Cyber Security Tip & Tricks

Sunday, December 28, 2008

90 Percent of emails received Worldwide are SPAM

90 Percent of emails received Worldwide are SPAM


A recent survey has found that 90 percent of the emails sent to a person’s inbox are usually spam.  90pct of emails received worldwide are spamThe survey report suggests that more and more hackers are devising new ways to send in spam emails, reports the China Daily.
 
It further states that virus-infected computers are woven into “botnets” used to attack more machines, and to send sales pitches to e-mail addresses in low-cost quests to bilk readers out of cash.
 
“Every year we see threats evolve as criminals discover new ways to exploit people, networks and the Internet,” Cisco chief security researcher Patrick Peterson, who was involved in drafting the report, said.
 
According to the Cisco Annual Security Report, junk e-mail make up for nearly 200 billion messages daily, approximately 90 percent of email worldwide.
 
As per the survey, the US is the biggest source of spam, accounting for 17.2 percent messages.
 
Turkey and Russia ranked second and third, accounting for 9.2 percent and 8 percent spam respectively, according to Cisco.
 
This year, botnets were used to inject an array of legitimate websites with an IFrames malicious code that reroutes visitors to websites that download computer viruses into their machines.
 
“The botnet is, in many cases, ground-zero for online criminal threats,” Peterson said.
 
“Using malware to infect someone's computers is an incredibly common mechanism and harnessing them all together is a way they do their click fraud, spam emails, and data stealing,” he added.
 
Online criminals are turning botnets on web-based e-mail accounts. Hackers are "reputation hijacking" by using botnets to figure out weak passwords protecting web-based e-mail accounts, according to Peterson.
 
Weak passwords consist of family names, birthdays, home addresses or other terms considered relatively easy to deduce.
 
Once access is gained to legitimate e-mail accounts, a plethora of spam messages are sent in the owners' names.
 
Source: ANI

Microsoft Kicks Fake Security Software off 400,000 PCs

Microsoft Kicks Fake Security Software off 400,000 PCs

In the second month of a campaign against fake security software, Microsoft Corp. 

has booted the rogue application "Antivirus 2009" from almost 400,000 PCs, the company recently claimed.

December's version of the Malicious Software Removal Tool (MSRT), a free utility that Microsoft pushes to Windows users as part of Patch Tuesday, targeted one of the most popular phony security app, Antivirus 2009. According to Microsoft, the MSRT erased the fake from over 394,000 PCs in the first nine days after it released this month's edition on Dec. 9.

Last month, Microsoft trumpeted a similar cleaning operation against another family of bogus security software that it said had purged nearly a million machines of programs such as those called "Advanced Antivirus," 

"Ultimate Antivirus 2008" and "XPert Antivirus."

Sony’s Pocket PC: Netbook or Notebook?



Details of Sony’s rumored mini-notebook are steadily leaking. The last thing the world need is another netbook, but this one seems to have a twist: a small LED display (only 8 inches) with a large resolution of 1,600 by 768 pixels. Other specs appear to include a 1.33GHz Intel processor, a 60GB hard drive or 128GB SSD, and Windows Vista. Based on the clock speed, the chip might be an Intel Atom Z520 or the ultra low-voltage Core 2 Duo U7700, a more powerful and much pricier processor. The display size–along with some blurry pictures which were posted on Engadget and other sites–would put the “P series” somewhere between a netbook and what Intel refers to as an MID, or Mobile Internet Device, the target device for the Z series Atom processor. But it would be unusual to pair this chip with Vista and such a high-resolution display–most netbooks use Windows XP and the handful of MIDs that have shipped tend to use lightweight Linux operating systems. So it could be that the P series won’t be a netbook at all, but rather a traditional, high-end subnotebook with a distinctive display size and design.

Saturday, December 27, 2008

Take precaution against Cyber Theft - During this Holidays


  1. Be wary of holiday gift cards and holiday coupon offers sent via e-mail—these often have malicious links within the offer which lead to downloads of info-stealing Trojans or the hackers try to scam you out of your bank account information.
  2. When visiting your favorite online retailer to purchase gifts, be sure to type the actual Web site address of the retailer into your browser. Do not follow links provided by e-mail offers or pop up ads. Many times these are fraudulent sites made to look like the legitimate retail sites.
  3. When making online purchases, always use a credit card that limits your fraud liability. Avoid using debit cards to do online purchases when possible so as to limit your personal exposure to any possible fraudulent transactions.
  4. When making online purchases, always look at your Web browser for the https (as opposed to http) protocol that proceeds a Web address. The “s” let’s you know that the Web site is providing a layer of security for transmitting your personal information over the Internet.
  5. Be wary of unsolicited e-mails, even from senders that you know, that include links or attachments. Before clicking on links or attachments, ALWAYS verify that the correspondent sent you the e-mail and enclosed link or attachment.
  6. Be wary of e-mails notifying you that your banking certificate or token is out of date and to download a new certificate or token. Before taking any action, verify with your financial institution by calling them on a number that is not provided in the email.
  7. Avoid using simple (weak) or default passwords for any online site.


U.S. government vulnerable to Internet predators

U.S. government vulnerable to Internet predators

Most Internet users have some awareness of the problem of threats to the entire system from criminals, terrorists and potentially hostile nations, since they encounter it in the form of spyware, viruses and other online nuisances.

However, the most disturbing "cyber" threats are largely invisible to the general public, because they involve attacks on specialized networks used by the armed forces, healthcare professionals, air traffic controllers, financial institutions, public utilities and heavy industry.

Each of these vital components of modern society now relies on Internet Protocol communications to run efficiently, and in most cases the new technology was assimilated without a careful assessment of its vulnerability to attack by outsiders.

Friday, December 26, 2008

Fake Christmas, HolidayGgreetings Spread New Malware over Internet

Fake Christmas, Holiday Greetings Spread New Malware over Internet

New malware is spreading via Christmas and holiday greetings, security researchers said today, a tactic reminiscent of those used last season by the notorious Storm Trojan horse.

Researchers at the Bach Khoa Internetwork Security Center in Hanoi, Vietnam, reported today that a new piece of malware, dubbed "XmasStorm" by the center, is spreading through holiday-themed spam.

Touting subject lines such as "Merry Xmas!" and "Merry Christmas card for you!" the spam includes links to sites that purportedly host electronic greeting cards waiting for the recipients. In fact, the sites are serving up malware that hijacks the visiting PC, then installs a bot that waits for commands from the hacker controllers.

Nguyen Minh Duc, manager of Bach Khoa's application security group, said that XmasStorm originated in China. Hackers have registered at least 75 domain names relating to the malware campaign's holiday theme in the last month, including "superchristmasday.com" and "funnychristmasguide.com." According to WHOIS searches, those domains were registered to a Chinese address on Dec. 1 and Dec. 19, respectively.

"Special occasions such as Christmas and New Year have always been the periods when hackers distribute viruses via fake e-card with malicious code," said Nguyen in an e-mail Wednesday. "Therefore, users should be careful on receiving greeting e-mail from unknown sources for safety's sake."

Similar attacks have been monitored by other researchers, including those at ESET LLC, a Slovakian security company that has offices in San Diego. On Monday, ESET researcher Pierre-Marc Bureau reported a spike in holiday spam that pointed to sites hosting a file named "ecard.exe" that was not, of course, a greeting card, but instead malware.

"The reason this wave has attracted our attention is that it is very similar to the Storm worm attacks we were seeing last year," said Bureau in an e-mail.

Source: Computer World.

Credit Card Theft Underground - Awareness Article

Credit Card Theft Underground - Awareness Article

This is a fascinating article in the recently-released January issue of Wired magazine about the credit card theft and fraud underground. It's the story of the rise and fall of a completely criminal -- and quite technically sophisticated -- business enterprise.

Unlike the print version, which I just picked up, the online article has a video with Detective Bob Watts of the Newport Beach PD, telling how some of it was done, complete with card pressing and embossing equipment. The machines were used to press real cards from the stolen data.

The article also has a link to another video on the Identity Theft Secrets web site about CardersMarket.com, one of the web sites used in the criminal venture.

And while we're on the subject of credit card security, here's five tips from SC Magazine for successfully complying with the Payment Card Industry Data Security Standard (PCI DSS). Besides being required for any business involved with credit cards, PCI compliance is one big step in protecting against credit card crime.

The Duhs of Security

The Duhs of Security

This security awareness video was developed by the Commonwealth of Virginia to promote simple changes in behavior that will strengthen security.

* Dont allow tailgating
* Guard your password and change it often
* Safe sensitve information to secure backed-up network storage areas
* Lock the computer when unattended
* Pick up sensitive printouts immediately
* Dont have sensitive conversations where you can be overheard.
* Be wary of suspicious emails
* Keep electronic media secure and safe from theft or damage.

Nokia Phones vulnerable to Java Attacks

Nokia Phones vulnerable to Java Attacks

A pair of critical vulnerabilities in Sun Microsystems Inc.’s Java technology for mobile devices could be used by hackers to surreptitiously make calls, record conversations, and access information on Nokia Series 40 cell phones, a Polish researcher said Monday.

Adam Gowdiak, a researcher who has found numerous bugs in Java 2 Micro Edition (J2ME) in the past, said he reported the two vulnerabilities to Sun last Thursday, and notified Nokia the same day of the security issues in its handsets. However, Gowdiak is taking a disclosure tack he admitted will be controversial. He has provided the vendors with only a small subset of the information he’s uncovered, approximately one-to-two pages worth. To obtain the remainder, which includes proof-of-concept code, Sun or Nokia will have to pony up $29,826.

The flaws can be used by attackers to force-feed malicious Java applications to Nokia Series 40 phones, said Gowdiak. Those applications, in turn, could be crafted to conduct all kinds of mischief, including making phone calls from the phone, sending text messages from the phone, and recording audio or video. Hackers could also access any file on a Nokia 40 model phone, obtain read and write access to the phone’s contact list, access the phone’s SIM card, and more, added Gowdiak.

“This can completely wipe out any security within J2ME,” said Gowdiak in an interview Monday. “It allows [attackers] to do anything malicious on any mobile device.”

All told, Gowdiak said he had found 14 security issues with the Nokia Series 40 handsets. The Series 40 is the world’s most widely-used mobile platform, according to Nokia. Gowdiak estimated that approximately 140 different Nokia handsets use the Series 40 platform.

All an attacker needs to hack a specific Series 40 handset is its phone number, Gowdiak claimed. A security flaw in the platform can be exploited by simply sending a maliciously crafted series of messages to a given phone. “By combining the vulnerabilities with the Series 40 issues, one could develop malware which could be simply deployed. And that malware won’t be visible to the user,” he said.

Gowdiak tested seven different Nokia Series 40 handsets — “At least one from each major family in the series,” he said — but he suspects that other manufacturers’ phones that use J2ME may also be vulnerable.

He said that the most current version of Sun’s Java Wireless Toolkit also contains the critical bugs. The Toolkit is essentially a software developer’s toolkit, or SDK, for building wireless applications based on J2ME. The implication, said Gowdiak, is that any application created with the Toolkit would also be open to attack, including those installed on handsets other than Nokia’s.

Nokia did not respond to a request for comment Monday, and although Sun did return a call, its spokeswoman did not have any immediate information about the vulnerabilities reported by Gowdiak.

For his part, Gowdiak said security teams at both companies had confirmed receiving his reports last week. “They seem to be working on these issues,” he added.

But the vulnerabilities may not be what many focus on, Gowdiak admitted.

To fund his start-up — a Polish-based company called Security Explorations — Gowdiak is selling copies of his research for 20,000 euros each. “There are six long months of work in this research,” he said in justifying the price. “It was an enormous amount of research.”

But Gowdiak is savvy enough to know that the move will be controversial. “Of course. The whole security arena is divided,” he argued. “Some will be against this and some will be for it.”

He said that the amount of information he had turned over to Sun and Nokia was “similar” to what he had disclosed to vendors previously. “We’re not blackmailers, we’re not black hats,” he said. “They have a choice whether they want to sign up for our security research or whether they want to [devote] research engineers of their own to investigate the vulnerabilities.

“But in our opinion, they have full vulnerability information.”

He also stressed the special nature of the vulnerabilities he had discovered. “This is the first time that such a widespread and critical attack has been demonstrated against Nokia’s Series 40 devices,” he said. “We have proved that these devices can be hacked and infected with malware in a very similar way PC computers are.”

Still, he was on the defensive. “Some people will attack us, and hate us,” he said, for selling research in this fashion. “But in time, people will be able to judge on their own whether we got it right.”

He stopped short, however, of promising to release more information once Sun and/or Nokia had patched their software. “We’re considering it,” was as far as he would go.

(Source:ComputerWorld)

Wednesday, December 3, 2008

Salute To Indian Security Forces In Mumbai

Salute To Indian Security Forces In Mumbai

This video is dedicated to all the Indian Security Forces who are involved in saving lives of the people from all over the World in Mumbai.

Recent Comments