ads or suspect your machine may be infected, the FBI has created a website that will help you detect the malware and get rid of it.
Linda
Comments Off | Linda's Blog | Tagged: Click fraud, FBI, internet security, Malware, Scams | Permalink
Posted by Linda Criddle
Over half (53%) of smartphone users say they are unaware that there is security software available for smartphones according to research by security company BullGuard, a shocking data point when mobile malware is skyrocketing.
In just the first six months of 2011, malware aimed at the most vulnerable platform, Android, has grown by 400% according to BullGuard, but that isn’t to say that Symbian, Apple or Windows Mobile users are safe.
The company has just released a new infographic titled Mobile Malware: – The Growing Threat of Smartphone Hackers & What You Need to Know’ that gives a great overview of the landscape of mobile malware, the lack of awareness about mobile threats among consumers, and what to expect for the second half of this year and into 2012 (the news isn’t great).
By the time you’ve finished scanning through the infographic, you may just be persuaded to install the mobile security software smartphones now desperately need.
Linda
Comments Off | Linda's Blog | Tagged: Malware, mobile, mobile malware, mobile security, phone safety, smartphones | Permalink
Posted by Linda Criddle
Bad news always outweighs the good when talking about online security, and a new report from Commtouch just underscores this point.
The good news is that spam volumes are down nearly 30%, to a measly 113 billion a day, thanks to the takedown of the Rustock botnet.
That includes a downturn in pharmacy spam though this category still represents 24% of all spam.
The bad news on the spam front is that spammers are now using compromised email accounts – so expect more spam coming from friends and family’s accounts.
Additionally, the report found that zombie activity skyrocketed with an average turnover of 377,000 new zombies per day targeted at sending malware and spam. This represents a 68% increase over zombie volumes in the first quarter of the year. India remains the top zombie producing country now hosting 17% of the global population, followed by Brazil and Vietnam.
Whether or not you think of pornography as ‘dirty’ the websites hosting porn really are dirty. Pornography and sexually explicit content sites rank highest in the most-likely-to-contain-malware contest, followed by parked domains and portals.
Education websites interestingly enough come in fourth place for categories infected with malware ahead of entertainment and business. This may be because scammers are smart enough to suspect users will be less cautious on educational sites, or the reason may be that educational sites aren’t very well protected and make easy targets.
The bottom line
Criminals continue to increase the number and creativity of their exploits; letting your guard down for even a moment increases the likelihood that you’ll be their next target.
Linda
Comments Off | Linda's Blog | Tagged: Spam, Phishing, Malware, Internet Safety, Security, Online Security, Botnets, zombies, pornography | Permalink
Posted by Linda Criddle
You’ve been warned to be skeptical of notices that pop up warning you of malware on your device that is actually malicious software trying to get you to download fake ‘anti-virus’ software. However, if you see this notification from Google at the top of your Google search results, believe it.
Noticing an unusual pattern of activity in Google search traffic, the company enlisted the help of outside security professionals in the companies sending the modified traffic to determine the computers were infected with malware.
Google’s online security blog says “This particular malware causes infected computers to send traffic to Google through a small number of intermediary servers called “proxies.” We hope that by taking steps to notify users whose traffic is coming through these proxies, we can help them update their antivirus software and remove the infections.
We hope to use the knowledge we’ve gathered to assist as many people as possible. In case our notice doesn’t reach everyone directly, you can run a system scan on your computer yourself by following the steps in our Help Center article.”
Kudos to Google for being proactive and transparent about the issue as well as for providing clear, easy-to-follow steps users can take to fix the problem.
This is one more example of why everyone must keep their security software up to date.
Linda
Comments Off | Linda's Blog | Tagged: Malware, Google, Malware Notification | Permalink
Posted by Linda Criddle
Protect your computer! has been the mantra of safety, security and privacy experts for years. We tell you to be sure to have up-to-date security software installed. To use strong passwords. To password protect your home network. To avoid using unknown networks. And so on…
But we also tell you that all the security in the world can’t protect you, if you, or someone else using your devices, act carelessly.
You can protect your home by selecting a safe neighborhood, installing locks on the doors and windows, adding security systems, outdoor lighting, fencing and gate, and getting a guard dog. But you can also disable all that security in the blink of an eye by opening your front door. If the person at the door is safe, then no harm is done. But if the person at the door has fooled you into believing they’re safe – you could be at high risk.
The same scenario of security and disabling of security plays out online. The term social engineering refers to the ways criminals use non-technical tricks to convince you to disable your security measures so they can get into your computers, phones, consoles, etc., and cause harm.
Interesting data from AVG Technologies reported in the Virus Bulletin shows that users are more than four times more likely to come into contact with social engineering tactics as opposed to a site serving up an exploit. Why? Because criminals know that humans are usually the weakest link in the security chain.
Think about it, why would crooks struggle to dismantle or bypass your security when they can convince you to open the door and let their exploits in?
How do criminals convince users to allow them bypass the user’s security? By gathering information about their victims. Some attacks are fairly unsophisticated broad attempts sent out knowing that a certain percentage of users will have an account with a service like eBay, Facebook, Chase Bank, etc. and that some will click on a notice that appears to be from one of these companies.
In more sophisticated attacks the criminals learn more about your specific behaviors, interests and who your friends are. Once the criminals have learned these things about you, they can set up a scenario that significantly increases your likelihood of falling for their scam. The better they know you, the more likely you will click on their link or download their exploit.
How to defend yourself
Study and practice the easy to learn 14 Steps to Avoiding scams. If you follow these steps rigorously, they will help you avoid falling for socially engineered exploits.
Linda
Comments Off | Linda's Blog | Tagged: Malware, Online Risks, Social Engineering | Permalink
Posted by Linda Criddle
With all the news about Mac malware making Apple devices more vulnerable, Microsoft has announced that Windows is getting safer – particularly if you’re using Windows 7.
There are some pretty interesting discoveries in Microsoft’s most recent Security Intelligence Report covering the second half of 2010, and it’s worth the full read if you’re at all technically inclined. Here are a few points I found particularly interesting:
It really pays to upgrade your Windows OS to increase your security. A Windows 7 64-bit system (their most recently released Windows client) has the lowest infection rates at 2.5 infections per thousand computers.
For context, recent studies show that despite the headlines that exploits of software vulnerabilities get, people browsing the Web are more likely to face a socially engineered attack. Recent articles have compared different approaches to protecting people. Application Reputation is a natural extension of the current protections introduced in IE7 & IE8 that block phishing sites and sites that distribute malicious programs.
…User-downloaded malware is a huge problem and getting bigger.
…IE blocks between 2 and 5 million attacks a day for IE8 and IE9 customers. Since the release of IE8, SmartScreen has blocked more than 1.5 billion attempted malware attacks. From our experience operating these services at scale, we have found that 1 out of every 14 programs downloaded is later confirmed as malware.
These reports paint a very sobering picture on the state of internet security, but there are clear steps you can take today to decrease your chances of malware infections – not matter which operating system, browser, or device type you are using.
Here’s a 12 point checklist to get you started on the road to Internet security and safety. If you want more detail, look to http://ilookbothways.com for straightforward practical advice on how to steer clear of Internet hazards whether you’re sending e-mail, dating online, making purchases or socializing – and whether you are on a computer, or your phone.
For even more information and help, check out these two blogs:
Linda
Comments Off | Linda's Blog | Tagged: internet security, Malware, Windows security | Permalink
Posted by Linda Criddle
Criminal interest in Google’s Android platform appears to be increasing. In March Google had to remove more than 50 malicious mobile apps from their Android Market for exploiting as many as 250,000 consumers information and downloading malware known as Droid Dream (see my blog More Mobile Apps Caught Inappropriately Collecting User Info and Installing Malware for more on that outbreak).
Now security experts from Lookout Security, have identified 25 new malicious applications in the Android Market (since removed) that have potentially damaged somewhere between 30k-120k users. This is a variant on the original malware launched in March, and Lookout believes it has been launched by the same malware developers according to a news article in Forbes.
Droid users beware
This won’t be the last outbreak on Android Apps for two reasons; money, and ease of inclusion.
With Android enjoying 53% of the mobile market the revenue potential for criminals is huge. Add to this the awareness that Google does less than other mobile platforms to test products offered through their market place, and you’ve got a scenario ripe for exploitation. Android users who aren’t careful about what they download now have a red target on their backs.
In this outbreak, legitimate applications were copied, had malware inserted, and then posted to the Android marketplace so it is critical that if you’ve downloaded one of the apps listed below that you check who is listed as the developer. According to the Forbes article, if the developer listed is Magic Photo Studio, Mango Studio, E.T. Tean, or BeeGoo you phone may be infected:
Defend Your Phone!
Users need to stay vigilant by always checking to see who has developed an app and what their reputation is. Look at reviews they’ve received and only download apps from sources that have a strong history and trust rating.
Lookout Security also recommends that you check the permissions the app is requesting, be aware of any unusual behavior on your phone and install a mobile security app.
To see a listing of top mobile security products, and gain a deeper understanding of mobile malware risks, see my blog It’s No Accident – Mobile Money and Mobile Malware Set to Go Big in 2011.
Linda
Comments Off | Linda's Blog | Tagged: Android, Android Malware, cell phones, Malicious Apps, Malware | Permalink
Posted by Linda Criddle
After a 25-day delay Apple finally responded to the appearance of the fake anti-virus scam called Mac Defender (there are other variants called Mac Protector and Mac Security) designed to trick Apple users into paying for bogus security software.
Apple’s response countermands the company’s earlier directive insisting support reps NOT help users remove the malware. Now they’ve provided reps with a “How to avoid or remove Mac Defender malware,” script for helping consumers who have been exposed to the malware. Apple also committed to developing a security update to remove infections automatically.
Unfortunately, it took less than 12 hours for the malware writer to morph his code so that the instructions for fixing the problem were no longer effective according to an article in ZDNet.
Malware isn’t Static
According to the ZDNet article, the malware variant was found in a Google search under yet another name, MacGuard, and does not require the user to enter the administrator password to be installed. These permutations will continue because all malware evolves; to expect this to be different for Apple users is absurd.
Apple OSx users have now joined Windows users in the perpetual cat and mouse world of malware where variations and entirely new forms of malware spring up to enable criminals revenue streams, the real question is what will users and Apple do about it? There are really only three choices: 1) pretend this is a one-time experience and do nothing, 2) address the issue and any future issue as they arise, 3) acknowledge the Apple OSx will face ongoing exploits and proactively prepare for defense.
For users this means installing anti-malware software if you have not already done so. It may also mean taking the time to learn a few skills to help you identify and avoid malware that comes creeping your way.
For Apple, which has prided itself on their ‘it just works’ clean experiences, the refusal to help infected users, then the 25-day response time is a double black eye.
As windows users can attest, sticking your head in the sand will leave your rear end rather exposed.
Linda
Comments Off | Linda's Blog | Tagged: Mac Attack, Mac Defender, Mac malware, Malware | Permalink
Posted by Linda Criddle
