eBay, PLEASE get your act together

There’s a BBC article about eBay “facing up to online fraud”.

In an interview with Radio 5 Live, eBay would not reveal exactly how many accounts had been hijacked, although a company spokesman refused to deny that possibly tens of thousands had been compromised.

Link here.

eBay is appalling in its apparent lack of aggressiveness toward fraud.  Maybe they have a huge staff of security people, but I don’t see the results.  Basic antiphishing starts with having a massive amount of honeypots to get all the scams out there and then going after each site with a vengeance through the various channels and options available.  Perhaps we need some legislation to make it easier to get ISPs to shut a site down, but there are other ways as well to knock a site off the radar.  Get to the site before your grandma clicks on it.  Because that’s who is going to suffer.

I’ve gone to eBay’s security website numerous times to report obvious fraud, and it’s a painful experience, where you have to click through like some idiot through a bunch of options (compare that to PayPal, where you can simply forward an email to “spoof(at)paypal.com”). I’ve seen phishing sites still up far longer than they should be (max life for these sites shouldn’t be more than a few hours).

Back in October, I wrote about one bank that had a massive attack plan to go against phishers—and it was working

You have to hit phishing HARD.  I’m not talking about illegal DoS.  Phishing sites are lame little sites that should be easy to take down. 

I know it’s controversial, but I experimented with one phishing site using phishfighting.com and was able to take the phishing site down in about a day, just me. This site had been around for a while and was gone with a simple effort. (Before the comment storm: I know the arguments for and against phishfighting.com well.  Needless to say, only the most advanced users should play with this site.  I won’t go into the other arguments about philosophy, etc.  Frankly, we shouldn’t need to have a site like this, the banks and companies like eBay should take the phishing sites down with a vengeance, leaving people like me to spend time writing about other things).

We can’t wait until users get IE 7 with its built-in antiphishing tools or get yet another browser add-on that alerts you to bad sites.

Simple message: eBay, get it together. 

Alex Eckelberry

NSA spying on us without warrants?

This is not a political blog and I am absolutely uninterested in making political statements here.

I am, however, a pretty serious privacy and free speech advocate. In other words, it’s never a question of politics. It’s a question of our constitution and other universally agreed-upon rights.

So it is with this non-political disclaimer that I introduce you to today’s headline on the front page of the New York Times that alleges that our government:

“secretly authorized the National Security Agency to eavesdrop on Americans and others inside the United States to search for evidence of terrorist activity without the court-approved warrants ordinarily required for domestic spying, according to government officials.”

Link here.

I have said this before and I will continue to repeat it as a mantra: The fear of real or perceived outside threats has historically been the justification for the biggest assaults on civil liberties.

Be vigilant.

Alex Eckelberry

Just a reminder: We’re always hiring

A lot of smart people read this blog, and if you know of anyone who is interested in working for a killer software company located in beautiful Tampa Bay, send them our way. 

We currently need people in software development,  sales administration, tech support, web development and quality assurance.  Our Careers page changes constantly, but the latest one is here. Contact hr(at)sunbelt-software.com.

 

Alex Eckelberry

Good guys who take the bad guys out

A faithful blog reader (who wishes anonymity) sent me this link and it looks pretty cool.

The Internet Crime Prevention and Control Institute (ICPI) is a private membership organisation that fights internet crime (phishing, fraud, etc.).  They work through legal and diplomatic channels to get the job done.

From my reader:  “I have seen [ICPI] get results in taking down phishing sites (and others). The one I personally saw go down was hosted and registered in China, of all places. It took a week (kind of a long story as to why), but they got the job done.” 

Ipcimainpage

Good.  We need all the help we can get.

Link here.

 

Alex Eckelberry

Good article on rootkits

Joern Wettern at Redmondmag has a good overview of the situation.

As if there weren’t enough threats coming at you via the Internet, now you have to secure your systems against rootkits, as well. Rootkits are similar to spyware, viruses and worms in that they’re designed to run on your computer without your knowledge. Once on your system, they often perform a malicious task, like creating a backdoor to enable unauthorized access to your system.

What makes rootkits unique is that they’re designed to avoid detection by standard scanning methods and tools. If a rootkit has installed itself on your computer, you won’t find it using Windows Explorer or see it in the list of services that are currently running. Most virus scanners can’t even find a typical rootkit. To protect yourself against this type of threat, you need to know how they work and how to remove them from your systems.

Link here.

 

Alex Eckelberry
(Thanks Dan)

Consumer Affairs article on RFID

Martin Bosworth at ConsumerAffairs.com has an excellent article on RFID.  Definite must read if you’re interested in privacy issues.

From an RFID advocate:

“Today everybody knows what an iPod is,” said Thompson, “and the same thing as with a chip in your arm that is placed there instantaneously, and is going to be able to help you secure your medical records which will be able to allow you to…be able to get immediate care.”

Link here.

 

Alex Eckelberry

Is the Pentagon spying on you?

Pretty interesting blog at the WashingtonPost today by national security expert William Arkin.

An NBC Nightly News piece yesterday on domestic spying by the military featured yours truly discussing an intelligence database of 1,519 “suspicious incidents” that covers the period July 2004-May 2005. 

The database — which I obtained from a military source — is a rare look inside the actual work of the Defense Department conducting counter-terrorism and “force protection” missions inside the United States.  Building on the NBC story, what does the database actually show?

Now check out some of these hardcore terrorist threats:

In last night’s report, NBC focused on one such report, the monitoring of an anti-war Quaker meeting in Lake Worth, Florida by the Army’s 902nd Military Intelligence Group (that, according to the database). The database categorizes the meeting, which was to plan a protest at a military recruitment station, as a “threat.”

Or

August 2004, Atlanta, Georgia, a Navy enlisted man is arrested for driving under the influence by the Cobb County Police Department “and upon search of vehicle, discovered a picture of Usama bin Laden displayed as a screensaver on E-4’s cellular telephone.”

Link here.

The fear of real or perceived outside threats has historically been the justification for the biggest assaults on civil liberties.

Be vigilant.

Alex Eckelberry

Another fake security site.

Here’s yet another fake security site, with a blatant rip-off of the Microsoft security logo, pushing the WinFixer scam.

Anotherfakesecuritysite

For your block lists:

amaena.com

 

Alex Eckelberry
(Thanks Patrick)

Update:  Suzi posted this comment — thanks Suzi:

Gravatar Whois info for the domain:

http://www.whois.sc/amaena.com

IP: http://www.whois.sc/66.244.254.177

Most of the other domains on this IP are porn sites along with some other fake security sites thrown in, too.

And these:
Win-anti-virus-pro.com
Win-antivirus.com
Win-virus-pro.com
Winantivirus2005.com
Winvirus2005.com

 

Beware Vcodec

Wondering how people get to these bogus security sites and download junk like SpyAxe?

Patrick Jordan and Adam Thomas on our spyware research team have been investigating Vcodec.com.  This is a site that has a program called “VCodec v3.05b is new generation multimedia compressor/decompressor which registers into the Windows collection of multimedia drivers…”

Vcodecasdfasdfawe4r234234234qwdfasdf

This is bogus video utility. The file, VideoCodec3_05b, is a trojan which then starts the scam about “Your computer is infected!”.

Videocodecpostinfect

I ran this through VirustTotal and here are the results (“No virus found” means the scanner did not detect the file as a trojan):

—————————————————————————————————

This is a report processed by VirusTotal on 12/14/2005 at 23:23:24 (CET) after scanning the file “VideoCodec3_05b.exe” file.

Antivirus Version Update Result
Kaspersky 4.0.2.24 12.14.2005 Trojan-Downloader.Win32.Zlob.cu
NOD32v2 1.1322 12.14.2005 probably a variant of Win32/TrojanDropper.Small.NCU
CAT-QuickHeal 8 12.13.2005 (Suspicious) – DNAScan
AntiVir 6.33.0.61 12.14.2005 no virus found
Avast 4.6.695.0 12.14.2005 no virus found
AVG 718 12.14.2005 no virus found
Avira 6.33.0.61 12.14.2005 no virus found
BitDefender 7.2 12.14.2005 no virus found
ClamAV devel-20051108 12.12.2005 no virus found
DrWeb 4.33 12.14.2005 no virus found
eTrust-Iris 7.1.194.0 12.14.2005 no virus found
eTrust-Vet 12.3.3.0 12.14.2005 no virus found
Fortinet 2.54.0.0 12.14.2005 no virus found
F-Prot 3.16c 12.13.2005 no virus found
Ikarus 0.2.59.0 12.14.2005 no virus found
McAfee 4650 12.14.2005 no virus found
Norman 5.70.10 12.14.2005 no virus found
Panda 8.02.00 12.14.2005 no virus found
Sophos 4.00.0 12.14.2005 no virus found
Symantec 8 12.14.2005 no virus found
TheHacker 5.9.1.055 12.14.2005 no virus found
VBA32 3.10.5 12.14.2005 no virus found

—————————————————————————————————

So,only Kaspersky (no surprise), NOD32 and CAT-QuickHeal are catching it. 

Put this one on your blocklist.  Hopefully AV vendors will get signatures out very soon.

Alex

New IRS phishing scam

Looks like this:

From: supp…@irs.gov <supp…@irs.gov
Date: 14 Dec 2005 18:41:23 -0000
Local: Wed, Dec 14 2005 1:41 pm 
Subject: Refund notice

You filed your tax return and you’re expecting a refund. You have just one question and you want the answer now – Where’s My Refund?

Access this secure Web site to find out if the IRS received your return and whether your refund was processed and sent to you.

New program enhancements allow you to begin a refund trace online if you have not received your check within 28 days from the original IRS mailing date.  Some of you will also be able to correct or change your mailing address within this application if your check was returned to us as undelivered by the U.S. Postal Service.  “Where’s My Refund?” will prompt you when these features are available for your situation.

To get to your refund status, you’ll need to provide the following information as shown on your return:

  • Your first and last name
  • Your Social Security Number (or IRS Individual Taxpayer Identification Number)
  • Your Credit Card Information (for the successful complete of the process)
     

Okay now, Where’s My Refund?  (Link points to a bogus site, http://www[dot]collionline[dot]it/img/[dot]www4[dot]irs[dot]gov/index[dot]html

Note: If you have trouble while using this application, please check the Requirements to make sure you have the correct browser software for this application to function properly and check to make sure our system is available.

The link leads to a bogus phishing site that is highly believable as an IRS page:

Irsfakephish

Two links which provide more here and here.   Reported by n3td3v on Full Disclosure.

 

Alex Eckelberry
(Thanks Eric)

FTC settlement with DirecTV

The FTC settles with DirecTV over alleged violations of the Do Not Call registry.

But what’s interesting in this article is the following:

The FTC’s action “demonstrates that the registry is a program consumers can continue to believe in,” said FTC Chairwoman Deborah Platt Majoras at a press conference held Tuesday morning. “Sellers are on the hook for calls placed on their behalf and for their benefit,” she added. “It is not named the Do Not Call Registry for nothing.” [my emphasis in bold]

Link here.

Hmm… would that imply that companies advertising through spyware applications might have a liability?  Remember that Can Spam has this type of provision:

    (a) IN GENERAL- It is unlawful for a person to promote, or allow the promotion of, that person’s trade or business, or goods, products, property, or services sold, offered for sale, leased or offered for lease, or otherwise made available through that trade or business, in a commercial electronic mail message the transmission of which is in violation of section 5(a)(1) if that person–
      (1) knows, or should have known in the ordinary course of that person’s trade or business, that the goods, products, property, or services sold, offered for sale, leased or offered for lease, or otherwise made available through that trade or business were being promoted in such a message;
      (2) received or expected to receive an economic benefit from such promotion; and
      (3) took no reasonable action–
        (A) to prevent the transmission; or
        (B) to detect the transmission and report it to the Commission.

Alex Eckelberry

RFID = Big Bucks

Gartner estimates:

Worldwide spending on the emerging wireless tracking technology is set to reach $504 million this year, up more than one-third from 2004, market researcher Gartner said Tuesday. Adoption will accelerate by 2007, with spending pegged to hit $3 billion by the end of the decade.

It’s also been denounced as a harbinger of a Big Brother society in which personal privacy disappears, either because of voluminous record-keeping on people’s shopping habits and travel patterns, or even because the chips could even end up under the skin.

Link here.

 

Alex Eckelberry

Running IE 7 alongside IE 6

For those who are testing IE 7, pretty good data.

Sure, you knew IE7 Beta 1 was up on MDSN, but you don’t have a free machine to test it on. Can’t install it on your main work machine, because you can’t afford to mess it up… plus, you need to be testing your work against IE 6, right?

You thought about setting up a Virtual PC image, but it seemed like too much trouble for a Beta 1. Still, it would be nice to click around in it for a few minutes here and there…

Fret no more! IE has a secret standalone mode which lets you run multiple versions side by side (thanks to Joe Maddalone for figuring this out).

More here.

 

Alex Eckelberry
(Hat tip to Deb)

Cell phone tracking

Mobile phones get more and more sophisticated all the time. More and more people are getting rid of their landline service altogether and using mobiles as their primary means of telephone communications. As this trend started to develop several years ago, one problem that emerged was the inability to pinpoint the location of users who called 9-1-1 in an emergency, as has long been possible with landlines.

The solution was a technological one: build Global Positioning Satellite (GPS) receivers into the cell phone handsets. Many of us already have GPS units in our cars or use standalone handheld units or GPS software on our Pocket PCs to provide driving (or walking) directions to our destinations. The receiver uses a technique called trilateration to calculate the distance to each of four earth-orbiting satellites by timing how long it takes for each satellite’s signal to reach it, and from that it can deduce its location. For a detailed explanation of how this works, click here

The Federal Communications Commission (FCC) mandated that all cell phone providers have the technology in place to provide Enhanced 911 (E911) service, giving emergency operators the caller’s physical location, by 2004, and 95% of phones are required to be GPS-enabled by the end of 2005. All cell phones being sold now by major providers contain the GPS technology. If you have an older phone that doesn’t support GPS, it won’t be turned off, but when you go to replace it, you’ll get a GPS-capable phone.

E911 has been credited with saving lives when callers get cut off or otherwise are unable to give their locations, or don’t know where they are. But what else can this technology be used for?

Some privacy advocates are afraid it can be used by the government or private concerns to track everyone’s location without their permission. More and more of us carry mobile phones almost everywhere we go, and most of us keep the phones turned on all the time in order to receive calls. This can make it a handy electronic tracking device. And in fact, law enforcement agencies have used the technology to monitor the movements of criminal suspects for the past several years. However, under the 4th amendment to the Constitution, they’ve had to get a warrant issued by a court to conduct this type of surveillance.

Federal judges in several states, including New York and Texas, have recently denied warrants because of a lack of probable cause – the standard of proof showing that a crime has been committed and evidence tying the suspect to that crime. Some prosecutors have argued that the USA Patriot Act expands their powers to allow them to use cell phone tracking without meeting that high standard of proof. For more on this conflict, click here.

Of course, government surveillance isn’t the only potential use for this technology. Some consumer advocates worry that cellular companies will sell customers’ location information to advertisers, who could then display ads on your phone screen for retailers, restaurants, etc. that are close by, effectively turning your phone’s display into a miniature electronic billboard.

There are more consumer-friendly uses for GPS phones. In 2004, Nextel offered a GPS navigation service that could be used with some of their phones. Rather than having to buy a separate GPS device or handheld computer and software, you could just use your cell phone to receive driving directions through the TeleNav or ViaMoto services. Click here.

Sprint also offers the TeleNav service. And just last week, Verizon announced their VZ Navigator service that does the same thing, for a $10 monthly fee. Unfortunately, the services are limited to only a few models of phones at this time. Read more about Verizon’s service here.

Or how about if you’re a parent, using the technology to keep up with where your kids are? There are several services, including MyChildTracker (http://www.trackwell.com/products/mct.html) and FindYourChild (http://www.findyourchild.net), that make it possible for you to locate your child’s cell phone through the Web or through your own mobile phone. You can also designate who else is allowed to get location information about your child, if you want to delegate that ability to a grandparent or babysitter.

Trackwell also offers MyBuddyTracker for teenagers to locate their friends, MobileDate to “bring people with similar interests together” anonymously, and business-oriented GPS services suchas TracScape for fleet management and TrackWell Vessel Monitoring System for fisheries to keep up with their boats.

There’s another service, AccuTracking (www.accutracking.com) for Web-based cell phone tracking (if you have the right model phone and cellular provider). The good thing about this one is that it’s free for personal non-commercial use.

It’s important to note that all of these services that allow tracking by private parties require the person whose phone is being tracked to explicitly give permission. Usually client software has to be installed on the phone, so it’s not as if just anyone can go to the Web and find you via your cell phone? Or can they?

There’s already a company called PangoNetworks that sets up sensors in shopping malls to detect phones and PDAs and send ads to them. And courts have held that employers can use GPS services to track their employees’ locations during working hours if they pay for your phone (or provide you with a GPS-equipped vehicle).

More troubling, some hacker sites suggest that it might be possible to write a program that could be sent via an SMS message to query a phone’s GPS function and get its location. They would need to know the phone number to do so. Of course, most GPS-enabled phones allow you to turn the GPS receiver on or off, and some let you set the E911 GPS separately from the location service. If you’re particularly paranoid, though, you may wonder if turning off these options would really keep the provider from tracking you. Some security experts say the only way to be sure you’re not being tracked is to turn the phone off completely, and a few go so far as to recommend removing the battery. Maybe you’re better off just leaving the phone at home if you’re going someplace you don’t want anyone to know about.

How accurate is GPS-based cell phone tracking? Although the FCC’s E911 rule requires that carriers be able to locate phones within 100 meters, the technology can usually pinpoint your location to within a few feet. And what else can your cell phone tell about you besides your current location? MIT media lab conducted a research project in which they were able to create detailed profiles of people’s lives from the information that tracking their phones provided. Click here.

What do you think about all this? Does it have you ready to dump your cell phone, or are you excited about the possibilities the technology offers? Do the public safety benefits of E911 outweigh the privacy implications? Would you like to see more cell phone companies offer navigation services and private Web-based location tracking? Should unsolicited location-based advertising (phone spam) be banned? Comment away.

Deb Shinder
Editor, Sunbelt WXPnews.

My New Best Friend is the Bestest Friend Ever!

You read an article, and it starts like this:

Imagine your best friend, a skilled reference librarian, watching you surf the web and — by noting what you stop to read and what you bypass — continually offering you lots of additional, in-depth content you might not easily find on your own.

Relax… all is good.  Your New Best Friend is helping you.

Except you wake up and realize your New Best Friend is:

Gator. Claria.

The company is releasing PersonalWeb in January. It’s a software download that watches “profiles” the sites you visit and the content you read, continually updating a personal home page.

More:

As with Google Sidebar, PW will be a software download that will profile the sites you visit and the content you select. It will determine your news and information interests in much the same way behavioral targeters already infer and anticipate your advertising interests. Using both algorithms and your personal choices, the PW system will bring you more and better content within the topics you’re already reviewing, and will also “audition” other content you might find of interest.

The analogy to Google Sidebar is misleading.  As far as I know (and correct me if I’m wrong), Google Sidebar primarily collects information on the types of news that you read—not profiling the sites I visit and the content I select.

I will be very curious to look at this program when it releases.

Link to the article by Robert Moskowitz here.

 

Alex Eckelberry
(Thanks Amanda)

It’s a security scam party, and this is one party you don’t want to crash

Patrick and Adam found a bunch more of these “security scam” sites.  

IPs below, feel free to put these in your block lists.

Newly found sites

Mattie Muirhead
Florence, AL US
wm @ needupdate.com
85.255.115.174  dns404.net
85.255.115.130  needupdate.com
85.255.115.173  yoursystemupdate.com
85.255.115.172  systemwarning.com

Mag Dicacik     
Praha,  CZ       
mag @ sexpicporn.com 
85.255.115.172  securitywarnings.net

Sites already known

Henn Preson    
Stockholm,  SE 
henn @ teeeen.com

85.255.115.130  Warningmessage.com   
85.255.115.131  syserrors.com

Mag Dicacik     
Praha, CZ       
mag @ sexpicporn[dot]com

85.255.115.131  notfound404.com
85.255.115.132  Updateyoursystem.com
85.255.115.170  securityerrors.com
85.255.115.179  hdnsservidce.com
85.255.115.180  downldboost.com

And now for a picture party:

1asdfa324234

201231231233123

398098lijkjf

5234asdfacvwdr23ra

6asdfasdf234sd

70909090909

829asdkfjasldfjkadf

9oiuoiuljh

105468789764534415

1109090909090adf

 

Alex Eckelberry