Posts Tagged: ‘keystroke logging malware’

Scam of the day – December 20, 2014 – Latest phishing emails

December 20, 2014 Posted by Steven Weisman, Esq.

Phishing emails by which an identity thief sends you an email that purports to be from a trusted source, such as your email provider or bank in which you are instructed to click on a link in order to resolve a major problem is a common and effective way for identity thieves to get you to unwittingly install keystroke logging malware on to your computer that will steal your personal information from your computer and use it to make you a victim of identity theft.  In a more advanced form of phishing called “spear phishing” the email may be directed to you by name and have other information that can fool you into believing that the email is legitimate.  Spear phishing has resulted in many of the major data breaches in the past year including Target and possibly Sony.

Here are some examples of some phishing email commonly circulating.  DO NOT CLICK ON THE LINKS.

“Your mailbox has exceeded the storage limit of 1 GB. You can not receive new messages until you update your mailbox. CLICK HERE to update.
Thank you
Aol Team!”

“Dear Aol User,

Your Account needs to be updated to enable your account work properly, Aol is doing upgrades to all users to keep there account safe from viruses and hacking.

Please CLICK HERE to upgrade now and continue to enjoy the benefits and services of Aol Mail.

Privacy Policy | Terms of Use | Security Tip
Copyright © in 2014 All rights reserved.”

“The Mail Team

Dear Customer,
Your incoming messages were placed on pending due to our recent upgrade.
You have 1 new Security message From Wells Fargo Bank.Click the secure link below to confirm your account.

https://www.wellsfargo.com/confirmation

Security Adviser, ATM/debit card number.
—————————————–
Copyright © 1999 – 2014 Wells Fargo. All rights reserved. NMLSR ID 399801.”

“We believe you have violated either the Terms of Service, product-specific Terms of Service (available on the product page),or product-specific policies.Please view all violated Terms below

Violated Terms Of Service”

TIPS

Trust me, you can’t trust anyone!  These particular phishing emails are pretty rudimentary.  Not only does your name not appear in the email, but the email addresses from where they were sent does not reflect that it was sent by AOL or Wells Fargo as represented in the email.  Rather, the email addresses from which these emails were sent are those of innocent people whose email accounts have been hijacked by the identity thieves and made a part of a botnet by which these phishing emails are sent.  Never click on a link or download an attachment from anyone unless your absolutely sure that it is legitimate. Even if the email appears to come from a legitimate company or someone you trust and even if the email addresses you by name, you should not click on the link until you have confirmed that the email and link are legitimate.  Identity thieves can hijack the email accounts of your friends or make the address of the sender appear to be legitimate.

 

Scam of the day – December 1, 2014 – How to protect yourself on CyberMonday

December 1, 2014 Posted by Steven Weisman, Esq.

Every year, the number of people shopping online and the money spent through online shopping grows significantly.  And why not?  The convenience alone of being able to shop from the comfort and privacy of your home is reason enough for many of us to shop online and when you couple that with often lower prices and, in many instances, the sales not being subject to sales taxes, online shopping is a winner.  But how safe is it?  We all know from last year’s data breach at Target, how risky shopping in brick and mortar stores is, but shopping online can also be risky.  However, if you follow a few simple rules, you can dramatically improve the safety and security of your online shopping.

TIPS
Here is a list of some online shopping tips:

1. Make sure that the computer, laptop, tablet or smartphone you use is equipped with the anti-virus and anti-malware software programs and that you have updated the programs with the latest security patches.

2.  As with shopping at brick and mortar stores, don’t use a debit card for online purchases, as well.  In the event of a data breach, the consumer protection laws in regard to fraudulent use of your debit card are not as protective as those that apply when your credit card is fraudulently used.

3.  Don’t supply your credit card number unless the address of the website is preceded by the letters “https.”  That additional letter “s” indicates that the transmission of your data is encrypted and secure.

4.  Don’t leave your credit card number on record with the online retailers you use for the sake of convenience.  Doing so only makes you more likely to become a victim of identity theft if the company suffers a data breach (and many of them will).

5.  Don’t click on coupons or ads that you may receive by way of an email or text message regardless of how good they appear.  They may be loaded with malware that will be downloaded on to your computer, tablet or smartphone if you click on the link.  That malware can steal all of your personal information and lead to your becoming a victim of identity theft.  Any legitimate coupon you might receive through an email or a text message will also be available on the website of the company where you want to shop.

6.  Limit your online shopping to companies that you know and trust.  Merely because a company comes up high on a Google search does not mean that the company is legitimate.  Any company offering a price that appears too good to be true, should be particularly suspect.

7.  Use distinct and complex passwords for each online company with which you shop and use dual factor authentication whenever possible.

Scam of the day – October 4, 2014 – J.P. Morgan update and credit freeze information

October 4, 2014 Posted by Steven Weisman, Esq.

Last Thursday, in a required SEC filing,  J.P. Morgan Chase & Co. reported that the data breach, which we reported to you about when it was first discovered during the summer, was much larger than initially thought.  At the time, J.P. Morgan believed that only a million accounts were compromised, but now, J.P. Morgan is indicated that information on 76 million households and 7 million small businesses was stolen by hackers thought to be from Russia or another Eastern European country.  According to the SEC filing, J.P. Morgan says that the information stolen included names, addresses, phone numbers and email addresses.  At this time J.P. Morgan is saying that they are not aware of fraudulent activities tied to the data breach and that no account numbers, passwords, user IDs or Social Security numbers were stolen.  The data breach apparently began in June and went on until discovered in mid August, which is especially troubling because it provided time for the hackers to cover their tracks for what may have been their true goal.  The hackers did manage to gain access to the entire list of applications and programs used by J.P. Morgan Chase on its computers which could then be evaluated by the hackers for inevitable vulnerabilities that could be exploited at a later time.  Obviously J.P. Morgan is busy trying to protect against this threat.

TIPS

For customers of J.P. Morgan Chase, now is not the time to run and hide nor take your money out of the bank.  In fact, at the time that the FBI began its initial investigation of this data breach during the summer, it indicated that it was looking into possible data breaches of as many as four other banks as well.  It may well be that we are not yet aware of the breaches that occurred and may still be going on in other banks.  You can expect either the hackers, people who the hackers sell the information they gathered and even totally independent identity thieves to start contacting people through emails, text messages and phone calls purporting to be from J.P. Morgan Chase.  In these contacts, they will attempt to lure unsuspecting victims into providing personal information under various guises or clicking on links to obtain what may appear to be important information.  However, if you provide that personal information all you will do is end up a victim of identity thief.  If you click on the links in emails or text messages appearing to be from J.P. Morgan you may well end up downloading keystroke logging malware that will steal all of the information from your computer that will be used to make you a victim of identity theft.  Trust me, you can’t trust anyone.  Even if your Caller ID appears to show that the call you receive is form J. P. Morgan Chase, scammers are able to make their calls appear to be from J.P. Morgan Chase through a tactic called spoofing.  The best course of action if you receive any purported communication from the bank is to not respond directly, but instead contact the bank independently on your own to find out what the truth is.

This also may be a good time to consider putting a credit freeze on your credit report so that even if someone manages to obtain your Social Security number and other personal information, they will be unable to access your credit report and run up large debt in your name.  A separate credit freeze needs to be established at each of the three major credit reporting agencies to be effective.  Here are the links to the pages at Experian, TransUnion and Equifax where you can put a credit freeze on your report and get some peace of mind.

TransUnion http://www.transunion.com/personal-credit/credit-disputes/credit-freezes.page

Equifax https://www.freeze.equifax.com/Freeze/jsp/SFF_PersonalIDInfo.jsp

Experian https://www.experian.com/freeze/center.html

Scam of the day – September 22, 2014 – College students and identity theft

September 21, 2014 Posted by Steven Weisman, Esq.

Identity theft is a major problem for everyone, however college students are five times more likely to become a victim of identity theft than the general public.  There are two primary reasons for their vulnerability.  They live in close quarters with lax security and they do not take sufficient precautions to protect themselves in their dorm rooms or online.  Identity theft can be high tech, low tech or no tech and college students are victimized in all three ways.  They become victims of identity theft because, too often, they fail to protect their smartphones with security software or even a proper password.  They click on links in emails, text messages and social media that promise to provide free music, video games, alluring photos or gossip without realizing that a large number of these communications are sent by identity thieves and that the links only download keystroke logging malware that steals their personal information from their computers, smartphones and other electronic devices and use this information to make them victims of identity theft.  They download free apps from questionable sites and again end up downloading malware.  They use free wifi in public locations without proper encryption and security software on their electronic devices not knowing that the free wifi they are using may be set up by an identity thief eavesdropping on their communications and stealing their information.  They leave the computers in their dorm rooms unprotected by a good password and they leave important documents with personal information unprotected in their room.

TIPS

On the low tech and no tech side of things, they should lock up all their important papers that contain personal information.  They should also shred papers with personal information that they do not need to keep.  They should install security software and encryption software on all of their electronic devices including their smartphones, computers and tablets.  They should use strong passwords and different passwords for all of their accounts and devices.  They should never click on links in emails, text messages or social media postings unless they have confirmed that the links are legitimate.  Be wary of wifi and don’t use it for financial transactions.

Scam of the day – September 20, 2014 – New nude photo scam

September 21, 2014 Posted by Steven Weisman, Esq.

On September 2nd I told you about stolen nude photos and videos of more than a hundred celebrities including Jennifer Lawrence, Kate Upton, Jenny McCarthy, Cat Deeley, Kayley Cuoco, Scarlet Johansson and others being posted on the Internet on websites such as 4Chan.  Now nude photos of Kim Kardashian, Vanessa Hudgens and Hope Solo were again put up on 4Chan and Reddit and becoming a prominent topic on Twitter.  In response to the tremendous amount of criticism that 4Chan received over the Labor Day posting of the celebrity nude photos, 4Chan changed its policy on copyright infringement and consistent with its new policy promptly had the new nude photos removed from the website.   Reddit has also removed the photos.  These new photos were probably obtained in the same manner and even, perhaps by the same hacker involved in the massive Labor Day release of celebrity nude photos.  Although the exact manner by which these photographs and videos were hacked and stolen has still not been definitively determined, Apple has strongly indicated that the problem was not a flaw in iCloud security and that is probably accurate.   Anyone who is able to get someone’s email address and password would find it easy to gain access to that person’s iCloud account and download the photographs and videos.  Obtaining an email address is a relatively easy task for any hacker and passwords can be obtained either from other hacked devices or by, as often is the case, by using the “forgot password” link on Apple’s iCloud, as with other accounts.  The answers to the security questions used to obtain the password through the “forgot password” function are generally easy to find for celebrities whose personal information, such as where they went to high school or other information used in security questions is easily found online.

So, I will again ask the question that I asked first on September 2nd, what does all of this mean to you?

This hacking presents two separate problems.  The first is that identity thieves will be taking advantage of the public’s interest in these photos and videos.  You will be receiving emails, text messages or social media postings with links that promise to bring you to these stolen photographs that will download keystroke logging malware when you click on the links.  Once this malware is installed on your computer, smartphone or other portable device, your personal information will be stolen and the information will be used to make you a victim of identity theft.

The second problem is the same problem faced by the celebrities whose accounts were hacked.  How do you keep your accounts secure?

TIPS

Don’t give in to the temptation to view these photos and videos online.  Ethically, it is the wrong thing to do.  However, it also is too risky an activity.  You cannot trust any email, text message or social media posting that promises access to these photos and videos.  Many of these will be laced with malware and you cannot know which one’s to trust.  Trust me, you can’t trust anyone.  In addition, identity thieves will be setting up phony websites that promise to provide these photos and videos, but again will only end up installing malware on your computer when you click on links in these websites.  Identity thieves are often adept at search engine optimizing so a phony website might appear high in a search from your web browser.  As for Kim Kardashian, if you believe you need to see nude photos of her, you can easily find photos she took for a Playboy Magazine spread a few years ago on the official Playboy website.

As for securing your own account, you should use a unique password for all of your accounts so if any of your accounts are hacked, all of your other accounts are not in jeopardy.  Make sure the password is a complex password that is not able to be guessed through a brute force attack.  Check out my book “Identity Theft Alert” for advice as to how to pick a secure and easy to remember password.    Also, even if you are not a celebrity, you would be surprised how much information is online about you that can be used to come up with the answer to your security questions.  It is for this reason that I advise you to use a nonsensical answer to your security question, such as the answer “Grapefruit” for the question of  what is your mother’s maiden name.  Also, take advantage of the two-factor identification protocols offered by Apple and many others.  With two-factor identification, your password is only the starting point for accessing your account.  After you have inputted your password, the site you are attempting to access will send a special one-time code to your smartphone for you to use to be able to access your account.  It is also important to note that merely because you think you have deleted a photograph or video from your smartphone, that may not be the truth.  Smartphones save deleted photographs and videos on their cloud servers such as the Google+service for Android phones and the iCloud for iPhones.  However, you can change the settings on your smartphone to prevent your photos from automatically being preserved in the cloud.

Scam of the day – September 13, 2014 – Iggy Azalea sex tape

September 13, 2014 Posted by Steven Weisman, Esq.

Iggy Azalea, the popular, young Australian rapper is at the center of a controversy regarding the existence or non-existence of a sex tape.  Steven Hirsch of the adult film company Vivid Entertainment which has released numerous other celebrity sex tapes says that he has obtained such a video, while Azalea now admits that the video may indeed be legitimate after initially denying that it was genuine.  Meanwhile, to no one’s surprise supposed leaks of the tape are purportedly turning up on the Internet where the curious can put themselves in serious risk of identity theft by clicking on links in emails, text messages or social media postings promising to take you to the purported tape.  Other times, you may find yourself being prompted online to update your video capabilities on your computer or other electronic in order to view the video.  Again, this is just a ruse to lure you into downloading dangerous keystroke logging malware that will steal information from your computer and use it to turn you into a victim of identity theft.

TIPS

Without even getting into the question of the morality and ethics of looking for material such as this or the stolen videos of Jennifer Lawrence, Kate Upton and other celebrities, the truth is that you cannot trust any text message, email, social media posting that promises you such tantalizing material.  The chances are just too great that by clicking on any of these links or downloading attachments you will be downloading malware that will be used to steal your identity.  As for websites that turn up on Google and other search engines promising to provide you with these videos, scammers are adept at manipulating the algorithms used by search engines to rank websites so that although you may think you are looking at a legitimate website, you are not.  It is also important to remember that even if you have kept your anti-malware and anti-virus software up to date, that is of little consolation since these security software programs are always at least a month behind the latest malware and viruses.  If you need to satisfy your curiosity for gossipy material, stick to legitimate websites such as www.tmz.com.

Scam of the day – August 30, 2014 – New scam threats springing from J.P. Morgan data breach

August 30, 2014 Posted by Steven Weisman, Esq.

As I have told you so many times, whenever something catches the attention of the public, it catches the attention of scammers and identity thieves who use it as a hook to turn that public’s interest in something into making the public victims of scams.  The recent death of Robin Williams and the Ice Bucket Challenge are two examples of things that have fascinated the public that were used to turn people into scam victims.  You can find the details about both of these scams in previous Scams of the day.  Now, the J.P. Morgan bank hacking is a big news story and it should be.  The data breach at J.P. Morgan and a number of other banks poses a serious threat to the financial well being of many people.  Scammers and identity thieves are now capitalizing on this concern and fear in the public to send emails and text messages to people in which the identity thieves pose as J.P. Morgan or other banks.  In the emails and text messages, you are told about problems with your account that require your immediate attention and you are directed to click on a link for further information.  If you click on this link, however, you will end up downloading keystroke logging malware that will steal the personal information from your computer and use it to make you a victim of identity theft.  In another variation of this scam, you are directed to provide your personal banking account information in response to the email for verification purposes.  Of course, if you do this, all you will succeed in doing is providing an identity thief with the information he or she needs to steal money from your accounts.

TIPS

Whenever you receive an email or a text message you cannot be sure of who sent it to you.  Even if the address of the sender appears to be legitimate, it is easy for a scam artist (remember, they are called artists) to “spoof” or counterfeit a legitimate address to make the message appear to be legitimate.  Never provide personal information in response to an email or text message.  Never click on links in emails or text messages unless you are absolutely sure that the message is legitimate.  If you have think that the email or text message may be legitimate, you should call the bank or other purported sender at a phone number that you independently have confirmed is legitimate to inquire.  Don’t call the number provided to you by the scammer.

Scam of the day – August 24, 2014 – Ice Bucket Challenge scams

August 24, 2014 Posted by Steven Weisman, Esq.

According to the old saying, “no good deed goes unpunished” and this phrase could apply to the ALS Bucket Challenge, which has been taking the country by storm.  As everyone knows by now, people are dousing themselves with buckets of icy water as part of a national fund raising effort to support the fight against amyotrophic lateral sclerosis or ALS, which is also commonly known as Lou Gehrig’s disease.  We have all seen videos online and on television showing various people doing the challenge in entertaining and unusual ways.  Many celebrities and politicians have also been caught up in this viral campaign.  Unfortunately, as with anything that captures the public’s imagination, the Ice Bucket Challenge has also captured the imagination of scam artists, the only criminals we refer to as artists who are sending emails and text messages that purport to provide links to videos of particularly enticing and entertaining examples of the Ice Bucket Challenge, such as purported videos of popular celebrities, politicians, or athletes being dowsed, but, in fact are links that when clicked upon will download keystroke logging malware that will steal all of the personal information from your computer and use it to make you a victim of identity theft.

Another Ice Bucket Challenge related scam relates to websites or links for you to click on in order to make a charitable contribution.  Scammers have been busy setting up phony ALS charities and soliciting online and through telemarketing for phony ALS charities where your contribution will not go to ALS research and prevention, but rather to line the pockets of a scammer.

TIPS

In regard to avoiding the Ice Bucket Challenge video scams, my advice is the same as always, which is to never click on links in emails or in text messages unless you are absolutely sure that they are legitimate.  Even if they appear to come from a real friend of yours, you cannot be sure that your friend’s email account had not been hacked by a scammer sending you a tainted text or email.

As for avoiding the ALS charitable contribution scams, my advice is the same in regard to all charitable solicitations which is that whenever you are contacted by phone, mail, email, text message or any other form of communication, you can never be sure that the sender is actually from a legitimate charity.  In addition, many phony charities have names that are quite similar to legitimate charities and you can be fooled into giving a contribution to a scammer.  The first thing you should do before making any charitable contribution is to first check out the charity at www.charitynavigator.org where you first can find out whether or not the charity is actually legitimate.  Charitynavigator.org also provides information as to how much of the particular charities contributions go toward its charitable purposes and how much goes toward its salaries and administrative costs.  Once you have ascertained that a charity is legitimate, you should go online to the charity’s website to make your contribution directly.  In the case of the ALS Association, its website is http://www.alsa.org/

Scam of the day – August 13, 2014 – Robin Williams death scams

August 13, 2014 Posted by Steven Weisman, Esq.

You can always count on scammers and identity thieves to capitalize on every tragic event that captures the public’s imagination.  Celebrity deaths seem to be of particular interest to many people.  Following the deaths of celebrities in recent years such as Whitney Houston, Amy Winehouse and Paul Walker, scammers and identity thieves set up scams and identity theft schemes to take advantage of the curiosity of the public about the deaths of these celebrities.  The sad passing of Robin Williams by suicide is bringing new scams and identity theft schemes.   Some of these scams  start with a post on your Facebook page, which often can appear to come from someone you know, when in fact, it is really from an identity thief who hacked into the Facebook account of a friend of yours.  The post provides a link to be able to view photographs of Robin Williams purported to be police photographs that have not appeared in the news.  Unfortunately, if you fall for this bait by clicking on the link, one of two things can happen, both of which are bad.  In one scam, you are led to a survey that you need to complete before you can view the video. In fact, there is no such video and by providing the survey information, you have enabled the scammer to get paid by advertisers for collecting completed surveys.  However, the problem is worse because by completing the survey, you have turned over valuable information to a scammer who can use that information to target you for phishing and identity theft threats.  Even worse though in another variation of this scam is when click on the link and unwittingly download a keystroke logging malware program that will steal all of the information from your computer including credit card numbers, passwords and bank account information and use that information to make you a victim of identity theft.

TIPS

Remember my mantra, “trust me, you can’t trust anyone.”  Merely because a post on your Facebook page appears to come from someone you trust is no reason to consider it reliable.    The posting could be merely from someone who has hacked your friend’s Facebook account.  Other times, the posting may indeed be from your real friend, however, that real friend may unwittingly be passing on tainted links that they have received.    For news matters, you should only rely on legitimate news sources, such as the websites of the major network news stations such as CNN.  In matters such as rare celebrity footage, you should limit your sources to only those that you know are legitimate and can trust such as www.tmz.com.  If it isn’t on TMZ, then it doesn’t really exist.  It is a scam.  Also, make sure that you keep your anti-malware software up to date with the latest security patches.