|
Online Scam of the Week: |
||
|
Security Links As a result of the open way that the Internet operates, there are individuals that will use it to exploit other computer systems and networks. These threats have become more frequent and increasingly creative in their operations in the past year. The attacks are often extremely harmful to your computer or to your personal confidential information. First Federal Bank makes sure that all of our data systems are secure and reliable, but the connection at the user's end must be just as secure for your information to be safe. For these reasons, we recommend that you download and install all pertinent security patches for your PC's operating system (Windows) and the PC's internet browser (Internet Explorer, Netscape Communicator, etc.), and maintain an anti-virus program. Popup blockers, spyware removers and firewalls are recommended as well. Some hackers have even started to exploit security flaws in other programs, such as email readers and word processors. | ||
| What is "Phishing" and"Spoofing"? | ||
|
"Phishing" is a technique used by scammers to gain your confidential information. These people send authentic-looking emails to customers of banks, credit card companies, and even delivery services. This type of email or website imitation is known as "spoofing", and you should not let it fool you. The emails will typically warn that due to recent online threats, the customer needs to visit a website where they can confirm their information. Some spoofers have even been known to include viruses, either as a payload in the message, or as a result of following the included link. The link in the email redirects the recipient to a website that appears quite valid, usually with copies of the bank logos and often even duplicating the layout of the spoofed bank's website. This causes the user to lower their guard and answer the questions on the website, giving up their credit card numbers, bank account numbers, social security numbers, telephone numbers, addresses, and anything else that the scammer can use in executing identity theft against the recipient. Be assured that First Federal Bank will NEVER request that you reveal any information in this way. If you receive a message that appears to be from First Federal Bank (or any other company) that asks you to verify personal information, it is a scam. Fortunately, the only threat that can be caused by this scheme is if you do what the scammer wants. Follow these simple steps to protect yourself and your information:
|
||
Please feel free to contact us if you have any other questions or concerns about online security. The following links should prove useful in securing your PC: |
||
| Microsoft Technical Assistance | ||
|
If
you need assistance with online security: webmaster@ffbtn.com
|
|
|
American Airlines Confirmation Don't do it. Leave the link alone and don't click! Delete those messages immediately, and make sure to clean out the deleted messages folder. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Facebook Scams
Facebook changes its look and functionalities often, but a lot of users dislike any kind of change. This normal human tendency is often misused by scammers who offer bogus Facebook Timeline deactivation options. An even greater number of scams targets those who aren't satisfied with features offered by the social network and are tricked into believing that there are ways to add functionalities such as the ability to view who checks out their profile more often, view who has deleted or unfollowed them, to see how many hours they spent on Facebook, to post again their first post, to add a Dislike button, to change their Facebook color theme, and even to add a Facebook security app to guard their accounts or to try a Facebook 2013 Demo app. Next we have the scams that profess that Facebook is giving out something for free: an official Facebook T-shirt or mug to celebrate the social network's birthday, the random $50,000 reward, free Facebook Credits, or even a free mobile recharge. Lastly, there are scams that try to scare users into doing something because Facebook is closing all accounts, will close theirs because of overpopulation, will start charging users, or the Facebook Security Team will suspend their page.It's also good to know that Facebook-themed scams - and especially phishing attempts and malware-infection attempts - can often come in the form of fake Facebook notification emails - password change notifications, account cancellation (or deactivation) warnings, offensive comment notices, friend requests, and so on. Facebook has come out with something new, and you always need to watch it when that happens. It's a combination of big data and social networking so that people can easily find new friends, dates, customers or business partners. In short, it's more or less a search engine that allows you to track down Facebook users that meet the criteria you specify. With all that personally relevant data at hand, this new Graph Search function is a bonanza for social engineers that now can manipulate you even easier and/or send spear-phishing attacks. This data can be used in a variety of scams. They are currently beta testing and are planning to release it this summer. The only thing I can say is that it is more important than ever to THINK BEFORE YOU CLICK, and get some very good security awareness training. Read the story below about the types of Facebook hacks you (and your employees) need to watch out for. |
|||||||||||||||||||||||||||||||||||||||||||||
|
MSN/Hotmail Scam This is the attack, an email which claims to come from the "Windows Live Team" and warns Hotmail/MSN users that their account is at risk of immediate closure after different computers logged into it, and multiple attempts were made to guess the password. The email, which has the subject line "CONFIRMATION ALERT RESET (2013)" and comes from an unofficial-looking @msn.com email address, urges the user to reply via email with their full name, username, password, date of birth, and country in order to confirm their identity. Alert your friends about this, and continue to warn them they should NEVER give login information to ANYONE. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Eurograbber steals 36 million € First you have to understand that mobile authentication is used all over in Europe for bank transactions, and that U.S. banks are moving into the same direction for some services. The Eurograbber attack first infects a user's PC with a banking Trojan, using social engineering and next it infects the user's mobile device with a second social engineering trick, when the user is fooled again into clicking on a link that now infects their phone. When a user with an infected machine visits a banking site, the malware intercepts the session and injects a JavaScript onto the page. The user is notified of a "security upgrade," which involves providing cell phone information. When the cyberthieves send a confirmation message to the phone, it asks users to click on a link that actually infects the phone. The malware targets the Android and Blackberry platforms, and has not been spotted on the iPhone yet. Originally, the attacks were first reported in Italy, and then bank customers saw the same exploit pop up in Germany, Holland and Spain after the cyber gang had done their translations, testing and quality assurance. What you may not be aware of that in Eastern Europe, there are some people that go to work at 9 in the morning, punch the time clock, have lunch, leave the office at five and get health insurance, but what they do during the day is develop and test malware for criminal use. There are several competing criminal software companies out there, trying to outdo each other in creating the most advanced banking trojans. "This attack meets all the key buzzwords we hear about attacks today," Burkey says during an interview with BankInfoSecurity. "It's sophisticated in the way it goes about taking advantage of two-factor authentication. It's targeted. It's stealthy. And, unfortunately, it's successful." The exploit was first discovered in August by Versafe, an online identity-theft protections provider. The command-and-control servers have been taken down at the moment, but this could easily be repeated. Now, how can these attacks be prevented? The bad guys go after the weak link in IT security: the human. That means they send well-crafted emails that make people click because they either think they get something for free, or try to prevent a negative consequence. There are thousands of ways that the bad guys can trick someone, and only one way to prevent an attack from happening: security awareness training which will arm both consumers and organizations against increasingly sophisticated malware attacks. |
|||||||||||||||||||||||||||||||||||||||||||||
|
You Accessed Illegal Content Moreover, this scam uses the good name of the Internet Crime Complaint Center (IC3) to lure the victim to a drive-by download website, which in turn installs the ransomware on the victim's computer, and tries to extort money. As you well know, cyber criminals use social engineering to make people click on links to 'prevent a negative consequence'. To trick users to click this latest version of the malware claims that the victim's computer activity is being recorded using audio, video, and other devices. We strongly recommend you warn your friends and co-workers about this one, as they can be hit both in the office and at home. |
|||||||||||||||||||||||||||||||||||||||||||||
|
The Huge Damage That ONE Click Can Cause - Please Read! An international hacker sent a few South Carolina Department of Revenue employees a phishing email. Unfortunately, one employee unknowingly clicked on the link. From that one click, the cybercriminal was able to steal the employee's user name and password. For weeks after, the cybercriminal started copying large amounts of information and transferring them onto zip files that were transferred outside of the system. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Apple Invoices 1) FDIC spamvertising with 'Your activity is discontinued', tricking users into believing that their ability to send Domestic Wire Transfers is disabled 2) Twitter attacks getting more subtle, where you first need to open the mentioned account to get the payload 3) Tsunami spam that 'warns' users and tells them to click on a link to see the video 4) More Twitter scams that they are going to start charging for their up to now free service. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Top
10 Holiday Scams 10 'The Charity Tricksters': The holidays are traditionally the time for giving. It's also the time that cyber criminals try to pry money out of people that mean well. But making donations to the wrong site could mean you are funding cybercrime or even terrorism. So, watch out for any communications from charities that ask for your contribution, (phone, email, text, tweets, snail mail and even people ringing your door bell) and make sure they are legit and show their ID. It is safest to only donate to charities you already know, and refuse all the rest. 9 'The Grinch E-Card Greetings': Happy Holidays! Your email has an attachment that looks like an e-greeting card, pretty pictures and all. You think that this must be from a friend. Nope, not so. Malicious e-cards are sent by the millions, and especially at the office, never open these things as they might infect your workstation. 8 'The Fake Gift Card Trick': Internet crooks promote a fake gift card through social media but what they really are after is your information, which they then sell to other cyber criminals who use it for identity theft. Here is an example: A recent Facebook scam offered a "free $1,000 Best Buy gift card" to the first 20,000 people who signed up for a Best Buy fan page, which was a malicious copy of the original. 7 'The Copied Site': Bad guys build complete copies of well-known sites, send you emails promoting great deals, sell products, take the credit card, but never deliver the goods. These sites live only a few days and the money usually goes abroad. Your credit card company will refund the purchase, but apart from not getting your gift(s) your card number is now compromised and will be sold and used by cyber criminals. Always check for the https:// rather than just http:// . 6 'The DM-Scam': You tweet about a holiday gift you are trying to find, and you get a direct message (DM) from another twitter user offering to sell you one. Stop - Look - Think, because this could very well be a sophisticated scam. If you do not know that person, be -very- careful before you continue and never pay up front. 5 'The Extra Holiday-money Fraud': You always need some extra money during this season, so cyber fraudsters are offering work-from-home scams. The most innocent of these make you fill out a form where you give out confidential information like your Social Security number which will get your identity stolen. The worst of them offer you work where you unwittingly launder money from a cyberheist which can get you into major trouble. 4 'The Fake Recession Relief': Internet swindlers target people that are vulnerable due to the recession with pay-in-advance scams and credit offers. Spam emails advertise "prequalified, super low-interest" credit cards and loans if you pay a processing fee, which goes straight into the scammer's pocket. 3 'The Search Term Trap': Bad guys do their research and find out what people want. They then build a site that professes to have the item. They push that site high onto the search engines and you might click on that link. But the site contains malware and will infect your PC. Make sure that your web-browser is fully updated, and will warn you if it sees that the site is unsafe. 2 'The Evil Wi-Fi Twin': You bring your laptop and go to the mall to scout for gifts. Then you check if you get it cheaper somewhere online. But the bad guys are there too, shopping for your credit card number! They put out a Wi-Fi signal that looks just like a free one you always use. Choose the wrong Wi-Fi and the hacker now sits in the middle and steals your credit card data while you buy online. When you use a Wi-Fi connection in a public place, it is better not to use your credit card. 1 'The Black Friday Racket': Black Friday is the start of great holiday shopping deals, unless they are too good to be true and you get tricked into buying an iPad for a 90% discount. Be extra careful with online buying starting the day after Thanksgiving! |
|||||||||||||||||||||||||||||||||||||||||||||
|
Stolen
Election! And as always, the scammers jumped on Hurricane Sandy and started spewing various spam and phishing attacks promising everything from help with insurance claims, disaster relief for people and pets, restaurant deals, gas discount coupons, and even web pages where they can "win" Apple products. Watch it with these Apple scams, because they ask for a lot of personal information, including your cell phone number, which they can use to initiate premium-rate SMS charges you get billed for. We recommend you forward this warning to your employees. |
|||||||||||||||||||||||||||||||||||||||||||||
|
20
Notorious worms, viruses and botnets
|
|||||||||||||||||||||||||||||||||||||||||||||
|
Is
Your Smartphone Spying On You? To do many of the things you've grown to appreciate, your apps have access to information, such as your location. They also have access to your contacts (potentially), your usage history, and your always-on network connections. It's no surprise that parents are loading up their kids' smartphones with tracking apps, in case their little cherubs aren't where they say they are, and the grown-ups want a way to check up on them. But very similar technology could be used to check up on you, and you may not necessarily know what it's up to. For instance, a popular app for the Android platform claims to help track wayward spousal activity by tracking down voice conversations, location, and call history -- all tasks previously reserved for private investigators sipping stale coffee while staked out all night outside the target's apartment. Not anymore! Now there's an app for that. What if you shut off your phone? That's no guarantee you can't be tracked. In years past, the FBI successfully prosecuted a crime boss based on a conversation recorded via his phone when it was switched off. The problem is that it's really tough to completely switch some smartphones off -- devilishly tough in some cases. You could pop the battery out, right? Well, on many iPhone and Android models, there really isn't a simple way to do that. And of course there are malicious apps that record your activity, in some cases recording the information you use in financial transactions and then spiriting the information out over the wireless network without you even noticing -- that is, until you get your bank statement a month later and notice strange purchases overseas in locations you've never visited. I have a friend who refuses to get any modern phones because he's deliberately trying to opt out of mobile devices that have the ability to always know where he is. But, then, he isn't a Twitter junkie either, so it works for him. He says he's going analog in a digital world. Would that work for you? Maybe not, but it's getting increasingly difficult to fit into a technology-driven world and still retain your anonymity. If you want to give it a shot, try limiting the amount of time your network services are enabled to only when you need them. Also, restrict which apps you load to just what you really need. Using the less is more approach to apps will help. It might also be a good idea to install security software that tells you when apps go rogue. Of course, you could always just use a landline phone to call people, but that's just way too old-fashioned for most of us these days.
|
|||||||||||||||||||||||||||||||||||||||||||||
|
Friday
is Phishing Day Websense reported on October 8, 2012 about their most recent July-August 2012 research. They said: "A disturbing new twist on targeted attacks has started to emerge this year that directly affects professionally managed networks. If we look at the days of the week when most phishing emails are sent, we notice a huge uptick in volume on Fridays, Sundays and Mondays. Most phishing emails are sent on Fridays, followed by Monday and Sunday. The bad guys have learned that they can evade email security measures by sending an email with a clean link on Friday or over the weekend - bypassing email URL scanning. Then, over the weekend they compromise the URL with malicious code. The top phishing days of the week (by percentage) are: Friday (38.5%) 1) Find a URL that
can be easily compromised
but do nothing at that time. Leave it
'as is' for now. Evasion techniques
like these help when hackers are going for the big game - spear-phishing
employees with access to a specific network or data or whale phishing,
the targeting of executives at companies." The above new tactic shows
that it is more important than ever to step all employees through high-quality
security awareness training. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Romney
Almost President They use these events to social engineer people into clicking on links they normally would not. Politics is especially charged at the moment, so the new malicious email campaign that pretends to be from CNN is a good example. It announces breaking news about Romney, but it leads to a website with 'blackhole' malware which will infect their workstation. Be especially wary during and -after- the election, where there will be allegations that "the election was stolen" and cybercrime will use election fraud as bait. I'm sure they are working on a campaign right now that will lie in wait until right after the election. No matter who wins, they will have phishing email ready to trap you. It just happened after the Venezuela elections. The bad guys are getting more crafty by the month; when you visit the infected website with a hardened PC that is not able to pick up the infections they want to spread, they resort to a page that looks identical to the Adobe Flash Player download and tell you to download it, but it's of course a fake and will install a trojan instead of Flash. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Lol
is this your new profile pic? It's a form of phishing, of course, tempting Skype IM users to interact with what appears to be a cheerful and harmless greeting from a friend. The malicious content of the messages was discovered by cloud security vendor TrendMicro, which reported Monday that the malware was "spreading fast." The payload contained in the message is the charmingly named Dorkbot worm. The symptoms of infection can be "nasty," ranging from locking you out of your computer and demanding a ransom, to stealing user names and passwords for Websites. Skype has acknowledged the presence of the threat and is working to mitigate its effects. Meantime, it offers advice that should be obvious: "following links -- even when from your contacts -- that look strange or are unexpected is not advisable." Surely we've all by now received completely uncharacteristic emails from friends who have had one of their accounts hacked. In most cases, these are obvious phishing attempts: Your aunt is unlikely to invite you to "Get a load of this deal." Or maybe she is, but you get my point. Difficulty arises when neutral messages are received from recognized sources. Whether the Dorkbot IM fits this category depends, I suppose, on whether your friends are accustomed to beginning a sentence with "lol..." It's probably subtle enough to dupe many users, although it's currently unknown how many have fallen victim. Another day, another threat. With Skype increasingly used as an enterprise tool, there are two takeaways for IT managers: Make sure employees are using the latest version of software like Skype, and reinforce the message that it's hard to automate solutions against phishing. User vigilance is the best defense. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Pay
Money to Get Money |
|||||||||||||||||||||||||||||||||||||||||||||
|
Changes to
Microsoft Services Agreement
|
|||||||||||||||||||||||||||||||||||||||||||||
|
You
Have Been Targeted for Assassination The last few weeks, the Internet Crime Complaint Center (IC3) reported they received complaints about the latest version of 'Hit Man Scam' which now tells people via e-mail they have been targeted for assassination. The complainers told IC3 that the email wants them to buy a security alarm so they can use that if they see suspicious activity. The e-mails were signed by Agent Bauer (remember "24" on TV?) of the fictional International Intelligence Bureau. It is always surprising how many people go into panic mode and start clicking on links to avoid a negative consequence. While most people know such an email is a hoax, the scammers obviously find enough people that respond to make it worthwhile for them keep the scam going. |
|||||||||||||||||||||||||||||||||||||||||||||
|
Easy
Password/PIN Hacking - courtesy of Forbes Magazine
And just as bad are the weak PIN codes people often set on their ATM/debit/credit cards. If you were to happen to lose your card somewhere, these are the first combinations that a criminal would try to access your account. These are the 20 worst PIN code combinations:
|
|||||||||||||||||||||||||||||||||||||||||||||
|
Two other scams are also worth mentioning. To start with, an email disguised
as a voicemail notification from Microsoft Exchange Server tries to get
users to double click a link to listen to the voicemail. The second one
is an email that appears to come from the FDIC and tries to get users
to follow a link to download "a new security version." RedFlags (Adobe PDF) |
|||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||||||||||||||||||
| Big
Brand Hijacking A customer reported about a fresh scam. The bad guys are getting quite inventive, especially with big brands. They are now causing confusion using the UPS logo with a phishing attack on both employees and people at the house. Have you ever noticed that when people get confused, they go blank for a moment? That is what the phishers are consciously exploiting: "Did I really send something that day? Perhaps it was another day and they got it wrong? What -is- this?" ~CLICK~ Big brand hijacking is extremely popular with phishers these days. Be especially careful when you get emails that use the following brands: UPS, FedEx, Amazon, DHL, Verizon Wireless, Internal Revenue Service, Better Business Bureau, Bank of America, and Facebook. Just the FedEx brand alone is 'stolen' daily and used in 1-5 million (!) phishing emails. |
|||||||||||||||||||||||||||||||||||||||||||||
| Tech Support Scams Telemarketing scams come in waves. In the past it was time-share condos, but now we hear horror stories about boiler rooms pushing tech support. People get harassed with phone calls at the most inconvenient hours, posing as Microsoft employees and trying to scam you into some kind of PC security service, because your machine is infected with malware. So, please let your friends know that phone scammers with foreign accents try to social engineer people to pay with credit cards and paypal for services that they don't need! |
|||||||||||||||||||||||||||||||||||||||||||||
| Olympics Scam Roundup Olympic organizers recorded 124 different scams so far but expect double or more. First, there is an "Invitation FACEBOOK - Olympic Torch" chain letter. It claims that your machine will be infected with malware but the whole thing is a hoax. Think before you click and do not forward. Next, scammers prey on Olympics Mobile game players. Not long ago, organizers of this year's Olympic Games released London 2012 - Official Mobile Game, a fun smartphone app for Android, iOS, and Blackberry users. But there are a few Russian websites claiming to be legitimate app markets and they host malware claiming to be the official London 2012 game. Be very careful downloading games for your smartphone. Then, there is a blizzard of bogus Olympics-themed emails that try to steal money and/or information. They offer fake last-minute tickets, memorabilia, tell you that you have won an "Olympic lottery" or that you can sign up for temp jobs online and make some extra money. These scam emails use well known brands, or even spoof the London Olympics. Delete all of these immediately. Especially do not click on any emails with pictures or videos about the Olympics, because clicking on one of these has a very high chance to infect your workstation with malware. Even search results on Google could be infected links so be careful. Last but not least, be particularly wary of text messages on your phone, that claim a golden medal win, or something else 'exciting'. The safe way to get information about the Olympics online is to go their official website. |
|||||||||||||||||||||||||||||||||||||||||||||
| Online Dating Beware, another honey trap is doing the rounds trying to snare people. This is something you could forward to all your friends as a good example of social engineering they should not fall for. Russian online dating scammers are currently spamvertising a fraudulent campaign attempting to socially engineer users into interacting with a bogus online dating service. What we have here is a recent example of one of the most prolific online scams, namely, Russian dating scams. The scam orbits around on the notion that lonely Internet users will engage in emotional and financial transactions with complete strangers based on their profiles and associated photos promising love, marriage, or friendship. The idea is to have users click on the link to a webcam or other services, but clicking on links like that is fraught with all kinds of risk. |
|||||||||||||||||||||||||||||||||||||||||||||