• Tag Archives computer security
  • Online Accounts: Just a Bit of Common Sense

    By Craig Szymanski

    Millions, possibly billions, of people are conducting transactions online. Whether this is online banking, shopping, social networking or group discussions there are a few important guidelines to follow in order to make sure that your information and accounts are only going to affect the scope of the site you use them on. In other words do NOT use the same username/password at multiple sites. In the last week alone there have been three larga data breaches that involved either employee or customer information. For an example just Google: texas OR barracuda OR epsilon data breach.

    Account Choices:

    For my very important accounts I never use anything remotely close to a real name when choosing my username. The same applies when I am choosing a password. I never will use the same password that I used on another site. Why? Because when something happens at the site with whom I am engaging services with is hacked or left wide-open I do not want my username password to be valid elsewhere. For instance, say I have an account with Citibank or some other online banking firm and somehow that site’s information is extracted by a group of online criminals. I want this breach to stop within the scope of that institution and not have those credentials move onto another popular website.

    Choosing an account name and password. Your usernames and passwords need to contain alpha, numeric, upper case, lowercase and special characters(These things:!@#$%^&*). When I am making a password I have a couple approaches. One approach is to choose a fairly long phrase or lyric that I like and use the first initial of each word to create my password. I’ll alternate upper and lower case and put in a few 1′s for I’s or zeros for O’s. Sometimes I’ll phonetically alter the spelling and combine acronyms. For example: RUr34llyPhour2dazeOld? (English Translation: Are you really four days old?) Another approach that I use I like to call is a Brain-Fart-on-my-Keyboard. Just start pressing random keys on the keyboard while thinking random things. I usually end up with something like this…

    User: Lhjglkj(*&y43tiy678e
    Pass: z7834hKJGjkG78efuhff%Y

    These are things I will never remember and if possible they will never be lifted from my mind. I save these passwords in an encrypted file that I do know the password to (that is another story) and then simply copy/paste them into the sites that I am logging into. An easy way to do this would be by using the highly rated free program LastPass: https://lastpass.com/

    The point to all this: Do not use a real word or name!

    Those Stupid Questions they ask:

    One thing that is really annoying are those security questions that they ask you to fill out. Such as what is your Mother’s maiden name, etc… If they ask you to create your own question I use the “Brain Fart” method above for the question and the answer. If it is one of those choose a drop-down question and then they make you type your answer it’s another brain fart for me…

    Filed under:

    Category: Computer Security, For-Facebook, For-My-Facebook, computer security, databreach, keyboardbrainfart, passwords, Security


  • Specialized Email Phishing Attacks Highly Likely

    By Craig Szymanski

    This week many of you have received emails from companies (Best Buy, Chase, Citi, Disney, Walgreens, TiVo, etc, etc..), whose website’s you’ve registered with with that mentions a data or security breach in which your Name and Email address was stolen from a company called Epsilon. Epsilon is a company that send out gazillions of emails for a lot of companies(About 2,500). Simply they are a very busy email marketing delivery service with a lot of personal information.

    The Problem: Since these criminals now have your name, email address and the actual company associated with that information, you can expect that they will be sending you email communications posing as a legitimate company. I’m not going to get in to the technical aspects of how they will do this, just know that they can and will.

    The Solution: In a previous blog post I mentioned phishing attacks that appear to come from a legitimate source yet do not. In that post I summarized at the end a few things that you should do to be cautious and protect your information/identity from being stolen. What I really should have said is simply: Do not click on links in an email*.

    If you get an email from your bank, read it, maybe it is real (Do you always believe everything you read?) and something you need to take care of. Instead of clicking on that convenient link in the message, manually open your web browser(hopefully you use Firefox or Chrome), go to the companies site that you should have bookmarked and take care of business.

    For a fairly complete list of companies that were exposed check this website: http://www.databreaches.net/?p=17374

    For more on Phishing attacks the FBI.gov site has a good example: http://www.fbi.gov/news/stories/2009/april/spearphishing_040109

    If you want learn more about computer security I recommend this weekly podcast: http://twit.tv/sn . They have hundreds of shows online with notes: http://wiki.twit.tv/wiki/Category:Security_Now_Show_Notes

    ——————————————————-

    * Unless of course you know what message headers or HTML source code are and how to decipher what they actually mean. I only look at them since it is part of my job and I am curious. In reality, it is easier and safer to just go to the companies website manually.

    Filed under:

    Category: Computer Security, For-Facebook, For-My-Facebook, Phishing, Email, Epsilon, phishing


  • Avoiding Phishing Scams That Look Like Facebook Notifications

    By Craig Szymanski

    Social network users need to pay close attention to links that come to you via a social network website. There are several Phishing scams circulating that will trick you into clicking on a misleading link in a message. Sometimes the link is just to show you something that they are trying to sell, or infect your machine with a malicious program such as a virus or trojan. By default facebook notifications come to the email account that you signed up with. For me this is not a big deal. I just used an inbox that I use for nothing but junk and rarely do I visit it, but there are several that will check an email account daily if not more and have “notifications” in the inbox that will be clicked on regularly. Below is an example email fake facebook notice. It looks genuine. I should know. My wife clicked on it before I could tell her that it wasn’t real 🙂

    This email looks like it is from facebook. The return address has facebookmail.com in it just like all the other messages you receive from this website. So what do you do? The first thing you need to do is just hover your mouse over a few of the links (do NOT click on them) and see if they actually read the same in the hover as they read…

    You can see from these examples that if you click on these links it will send you to a site that is anything but facebook. The domain: campus.2kool4u.net is where this goes. If you click on it the site will redirect to a site selling viagra. If you look at https://whois.domaintools.com/2kool4u.net you see that the 2kool4u.net domain hosts quite a few different sites. This looks a tad “phishy”. Try googling these keywords: 2kool4u.net scam and all you seem to find is junk and more junk.

    Summary/Options:

    1. Do not click on links in an email unless you are sure that it is a good link.
    2. Turn off your notifications or just trash them and manually go to the social networking site and look at your updates.
    3. Turn off HTML email in your mail program if you can. There should be an option to view mail as “plain text”. This is inconvenient, but it removes the fake links from the message.

    Note: Edited on 4/9/11 to change #1 and #2 in the summary. Simply do not click on links in an email. Explanation on this newer blog post.

    Filed under: Computer Security, For-Facebook, Internet, Phishing, Social Networking

    Category: Computer Security, For-Facebook, Internet, Phishing, Social Networking, computer security, Email, facebook, phishing