UK’s Misguided ‘Panic Button’ Request on Social Networking Sites

November 18, 2009

The head of UK’s Child Exploitation and Online Protection Centre (CEOP) has once again called for a special button to be placed on social networking sites that would allow youth to report online abuse directly to law enforcement.

This proposal is as ill-advised today as it was 4-5 years ago when Jim Gamble, head of CEOP, last pushed for this functionality.

Here’s why:

  • Social networking services already have easily discoverable report abuse functionality– as do most other types of consumer-interactive services. The exclusive focus on social networking sites as the source of potential exploitation is as absurd as it is naïve.  
  • Most of what is reported through report abuse functionality is not criminal and should not go to law enforcement. Do you want a spat between your child and another to be put in law enforcements hands?

Furthermore, sifting through the non-criminal reports – which are the vast majority – is a very poor use of law enforcement time and taxpayers money.

  • Reporting directly to law enforcement – or any other entity – means Internet services cannot respond to issues. This proposal would result in a situation where the companies won’t even know a problem exists and ruins their ability to appropriately moderate and manage their services – which is the real goal here.
  • Dual reporting – where the information is sent both to law enforcement and the service creates a mess. There needs to be a single chain of ownership or work will be duplicated, contradicted, or fall between the cracks.

The right approach is to ensure that companies’ own abuse reporting infrastructure has proper escalation paths to appropriately address non-criminal matters within the service, and to bring criminal matters to law enforcement agencies in a timely manner. If companies’ abuse handling processes do not escalate criminal issues to law enforcement in a timely fashion, this is where focus should be placed.



T-Mobile Confirms Biggest Data Breach; Affords Glimpse of Internet’s Financial Underbelly

November 17, 2009

Thousands of personal record details of British T-Mobile customers were stolen and sold by an employee for “substantial sums” to rival carriers putting a spotlight on the unlawful trade in personal data in the UK.

According to an article in the Guardian, the employee allegedly sold the account information to a number of “brokers”, who then resold the data to competing mobile services so they could target T-Mobile customers.

“The number of records involved runs into the millions, and it appears that substantial amounts of money changed hands,” according to Christopher Graham, the UK’s Information Commissioner. “We are considering the evidence with a view to prosecuting those responsible and I am keen to go much further and close down the entire unlawful industry in personal data.”

Pressing for change, Graham said “More and more personal information is being collected and held by government, public authorities and businesses. In the future, as new systems are developed and there is more and more interconnection of these systems, the risks of unlawful obtaining and disclosure become even greater. If public trust and confidence in the proper handling of personal information, whether by government or by others, is to be maintained, effective sanctions are essential.”

Why this matters

It is not just Social Security numbers, account numbers, and driver’s license numbers that have value to criminals and legitimate corporations alike. In the data age, you are a commodity. Every piece of your personal information, your preferences, your relationships to others, your financial value, information about services you currently use, your location, even your emotions has significant economic value.

Given the value of the data the temptation to steal and sell it is huge – there’s a reason that over 340 million personal data records have been breached in the US alone since Jan. 2005.

Companies and criminals purchase this information to help in the design products (including malware), shape and target advertising (and fake ads), even help build socially engineered scams tailored to you.

The Information commissioner is right. Slapping small fines on those who steal and sell consumers private information offers little deterrent when the data sellers can collect premium prices. When the only consequence is a fine, it’s nothing more than another cost of doing business.

In the T-Mobile case, not only should the T-Mobile employee who stole the information receive a strong punishment, the competitors bought the data to poach customers should be charged with purchasing stolen goods.

Without punishing every piece of the “entire unlawful industry in personal data” it will be difficult to make headway against the crimes and protect consumers.


Consider Using a Free Browser Protection Utility

November 16, 2009

Malware, scumware, scareware, ransomware, call it what you want, there is a plague of exploits aimed at changing your defaults, stealing passwords, shoving pop-ups at you, and otherwise making your online experience far less than ideal.

Traditional methods for combating these attacks are with traditional antivirus and antispyware products – which are an absolute required defense on any internet connected device.

There is however, an emerging additional method for proactively defending against vulnerabilities called browser protection or intrusion detection utilities. These are worth more than a passing glance, particularly if you have kids (or are an inexperienced yourself) using your computer who may be more inclined to click on sites or ads that leave your computer particularly susceptible to exploits.

Here are two browser protection utilities to consider:

Sandboxie creates a locked down environment in which to run your applications – called a sandbox. Within this sandbox, applications operate normally and at full speed, but actions taken within the sandboxed area are isolated and cannot make changes to your computer.

This means that your operating system, memory, and existing files remain safe. Sandboxie is FREE, and easy to use, and the site has excellent instructions to get you started.

GeSWall isolates applications that can act as entry points for malware and targeted intrusions, like browsers and PDF’s, and applies access restrictions to effectively prevent damage.

GeSWall restrictions include blocking access to the kernel, allows read only access to trusted files, registry, processes etc., blocks local communications to trusted processes, like windows messages, and blocks access to confidential files. Addtionally, the product locks malware or an intruder within an isolated layer. Download GeSWall’s FREE product, or consider their for pay version.

There are also ways in which you can create limited user accounts within your existing operating system. For instructions on how do create these in Windows, click here.

Now, go have fun…


Cybercriminals Encrypt Your Files, Demand $100 Ransom to Decrypt

October 29, 2009

This year has seen the escalation of many existing types of online crime and the introduction of entirely new exploits – including extortion – as criminals push into micro-payment revenue models and further diversify their revenue streams.
The most recent example of this is the LoroBot ransomware that encrypts popular file extensions on the users computer then demands a $100 for the decryption software.

If your computer becomes infected with the LoroBot, you may find yourself unable to open your documents, spreadsheets, photos, pdf’s and other common file types and instead see a ransom note informing you that your files have been held hostage (Image from ZDNet).


According to researchers from CA who found the ransomware, this particular bot appears to be mostly a bluff, but it demonstrates a new tactic in the ransomware arena which to date had focused primarily on locking users out of their computers entirely.

As the price to obtain ransomware continues to drop in underground markets, (average price is between $15 and $30) more cybercriminals will leverage these tools – and drive the demand for more exploitive innovation in this area.

Read the full article New LoroBot ransomware encrypts files, demands $100 for decryption on ZDnet.

Techniques Used By Fraudsters On Social Networking Sites

October 20, 2009

Repost: Originally posted and prepared by the Internet Crime Complaint Center (IC3)

Fraudsters continue to hijack accounts on social networking sites and spread malicious software by using various techniques.

  • One technique involves the use of spam to promote phishing sites, claiming there has been a violation of the terms of agreement or some other type of issue, which needs to be resolved.
  • Other spam entices users to download an application or view a video.
  • Some spam appears to be sent from users’ “friends”, giving the perception of being legitimate. Once the user responds to the phishing site, downloads the application, or clicks on the video link, their computer, telephone or other digital device becomes infected.
  • Another technique used by fraudsters involves applications advertised on social networking sites, which appear legitimate; however, some of these applications install malicious code or rogue anti-virus software.
  • Other malicious software gives the fraudsters access to your profile and personal information. These programs will automatically send messages to your “friends” list, instructing them to download the new application too.

Infected users are often unknowingly spreading additional malware by having infected Web sites posted on their Webpage without their knowledge. Friends are then more apt to click on these sites since they appear to be endorsed by their contacts.

Tips on avoiding these tactics:

  • Adjust Web site privacy settings. Some networking sites have provided useful options to assist in adjusting these settings to help protect your identity.
  • Be selective of your friends. Once selected, your “friends” can access any information marked as “viewable by all friends.”
  • You can select those who have “limited” access to your profile. This is for those whom you do not wish to give full friend status to or with whom you feel uncomfortable sharing personal information.
  • Disable options and then open them one by one such as texting and photo sharing capabilities. Users should consider how they want to use the social networking site.
  • If it is only to keep in touch with people then perhaps it would be better to turn off the extra options which will not be used.
  • Be careful what you click on. Just because someone posts a link or video to their “wall” does not mean it is safe.

Those interested in becoming a user of a social networking site and/or current users are recommended to familiarize themselves with the site’s policies and procedures before encountering such a problem.

Each social networking site may have different procedures on how to handle a hijacked or infected account; therefore, you may want to reference their help or FAQ page for instructions.

Individuals who experienced such incidents are encouraged to file a complaint at reporting the incident.


Stay Safer – Place a Security Freeze on Your Credit

October 16, 2009

Criminals use stolen ID’s to open new lines of credit. You can thwart their efforts to use your identity by simply freezing your credit. Many states have laws giving you this right, but even where states don’t provide legal mandates, the large credit bureaus provide a voluntary security freeze program.

To determine whether there are any costs associated with placing a security freeze on your credit, and for temporarily lifting that credit freeze when you do seek credit, see State Freeze Requirements and Fees. For example, In Washington state, those who have been victims of ID theft can freeze, and temporarily lift their credit for free. It costs just $10 for anyone else under the age of 65.


Plan ahead when you do want to apply for new credit, as it may take up to 3 days to process your request for a temporary lift of the security freeze. (A freeze limits the credit bureaus from disclosing your credit score to third parties except in those cases where you specifically contact a credit bureau like Equifax and request that they temporarily lift the security freeze.) It may take longer if you have lost the security freeze confirmation number which the credit bureau provided.

Click here to learn more about placing a Security Freeze through Equifax on your credit file.


UN Experts Say Online Child Pornography Has Increased; Some 750,000 pedophiles prowling Internet

October 10, 2009

New statistics cited by Najat M’jid Maalla, the United Nations’ investigator for the sale of children, outlined an increasingly bleak picture on the exploitation of children online.

Among their findings:

  1. Child prostitution and child pornography found on the Internet has increased, with over four million sites exploiting children, including those of children aged under two years.
  2. “The number of sites devoted to child pornography worldwide is growing. The number of predators connected to the Internet at any one time is estimated to be 750,000.
  3. More than 200 new images are also circulated daily, the production and distribution of child pornographic images rakes in between 3 and 20 billion dollars (2.04 and 13.62 billion euros) a year.
  4. Images of sexually exploited children are not only growing in number but are also increasingly shocking. The number of images showing serious exploitation quadrupled between 2003 and 2007, showing abject images of brutal rape, bondage, oral sex and other forms of debasement.
  5. The UN estimates that between 10,000 and 100,000 minors are victims of the child pornography network.

The methodology of this UN report and the statistics cited will unquestionably be challenged. Some will point to age of consent issues, others will challenge the wide spread of estimates given both for the revenue and number of victims as being too far apart to be meaningful.

Don’t let the squabbling obfuscate the stark reality that the ease of access to images of child sexual abuse is increasing, the number of sites offering the images are increasing, and the number of children forced into sexual slavery is increasing.

To learn more about these issues and how you can  help, see my blog Child Trafficking and the Internet.