The Blog of Hans Eisenman

Sunbelt Blog: “10 million people will you computers are perfectly safe”

This is how far bad guys will go to hack your PC or computer network.  In case it's not abundantly clear what's happening here, Sunbelt (maker of highly competent anti-virus and other security software which won't slow your PC down) is showing a "rogue security product" maker's website.  Note that their website makes them look like a real company and even has stolen the exec bios from a real company (AVG). 

Best to use known entities when looking for protection for your computer(s).

Sunbelt Blog: “10 million people will you computers are perfectly safe”.

New rogue borrows massively from AV company sites Our friend M.N. Bharath drew our attention to this web site associated with the new System Adware Scanner 2010 rogue security product. Although the group claims 10 million users world-wide, oddly enough their site was only registered Nov. 25. It seems they also have recruited the entire management team from AVG anti-virus company as well. Right!

Jeff Jonas: Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society

This is thought-provoking stuff on not only how close we could be coming to a "total surveillance" society, but how/why consumers would love it.

Jeff Jonas: Six Ticks till Midnight: One Plausible Journey from Here to a Total Surveillance Society.

The ACLU has recently announced a Surveillance Society Clock which depicts, in their view, how close we are to a total surveillance society. At the time of this writing the clock sits at 11:54pm – just six minutes from midnight! This clock got me thinking about what series of plausible events might lead up to total surveillance. Unfortunately, such an exercise turned out to be spooky because I quickly concluded that a total surveillance society is not only possible but a certainty. It will happen through a series of fairly quick small steps, it will be irreversible, and the real shocker is that I suspect consumers will find it "irresistible!"

The Six Ticks till Midnight... [click link above for rest of article]

Phishing Alert!

You, dear reader, probably wouldn't fall for this but just in case, I'm posting the message and warning all readers.   First, a definition, for those of you unfamiliar with the term:

Phishing: In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.
(http://en.wikipedia.org/wiki/Phishing)

I received this email (below) through one of my email addresses today--one that is more prone to spam than the others (since I have had it since about 1996).  The offer seems innocuous enough at first, but the giveaway is the request for personal information right up front (i.e., in the first contact).  No professional company would expect you to release your most private info without first making themselves better known--without more TWO-way communication first. 

Parking tickets actually malware attacks in disguise : Christopher Null : Yahoo! Tech

Real and digital worlds blend together as hackers use paper faux parking tickets to violate unwitting visitors to a malicious website.  Hat tip to Twitter user and friend @leknott for passing on ("reTweeting") the article (thanks, Jeff!).

Parking tickets actually malware attacks in disguise : Christopher Null : Yahoo! Tech.

The last place anyone would expect to face a computer security attack is on the windshield of their car in the form of a parking ticket. But that's the latest -- and intensely clever -- way that hackers are attempting to goad people into visiting infected websites and willingly install malware on their machines. The scam is instantly clever once you hear how it works: Hackers print up phony "PARKING VIOLATION" notices and plaster them on cars parked on the street. The phony ticket directs the car's owner to visit a certain website, and of course the website in question (which largely seems to comprise of photos of badly parked cars) is a hack site which attempts to install malware on your PC.

Is your browswer secure?

"According to a new study from researchers at Google, IBM and ETH
Zurich, there are about 637 million Google users surfing the Internet
with a vulnerable Web browser."

More: ZD Net Article

Spock.com's Spamming

Got some interesting spam today.  It was not only TO: me, but it was FROM: me.  This intrigued me.  The message said that I liked Spock.com, a new search service, so much that I wanted to share it with myself, in so many words.

This was as redundant as it was completely false, so I had to see how this could be.  Possibly more of my contacts got this message.  Often, when spam like this happens, the spammer gains illegal access to an address book of Person A and then spends out messages (the spam) to people in the address book, but not from Person A. They pick someone else, or scramble the whole address book up so it is difficult to see who actually had their address book hacked.

Anyway, that might be what happened here.  I'm not sure yet. But I'm going to make it known to LinkedIN that it appears that this company, Spock.com, is possibly hacking their users' address books and then making it look like those users are recommending Spock.com to their friends by sending these spam emails (clikc on image above to see what the message looks like.

Did some cursory searching on this company Spock.com and found that I'm not the only one who is on the wrong end of their shenanigans.  Here are my notes so far.

I've been in the tech area for years now and this kind of thing really gives the 'net a bad name.  It's not just another annoying marketing ploy.  It's completely dishonest and immoral.  If I were a VC, I'd pull their funding and move on.  It's just a matter of time before people who do this kind of thing get their comeuppance.

We've Been Duped!

So I'm doing the should-be-weekly, dreaded financial planning (not as dreaded, though, since I started using www.mvelopes.com, I must say), when lo! what do I find?  A $10 charge to my wife's account.  That's not odd, particularly, but I don't recognize the vendor, a Reservation Rewards out of Connecticut.

First stop is ask my wife if she knows of these cats.  She replies in the negative: "never heard of 'em."  Then comes some research a la Google to find out they are apparently a real company and even have a website with a pretty easy-to-find cancellation number (1-800-732-7031).  So far so good.  At least I can get out of the thing without the AO-HELL levels of diligence to cancel.

After going through those steps, I notice, though, that my wife actually has an account with this company--I mean she has a profile with some of her info, particularly her name and c.c. data.  No address, though, which is odd since one would normally include that info with a service one had knowingly opted into.  This makes me wonder: who are these guys really?

ATMs--Security Warning

Here is something you should know about your friendly neighborhood ATM(s).  After reading this I'm going to be far less likely to use a convenience store ATM (you know the type: they look like someone just rolled it off a pick-up truck and plugged it into the wall) unless absolutely necessary.

It would be much harder for someone to make these kinds of adjustments to a bank-branded ATM, particularly one which is almost inside the bank (like in their foyer). 

"They also moved into a process called ATM skimming whereby people
retrofit ATM machines with their own hardware that is actually able to
capture card swipes and pin entries, while still maintaining the
functionality of the original ATM device. This was unbelievable to see,
and I honestly believe I’ll never use an ATM machine again. Also
of note, it was clear that phishing is not really the major concern;
identity theft is the concern, and the people exploiting this are using
any means possible." Link to article

Electronic Voting and Security

A thorny issue indeed...at least as thorny as any other security issue.  It reminds me of the question I point of view I often witness from less-technical friends about the relative security of the Internet when they are making purchases.  The implication they make is that purchasing on the 'net is less secure somehow--that their c.c. informaiton could end up in the hands of some shadowy cyber-person.  This is usually about the time they are paying for their lunch with their ATM card, handing it to the server who takes it out of their sight and can see the full number, the signature and the CVS code (three numbers on back of card used for security), all of which would be encrypted if the transaction were over the Internet through any respectable site.

The moral of the story might be: just because we're familiar with the transaction model being used, doesn't mean it's the most secure one to use today.

Link: Slashdot | Open Source Electronic Voting Progress Limited.

"People debate the merits of e-voting for a variety of reasons, including suspicion of new technologies and a general distrust of politics, according to Jamie McKown, Wiggins professor of government and polity at the College of the Atlantic. 'Reports on e-voting security often de-contextualize the history of voter fraud in this country, as if boxes were somehow assumed to be better. You constantly hear calls for paper trails, and open and free inspection of voting machine source code. But it's a very thorny issue and one that has a lot of facets,' McKown told LinuxInsider."

Has Skype Been Compromised?

It's relative security has been one of the best and unique features of Skype since it was created. Where else could you get encrypted verbal communication these days without employing some form of Bond-esque appliance?

The article covers all that can be at this point, without knowing what really happened.  I have to admit, though, I'm giving Skype second thoughts now and am going to look into using some of the other tools so I can rest a little easier.  Whether I'm talking about business or my kids--or even my groceries, I know one thing: I'm not interested in Big Gov listening in.

Bond out.

Link: Beware of Skype | Free Software Magazine.

On Sunday, August 5, 2007 Bush signed the revised Foreign Intelligence Surveillance Act (FISA) into law, in which the U.S. Congress spinelessly caved in and gave legal authority to the Bush administration to continue to intercept and spy on electronic communications. Then, on Thursday, August 16, 2007 the whole worldwide Skype network goes down. Coincidence?  [click link above for full article]