Is Your Computer Infected With Rogue Security Software?

Symantec Corp. recently announced the rather frightening findings of its Report on Rogue Security Software and it doesn't look good for millions of computer-owning consumers. The study revealed that cybercriminals are employing increasingly persuasive online scare tactics to convince users to purchase rogue security software.

Rogue security software, or "scareware," is software that pretends to be legitimate security software. These rogue applications provide little or no value and may even install malicious code or reduce the overall security of the computer. The scam involves encouraging unsuspecting users to install rogue software with website ads that prey on users’ fears of security threats. These ads typically include false claims such as "If this ad is flashing, your computer may be at risk or infected," urging the user to follow a link to scan their computer or get software to remove the threat.

According to the study, 93 percent of the software installations for the top 50 rogue security software scams were intentionally downloaded by the user. As of June 2009, Symantec has detected more than 250 distinct rogue security software programs.

The initial monetary loss to consumers who download these rogue products ranges from $30 to $100. However, the costs associated to regain ones’ identity could be far greater. Not only can these rogue security programs cheat the user out of money, but the personal details and credit card information provided during the purchase can be used in additional fraud or sold on black market forums resulting in identify theft.

To make matters worse, some rogue security software actually installs malicious code that puts users at risk of attack from additional threats. As a result, installing these programs can lower the security posture of a computer while claiming to strengthen it. For example, rogue programs may instruct the user to lower or disable any existing security settings while registering the bogus software or prevent the user from accessing legitimate security Web sites after installation. This, in turn, leaves users exposed to the very threats the rogue software promised to protect against.

Symnatec offers these tips to protect against rogue security software:

• Avoid following links from emails, as these may be links to spoofed or malicious websites. Instead, manually type in the URL of a known, reputable website.
• Never view, open, or execute email attachments unless the attachment is expected and comes from a known and trusted source. Be suspicious of any emails that are not directly addressed to your email address.
• Be cautious of pop-up windows and banner advertisements that mimic legitimate displays. Suspicious error messages displayed inside the Web browser are often methods rogue security software scams use to lure users into downloading and installing their fake product

Online Shopping Safety Tips

Shopping online is the most convenient thing since sliced bread! There's no need to hassle with mall parking or crowds. Just simply click on what you want, enter in your credit card information and in a few days you'll get your items in the mail — so simple! Or is it?

Of course there are those who shy away from online shopping because of identity theft. Sure it's a problem but if you arm yourself with knowledge then you can avoid becoming a target.

Below are some safety tips to keep you safe while you're shopping online.

• Read reviews from other shoppers
• Look for the Better Business Bureau logo or call them to verify the company is legitimate
• Shop with reputable leading companies
• Look for the lock icon that lets you know the Web site is secure
• Update your browser often as it comes with security features
• Stay away from sites that ask you to enter in your social security number to make a purchase

The BBB's Advice on Giving and Getting Pre-Paid Bank Cards

There are only a precious few more shopping days until Christmas. If you are like me, it's tempting to skip the malls and the expensive postage by getting everyone on your list a gift card! While they seem like a safe and easy way to give money during the holidays, the Better Business Bureau recently had a few things to say about this popular holiday choice.

According to the BBB, billions of dollars will be spent on gift cards this holiday season and pre-paid bank cards—or stored-value cards—are expected to be very popular. These pre-paid bank cards are like gift cards, but can be used anywhere credit cards are accepted, allowing the recipient more flexibility in where the money can be spent. But the BBB warns that pre-paid bank cards aren’t without their downside.

"Cold hard cash is going to be on a lot of wish lists this year as families find it increasingly difficult to balance holiday spending with paying for essentials," said Steve Cox, BBB spokesperson. "Pre-paid bank cards can be a great way to give money, but givers and receivers need to pay special attention to the terms and conditions, which can include substantial fees and limitations."

Not only are pre-paid bank cards a popular holiday gift, they are also a way for people with limited access to credit cards to manage their money—including making it easier to purchase items online. The terms and conditions on these products do vary, so BBB recommends consumers pay special attention to the following details when giving, or receiving, a pre-paid bank card:

'Tis The Season to See Fees
BBB recently researched a bank card offer and discovered more than 27 different fees ranging from a little under a dollar to almost $20. Fees were attached to contacting customer service, loading more money onto the card, and inactivity. The card even had weekly base fees of $1.95—which ads up to more than $100 a year to use the card. BBB recommends paying close attention to all terms and conditions associated with pre-paid bank cards and is encouraging consumers to ensure they read the fine print and ask about and understand any "hidden" fees.

What Happens if the Card is Lost or Stolen
Pre-paid bank cards are often branded by major credit card companies, such as MasterCard or Visa. While credit card companies promise zero or limited liability to card holders if their credit card is stolen or lost, the same protections do not necessarily apply to stored-value cards. Again, BBB recommends paying close attention to the terms and conditions of the card, which should outline the consumer protections allotted to the holder. 

Just Like a Credit Card?
In some cases, such as renting a car or reserving a hotel room, a pre-paid bank card might not be accepted. Consumers might also have a hard time using pre-paid cards when paying a deposit for larger purchases.

Some card issuers, but not many, report to a credit bureau, which means that holding a card can potentially have a positive impact on a consumer’s credit score.  Because a consumer cannot overdraw on the card or risk not paying a bill on time, there’s no way for a consumer to damage their credit by using a pre-paid bank card either.

For more information on giving and using gift cards, and on managing credit and debit cards this holiday season, go to www.bbb.org.

Beware of Digital Transition Scams

As with any new product or service that comes out, there are scam artists waiting to take advantage of people concerned about the digital transition coming this February. We've been talking about what to expect and giving advice and information on this issue, including the TV converter box coupon program, for awhile now, so I hope that we've helped ease you through the transition. However, if you are getting your information from other sources, make sure to remain skeptical.

For example, the Better Business Bureau has been alerting consumers to beware of a misleading advertising campaign by an Ohio-based company called Universal TechTronics. Apparently, the company has been running ads across the U.S. promising free television channels, services and digital TV converter boxes, but are really a bait and switch tactic that prey on consumers’ lack of knowledge about digital TV conversion requirements.

The BBB investigation found that Universal TechTronics was offering "five-year warranties" for $59 that must be purchased with their "free" digital TV converter boxes. With shipping and handling fees rolled in, the total cost per box is nearly $100. However, these are most likely the same boxes consumers can buy in electronics retail stores across the country using the aforementioned $40 U.S. government coupons that make the total cost to consumers about $20 per box.

"The bottom line is that these ads confuse and mislead consumers," said Steve Cox, BBB spokesperson. "Unfortunately consumers who do respond may find that not only will they not receive free products and services as implied by the ads, but they will end up paying more than they would have by taking advantage of the really good deal being offered through the DTV coupon program."

The AARP is also warning it's members about DTV transition scams, advising them to watch out for phony rebates and grant money, bait and switch scams, and expensive help you really don't need.

If you aren't ready for the transition, check out the blog posts I linked above or go directly to the source for the most up-to-date information at DTV.gov!

Scamming on Facebook

We've written in the past about avoiding e-mail scams, but as social networking (i.e. Facebook, MySpace, etc.) expands...so do the scams. Recently, it was reported on CNET.com that one of the old classics, the Nigerian scam, has hit Facebook.

In such scams, the con artist tries to solicit money through a letter, either by hard, or more commonly now, soft copy. They tell a story of some sadness and heartache as to how they've come to need money, then request you, the target, to send it on.

So be wary of any requests you get from your social sites...even if it seems to be from your best bud. Give them a ring to make sure it is actually them stuck in Lagos needing the money before you wire it over.

Read more about the story in the Sydney Morning Herald or CNET.com.

Beware of the Big Bad Moving Broker

With the advent of the internet there have been more opportunities to take advantage of consumers. People use brokers for everything from finances to our energy needs, so why not use a broker for other events in our lives? Well, one of the newest scams being utilized is moving brokers.

According to the recent Census Bureau, 39.8 million people in the United States moved within the previous in 2006. This means that a huge portion of the population had the same needs. Knowing this, would-be criminals have developed a way to monetize the industry by using the internet to prey on people's desire to save time and money.

Traditionally, moving brokers help the consumer to shop the local competition to find the best rate for the customer's move. However, recently some moving brokers have been devising methods to take advantage of that customer. Some work directly with a moving company. The mover will provide a bid lower than industry standard, so the customer uses his company for the move. The furniture is loaded, but before arriving at the new location the mover requests additional money from the customer for the move and holds hostage all property until this is made. Customers find that they can no longer contact their broker, and are forced to pay for their own belongings.

Crooked brokers also utilize another scam to dupe consumers. They require a customer to submit a down payment to lock in a price. When thinking of the cost of a state-to-state move, the cost savings can be extraordinary, which is why a consumer is apt to buy into an extremely reasonable rate. Those moving interstate are also more likely to plan weeks or even months in advance, so by the time they contact the broker again, they are nowhere to be found—phones are disconnected and websites are no longer available. When dealing with an internet-based company that is individually run, there is no way of knowing their location and who to look for when problems arise.

Now here's the good news! There are many reputable moving companies and methods to get a good qualified moving lead from an internet-based company.

• A consumer should use a reputable lead source. Check for credibility. Are they a member of the BBB (Better Business Bureau)?
• Are you able to get the estimate/quote in writing?
• Is the company you chose licensed? This can be checked online with the Department of Transportation's Federal Motor Carrier Safety Administration.
• Do not pay up front for a price guarantee. Most reputable companies will not require a payment until the day of the move.
• Shop around. Make sure to contact an aggregate that will get several estimates.
• Be honest. Moving companies are allowed to charge more than the estimated price if the consumer was not honest about what actually needed to be moved. By law they are not required to itemize the extra expense or weigh the additional items.

With a few simple, extra steps we can protect ourselves from moving scams.

PayPal Unveils New Security Key to Help Members Stay Safe Online

Does giving out your credit card online fill you with dread? Two of the largest players in e-commerce have come up with something that might give you a little extra peace-of-mind. Last month at the sixth annual eBay Live! Conference, eBay and PayPal announced the availability of the PayPal Security Key for its customers.

The small electronic token generates a unique security code approximately every 30 seconds. The companies say that members can use this code, along with their user name and password, to sign into both their eBay and PayPal accounts, helping to prevent unauthorized users from accessing them.

This type of additional security, known as two-factor authentication, is used by financial institutions as additional means to protect consumers and reduce losses from online fraud such as phishing attacks.

"We???ve had a tremendously positive response to the PayPal Security Key beta program and are excited to make the device generally available," said Michael Barrett, chief information security officer at PayPal. "While PayPal.com remains a trusted and secure environment, the PayPal Security Key allows customers to take their privacy and security into their own hands to help protect their eBay and PayPal accounts against unauthorized access."

The PayPal Security Key is part of the VeriSign Identity Protection (VIP) Network. As part of this network, consumers use the PayPal Security Key to protect themselves on a variety of financial services and e-commerce websites.

"As founding members of the VIP network, eBay and PayPal are leading the way in giving millions of consumers the tools they need to add an extra layer of protection when online," said Fran Rosch, vice president, Authentication Services, VeriSign. "Through the VIP Network, eBay and PayPal members will be able to use their PayPal Security Key to protect their account data at other participating sites and thereby reduce online fraud and cyber crime."

The PayPal Security Key has a promotional one-time fee of $5.00 for PayPal and eBay account holders in the U.S. The PayPal Security Key will also become generally available in Germany and Australia with more countries to follow.

For more information, check out https://www.paypal.com/securitykey or http://www.ebay.com/securitykey.

Number of Identity Theft Victims Has Increased More Than 50 Percent Since 2003

Approximately 15 million Americans were victimized by some sort of identity-theft related fraud in the 12 months ending in mid-2006, according to a survey by Gartner Inc. These statistics represent more than a 50 percent increase since 2003 when the Federal Trade Commission (FTC) reported 9.9 million American adult identity theft victims.

According to the Gartner survey of 5,000 online U.S. adults in August 2006, the average loss was $3,257 in 2006, up from $1,408 in 2005. At the same time, the percentage of funds consumers managed to recover dropped from 87 percent in 2005 to 61 percent in 2006.

"Hackers are exploiting Internet auctions, nonregulated money transmittal systems, the ability to impersonate lottery and sweepstake contests, and other types of imaginative scams," said Avivah Litan, vice president and distinguished analyst at Gartner. "The thieves have also discovered the weakest links in the U.S. payments systems. Typically, the weak links are found among the five or more million businesses that accept electronic payments from consumers, and the consumers themselves."

Electronic theft of sensitive information is a leading cause of certain types of fraud, including credit card, debit/ATM card and bank account transfer fraud. This is not the case with check forgery and new account fraud, where in-person data theft is the leading cause.

"All sensitive electronic data needs to be protected, but enterprises should be aware that the low hanging fruit for the criminals is electronic card and checking account numbers, as well as user IDs and passwords for online financial accounts," Ms. Litan said.

The average loss on new account fraud more than doubled from $2,678 in 2005 to $5,962 in 2006. Unauthorized charges to credit cards rose nearly fourfold from an average of $734 in 2005 to $2,550 in 2006. This trend reconciles with a trend cited by various U.S. card issuers who reported large increases in counterfeit card fraud in 2006. Similarly, there were large increases in checking account transfer fraud and "other" noncategorized types of fraud (for example, scams exploiting eBay, PayPal and phone companies).

"Oftentimes, consumers have no idea how criminals hijack their accounts and/or identities," Ms. Litan said. "They also typically have no clue if one or more of their personal attributes, such as their social security number, is used to piece together a new fictitious identity in a phenomenon typically referred to as synthetic identity fraud."

Regardless of the method used to steal data to commit new account fraud, the fraud itself can be largely prevented by using identity verification and scoring services.

"Enterprises that store credit card, debit/ATM card and bank account data should expect electronic data breaches and/or hacks, and migrate away from that practice while protecting their systems accordingly until they are able to do so," Ms. Litan said. "Rule-makers debating identity-theft legislation should consider comprehensive financial protection for consumers who lose money to fraud that goes beyond disparate regulations in place today. Service providers should pay for this protection when data or accounts under their custody are breached."

For more information, check out the press release.

Valentine Virus Strikes at email inboxes

Experts at SophosLabs™, a global network of virus, spyware and spam analysis centers, have warned of a widespread worm posing as a Valentine's Day greeting which is spreading fast across the Internet

The W32/Dref-AB worm has been deliberately spread via e-mail in readiness for office workers and home computer users to find the malicious Valentine e-mail in their inbox first thing in the morning. Since the beginning of the holiday, the Dref-AB worm has accounted for 76.4 percent of all malware sighted at Sophos's global network of virus monitoring stations.

Subject lines used in the attack are many and varied, but all pose as a romantic message. Some of them include "A Valentine Love Song", "Be My Valentine", "Fly Away Valentine", "For My Valentine", "Happy Valentine's Day", "My Lucky Valentine", "My Valentine", "My Valentine Heart", "My Valentine Sunshine", "Send Love On Valentines", "The Valentine Love Bug", "The Valentines Angel", "Valentine's Love", "Valentine's Night", "Valentine Letter", "Valentine Love Song", "Valentine Sweetie", "Valentines Day Dance", "Valentines Day is here again", and "Your Love on Valentine's".

Attached to the e-mails are files called flash postcard.exe, greeting postcard.exe, greeting card.exe, or postcard.exe which contain the worm.

"This new Valentine attack is spreading hard and fast across the Web, accounting for over three quarters of all the malware we've seen at e-mail gateways around the globe since Feb. 14 began," said Graham Cluley, senior technology consultant. "People will be truly love sick if they let the virus run on their PC."

Opening the attached files on a PC activates the worm, which then sends itself to other e-mail addresses found on the now infected computer. Sophos analysts believe that the worm code is designed to attempt to download further malicious code from the Internet designed to take over the PC, convert it into part of a zombie network, and use it to send spam on behalf of hacking gangs.

"Cynical hackers are using the theme of Valentine's Day to conquer innocent people's computers and use them for their own money-making purposes," continued Cluley. "Your PC and the data on it is precious, and it needs to be protected. No-one should be blinded by the excitement of Valentine's Day into opening unsolicited attachments or clicking on links to unknown websites, as you could be falling deep into a hacker's trap. The best defense is common sense, combined with up-to-date anti-virus software and e-mail filtering at your gateway."

For more information, check out the Sophos press release.

EarthLink Upgrades Protection Control Center with Attack Shield

Continuing in its commitment to provide consumers with a safe Internet experience, EarthLink has added "zero-day protection" in the fight against spyware, Trojans, keyloggers and other threats with its upgraded Protection Control Center with Attack Shield.

Traditional antivirus solutions take a reactive approach to detecting and eliminating new viruses: they wait for an attack to infect a computer before arming consumers with updates that protect them from the latest threats. However, EarthLink's "Attack Shield" technology is proactive: by utilizing Sana Security's award-winning multi-behavioral security engine, the application is able to monitor in real-time the consumer's PC to detect potential behaviors to determine if an installed program is malicious and remove it without requiring definition updates.

Why Upgrade to the Protection Control Center with Attack Shield?
Online security has typically required an Internet user to manage each protection application individually on a desktop or laptop computer - a time consuming and frustrating process. According to EarthLink, it's Protection Control Center and Sana's anti-malware behavior technology will give consumers a single, easy-to-use consumer interface that simplifies the task of securing a computer against online threats and nuisances that can compromise personal identity and data.

In addition to the Attack Shield upgrade, the Protection Control Center 2.0 also includes the following enhancements:

• Improved active defense technology that detects more spyware and viruses before they can get onto a consumer's PC
• Better system performance
• Enhanced user interface
• Firewall lockdown that allows consumers to shut down all Internet traffic with one click if they think their computer is under attack
• Enhanced Firewall
• LAN Detection that allows consumers to set up trusted networks to which they connect to most

More on Viruses & Malware
According to the Anti-Spyware Coalition, a computer virus is code that recursively replicates a possibly evolved copy of itself. Viruses infect a host file or system area, or they simply modify a reference to such objects to take control and then multiply again to form new generations. Definitions for spyware, Trojans and other forms of malware can be found at http://www.antispywarecoalition.org/documents/glossary.htm. For more information on the Protection Control Center with Attack Shield or to sign up, visit http://www.earthlink.net/software/pcc/. For EarthLink's Podcast about the Protection Control Center with Attack Shield, please go to: http://www.earthlink.net/about/.