|
|
 |
|
|
 |
|
| - More Security News & Alerts |
|
| (updated every hour, 6 am - 7 pm) |
|
| Computerworld Malware and Vulnerabilities News |
|
|
|
|
|
US-CERT Tips http://www.us-cert.gov/ncas/tips US-CERT Tips describe and offer advice about common security issues for non-technical computer users. Tips are restricted to a single topic, although complex issues may span multiple tips. Each tip builds upon the knowledge, both terminology and content, of those published prior to it. en ST04-015: Understanding Denial-of-Service Attacks http://www.us-cert.gov/ncas/tips/ST04-015 Original release date: November 04, 2009 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> </font> </td> </tr> </table> <h3>What is a denial-of-service (DoS) attack?</h3><p>In a denial-of-service (DoS) attack, an attacker attempts to prevent legitimate users from accessing information or services. By targeting your computer and its network connection, or the computers and network of the sites you are trying to use, an attacker may be able to prevent you from accessing email, websites, online accounts (banking, etc.), or other services that rely on the affected computer.</p><p>The most common and obvious type of DoS attack occurs when an attacker "floods" a network with information. When you type a URL for a particular website into your browser, you are sending a request to that site's computer server to view the page. The server can only process a certain number of requests at once, so if an attacker overloads the server with requests, it can't process your request. This is a "denial of service" because you can't access that site.</p><p>An attacker can use spam email messages to launch a similar attack on your email account. Whether you have an email account supplied by your employer or one available through a free service such as Yahoo or Hotmail, you are assigned a specific quota, which limits the amount of data you can have in your account at any given time. By sending many, or large, email messages to the account, an attacker can consume your quota, preventing you from receiving legitimate messages.</p><h3>What is a distributed denial-of-service (DDoS) attack?</h3><p>In a distributed denial-of-service (DDoS) attack, an attacker may use your computer to attack another computer. By taking advantage of security vulnerabilities or weaknesses, an attacker could take control of your computer. He or she could then force your computer to send huge amounts of data to a website or send spam to particular email addresses. The attack is "distributed" because the attacker is using multiple computers, including yours, to launch the denial-of-service attack.</p><h3>How do you avoid being part of the problem?</h3><p>Unfortunately, there are no effective ways to prevent being the victim of a DoS or DDoS attack, but there are steps you can take to reduce the likelihood that an attacker will use your computer to attack other computers:</p><ul class="bulleted"><li>Install and maintain anti-virus software (see <a href="/ncas/tips/st04-005">Understanding Anti-Virus Software</a> for more information).</li><li>Install a firewall, and configure it to restrict traffic coming into and leaving your computer (see <a href="/ncas/tips/st04-004">Understanding Firewalls</a> for more information).</li><li>Follow good security practices for distributing your email address (see <a href="/ncas/tips/st04-007">Reducing Spam</a> for more information). Applying email filters may help you manage unwanted traffic.</li></ul><h3>How do you know if an attack is happening?</h3><p>Not all disruptions to service are the result of a denial-of-service attack. There may be technical problems with a particular network, or system administrators may be performing maintenance. However, the following symptoms <i>could</i> indicate a DoS or DDoS attack:</p><ul class="bulleted"><li>unusually slow network performance (opening files or accessing websites)</li><li>unavailability of a particular website</li><li>inability to access any website</li><li>dramatic increase in the amount of spam you receive in your account</li></ul><h3>What do you do if you think you are experiencing an attack?</h3><p>Even if you do correctly identify a DoS or DDoS attack, it is unlikely that you will be able to determine the actual target or source of the attack. Contact the appropriate technical professionals for assistance.</p><ul class="bulleted"><li>If you notice that you cannot access your own files or reach any external websites from your work computer, contact your network administrators. This may indicate that your computer or your organization's network is being attacked.</li><li>If you are having a similar experience on your home computer, consider contacting your internet service provider (ISP). If there is a problem, the ISP might be able to advise you of an appropriate course of action.</li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 05 Nov 2009 02:35:11 +0000 US-CERT 116 at http://www.us-cert.gov ST06-006: Understanding Hidden Threats: Corrupted Software Files http://www.us-cert.gov/ncas/tips/ST06-006 Original release date: March 09, 2011 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Malicious code is not always hidden in web page scripts or unusual file formats. Attackers may corrupt types of files that you would recognize and typically consider safe, so you should take precautions when opening files from other people. </font> </td> </tr> </table> <h3>What types of files can attackers corrupt?</h3><p>An attacker may be able to insert malicious code into any file, including common file types that you would normally consider safe. These files may include documents created with word processing software, spreadsheets, or image files. After corrupting the file, an attacker may distribute it through email or post it to a website. Depending on the type of malicious code, you may infect your computer by just opening the file.</p><p>When corrupting files, attackers often take advantage of vulnerabilities that they discover in the software that is used to create or open the file. These vulnerabilities may allow attackers to insert and execute malicious scripts or code, and they are not always detected. Sometimes the vulnerability involves a combination of certain files (such as a particular piece of software running on a particular operating system) or only affects certain versions of a software program.</p><h3>What problems can malicious files cause?</h3><p>There are various types of malicious code, including viruses, worms, and Trojan horses (see <a href="/ncas/tips/st04-001">Why is Cyber Security a Problem?</a> for more information). However, the range of consequences varies even within these categories. The malicious code may be designed to perform one or more functions, including</p><ul class="bulleted"><li>interfering with your computer's ability to process information by consuming memory or bandwidth (causing your computer to become significantly slower or even "freeze")</li><li>installing, altering, or deleting files on your computer</li><li>giving the attacker access to your computer</li><li>using your computer to attack other computers (see <a href="/ncas/tips/st04-015">Understanding Denial-of-Service Attacks</a> for more information)</li></ul><h3>How can you protect yourself?</h3><ul class="bulleted"><li><b>Use and maintain anti-virus software</b> - Anti-virus software can often recognize and protect your computer against most known viruses, so you may be able to detect and remove the virus before it can do any damage (see <a href="/ncas/tips/st04-005">Understanding Anti-Virus Software</a> for more information). Because attackers are continually writing new viruses, it is important to keep your definitions up to date.</li><li><b>Use caution with email attachments</b> - Do not open email attachments that you were not expecting, especially if they are from people you do not know. If you decide to open an email attachment, scan it for viruses first (see <a href="/ncas/tips/st04-010">Using Caution with Email Attachments</a> for more information). Not only is it possible for attackers to "spoof" the source of an email message, but your legitimate contacts may unknowingly send you an infected file. If your email program automatically downloads and opens attachments, check your settings to see if you can disable this feature.</li><li><b>Be wary of downloadable files on websites</b> - Avoid downloading files from sites that you do not trust. If you are getting the files from a supposedly secure site, look for a website certificate (see <a href="/ncas/tips/st05-010">Understanding Web Site Certificates</a> for more information). If you do download a file from a website, consider saving it to your computer and manually scanning it for viruses before opening it.</li><li><b>Keep software up to date</b> - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities (see <a href="/ncas/tips/st04-006">Understanding Patches</a> for more information). Many operating systems offer automatic updates. If this option is available, you should enable it.</li><li><b>Take advantage of security settings</b> - Check the security settings of your email client and your web browser (see <a href="/ncas/tips/st05-001">Evaluating Your Web Browser's Security Settings</a> for more information). Apply the highest level of security available that still gives you the functionality you need.</li></ul><h3>Related information</h3><ul class="bulleted"><li><a href="/securing-your-web-browser">Securing Your Web Browser</a></li><li><a href="/ncas/tips/st05-006">Recovering from Viruses, Worms, and Trojan Horses</a></li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 10 Mar 2011 02:38:40 +0000 US-CERT 117 at http://www.us-cert.gov ST06-001: Understanding Hidden Threats: Rootkits and Botnets http://www.us-cert.gov/ncas/tips/ST06-001 Original release date: August 24, 2011 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Attackers are continually finding new ways to access computer systems. The use of hidden methods such as rootkits and botnets has increased, and you may be a victim without even realizing it. </font> </td> </tr> </table> <h3>What are rootkits and botnets?</h3><p>A rootkit is a piece of software that can be installed and hidden on your computer without your knowledge. It may be included in a larger software package or installed by an attacker who has been able to take advantage of a vulnerability on your computer or has convinced you to download it (see <a href="/ncas/tips/st04-014">Avoiding Social Engineering and Phishing Attacks</a> for more information). Rootkits are not necessarily malicious, but they may hide malicious activities. Attackers may be able to access information, monitor your actions, modify programs, or perform other functions on your computer without being detected.</p><p>Botnet is a term derived from the idea of bot networks. In its most basic form, a bot is simply an automated computer program, or robot. In the context of botnets, bots refer to computers that are able to be controlled by one, or many, outside sources. An attacker usually gains control by infecting the computers with a virus or other malicious code that gives the attacker access. Your computer may be part of a botnet even though it appears to be operating normally. Botnets are often used to conduct a range of activities, from distributing spam and viruses to conducting denial-of-service attacks (see <a href="/ncas/tips/st04-015">Understanding Denial-of-Service Attacks</a> for more information).</p><h3>Why are they considered threats?</h3><p>The main problem with both rootkits and botnets is that they are hidden. Although botnets are not hidden the same way rootkits are, they may be undetected unless you are specifically looking for certain activity. If a rootkit has been installed, you may not be aware that your computer has been compromised, and traditional anti-virus software may not be able to detect the malicious programs. Attackers are also creating more sophisticated programs that update themselves so that they are even harder to detect.</p><p>Attackers can use rootkits and botnets to access and modify personal information, attack other computers, and commit other crimes, all while remaining undetected. By using multiple computers, attackers increase the range and impact of their crimes. Because each computer in a botnet can be programmed to execute the same command, an attacker can have each of them scanning multiple computers for vulnerabilities, monitoring online activity, or collecting the information entered in online forms.</p><h3>What can you do to protect yourself?</h3><p>If you practice good security habits, you may reduce the risk that your computer will be compromised:</p><ul class="bulleted"><li><b>Use and maintain anti-virus software</b> - Anti-virus software recognizes and protects your computer against most known viruses, so you may be able to detect and remove the virus before it can do any damage (see <a href="/ncas/tips/st04-005">Understanding Anti-Virus Software</a> for more information). Because attackers are continually writing new viruses, it is important to keep your definitions up to date. Some anti-virus vendors also offer anti-rootkit software.</li><li><b>Install a firewall</b> - Firewalls may be able to prevent some types of infection by blocking malicious traffic before it can enter your computer and limiting the traffic you send (see <a href="/ncas/tips/st04-004">Understanding Firewalls</a> for more information). Some operating systems actually include a firewall, but you need to make sure it is enabled.</li><li><b>Use good passwords</b> - Select passwords that will be difficult for attackers to guess, and use different passwords for different programs and devices (see <a href="/ncas/tips/st04-002">Choosing and Protecting Passwords</a> for more information). Do not choose options that allow your computer to remember your passwords.</li><li><b>Keep software up to date</b> - Install software patches so that attackers can't take advantage of known problems or vulnerabilities (see <a href="/ncas/tips/st04-006">Understanding Patches</a> for more information). Many operating systems offer automatic updates. If this option is available, you should enable it.</li><li><b>Follow good security practices</b> - Take appropriate precautions when using email and web browsers to reduce the risk that your actions will trigger an infection (see other <a href="/ncas/tips/index">US-CERT security tips</a> for more information).</li></ul><p>Unfortunately, if there is a rootkit on your computer or an attacker is using your computer in a botnet, you may not know it. Even if you do discover that you are a victim, it is difficult for the average user to effectively recover. The attacker may have modified files on your computer, so simply removing the malicious files may not solve the problem, and you may not be able to safely trust a prior version of a file. If you believe that you are a victim, consider contacting a trained system administrator.</p><p>As an alternative, some vendors are developing products and tools that may remove a rootkit from your computer. If the software cannot locate and remove the infection, you may need to reinstall your operating system, usually with a system restore disk that is often supplied with a new computer. Note that reinstalling or restoring the operating system typically erases all of your files and any additional software that you have installed on your computer. Also, the infection may be located at such a deep level that it cannot be removed by simply reinstalling or restoring the operating system.</p> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 25 Aug 2011 02:41:31 +0000 US-CERT 118 at http://www.us-cert.gov ST10-001: Recognizing Fake Antiviruses http://www.us-cert.gov/ncas/tips/ST10-001 Original release date: October 11, 2010 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Fake antivirus is malicious software (malware) designed to steal information from unsuspecting users by mimicking legitimate security software. It's important to protect your computer from fake antivirus infection and to be able to recognize when an infection has occurred. </font> </td> </tr> </table> <div id="ncas-content"><h3>What is fake antivirus?</h3><p>Fake antivirus is malicious software (malware) designed to steal information from unsuspecting users by mimicking legitimate security software. The malware makes numerous system modifications making it extremely difficult to terminate unauthorized activities and remove the program. It also causes realistic, interactive security warnings to be displayed to the computer user.</p><h3>How can my computer become infected with fake antivirus?</h3><p>Criminals distribute this type of malware using search engines, emails, social networking sites, internet advertisements and other malware. They leverage advanced social engineering methodologies and popular technologies to maximize number of infected computers.</p><h3>How will I know if I am infected?</h3><p>The presence of pop-ups displaying unusual security warnings and asking for credit card or personal information is the most obvious method of identifying a fake antivirus infection.</p><h3>What can I do to protect myself?</h3><ul class="bulleted"><li>Be cautious when visiting web links or opening attachments from unknown senders. See <a href="/ncas/tips/ST04-010">Using Caution with Email Attachments</a> for more information.</li><li>Keep software patched and updated. See <a href="/ncas/tips/ST04-006">Understanding Patches</a> for more information on the importance of software patching.</li><li>To purchase or renew software subscriptions, visit the vendor sites directly.</li><li>Monitor your credit cards for unauthorized activity.</li><li>To report Internet crime or fraud, contact the Internet Crime Complaint Center (<a href="http://www.ic3.gov">http://www.ic3.gov</a>).</li></ul></div><p>��</p> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Mon, 11 Oct 2010 15:52:12 +0000 US-CERT 134 at http://www.us-cert.gov ST06-004: Avoiding the Pitfalls of Online Trading http://www.us-cert.gov/ncas/tips/ST06-004 Original release date: April 07, 2011 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Online trading can be an easy, cost-effective way to manage investments. However, online investors are often targets of scams, so take precautions to ensure that you do not become a victim. </font> </td> </tr> </table> <h3>What is online trading?</h3><p>Online trading allows you to conduct investment transactions over the internet. The accessibility of the internet makes it possible for you to research and invest in opportunities from any location at any time. It also reduces the amount of resources (time, effort, and money) you have to devote to managing these accounts and transactions.</p><h3>What are the risks?</h3><p>Recognizing the importance of safeguarding your money, legitimate brokerages take steps to ensure that their transactions are secure. However, online brokerages and the investors who use them are appealing targets for attackers. The amount of financial information in a brokerage's database makes it valuable; this information can be traded or sold for personal profit. Also, because money is regularly transferred through these accounts, malicious activity may not be noticed immediately. To gain access to these databases, attackers may use Trojan horses or other types of malicious code (see <a href="/ncas/tips/ST04-001">Why is Cyber Security a Problem?</a> for more information).</p><p>Attackers may also attempt to collect financial information by targeting the current or potential investors directly. These attempts may take the form of social engineering or phishing attacks (see <a href="/ncas/tips/ST04-014">Avoiding Social Engineering and Phishing Attacks</a> for more information). With methods that include setting up fraudulent investment opportunities or redirecting users to malicious sites that appear to be legitimate, attackers try to convince you to provide them with financial information that they can then use or sell. If you have been victimized, both your money and your identity may be at risk (see <a href="/ncas/tips/ST05-019">Preventing and Responding to Identity Theft</a> for more information).</p><h3>How can you protect yourself?</h3><ul class="bulleted"><li><b>Research your investment opportunities</b> - Take advantage of resources such as the U.S. Securities and Exchange Commission's <a href="http://www.sec.gov/edgar.shtml">EDGAR database</a> and your state's securities commission (found through the <a href="http://www.nasaa.org/">North American Securities Administrators Association</a>) to investigate companies.</li><li><b>Be wary of online information</b> - Anyone can publish information on the internet, so try to verify any online research through other methods before investing any money. Also be cautious of "hot" investment opportunities advertised online or in email.</li><li><b>Check privacy policies</b> - Before providing personal or financial information, check the website's privacy policy. Make sure you understand how your information will be stored and used (see <a href="/ncas/tips/ST04-013">Protecting Your Privacy</a> for more information).</li><li><b>Conduct transactions on devices you control</b> - Avoid conducting transactions on public resources such as internet kiosks, computers in places like libraries, and other shared computers and devices. Other users may introduce security risks.</li><li><b>Make sure that your transactions are encrypted</b> - When information is sent over the internet, attackers may be able to intercept it. Encryption prevents the attackers from being able to view the information.</li><li><b>Verify that the website is legitimate</b> - Attackers may redirect you to a malicious website that looks identical to a legitimate one. They then convince you to submit your personal and financial information, which they use for their own gain. Check the website's certificate to make sure it is legitimate (see <a href="/ncas/tips/ST05-010">Understanding Web Site Certificates</a> for more information).</li><li><b>Monitor your investments</b> - Regularly check your accounts for any unusual activity. Report unauthorized transactions immediately.</li><li><b>Use strong passwords</b> - Protect your computer, mobile devices, and accounts with passwords that cannot easily be guessed (see <a href="/ncas/tips/ST04-002">Choosing and Protecting Passwords</a> for more information). Use different passwords for each account.</li><li><b>Use and maintain anti-virus software</b> - Anti-virus software recognizes and protects your computer against most known viruses. However, because attackers are continually writing new viruses, it is important to keep your virus definitions current (see <a href="/ncas/tips/ST04-005">Understanding Anti-Virus Software</a> for more information).</li><li><b>Use anti-spyware tools</b> - Spyware is a common source of viruses, and attackers may use it to access information on your computer. You can minimize the number of infections by using a legitimate program that identifies and removes spyware (see <a href="/ncas/tips/ST04-016">Recognizing and Avoiding Spyware</a> for more information).</li><li><b>Keep software up to date</b> - Install software updates so that attackers can't take advantage of known problems or vulnerabilities (see <a href="/ncas/tips/ST04-006">Understanding Patches</a> for more information). Enable automatic updates if the option is available.</li><li><b>Evaluate your security settings</b> - By adjusting the security settings in your browser, you may limit your risk of certain attacks (see <a href="/ncas/tips/ST05-001">Evaluating Your Web Browser's Security Settings</a> for more information).</li></ul><br /><p>The following sites offer additional information and guidance:</p><ul class="bulleted"><li>U.S. Securities and Exchange Commission - <a href="http://www.sec.gov/investor/pubs/cyberfraud.htm">http://www.sec.gov/investor/pubs/cyberfraud.htm</a></li><li>National Consumers League - <a href="http://www.fraud.org/tips/internet/investment.htm">http://www.fraud.org/tips/internet/investment.htm</a></li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 07 Apr 2011 16:19:46 +0000 US-CERT 135 at http://www.us-cert.gov ST04-014: Avoiding Social Engineering and Phishing Attacks http://www.us-cert.gov/ncas/tips/ST04-014 Original release date: October 22, 2009 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Do not give sensitive information to anyone unless you are sure that they are indeed who they claim to be and that they should have access to the information. </font> </td> </tr> </table> <h3>What is a social engineering attack?</h3><p>In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.</p><h3>What is a phishing attack?</h3><p>Phishing is a form of social engineering. Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.</p><p>Phishing attacks may also appear to come from other types of organizations, such as charities. Attackers often take advantage of current events and certain times of the year, such as</p><ul class="bulleted"><li>natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)</li><li>epidemics and health scares (e.g., H1N1)</li><li>economic concerns (e.g., IRS scams)</li><li>major political elections</li><li>holidays</li></ul><h3>How do you avoid being a victim?</h3><ul class="bulleted"><li>Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.</li><li>Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.</li><li>Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.</li><li>Don't send sensitive information over the Internet before checking a website's security (see <a href="/ncas/tips/ST04-013">Protecting Your Privacy</a> for more information).</li><li>Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).</li><li>If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (<a href="http://www.antiphishing.org">http://www.antiphishing.org</a>).</li><li>Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (see <a href="/ncas/tips/ST04-004">Understanding Firewalls</a>, <a href="/ncas/tips/ST04-005">Understanding Anti-Virus Software</a>, and <a href="/ncas/tips/ST04-007">Reducing Spam</a> for more information).</li><li>Take advantage of any anti-phishing features offered by your email client and web browser.</li></ul><h3>What do you do if you think you are a victim?</h3><ul class="bulleted"><li>If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.</li><li>If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.</li><li>Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.</li><li>Watch for other signs of identity theft (see <a href="/ncas/tips/ST05-019">Preventing and Responding to Identity Theft</a> for more information).</li><li>Consider reporting the attack to the police, and file a report with the Federal Trade Commission (<a href="http://www.ftc.gov/">http://www.ftc.gov/</a>).</li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 22 Oct 2009 16:24:01 +0000 US-CERT 136 at http://www.us-cert.gov ST06-005: Dealing with Cyberbullies http://www.us-cert.gov/ncas/tips/ST06-005 Original release date: June 01, 2011 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Bullies are taking advantage of technology to intimidate and harass their victims. Dealing with cyberbullying can be difficult, but there are steps you can take. </font> </td> </tr> </table> <h3>What is cyberbullying?</h3><p>Cyberbullying refers to practice of using technology to harass, or bully, someone else. Bullies used to be restricted to methods such as physical intimidation, postal mail, or the telephone. Now, developments in electronic media offer forums such as email, instant messaging, web pages, and digital photos to add to the arsenal. Computers, cell phones, and PDAs are current tools that are being used to conduct an old practice.</p><p>Forms of cyberbullying can range in severity from cruel or embarrassing rumors to threats, harassment, or stalking. It can affect any age group; however, teenagers and young adults are common victims, and cyberbullying is a growing problem in schools.</p><h3>Why has cyberbullying become such a problem?</h3><p>The relative anonymity of the internet is appealing for bullies because it enhances the intimidation and makes tracing the activity more difficult. Some bullies also find it easier to be more vicious because there is no personal contact. Unfortunately, the internet and email can also increase the visibility of the activity. Information or pictures posted online or forwarded in mass emails can reach a larger audience faster than more traditional methods, causing more damage to the victims. And because of the amount of personal information available online, bullies may be able to arbitrarily choose their victims.</p><p>Cyberbullying may also indicate a tendency toward more serious behavior. While bullying has always been an unfortunate reality, most bullies grow out of it. Cyberbullying has not existed long enough to have solid research, but there is evidence that it may be an early warning for more violent behavior.</p><h3>How can you protect yourself or your children?</h3><ul class="bulleted"><li><b>Teach your children good online habits</b> - Explain the risks of technology, and teach children how to be responsible online (see <a href="/ncas/tips/ST05-002">Keeping Children Safe Online</a> for more information). Reduce their risk of becoming cyberbullies by setting guidelines for and monitoring their use of the internet and other electronic media (cell phones, PDAs, etc.).</li><li><b>Keep lines of communication open</b> - Regularly talk to your children about their online activities so that they feel comfortable telling you if they are being victimized.</li><li><b>Watch for warning signs</b> - If you notice changes in your child's behavior, try to identify the cause as soon as possible. If cyberbullying is involved, acting early can limit the damage.</li><li><b>Limit availability of personal information</b> - Limiting the number of people who have access to contact information or details about interests, habits, or employment reduces exposure to bullies that you or your child do not know. This may limit the risk of becoming a victim and may make it easier to identify the bully if you or your child are victimized.</li><li><b>Avoid escalating the situation</b> - Responding with hostility is likely to provoke a bully and escalate the situation. Depending on the circumstances, consider ignoring the issue. Often, bullies thrive on the reaction of their victims. Other options include subtle actions. For example, you may be able to block the messages on social networking sites or stop unwanted emails by changing the email address. If you continue to get messages at the new email address, you may have a stronger case for legal action.</li><li><b>Document the activity</b> - Keep a record of any online activity (emails, web pages, instant messages, etc.), including relevant dates and times. In addition to archiving an electronic version, consider printing a copy.</li><li><b>Report cyberbullying to the appropriate authorities</b> - If you or your child are being harassed or threatened, report the activity. Many schools have instituted bullying programs, so school officials may have established policies for dealing with activity that involves students. If necessary, contact your local law enforcement. Law enforcement agencies have different policies, but your local police department or FBI branch are good starting points. Unfortunately, there is a distinction between free speech and punishable offenses, but the legal implications should be decided by the law enforcement officials and the prosecutors.</li></ul><h3>Additional information</h3><p>The following organizations offer additional information about this topic:</p><ul class="bulleted"><li>National Crime Prevention Council - <a href="http://www.ncpc.org/cyberbullying">http://www.ncpc.org/cyberbullying</a></li><li>StopBullying.gov - <a href="http://www.stopbullying.gov/">http://www.stopbullying.gov/</a></li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Wed, 01 Jun 2011 16:26:45 +0000 US-CERT 137 at http://www.us-cert.gov ST04-009: Identifying Hoaxes and Urban Legends http://www.us-cert.gov/ncas/tips/ST04-009 Original release date: March 10, 2011 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Chain letters are familiar to anyone with an email account, whether they are sent by strangers or well-intentioned friends or family members. Try to verify the information before following any instructions or passing the message along. </font> </td> </tr> </table> <h3>Why are chain letters a problem?</h3><p>The most serious problem is from chain letters that mask viruses or other malicious activity. But even the ones that seem harmless may have negative repercussions if you forward them:</p><ul class="bulleted"><li>they consume bandwidth or space within the recipient's inbox</li><li>you force people you know to waste time sifting through the messages and possibly taking time to verify the information</li><li>you are spreading hype and, often, unnecessary fear and paranoia</li></ul><h3>What are some types of chain letters?</h3><p>There are two main types of chain letters:</p><ul class="bulleted"><li><b>Hoaxes</b> - Hoaxes attempt to trick or defraud users. A hoax could be malicious, instructing users to delete a file necessary to the operating system by claiming it is a virus. It could also be a scam that convinces users to send money or personal information. Phishing attacks could fall into this category (see <a href="/ncas/tips/ST04-014">Avoiding Social Engineering and Phishing Attacks</a> for more information).</li><li><b>Urban legends</b> - Urban legends are designed to be redistributed and usually warn users of a threat or claim to be notifying them of important or urgent information. Another common form are the emails that promise users monetary rewards for forwarding the message or suggest that they are signing something that will be submitted to a particular group. Urban legends usually have no negative effect aside from wasted bandwidth and time.</li></ul><h3>How can you tell if the email is a hoax or urban legend?</h3><p>Some messages are more suspicious than others, but be especially cautious if the message has any of the characteristics listed below. These characteristics are just guidelines���not every hoax or urban legend has these attributes, and some legitimate messages may have some of these characteristics:</p><ul class="bulleted"><li>it suggests tragic consequences for not performing some action</li><li>it promises money or gift certificates for performing some action</li><li>it offers instructions or attachments claiming to protect you from a virus that is undetected by anti-virus software</li><li>it claims it's not a hoax</li><li>there are multiple spelling or grammatical errors, or the logic is contradictory</li><li>there is a statement urging you to forward the message</li><li>it has already been forwarded multiple times (evident from the trail of email headers in the body of the message)</li></ul><p>If you want to check the validity of an email, there are some websites that provide information about hoaxes and urban legends:</p><ul class="bulleted"><li>Urban Legends and Folklore - <a href="http://urbanlegends.about.com/">http://urbanlegends.about.com/</a></li><li>Urban Legends Reference Pages - <a href="http://www.snopes.com/">http://www.snopes.com/</a></li><li>TruthOrFiction.com - <a href="http://www.truthorfiction.com/">http://www.truthorfiction.com/</a></li><li>Symantec Security Response Hoaxes - <a href="http://www.symantec.com/avcenter/hoax.html">http://www.symantec.com/avcenter/hoax.html</a></li><li>McAfee Security Virus Hoaxes - <a href="http://home.mcafee.com/VirusInfo/VirusHoaxes.aspx">http://home.mcafee.com/VirusInfo/VirusHoaxes.aspx</a></li></ul> <hr /> Authors: Mindi McDowell and Allen Householder <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 10 Mar 2011 16:29:58 +0000 US-CERT 138 at http://www.us-cert.gov ST05-019: Preventing and Responding to Identity Theft http://www.us-cert.gov/ncas/tips/ST05-019 Original release date: September 17, 2008 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Identity theft, or identity fraud, is a crime that can have substantial financial and emotional consequences. Take precautions with personal information; and if you become a victim, act immediately to minimize the damage. </font> </td> </tr> </table> <h3>Is identity theft just a problem for people who submit information online?</h3><p>You can be a victim of identity theft even if you never use a computer. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans.</p><p>The internet has made it easier for thieves to obtain personal and financial data. Most companies and other institutions store information about their clients in databases; if a thief can access that database, he or she can obtain information about many people at once rather than focus on one person at a time. The internet has also made it easier for thieves to sell or trade the information, making it more difficult for law enforcement to identify and apprehend the criminals.</p><h3>How are victims of online identity theft chosen?</h3><p>Identity theft is usually a crime of opportunity, so you may be victimized simply because your information is available. Thieves may target customers of certain companies for a variety of reasons; for example, a company database is easily accessible, the demographics of the customers are appealing, or there is a market for specific information. If your information is stored in a database that is compromised, you may become a victim of identity theft.</p><h3>Are there ways to avoid being a victim?</h3><p>Unfortunately, there is no way to guarantee that you will not be a victim of online identity theft. However, there are ways to minimize your risk:</p><ul class="bulleted"><li><b>Do business with reputable companies</b> - Before providing any personal or financial information, make sure that you are interacting with a reputable, established company. Some attackers may try to trick you by creating malicious web sites that appear to be legitimate, so you should verify the legitimacy before supplying any information (see <a href="/ncas/tips/ST04-014">Avoiding Social Engineering and Phishing Attacks</a> and <a href="/ncas/tips/ST05-010">Understanding Web Site Certificates</a> for more information).</li><li><b>Take advantage of security features</b> - Passwords and other security features add layers of protection if used appropriately (see <a href="/ncas/tips/ST04-002">Choosing and Protecting Passwords</a> and <a href="/ncas/tips/ST05-012">Supplementing Passwords</a> for more information).</li><li><b>Check privacy policies</b> - Take precautions when providing information, and make sure to check published privacy policies to see how a company will use or distribute your information (see <a href="/ncas/tips/ST04-013">Protecting Your Privacy</a> and <a href="/ncas/tips/ST05-008">How Anonymous Are You?</a> for more information). Many companies allow customers to request that their information not be shared with other companies; you should be able to locate the details in your account literature or by contacting the company directly.</li><li><b>Be careful what information you publicize</b> - Attackers may be able to piece together information from a variety of sources. Avoid posting personal data in public forums (see <a href="/ncas/tips/ST05-013">Guidelines for Publishing Information Online</a> for more information).</li><li><b>Use and maintain anti-virus software and a firewall</b> - Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable by using anti-virus software and a firewall (see <a href="/ncas/tips/ST04-005">Understanding Anti-Virus Software</a> and <a href="/ncas/tips/ST04-004">Understanding Firewalls</a> for more information). Make sure to keep your virus definitions up to date.</li><li><b>Be aware of your account activity</b> - Pay attention to your statements, and check your credit report yearly. You are entitled to a free copy of your credit report from each of the main credit reporting companies once every twelve months (see <a href="https://www.annualcreditreport.com/cra/index.jsp">AnnualCreditReport.com</a> for more information).</li></ul><h3>How do you know if your identity has been stolen?</h3><p>Companies have different policies for notifying customers when they discover that someone has accessed a customer database. However, you should be aware of changes in your normal account activity. The following are examples of changes that could indicate that someone has accessed your information:</p><ul class="bulleted"><li>unusual or unexplainable charges on your bills</li><li>phone calls or bills for accounts, products, or services that you do not have</li><li>failure to receive regular bills or mail</li><li>new, strange accounts appearing on your credit report</li><li>unexpected denial of your credit card</li></ul><h3>What can you do if you think, or know, that your identity has been stolen?</h3><p>Recovering from identity theft can be a long, stressful, and potentially costly process. Many credit card companies have adopted policies that try to minimize the amount of money you are liable for, but the implications can extend beyond your existing accounts. To minimize the extent of the damage, take action as soon as possible:</p><ul class="bulleted"><li><b>Contact companies, including banks, where you have accounts</b> - Inform the companies where you have accounts that someone may be using your identity, and find out if there have been any unauthorized transactions. Close accounts so that future charges are denied. In addition to calling the company, send a letter so there is a record of the problem.</li><li><b>Contact the main credit reporting companies (Equifax, Experian, TransUnion)</b> - Check your credit report to see if there has been unexpected or unauthorized activity. Have a fraud alerts placed on your credit reports to prevent new accounts being opened without verification.</li><li><b>File a report</b> - File a report with the local police so there is an official record of the incident. You can also file a complaint with the Federal Trade Commission.</li><li><b>Consider other information that may be at risk</b> - Depending what information was stolen, you may need to contact other agencies; for example, if a thief has access to your Social Security number, contact the Social Security Administration. You should also contact the Department of Motor Vehicles if your driver's license or car registration have been stolen.</li></ul><p>The following sites offer additional information and guidance for recovering from identity theft:</p><ul class="bulleted"><li>Federal Trade Commission - <a href="http://www.ftc.gov/bcp/edu/microsites/idtheft/">http://www.ftc.gov/bcp/edu/microsites/idtheft/</a></li><li>United States Department of Justice - <a href="http://www.usdoj.gov/criminal/fraud/websites/idtheft.html">http://www.usdoj.gov/criminal/fraud/websites/idtheft.html</a></li><li>Social Security Administration - <a href="http://www.ssa.gov/pubs/idtheft.htm">http://www.ssa.gov/pubs/idtheft.htm</a></li></ul> <hr /> Author: Mindi McDowell <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Wed, 17 Sep 2008 16:35:10 +0000 US-CERT 139 at http://www.us-cert.gov ST04-016: Recognizing and Avoiding Spyware http://www.us-cert.gov/ncas/tips/ST04-016 Original release date: November 19, 2009 | Last revised: February 06, 2013<br /><br /> <table cellspacing="6" cellpadding="6" border="1"> <tr> <td bgcolor="#96B4D2"> <font face="arial, geneva, helvetica"> Because of its popularity, the internet has become an ideal target for advertising. As a result, spyware, or adware, has become increasingly prevalent. When troubleshooting problems with your computer, you may discover that the source of the problem is spyware software that has been installed on your machine without your knowledge. </font> </td> </tr> </table> <h3>What is spyware?</h3><p>Despite its name, the term "spyware" doesn't refer to something used by undercover operatives, but rather by the advertising industry. In fact, spyware is also known as "adware." It refers to a category of software that, when installed on your computer, may send you pop-up ads, redirect your browser to certain web sites, or monitor the web sites that you visit. Some extreme, invasive versions of spyware may track exactly what keys you type. Attackers may also use spyware for malicious purposes.</p><p>Because of the extra processing, spyware may cause your computer to become slow or sluggish. There are also privacy implications:</p><ul class="bulleted"><li>What information is being gathered?</li><li>Who is receiving it?</li><li>How is it being used?</li></ul><h3>How do you know if there is spyware on your computer?</h3><p>The following symptoms <i>may</i> indicate that spyware is installed on your computer:</p><ul class="bulleted"><li>you are subjected to endless pop-up windows</li><li>you are redirected to web sites other than the one you typed into your browser</li><li>new, unexpected toolbars appear in your web browser</li><li>new, unexpected icons appear in the task tray at the bottom of your screen</li><li>your browser's home page suddenly changed</li><li>the search engine your browser opens when you click "search" has been changed</li><li>certain keys fail to work in your browser (e.g., the tab key doesn't work when you are moving to the next field within a form)</li><li>random Windows error messages begin to appear</li><li>your computer suddenly seems very slow when opening programs or processing tasks (saving files, etc.)</li></ul><h3>How can you prevent spyware from installing on your computer?</h3><p>To avoid unintentionally installing it yourself, follow these good security practices:</p><ul class="bulleted"><li><b>Don't click on links within pop-up windows</b> - Because pop-up windows are often a product of spyware, clicking on the window may install spyware software on your computer. To close the pop-up window, click on the "X" icon in the titlebar instead of a "close" link within the window.</li><li><b>Choose "no" when asked unexpected questions</b> - Be wary of unexpected dialog boxes asking whether you want to run a particular program or perform another type of task. Always select "no" or "cancel," or close the dialog box by clicking the "X" icon in the titlebar.</li><li><b>Be wary of free downloadable software</b> - There are many sites that offer customized toolbars or other features that appeal to users. Don't download programs from sites you don't trust, and realize that you may be exposing your computer to spyware by downloading some of these programs.</li><li><b>Don't follow email links claiming to offer anti-spyware software</b> - Like email viruses, the links may serve the opposite purpose and actually install the spyware it claims to be eliminating.</li></ul><p>As an additional good security practice, especially if you are concerned that you might have spyware on your machine and want to minimize the impact, consider taking the following action:</p><ul class="bulleted"><li><b>Adjust your browser preferences to limit pop-up windows and cookies</b> - Pop-up windows are often generated by some kind of scripting or active content. Adjusting the settings within your browser to reduce or prevent scripting or active content may reduce the number of pop-up windows that appear. Some browsers offer a specific option to block or limit pop-up windows. Certain types of cookies are sometimes considered spyware because they reveal what web pages you have visited. You can adjust your privacy settings to only allow cookies for the web site you are visiting (see <a href="/ncas/tips/ST04-012">Browsing Safely: Understanding Active Content and Cookies</a> and <a href="/ncas/tips/ST05-001">Evaluating Your Web Browser's Security Settings</a> for more information).</li></ul><h3>How do you remove spyware?</h3><ul class="bulleted"><li><b>Run a full scan on your computer with your anti-virus software</b> - Some anti-virus software will find and remove spyware, but it may not find the spyware when it is monitoring your computer in real time. Set your anti-virus software to prompt you to run a full scan periodically (see <a href="/ncas/tips/ST04-005">Understanding Anti-Virus Software</a> for more information).</li><li><b>Run a legitimate product specifically designed to remove spyware</b> - Many vendors offer products that will scan your computer for spyware and remove any spyware software. Popular products include Lavasoft's Ad-Aware, Microsoft's Window Defender, Webroot's SpySweeper, and Spybot Search and Destroy.</li><li><b>Make sure that your anti-virus and anti-spyware software are compatible</b> - Take a phased approach to installing the software to ensure that you don't unintentionally introduce problems (see <a href="/ncas/tips/ST06-009">Coordinating Virus and Spyware Defense</a> for more information).</li></ul> <hr /> Authors: Mindi McDowell and Matt Lytle <hr /> <p>This product is provided subject to this <a href="http://www.us-cert.gov/privacy/notification">Notification</a> and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a> policy.</p> Thu, 19 Nov 2009 16:37:33 +0000 US-CERT 140 at http://www.us-cert.gov
|
|
|
|
