Credit card fraud is Americans number one concern

/in , , , , , , , , , , , /by

Identity theft Expert Robert Siciliano

A recent study conducted by the Unisys Corporation shows that identity theft as it pertains to credit card fraud is Americans’ number one concern.

When people ask me, “How do I protect myself from credit card fraud?” I tell them, “Cancel the card, or never use it.” Because that’s the only way.

Personal security (as it pertains to violence) and national security have always been a concern. However, this new study shows that people are more concerned with fraud, and the risk of having their savings depleted by scammers. Not so hard to believe, what with the number of data breaches, and the Madoffs of the world fleecing their unsuspecting investors.

75% of Americans feel that the recession has increased their chances of being victimized by criminal hackers and thieves. Most are also concerned their “private” information on a corporate or bank network may be compromised.

FBI’s Internet Crime Complaint Center’s 2008 Annual Report determined that online fraud increased by 33.1% last year. Dollar losses resulting from online fraud increased to $265 million.

Overall, these concerns are valid, due to flaws in the system of issuing credit that facilitate new account fraud. Furthermore, account takeover requires nothing more than access to credit card numbers, which are available in hacked databases or susceptible every time you hand your card over to a gas station attendant.

Viruses in spam or phishing emails continue to plague consumers and as scammers get more sophisticated, the chances of getting hooked increase.

Banks and business will continue to feel the pressure as criminals target their clients’ data.

Credit card skimming at ATMs and gas pumps makes it impossible to protect yourself when you could essentially be handing your digits over to a criminal.

Skimming is one of the financial industry’s fastest-growing crimes, according to the U.S. Secret Service. The worldwide ATM Industry Association reports over $1 billion in annual global losses from credit card fraud and electronic crime associated with ATMs.

Marite Ferrero, a blogger with Finextra, adds, “In Europe, the points of compromise are everywhere: ATM, gas pumps, parking, DVD rentals, movie tickets, food kiosks, tolls, buying metro tickets, and the list goes on… Because of chip and pin implementation, the proliferation of stand-alone terminals that accept chip and pin has provided a profitable playground for fraudsters.”

While the card holder is generally only responsible for the first $50.00 in losses, which is often waived by a “zero liability policy,” card holders who don’t pay attention to their statements often let these charges pass and eat them.

There are many technologies available to secure credit cards, such as “smart cards” and “chip and pin.” However, due to the nature of a credit card transaction, once the data leaves the card, it’s up for grabs. Whatever card security their may have been is now gone.

Check your credit and banking statements carefully. Scrutinize every charge and refute any unauthorized charges within 30-60 days. Call your bank or credit card company immediately if you see any fraudulent activity.

Invest in identity theft protection. Credit freezes or fraud alerts help prevent new account fraud. Protect your PC with McAfee, or other Internet security software.

Robert Siciliano, identity theft speaker, discusses credit card fraud.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Is the security community selling fear?

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Cyber crime profits are running into the trillions.

Weekly, and often daily, I remind readers of how potentially screwed they are once they boot up their PCs and access the Internet. Identity theft is a real problem that messes up people’s lives. When someone’s PC is hacked and their passwords are compromised, account takeover can be financially devastating. Even though a financial institution may resolve the errors, victims still lose money.

Most are beginning to realize that the only secure PC is one that is powered off.

Many view these rants as selling “FUD”: fear, uncertainty and doubt. And selling fear is what gets people to buy your security product. Many have accused the Internet security companies of being fear mongers peddling their wares during the Conficker scare.

Fear-based selling has been going on since the beginning of time and will always be a part of the sales cycle. But am I really selling fear? Do those I work with sell fear? I don’t think so. But feel free to disagree with me.

The fact remains that there are scumbags out there, trying to figure out how to get you to part with your money in thousands of different ways, every day, all day. And if reminding readers of all these scams and then selling a solution to the problem is selling fear, then so be it. The question is, is the fear real or made up? Is there a legitimate scare that needs to be brought to light, and a solution that will fix it? Or is this just selling snake oil and false promises, and taking advantage of people?

Information Week states, “The computer security industry has failed computer users, and the Internet has become so unsafe that average users can’t protect themselves.” The Internet is not a safe place for everyday folk. The online world is like Iraq and Afghanistan (dangerous), the Taliban (criminals) are everywhere. Most people do not have the capacity to secure their networks or the technical know-how to surf safely. Studies show that 40% of web surfers haven’t updated their browser’s security, or their Windows-based computers don’t have their critical security patches updated.

The threats are real. The Washington Post reports that Senate lawmakers are advancing legislation to create mandatory computer security standards for government and private sector operators of critical infrastructure. This is legislation that will force standards in security,  ensuring that we keep the lights on, the fields plowed, the water clean, and the engines running.

If there was ever a time to be “fearful” and to make an investment in identity theft protection, Internet security software such as McAfee, or any other protective hardware or software as a result, now is that time.

Robert Siciliano Identity Theft Speaker discussing online security here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Speaker; Confickers Threat Hasn’t Waned www.IDTheftSecurity.com

/in , , , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

We are not out of the woods with this one.

Conficker’s rise and fall and the passing activity of the worm on April 1st has allowed researchers and anti-virus companies to better understand the virus and its impact. While April Fools was supposed to be the day of reckoning for Conficker, it wasn’t and still isn’t a joke.

Viruses often come with a trigger date, as pointed out by CNET. And while many fail to meet the media hype, they still can and often do cause millions or billions in damage.

The media does what it does and reports on the news. While they or even I may not always get the facts straight, the impetus is still there.

In a “Conficker Postmortem,” CNET examines the media frenzy and points to a humorous spoof that Wired ran, a fake live blog from the “Conficker Worm War Room.” CNET also points out that, “The New York Times called it an ‘unthinkable disaster’ in the making. CBS’s 60Minutes said the worm could ‘disrupt the entire internet,’ and The Guardian warned that it might be a ‘deadly threat’.”

The positive result of this media hype is that it brings attention to an ongoing problem for an audience that never considered themselves vulnerable to these issues. In my world, even Facebook friends and Twitter followers who had never reacted to previous posts on a plethoraof IT and personal security issues are finally starting to ask the right questions.

“Your mom’s virus,” as we knew it, has become a part of popular culture. In a sense, this is a good thing, because it’s now water cooler talk with the same level of buzz as Britney Spears going nutty. We in the security community couldn’t ask for more and better attention, that may potentially enlist an army of security moms. Thank you, Conficker!

Still, Conficker is the most sophisticated virus to date and is still waiting to strike, which can very well lead to major data breaches and identity theft. As the virus continues to call home for the yet to be delivered update, researchers have determined an estimated 3.5 to 4 million PCs are infected on the Conficker botnet, which is the most powerful and dangerous aspect of Conficker.

Overall totals of infected computers may still be between 10 and 15 million. Many of those have a dormant virus that has the capability to wreak havoc, or that may have already been rendered impotent by anti-virus providers and IT administrators who have taken advantage of numerous solutions by McAfee and others.

What the public needs to understand is this infection is anything but over. The virus phones home every day looking for its next set of updates, which could still have catastrophic results if the virus ever reaches its full potential.

The risk here is that a virus of this kind has technology that can disable anti-virus software and that prevents access to numerous websites which provide automatic security updates, including Windows.

Today, Brian Krebs from the Washington Post points out the similarity’s to Y2K potential bug, just as I did last week. “In one sense, the response to Conficker could be compared to that of Y2K: A great deal of smart people threw a whole lot of resources and energy at a fairly complex problem and managed to turn a potentially very ugly situation into a relative non-event.”

The attention that Conficker brought upon itself has rallied security professionals to be on their highest guard, which is exactly where they should be.

See Robert Siciliano, identity theft speaker, discussing hacking for dollars.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out Uniball.com for more information.

Conficker virus has soft launch

/in , , , , , , /by

Robert Siciliano Identity Theft Expert

With the world watching Conficker has reached out but has not delivered any new malware.

Computer World reports “We have observed that Conficker is reaching out, but so far none of the servers they are trying to reach are serving any new malware or any new commands,” said Toralv Dirro, a security strategist at McAfee Avert Labs, in Germany.

The sense is its developers know IT security professionals are watching closely and are waiting for the noise to die down before making its next update.

A virus of this kind has enough juice to wait around for the white hats to drop their guard then strike.

However there are cures to Conficker and the longer they wait the more PCs will be cured.

For Windows learn more about Conficker and its symptoms here.

McAfee has detailed instructions on its removal here

You may need an IT administrator to do the dirty works as it’s a bit complicated for some.

Robert Siciliano Identity Theft Speaker discussing viruses here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

WWW. Weird Wild Web Goes Nutty

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Every day new reports of another flaw and another breach. Today we learn attacks rise 33 percent. I’m not surprised.

Credit card details of 19,000 Brits have been found on a cached Google page, where they had been accidentally published by fraudsters. Silly criminal hackers need to tighten up their data security controls and not publish sensitive data like that!

Reuters reports – Fraud on the Internet reported to U.S. authorities increased by 33 percent last year, rising for the first time in three years, and is surging this year as the recession deepens, federal authorities said.

Internet fraud losses reported in the United States reached a record high $264.6 million in 2008, according to a report released on Monday from the Internet Fraud Complaint Center, run by the FBI and the National White Collar Crime Center.

CNBC reports Online scams originating from across the globe—mostly from the United States, Canada, Britain, Nigeria and China—are gathering steam this year with a nearly 50 percent increase in complaints reported to U.S. authorities in March alone.

About 74 percent of the scams were through e-mail messages last year, especially spam, while about 29 percent used websites. But criminals were increasingly tapping new technologies such as social networking sites and instant messenger services.

The report highlights one new ‘significant’ identity-theft scam involving e-mail messages that give the appearance of originating from the FBI but seek bank account information to help in investigations of money being transferred to Nigeria.

Recipients of the e-mails are told they could be richly rewarded by cooperating. Duh.

Criminal hackers are going hog wild.

Invest in identity theft protection and secure your PC with anti-virus protection such as McAfee

Meanwhile two scumbag criminal hackers are arrested while spying on children between the ages of 14 and 17 using the child’s personal Web cam. The degenerates worked together to extort money from teenagers in exchange for stolen images.

They allegedly gained access to computers using a variety of e-mail addresses and screen names.

Conficker is spawning new hacks such as Scareware as Scammers are taking advantage of the huge interest in the impending “activation” of the Conficker superworm by poisoning search engine results.

Washington Post reports experts have discovered a security hole in the computer code that powers the Conficker worm, an aggressive contagion that has spread to more than 12 million Microsoft Windows systems worldwide.

Stay tuned…

Robert Siciliano Identity Theft Speaker discusses credit card scams here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Expert; Conficker Virus Countdown

/in , , , , , , , , , , /by

Robert Siciliano Identity Theft Speaker

News of Conficker out of control then under control is everywhere.

60 minutes reports on everything we have discussed in these posts. Main stream media has recognized the Internet has a cancerous virus and is infected. Criminal hackers are creating viruses infecting webpages in record numbers all in the name of money.

Security professionals are losing sleep as they race against the bad guys in anticipation of the next big breach.

Conficker is big news as its infecting mainly corporate networks at an astonishing estimated 10-12 million PCs and this sleeper cell is set to get its next set of updates April 1st.

Like Al Queda operatives living amongst us, cyber terrorists waiting for their next communiqué from a remote cave, Conficker waits to strike.

Nobody knows what’s going to happen April Fools, but security professional have a plan. Do you?

By all accounts Conficker has the potential capacity to steal data or launch a massive denial of service attack which encompasses massive amounts of data, flooding the Net, bogging down mainframe servers that distribute data to our inboxes.

60 Minutes used the example of what I did on CNN describing a Facebook hack and used a Morley Safer Facebook account that may be hacked with Conficker and begins to send messages to Morleys friends. Then Leslie Stahl who is a Morely “friend” receives an email looking like it’s from Morelys Facebook account to click a video. That video has a destructive payload that infects Leslies machine and the virus replicates itself to Leslies contacts.

Now Morelys PC has a virus that records all his keystrokes and Leslie is just as vulnerable. Bank accounts are cracked, credit card log-ins are stolen, the contents of their My Documents folders are copied and sent to Turkey and identities are stolen. People who don’t have any identity theft protection face years of dealing with creditors who accuse them of being bad debtors.

Malware is showing up on thousands of websites compromised in numerous ways and infecting computer users whose defenses are down.

Most attacks can be prevented with updated anti virus like McAfee or others. But with an estimated 15,000 new infections daily it’s difficult for the every day user to protect themselves unless they are automatically downloading virus definitions. And that may not be enough.

Criminal hackers come in all shapes and colors from every corner of the world. Russian hackers are often depicted as the best of the worst. These cyber criminals are often put on a pedestal in their communities as they brag about their accomplishments, hacking wealthy hacker Americans and stealing 10s of thousands of dollars monthly and spending that money in their remote villages.

Russian authorities generally don’t prosecute and may even employ criminals to steal from greedy Americans. As long as hate and money are motivators, foreign governments will groom and incite talented 14 year olds into a life of crime.

This story is far from over.

Robert Siciliano Identity Theft Speaker discusses online banking security here

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information

Identity Theft Expert; Anatomy of a Hack

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

There is a battle going on round the clock, between the bad hackers and the good hackers. Most of the time, the good guys lose. Here we have an example of the bad guy actually getting caught.

At age 19, an Israeli criminal hacker named Ehud Tenebaum made news as “The Analyzer,” (a great tag for a criminal hacker) after he cracked and penetrated the Pentagon, NASA and even Hamas computer networks.

He then went silent and is believed to have embarked on a 10 year long international conspiracy to hack networks of United States and Canadian banks and other financial institutions. Losses are estimated at $10-12 million.

The Analyzer’s hacking technique is believed to be “SQL injection,” a tactic that I’ve blogged about previously, which exploits vulnerabilities in software development.

A forensic analyst who investigated breaches in both countries found a common thread in each hack. Servers in Virginia owned by HopOne, an ISP, were used as a routing point, receiving their commands from another set of servers at a Dutch hosting company.

Here’s where Big Brother is watching, and in this case, for good reason.

Last spring, US investigators working with Dutch authorities requested that all data traffic from the Dutch servers on route to Virginia be intercepted through wiretapping and provided to authorities.

During this time, criminal hackers from all over the world used the stolen data to create ATM white cards and prepaid gift cards loaded with cash. They withdrew cash from ATMs on three continents to the tune of approximately $450,000.

According to Wired, the wiretapped traffic included email discussions between numerous criminal hackers, regarding their accomplishments. One email address, Analyzer22@hotmail.com, provided investigators with their smoking gun. The Hotmail address had Ehud Tenebaum’s name and age registered along with it. Not too smart, E.T.

Ehud Tenebaum owned and operated a Canadian computer security company called Internet Labs Secure. One of the IP addresses used to access the Hotmail account was registered to Tenebaum’s business. E.T. phoned home and got caught.

This is one example of high tech organized criminals taking advantage of numerous flaws in the technology we use every day.

Be warned, there are plenty more to take E.T.’s place. Chances are, someone moved right in where he left off.

Invest in identity theft protection. Install and update Internet security software such as McAfee. Check your bank and credit card statements online bi-weekly and make sure to refute unauthorized charges within a 30 to 60 day period.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Speaker Robert Siciliano discussing credit card hacks here

Identity Theft Speaker; April Fools Day is conficker worm day

/in , , , , , , , , /by

Robert Siciliano Identity Theft Expert

Criminal hackers have created a virus that has slipped into millions of PCs and is set to strike on April Fools day. This is no joke.

So far this year it is estimated that somewhere between 3 and 12 million computers have been compromised by the “Conficker” worm, also known as “Downup,” “Downadup” and “Kido,” possibly considered the largest known global botnet.

Microsoft and others are in a 24/7/365 battle with the makers of Conficker to see who ends up at the finish line first.

None of the PCs infected with Conficker are displaying any of the characteristics generally exhibited by the recent spate of viruses, offering a remote control component and often used to host spoofed websites and other malicious fraud related activities. At least not yet.

If Conficker reaches its full potential, it will result in data breaches, credit card fraud and numerous forms of identity theft.

It has been widely believed that Conficker is waiting for its next set of updates on April 1st, to unleash the endgame its writers had in mind.

The sense among security professionals is that Conficker will unleash an uncontrollable fury not yet seen or experienced by the security community.

Conficker duplicates like viruses of old and infects PCs that are unpatched and outdated. The virus scans the Internet, seeking and infecting unpatched computers. Conficker was built with encryption pirated from an MIT researcher and has the ability to circumvent anti-virus programs.

This level of technology has the ability to slip into external hard drives, thumb drives and any memory based peripheral. When that same peripheral is plugged into another PC, that PC is also infected.

Many PCs in Asia have rogue versions of Windows, and are largely unpatched due to Microsoft not allowing updates.

Update your Microsoft Windows ASAP. Make sure you have up to date Internet security software, such as McAfee. Stay away from rogue websites and be careful what you click.

As stated in a previous post, Microsoft offered a global bounty for the arrest and prosecution of whoever created and released the Conficker virus.

Even with the security community vigorously trying to defend PCs globally, in early March, millions of Conficker-infected PCs were upgraded into a peer to peer network, which makes the botnet even more dangerous by giving each infected PC commanding authority over others. This means that every PC has the capability of running every other PC on the botnet.

The anticipation among researchers leading up to April 1st is much like that which was felt prior to midnight on December 31st, 1999. The Y2K ”bug” was considered a ticking time bomb for all major computer applications.

Much has been done to avert a Conficker disaster, but nobody knows for sure what will happen. April 1st is a day of foolery, but this year it may also be a major breakthrough for hackers, good or bad, to see who is top dog.

See Robert Siciliano, identity theft speaker, discussing viruses in peripherals here.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Identity Theft Expert; Scareware Scares You Into Paying

/in , , , , , , /by

Robert Siciliano Identity Theft Expert

If one could have a favorite scam, for me it would be “scareware.” My reasoning for this is thats it’s one of the few scams that actually gets through to me. My defenses are pretty good, but I still see scareware. They’ve even taken my blog posts and used my name to launch scareware in Google News Alerts. I got some criminal hacker’s attention and he created scareware in honor of lil’ ole me!

Web pages may be infected or built to distribute scareware. The goal is to trick you into clicking on links. After landing on a page, pop-ups bombard you and warn that your PC is infected with an Ebola- like virus and your PC will die a horrible death with fluids running from all ports if you don’t fix it immediately for $49.95.

Shutting off this pop-up is often difficult and any buttons you press within this pop-up could mean downloading the exact virus they warned you of. BRILLIANT!

Criminals are even using Google Ads, and have posted ads on well known sites such as E-Harmony and Major League Baseball.

I’m online all day, every day and do a ton of research, which means I click lots of links, and see scareware often. If I wasn’t aware of IT security and what this ruse was about, I’d have been bilked of $49.95 long ago. Many people take the bait, more than you can imagine.

Studies show that organized criminals are earning $10,000.00 a day from scareware! That’s approximately 200 people a day getting nabbed. Some “distributors” have been estimated to make as much as $5 million a year.

What makes the scam so believable is there is actual follow through of the purchasing of software that is supposed to protect you. There is a shopping cart, an order form, credit card processing and a download, just like any online software purchase.

The software is sometimes known as “AntiVirus2009” “WinFixer,” “WinAntivirus,” “DriveCleaner,” “WinAntispyware,” “AntivirusXP” and “XP Antivirus 2008.” These are actually viruses or spyware that infect your PC, or just junk software that does nothing of value.

A report by the Anti-Phishing Working Group, released in March 2009, found 9,287 bogus anti-malware programs in circulation in December 2008 – a rise of 225% since January 2008. That’s simply because the scam works so well.

Teams of criminal hackers each have their own tasks and responsibilities. Team 1 creates pages loaded with scareware and works those pages into the search engines, while others infect legitimate websites. Team 2 creates the junky or spyware-ridden software you are scared into buying. Team 3 creates the infrastructure to process your credit card.

Protect yourself. Invest in anti-virus software, such asMcAfee. Make sure your browser has a pop-up blocker turned on, to avoid having to be “scared.” If you get a pop-up, you can close it by clicking the red X in the upper right corner, just don’t click on anything in the body of the pop-up. I suggest shutting down your entire browser, however, to be safe.

Make sure your PC is updated with critical security patches and most of all, be smart.

See Robert Siciliano, identity theft speaker, discuss Ransomeware, a form of scareware here.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.

Credit Card Hackers Target Small Business

/in , , , , , , , , , , , /by

Robert Siciliano Identity Theft Speaker

Up until now, identity thieves have been hunting elephants. But that may soon change.

According to this study, small to medium size businesses (SMB’s) are the criminal hackers next target. This should come as no surprise, as large enterprise networks have gradually become better at defending themselves.

Over the past few years, criminal hackers have acted like hornets, attacking and swarming unassuming enterprise networks. Big business has responded by allocated billions of dollars in funding for technology and talent to thwart their sting.

In 2009, enterprise defense is the best it has ever been. It’s still lax, but now the path of least resistance has become SMB’s. Your mom and pop shops simply don’t have the resources, including deep pockets, to keep up.

Studies by the International Council for Small Business show that one fifth of small businesses aren’t even equipped with basic defenses, such as McAfee security software. Furthermore, as many as 60% don’t even have wireless encryption activated. What is most disturbing, but not surprising to this security analyst, is two thirds don’t have any type of security plan in place.

According to poll responses, these same SMB’s overwhelmingly believe that they aren’t targets, that only big businesses need to worry. However, this same study shows that 85% of fraud related to criminal hacks occurs within this exact group.

The National Retail Federation stated that Level 3 businesses are only 60% compliant and Level 4’s are even less secure.

PCI Compliance, a Visa based organization that regulates merchants in order to prevent credit card fraud, recognizes retailers at different levels. Level 1 retailers process 6,000,000 Visa transactions per year, Level 2 retailers process 1,000,000 to 6,000,000, Level 3 retailers process 20,000 to 1,000,000, and Level 4 retailers process fewer than 20,000.

Many security issues stem from the SMB’s lack of resources, coupled with their shift to online transactions and the handling and storage of their own data.

Some say that the responsibility of handling these transactions should be shifted back to the banks.

One additional recommendation for these Level 3 and 4s is to adopt a strategy in which the merchant never handles the credit data at all. The merchant would have an online shopping cart, but the credit card transaction would be diverted to the bank server, without ever being touched by the merchant.

I’m one of those Level 4 merchants and this is the strategy that I use. All orders are taken online and nobody aside from the bank handles client credit card data. PCI compliance is a breeze – no hiccups.

While this is practical for some SMB’s, it doesn’t work for others, so those retailers need to get their act together immediately, because criminal hackers are watching.

See identity theft speaker Robert Siciliano discuss data breaches here.

I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.