security posts

Evildoing Spammers Discover TinyURL and Other URL-Shorteners

by Lee Bains — Jul 9th 2009 at 6:24AM

Twitter is no stranger to spam, so it shouldn't be of any great surprise that spammers are hitting one of tweeters' favorite utilities. According to the New York Times' Bits blog, URL-shortening services like TinyURL and Bit.ly have unintentionally provided spammers with a veil to cover the ugly face of their shady activities.

By copy-and-pasting a Web address (a.k.a. URL) into one of these services, a user is presented with another, much shorter alias URL. These content-rich, character-light URLs have gained in popularity as more and more people join Twitter, which only allows 140 characters per tweet.

Tags: bitly, e-mail, email, security, spam, tinyurl, top, twitter, url shortening, UrlShortening

Computers, MySpace, Web, Social Networking

Researchers Guess Social Security Numbers With Help of Social Networks

by Terrence O'Brien — Jul 8th 2009 at 3:12PM

Here is some terrifying news for those of you who are paranoid about identity theft: Criminals may be able to guess your Social Security Number (SSN) with little more than your birth date and home town.

Researchers at Carnegie-Mellon have found that using only publicly available data, such as that posted to a Facebook profile, they were able to guess the first five digits of a person's SSN on the first try 44 -percent of the time, provided that person was born in 1988 or later. In 8.5 percent of the cases, they were able to successfully guess all nine digits within the first 1,000 attempts.

Tags: crime, facebook, identity theft, IdentityTheft, idtheft, security, social security, social security number, socialnetworking, SocialSecurity, SocialSecurityNumber, top

Computers, Web

Government Web Sites Suffer Independence Day Attack

by Warren Riddle — Jul 8th 2009 at 2:10PM

On July 4th, as U.S. citizens celebrated the War of Independence, unknown cybercriminals launched a concentrated attack on several Federal Web sites. According to Associated Press reports, the unusually sophisticated attack affected Treasury Department, Secret Service, Federal Trade Commission (FTC), and Transportation Department Web sites.

Sources familiar with the situation believe the elaborate assault to be an orchestrated denial-of-service attack, which typically involves flooding a particular Web site with traffic in order to force it offline. Ben Rushlo of Keynote Systems, a Web site monitoring firm that watches 40 government sites, said that the Transportation Department site was completely down for two days, while the FTC site was still being affected as late as Tuesday night. Other similar attacks also affected South Korean government sites over the weekend, but officials are uncertain whether or not the attacks were related.

Tags: cyber crime, cyber security, CyberCrime, CyberSecurity, defense, government, security, terrorism, top

Computers, Web

Serious Internet Explorer Flaw Leaves Windows Users Vulnerable

by Terrence O'Brien — Jul 7th 2009 at 12:54PM

You know things are bad when Microsoft is trying to draw attention to its latest security flaw. A new vulnerability is affecting Internet Explorer users who are running Windows XP or Windows Server 2003 (do the latter even exist anymore?), allowing hackers to take control of victims' PCs remotely.

The risk of infection and hijacking is very serious since a user simply has to visit a Web site to fall prey to it. Criminals have been exploiting the security hole for about a week, primarily through links included in spam. Microsoft is working on the problem, but since the flaw was just recently discovered it may be a little while before it figures out how to plug the hole without breaking other features. Of course, we know from experience that Microsoft likes to take its sweet time with these things.

The flaw lies in how Internet Explorer and its notorious ActiveX controls handle video playback. Microsoft is encouraging users to disable the vulnerable ActiveX controls -- even in versions of Windows not known to be affected by the security problem -- until it can release an emergency patch later this month.

Tags: active x, ActiveX, internet explorer, InternetExplorer, microsoft, security, top, vulnerability, windows

Computers, Web

U.S. and E.U. Join Forces to Fight Cybercrime

by Caleb Johnson — Jun 30th 2009 at 12:46PM

Cybercrime spans the entire globe, and, until now, there's been little collaboration between nations when it comes to combating international networks of hackers.

The Wall Street Journal reports on the newly formed European Electronic Crime Task Force -- a Rome-headquartered effort between the United States and the European Union. The group is backed by the muscle of the U.S. Secret Service, an Italian cybercrime police unit, and the Italian post office Poste Italiane SpA (PISA). What does a mail system have to do with fighting crime, you ask? Well, many people use PISA to deposit paychecks and pay bills, both online and in person. The Wall Street Journal reports that the post office does more business in its banking and insurance divisions than it does mailing letters and packages.

Tags: banks, crime, cyber crime, cyber warfare, CyberCrime, CyberWarfare, defense, europe, hack, security, terrorism

Social Networking

Hacked High-Profile Twitter Accounts Still Spreading Malicious Links

by Warren Riddle — Jun 25th 2009 at 8:59AM

Phishing scams involving hijacked accounts continue to sweep through the popular microblogging site Twitter. In January, hackers commandeered the accounts of several high-profile members, including Britney Spears and Barack Obama, and distributed malicious links and spam messages. On Tuesday, scammers used the profile of Guy Kawasaki, a former Apple Fellow with over 100,000 followers, to post a link to a site that claimed to offer a (non-existent) sex tape featuring 'Gossip Girl' star Leighton Meester.

According to PC World, University of Alabama at Birmingham computer forensic scientist Gary Warner believes that over 1,600 people have already followed the link to a fake porn site that links to a Trojan horse program. This software affect both Macs and PCs, and, if downloaded, essentially turns your computer into a zombie that can be controlled from afar, enabling perps to extract valuable personal information. The scheme also leeched off the compromised accounts of a political blogger, a rising musician, and a gay news site, some of which still have the malicious link available on their Twitter pages.

Tags: phishing, scam, security, social networking, SocialNetworking, Twitter

Computers, Web

New E-Mail Scheme Hijacks Your Webmail Account

by Warren Riddle — Jun 25th 2009 at 8:00AM

Phishing scams involving hijacked accounts and the dissemination of phony links have recently appeared on Facebook and Twitter, but now that strategy is returning -- albeit in a creepy new way -- to its old stomping grounds: e-mail. A group of Net grifters has been breaking into browser-based e-mail accounts (e.g. Gmail, Yahoo! Mail, or AOL Mail), and sending dubious messages to everyone in the account's contact list. According to The Washington Post, the messages typically include a link to an e-commerce site or a message asking that money be wired to a specific location.

The scheme can be particularly effective and dangerous because people typically don't hesitate to open a message from the recognized account of a known friend. The scam can be prevented, though, so it's important to protect your e-mail account information and to always be wary of opening links. If you're going to use a personal account for business or shopping, try to only use your own computer or gadget, as hackers can use keystroke loggers on public devices to steal logins and passwords. It's also important to fortify your e-mail passwords and to definitely change them up if you feel an account may have been compromised. For further in-depth tips on warding off scammers and protecting your personal information, check out our list of 15 Phishing Scams to Watch Out For. [From: The Washington Post]

Tags: hack, identity theft, IdentityTheft, keystroke logger, KeystrokeLogger, phishing, security, top

Web, Social Networking

Facebook Hole Reveals Private Info

by Terrence O'Brien — Jun 22nd 2009 at 6:00PM

Facebook has had its share of privacy and security issues, but a pair of professed Facebook fans at FBHive have recently found an easily exploitable hole that can reveal private information, even if the privacy settings are set to hide it.

Thankfully, the folks at FBHive have not made public the details of the hole, which can allegedly reveal your hometown, relationship status, political views, birthday, and relationships. They did, though, bring it to Facebook's attention on June 7th. Facebook took its time, but rectified the issue today.

Robin Wauters of TechCrunch got the FBHive duo to confirm the exploit by revealing to him personal information which he had elected to keep private on Facebook. FBHive also revealed personal information about tech big-wigs like Kevin Rose (founder of Digg), Mark Zuckerberg (Facebook CEO), and Cory Doctorow (editor at BoingBoing).

Tags: facebook, identity theft, IdentityTheft, privacy, security, top

Web, Social Networking

Scammers Inserting Malicious Links in Popular Twitter Topics

by Caleb Johnson — Jun 22nd 2009 at 2:25PM

What do Wimbledon, Iran, and Perez Hilton have in common? Not a whole lot other than the fact that all three are popular topics on Twitter right now. Mashable reports that Panda Security, an antivirus company, has found that scammers are posting fake tweets that include these popular topics and a link to a malware site.

Sean-Paul Correll, a researcher at Panda Labs, described the scam in a blog post, "Cyber criminals have been targeting Twitter users by creating thousands of messages (tweets) embedded with words involving trending topics and malicious URLs."

After clicking one of these links, you're taken to a page that tells you to upgrade your Flash player, or a similar application. If you download the 'player,' malware will be installed on your computer. Next, you receive a message that says your computer has a virus and tells you to download a fraudulent program called 'Fast Anti-Virus 2009,' which, of course, costs $89.

Tags: iran, malware, perez hilton, PerezHilton, scams, security, social networking, SocialNetworking, top, twitter, wimbledon

Computers, Web

Ads Used to Spread Malware on Reputable Sites

by Terrence O'Brien — Jun 22nd 2009 at 6:45AM

Advertisements Used to Spread Malware on Reputable Sites

Most Web sites don't sell ad space directly to marketers. Instead, major sites like FoxNews.com, IGN.com, and MLB.com sell their ad space to ad networks, which then independently sell to other companies. But if an ad network fails to find an advertiser, it will often resell the spot on the Web site to another ad network, which may then turn around and place the ad space for sale on an ad exchange site, where it will be auctioned off to the highest bidder.

With so many links in the chain, it has become harder and harder for Web sites to police the advertisements being hosted. As a result, vulnerabilities are more and more likely. All it takes for hell to break loose is one careless party to let through an ad that leads to an infected site.

Tags: ads, advertising, malware, security, virus

Web, Social Networking

Fake Twitter E-Mail Invite Carries Malicious Worm

by Caleb Johnson — Jun 19th 2009 at 4:10PM

Twitter keeps on getting hit by phishing traps, scams, and worms. Recently, these attacks have come via links to YouTube videos, fake accounts, and infected tweets. Now, spammers are sending out fake e-mail invitations to join Twitter, according to Symantec's blog.

The e-mail, which has been sent to a large number of accounts and can be seen above, looks fairly legit, except for one tell-tale sign -- the body of the message does not include a URL that would direct users to the site. Instead, a .zip file called 'Invitation Card.zip' is attached to the message. Regular readers know the rule of thumb when it comes to unknown attachments: never, ever download or open them.

Tags: phishing, scam, security, social networking, SocialNetworking, top, twitter, worms

Computers, Web

Here Comes Nine Ball, Another Major Web Threat

by Terrence O'Brien — Jun 18th 2009 at 5:15PM

Another day, another massive attack that compromises the security of thousands of users. Just as we were getting ready to declare victory over Conficker (and settling in for a long battle with Gumblar), along comes Nine Ball, another difficult-to-defeat offensive that hijacks Web sites and tries to load malware onto a user's PC. The worm has a trick up its sleeve; repeat visitors to infected sites are dumped to Ask.com, a sneaky move that prevents security experts and investigators from being able to discover too much about the host of the malware.

According to Internet security firm Websense, Nine Ball has already compromised over 40,000 Web sites. The attack redirects visitors to an infected site that attempts to install malware and keyloggers (applications that can track your keystrokes) onto a PC, all intended for stealing personal data and passwords. The infected site will search the user's browser, Quicktime, and Adobe Reader for vulnerabilities that it can then exploit to load the malicious software.

Tags: keylogger, malware, nine ball, NineBall, security, top, trojan

Computers

GPS Glitches Cause Concern Over Future of Satellites

by Caleb Johnson — Jun 18th 2009 at 3:30PM

At any given moment, there are dozens of advanced GPS satellites orbiting the Earth. These satellites help with everything from missile launches and aircraft flight paths to automated teller machines. In a way, it is frightening to think the world depends so much on these complicated devices and their functioning correctly. Now, it looks like paranoia may pay off.

According to a report from The Wall Street Journal, a GPS satellite launched by the Pentagon is producing less than accurate results and weakening the signals of other satellites in orbit. This satellite, developed by Lockheed Martin Corp., uses a new civilian frequency called L5 intended for use by air-traffic control systems. However, during tests, the Air Force discovered this signal is making others less accurate -- only to around 20 feet instead of the usual two feet. That difference may not sound like much, but it's critical when figuring the coordinates to deploy a smart bomb or tracking a 747's flight path.

Tags: government, gps, lockheed martin, LockheedMartin, military, pentagon, security, space, top

Computers

Study Suggests Your IT Staff May Be Snooping On You

by Caleb Johnson — Jun 10th 2009 at 4:10PM

Just when you thought records, passwords, and other personal information might be safe at the office, Reuters reports that a new study by Cyber-Ark, a data security company, found that 35-percent of Information Technology (IT) professionals use their digital know-how to access confidential information at work. This marks a 2-percent increase since a similar study was conducted last year.

The 400 senior IT professionals surveyed (in the United States and U.K.) admitted to sneaking a peek at everything from salary details to minutes from board meetings. However, the study found the most commonly snooped data were human resource records. Customer databases, merger and acquisition plans, layoff lists, and marketing information rounded out the list of most snooped information.

Tags: data security, DataSecurity, employment, information technology, InformationTechnology, it, security, top

Computers, Web

FTC Shuts Down Criminal Web Hosting Company

by Terrence O'Brien — Jun 8th 2009 at 3:19PM

The FTC and a California district court judge are doing their parts to make sure the Internet is a safer place by last week shutting down the ISP and Web-hosting company Pricewert LLC -- also known by the aliases 3FN, Triple Fiber Network, APS Telecom and APS Communications. Pricewert has made its mark in the Web site hosting world by allegedly soliciting business from and shielding criminals like spammers, and hosting malware and child pornography.

The complaint (warning: PDF) against the company charges that Pricewert ignored take-down requests, moved illegal sites to different IP addresses (Web addresses) to avoid detection, and even actively marketed their services "to domestic and overseas criminals by placing ads in the darkest corners of the Internet." According to the FTC, Pricewert servers are currently home to over 4,500 pieces of malicious software -- including spyware, viruses and worms (presumably sent out by the spammers who are hosted by Pricewert). Worse still, according to chat logs obtained by the FTC, Pricewert employees were directly involved in the configuration and design of botnets run by some of their criminal clientele.

Tags: 3fn, aps telecom, ApsTelecom, child pornography, ChildPornography, crime, ftc, government, isp, malware, pricewert, security, spam, top, web hosting, WebHosting

Most Emailed Stories

Editors' Picks

Weirdest Techie Heists and Scams

Elderly Amish Man Caught on Film With Prostitute, Blackmailed
When a 75-year-old Amish widower slept with a prostitute, he -- we feel certain -- felt pretty bad about it the next morning. As if that guilt weren't enough for the old man, the prostitute and her boyfriend demanded $67,000 from him, claiming that they had filmed the scene with wall-mounted cameras and would upload the recording to the Internet. The pair was later arrested and, we can only imagine, the Amish man abhorred technology more than ever.

Bank Robber Gets Away With the Help of Craiglist
In October, a bank robber -- wearing a safety vest, blue shirt, face mask and goggles -- eluded police with the help of Craiglist. Just outside the bank, while the robbery was in progress, stood a group of men who were responding to a Craiglist day labor opportunity. As the advertisement required, they were all wearing safety vests, blue shirts, face masks and goggles.

Nude New Zealander Arrested After Responding to Fake Sexy Text Message
Late in 2007, a Wellington, New Zealand man received a racy text message from two anonymous "ladies," giving him only an address and a request that he show up naked. Well, he indeed showed up naked... at the home of one appalled, unsuspecting New Zealander. Both the nude Romeo and the sadistic texter were arrested, though neither were prosecuted.

Fake Craiglist Ad Costs Man Most of What He Owns
Last Spring, a post appeared on an Oregon Craigslist board stating that the owner of a specific house was leaving all of his worldly possessions (still in said house) to whoever wanted them. When homeowner Robert Salisbury rushed home -- on a tip from a woman suspicious about the offer of a free horse -- he found his house being ransacked by 30 strangers. We suggest he take that horse and collect some vengeance Clint Eastwood-style.

17-Year-Old Jailed for Stealing Virtual 'Furniture'
When a 17-year-old Dutch boy hacked into several accounts on the Second Life-style site 'Habbo' in 2007, the the law got involved. The boy was discovered to have stolen $5,800 worth of virtual furniture and knick-knacks. Apparently, crime -- whether actual or virtual -- does not pay.

Phishers Going After Your Phones in New 'Vishing' Trend
Over the past year, sneaky spammers have begun to forsake the worn-out territory of e-mail in favor of cell phones' fertile frontier. The result? "Vishing." Get it? Voice mail phishing. It might be more ominous if it didn't sound like a James Bond villain saying, "Wishing."

Burglars Break Into Restaurant, Steal HDTV, Leave Money / Food Behind
Around Halloween of last year, a truckload of thieves drove into -- that's right, into -- a Pennsylvania Mexican restaurant, where they -- apparently uninterested in the cash register -- stole a mid-grade 47-inch HDTV and fled the scene. We've all heard about how this generation is lacking in ambition, but this generation's thieves, too?

Latest Reviews from CNET.com

CNET provides the latest tech news, unbiased reviews, videos, podcasts, software, and downloads, making tech products easy to find, understand and use.

Top Product Reviews

Home Audio Reviews
9.0 out of 10
Denon AVR-4306 (black)
Incredibly well-featured 7.1-channel receiver; excellent sound quality; three HDMI inputs; converts analog video to HDMI output; upconverts analog video to 720p/1080i HD resolution; iPod and USB MP3 player connectivity; Internet radio and MP3/WMA streaming audio via built-in Ethernet port; XM Satellite Radio compatible; touch-screen remote; multizone, multisource operation; browser-based control via home network; accurate autocalibration routine. Full Review
8.8 out of 10
KEF KHT3005 (black)
The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review
8.8 out of 10
KEF KHT3005 (silver)
The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review
Cell Phone Reviews

8.6 out of 10
Wi-Ex zBoost YX510-PCS-CEL cell phone signal extender
The Wi-Ex zBoost YX510-PCS-CEL significantly boosts your cell phone reception and is easy to operate. Also, it uses a wireless connection to your phone. Full Review
8.6 out of 10
Turbo Charge Tc2 portable cell phone charger
The Turbo Charge Tc2 portable cell phone charger successfully delivers emergency power to your cell phone. It's easy to use and comes with a couple of surprising features. Full Review
8.3 out of 10
LG VX6000 (Verizon Wireless)
Compact and stylish; impressive battery life; solid audio quality; sharp color screen; built-in camera; USB ready; affordable. Full Review
Digital Camera Reviews

9.3 out of 10
Canon EOS 1D Mark III
Extremely fast, 10-megapixel continuous shooting; very low noise; highly customizable; well-designed body with weather sealing; 3-inch LCD; abundant optional accessories. Full Review
9.3 out of 10
Nikon D3 (body only)
Full-frame sensor; well designed, pro-level weather-sealed body; very low noise, even at extremely high ISOs; fast. Full Review
9.0 out of 10
Canon EOS-1Ds Mark III
Very low noise, high quality images; 21.1 megapixels; live view shooting; pro-level build-quality and performance. Full Review
Desktop Reviews

8.5 out of 10
Apple iMac (24-inch, 2.8GHz)
A minor specification update results in some significant performance gains; graphics upgrade an option on this 24-inch model; sleek, polished design didn't receive an update, but we won't start clamoring for a new design until the current one is at least 12 months old. Full Review
8.4 out of 10
Velocity Raptor Signature Edition Gaming PC
One of the fastest PCs we've tested; a PCI Express RAID card helps media encoding performance; typically immaculate Velocity Micro assembly; strong, three-year warranty. Full Review
8.3 out of 10
Dell Studio Desktop Computer (Intel Core 2 Quad Q8200, 750GB HDD, 6GB)
Best performance in its class; dedicated graphics card; large hard drive. Full Review