I often consult with people who are running online marketing businesses and soliciting opt-in subscribers to their newsletters. They do this through special landing pages that have forms specific to the information product they are offering. The danger in having such a form live on the web is not unknown–it’s relatively easy to initiate an SQL injection attack.
Another issue is spammers using robots to sign up for newsletters and then using the address of the marketer to attempt to hack the mailing list management service he uses. Most of these services use the marketer’s email address as the account username, so if a hacker or spammer has that information, they can then attempt an attack on the password.
Finally, there is the issue of junk traffic and subscriptions. Naturally, a marketer wants prospects that are not only interested in the products offered, but capable of buying them. Depending on the marketing methods used, traffic can come from anywhere in the world, and often does. My own newsletter at Ask the Geek has a worldwide subscriber audience.
Let’s say we want to block all traffic from China. It’s mostly useless, is spammer/hacker central and they don’t buy anything. Start with http://www.blockacountry.com. When you arrive at the site, look to the sidebar on the right and select the country or countries you want to block. You’ll be asked for your email address. This is OK, it’s just for update purposes. Click the submit button.
You’ll get a pre-configured text that you add to your .htaccess file on your web server. Here’s a look at the concatenated version of what I got:
ErrorDocument 403 http://www.proxynetwork.ws/blocked.html <Limit GET HEAD POST> order allow,deny deny from 220.127.116.11/14 deny from 18.104.22.168/13 deny from 22.214.171.124/16 deny from 126.96.36.199/15 ...[[huge list of every IP address in the country]]... allow from all </LIMIT>
You can change the location of the 403 error document to one you have created on your server. Then, just copy and paste or upload the file to your www root folder and you’re good to go. Full instructions are on the referenced website.
People since time immemorial have fallen for scams of various kinds. Chalk it up to wishful thinking, dreaming, greed, what have you, but eventually, everyone finds themselves gullible. If that weren’t the case, life would lose some of its luster. We love to play act; we love to be fooled; and, we love to fool others as long as it’s all in good fun. Unfortunately, there are malicious people–cyber criminals and scam artists–who love to take advantage of those traits for their own gain and our (usually financial) loss.
Here are the top ten tips, courtesy of OnGuardOnline.gov for avoiding online scams:
- Don’t send money to someone you don’t know.
- Don’t respond to messages that ask for your personal or financial information.
- Don’t play a foreign lottery.
- Keep in mind that wiring money is like sending cash: once it’s gone, you can’t get it back.
- Don’t agree to deposit a check from someone you don’t know and then wire money back.
- Read your bills and monthly statements regularly—on paper and online.
- In the wake of a natural disaster or another crisis, give to established charities rather than one that seems to have sprung up overnight.
- Talk to your doctor before buying health products or signing up for medical treatments.
- When considering an investment, remember that there’s no such thing as a sure thing.
- Know where an offer comes from and who you’re dealing with.
I’ve been saying these same things all along, but I will continue to repeat them for as long as I need to.
Once again, the Security Now! podcast has given me cause to justify my relentless insistence that security begins with the person sitting at the keyboard. No amount of Geeky IT rules, security policies and other preventive measures will ever be effective if the end user doesn’t understand them. This is why we need good educational resources to teach with. Believe it or not, our own U.S. Government has produced one. I’ll let Steve Gibson give you the highlights:
…if any of our listeners have ever wished there was a friendly, easy-to-use, really well put together website that they could point their less savvy friends and relatives to, I’ve got to say now there is. The FTC site is called OnguardOnline.gov, just all run together, OnguardOnline.gov. And it’s very nicely designed. In fact, I was impressed by it.
Well, so was I. I have posted a notice in several chat rooms that I participate in to help spread the word. Here’s my most recent post:
Hi Everyone. You know I’m an online security professional and nowhere is security more important than in our own IM businesses. A hacker could ruin your entire business in a minute if he gained access to any of your critical account information.
[8:33:48 PM] + Ken Harthun (Asst. Host: TIIMG): But there’s an awful lot of “geek speak” that sometimes goes with security and people get confused. Good news, though: our own government, in cooperation with the technology industry, has come up with a great site to help you protect yourself.
[8:35:01 PM] + Ken Harthun (Asst. Host: TIIMG): Go check out http://www.OnGuardOnline.gov and you’ll see what I mean. And please heed the advice there.
Please tell everyone you know who may benefit from the information there. This is very solid and useful information written for regular people, not Geeks.
I hope you find my alerts about these webcasts valuable. In general, they have some sort of product pitch built in, but I always manage to glean some valuable information from them. Once again, I have one presented by Sophos, “Strategies for Protecting Virtual Environments: Balancing Security with Performance,” scheduled for February 24, 2011, 2 pm ET/11 am PT. It is a complimentary webcast. Here’s the abstract:
The move to virtual servers has allowed organizations to reduce TCO while increasing IT and business efficiency, flexibility and reliability. Many are looking to extend these benefits to their endpoints with virtual desktops. With the increased adoption of virtualization, organizations now face a new set of security challenges.
Join Jonathan Tait at Sophos, for a live Webcast to learn about the security challenges for both server and desktop virtualization and strategies for balancing protection with performance. Jonathan will discuss these key topics and more:
- How virtualization changes your security posture
- Virtualization security needs and issues
- Strategies for a secure virtual environment
You can register here if you wish to attend.
There seems to have been a rash of tech support scams lately, some with people actually to pretend to be from Microsoft. The scammers seem to target online forums and tech support sites, so be careful what you post if you really do have a technical problem. (You are always welcome to Ask the Geek and that’s my site, so you’re safe.) Let’s take a look at some of the warning signs that will clue you into the fact that you’re probably being scammed. This is taken from one particular incident reported by Woody Leonhard in Windows Secrets.
- First of all, the call will be unsolicited. Even if you asked on a forum, so not assume that the call is in relation to that. You didn’t ask for a phone call, so if you get one, be wary.
- They will ask you for personal contact information, or perhaps pretend they already know it.
- You are asked for your Windows activation code or CD key. There’s no reason why anyone would need this to fix your PC; it’s just a tactic to make you think they’re legitimate.
- They will ask you for some other sort of code or “warranty check” information which you won’t have, and which, of course, is completely bogus anyway.
- Something like this will happen next (as described by the almost-victim in the above article. The person was put on hold while the “technician” purportedly “checked” the warranty: “A few minutes later, he was back and gave me the unfortunate news that my free support period had ended. He told me I would have to pay $99 for extended support and directed me to a place on the website to enter my credit card information. I’m not sure why, but I smelled a rat, so I hung up on him.”
- The website you are referred to looks legitimate and may even say things like, “Microsoft Registered Partner” and have an official Microsoft logo, or it may say “This company is a Technical Support Provider.”
- The domain name is registered in a foreign country and/or does not have legitimate contact addresses or phone numbers associated with it.
- The website they refer you to may have numerous spelling and grammatical errors or just “doesn’t look right.”
- The “support engineer,” or whatever he calls himself wants you to review your event viewer logs and points out that there are numerous yellow and red flags. This, of course, is normal for most Windows machines, but they will try to convince you of the dire consequences of ignoring the warnings and errors.
Don’t fall for it. Most of this will be social engineering in one form or another. They will get your money, they will get your personal information, and they may steal your identity.
Haven’t posted any funny videos in a while, so here’s one that will lighten your mood a bit! There is actually a series of these videos if you search for them, but I found this one on a site that I’m happy to plug: VeryFunnyAds.com. I’m pretty sure that I won’t have to look far for my daily dose of humor now.
[kml_flashembed movie="http://www.youtube.com/v/UNanKfY5T9A" width="425" height="350" wmode="transparent" /]
Hi Ken, Please offer your opinion on this. I had a phone call today from a person representing
Secure All PC.com. He told me that they received information directly from World Web Renting?? and that my windows operating system was a genuine windows and that they received my address, phone number etc. He wanted me to check my computer and see if i had virus/bugs etc that they knew about and if I did they would fix. He wanted me to press the windows button and r at the same time and then type in eventvwr. I was not comfortable doing this.
Needless to say, I gave the advice I would give to anyone in this situation: Run fast and far in the opposite direction. I then did two things: 1. Checked the whois on SecureAllPC.com; and, 2. Checked out their website.
Strike one: Registrant Contact: PrivacyProtect PrivacyProtect () Fax: All Postal Mails Rejected Navi Mumbai, MAHARASTRA 400614 IN. That’s India, not Indiana, in case you’re wondering. No individual’s name in the registration and you can’t even contact them.
Strike two: Amateurish website layout and graphics with numerous spelling and grammar errors.
Strike three: Unsolicited call to potential customer.
Umpire says, “Scam! You’re out!”
I’m willing to bet that whatever they do is useless, possibly malicious as in installing keyloggers or other such things, and they probably specialize in selling your credit card and other personal information to other cyber-criminals.
In the light of the recent revelations about the targeted malware attack against Iran’s uranium enrichment facilities, I’m re-releasing my original prediction about governments turning us into unwitting weapons in global cyber-warfare.
It’s 2010, maybe sooner. A rogue nation has just declared war on your country. No one will be killed in this war, at least not directly. But people will die from starvation, disease, and in the general chaos caused by disruption in vital communications lines. The rogue nation’s primary weapon? Botnets capable of taking down huge segments of the Internet and telephone networks.
The ongoing cyber attacks against Estonian Web sites, covered in a recent NewsBites edition should serve as a sobering reminder that Cyber Warfare is not a theoretical threat but a very effective and real one…
Having made my own observation of the shifting threats to computer and network security, I have to agree with SANS editor Skoudis:
Before 2003, our dominant threats were hobbyists and insiders. In 2003 and 2004, the threat then changed to organized crime looking to make money. Depending on the geopolitical environment, the dominant threat may shift again, and very quickly, to state-sponsored cyber warfare.
What’s ironic is that the attacker will, to some degree, be using your own people — as well as your allies — against you. There’s certainly a good number of people in every country whose computers have become zombies in a botnet. The actual attackers are virtually untraceable, so unless the attacker makes himself known, you’ll not even know your enemy. Scary.
This is why every citizen, every government, must share responsibility in protecting the security of their country’s network infrastructure.
The more things change, the more they stay the same.
In the Official Google Blog today, developed an advanced opt-in security feature called 2-step verification . They announced this to their Google Apps customers a few months ago, but they’re now rolling it out to everyone.
“Most of us are used to entrusting our information to a password, but we know that some of you are looking for something stronger,” Shah blogged. “…2-step verification … makes your Google Account significantly more secure by helping to verify that you’re the real owner of your account.
“2-step verification requires two independent factors for authentication, much like you might see on your banking website: your password, plus a code obtained using your phone.”
As I write this, the feature is still not available on my accounts, but it should be there shortly.
I hope that Google’s lead will bring a sea change in how all SaaS providers view security.
For the full story, here is the blog post:Advanced sign-in security for your Google account.
An attack on PlentyOfFish.com, a free online dating site, has reportedly compromised the passwords of nearly 30 million accounts. According to the site’s founder, Markus Frind, an Argentine hacker was behind the attack. In a strange twist, Frind also suggested that cyber security journalist Brian Krebs was also involved in some way. According to Krebs in his recent post, “…I have notified dozens of companies about various breaches over the years, and I’ve learned to read between the lines in how victims respond. Usually, when the company in question replies by implicating you in an alleged extortion scheme, two things become clear:
“1) You’re probably not going to get any real answers to your direct questions about the incident, and;
“2) The company almost certainly did have a serious breach.”
Frind has since made clear in his blog that Krebs was not involved:
Update*** Just to be clear Krebs didn’t have anything to do with this. I was trying to convey how the hacker tried to create a mass sense of confusion at all times so you never know whats real and what is not..
Krebs notes that the PlentyOfFish database has serious security problems and that the company stores user passwords in plaintext.