Rules to Protect your Kids and Family (from Eset's Newsletter)

Here is a great general list of eight rules from eset.com - as part of their Cyber Security Awareness month. They have a tremendous news blog at eset.com discussing all kinds of recent Internet and personal privacy issues.
This list is important as a general rules list for families and individuals,  to help protect identity and online scams.

CyberTips: How to protect your kids onlineUse of social media in all age groups almost seems ubiquitous.  Advising children and teens in both the cyber world and the real world is  a difficult issue to navigate. Here are some tips you should consider to keep your children safer on social media sites (and some of them might help you as well): Let your kids know that you trust them, but that you (and they) can’t always trust others online. Be sure they understand that the reason Facebook is free is because Facebook sells their data to others. Remind them to review their Facebook and other social media accounts' privacy settings, at least monthly. Get a Facebook account yourself and ask your children to “friend” you. Get them to change the settings in their smartphone to remove location data from pictures. Be sure they know that pictures taken by friends and posted on social media are out of their control and can be embarrassing, if not worse. Encourage them to keep their whereabouts private (don’t “check in” to a location). Remind them that “online is forever.” What seems cool today can ruin a relationship or a job opportunity in the future.

The only addition that Menlo Technology encourages is to design two different identities for social websites. Each identity should have an incorrect spelling of a last name like Smiith or possibly SmithFB and completely different birthday and year of birth. To not forget these profile changes, using the same incorrect spelling and date of birth will make it easy to use on a regular basis. 
For more news of current topics and news about the Internet, check out our other blog as well at http://menlotechnical.wordpress.com

How Sophisticated is a 2008 Computer Trojan?

On December 17, 2007 a Symantec security researcher Liam O Murchu discovered a Trojan that is called  Silent Banker. While McAfee names the same Trojan Spy-Agent.cm, it is the same beast. According to the Symantec website, the Trojan horse program was identified perform the following functions:

...records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker.

Since this discovery it was reviewed again in October 2008 and had grown very sophisticated since it was discovered. According to this review, the software digs deeper into the affected computers, by using rootkit technologies which once installed, sits under the Windows operating system - which means it is even harder to detect by anti-virus software. This Trojan horse has regular communication with its authors, and maintains the website pages for over 400 financial institutions around the world, including the major US firms. When an infected machine his directed to a bank like Chase, the user is immediately redirected to a fake version of the Chase site, with a replica version of the bank's webpage. From there, it skims the user name and password (even for the highly acclaimed two factor authentication bank sites). This infection continues to update itself and send user name and password information back to the Trojan authors and can exist on computers until the machine is completely reformatted and reinstalled.

Menlo Technical Blog II

As the computer security industry grows and more people have sophisticated computers in the most remote places on Earth, street scams and gimmicks common place to other cities and countries are brought inside an average computer user's home and inside a corporate network.

Sophisticated programs can jump onto a home or corporate laptop and report back to their makers on user names and passwords used by people to websites like banking and brokerage accounts. More than simply logging these user names and passwords, the programs can monitor and track what is displayed by bank websites. They use not-so-sophisticated means of triggering computer users to gain access to this information; something as simple as designing an email that makes a person THINK they have to log in to a common website - like Facebook or Chase Bank - yet the link is a fake but almost indistinguishable from the official website. 

Corporate (aka Enterprise) computer users need to re-adjust their thinking to believe potentially everyone is a suspicious character, not just those outside of their 'circle of friends'. 

Human interaction has many security features taken for granted that is used each and every day. Features such as:
-the exact tone of a person's voice, 
-the precise image of a person, 
-their movements and body language, 
-the language phrasing, 
-smell of another person. 

All of these are kinds of authentication reminders that are taken for granted when interacting with people day to day.

While socializing online we are blind to these physical world security features built into our daily interactions. We use something like a "friend authentication" but accommodate for the online world restrictions. We allow for a certain flexibility when we don't have physical visual queues, like slightly strange behavior in what is written by people we know. To complicate this matter, instead of a familiar and live one-on-one interaction, many times it is one-to-many missing many of the common queues we use to socialize with a person - like personal jokes, movements and gesticulations. Many times, an email is written to more than one person, a blog post written for many to read, a Facebook wall posting to an audience, or a tumblr link or twitter post.  The familiar tone which people speak to relatives and in-laws maybe alarmingly strange to a friend. Everyone has a slightly different level of humor and communication with each of their various friends, especially in social media.

When a program is designed by a hacker, it usually tries to 'play' in that socialization realm of unfamiliar behaviors. Presenting a plea or request pretending to be a person they are not, they use a kind of 'hook' to snag people emotionally into their scam. 

Each aspect of online life and technology is leveraged differently, by different hackers. Mostly hackers are using social engineering to gain access to an important piece of your identity that gives them access to all of your personal information and family money institutions.

Hackers socially engineer through such means as:
-fake email notifications of a purchase with a confirmation link
-a fake UPS or US Post Office email that installs a fake virus that claims to be an anti-virus program
-notifications of a Facebook account update
-a free fun video game for a child or gambling site for bored person that requires a small installation of a program with hidden components that captures your keyboard use
-a link in an email or webpage to update information, that injects a program into the computer to track keyboard movements
-a .pdf file that is attached to an email, from a friend or contact who had their email or address book accessed by an rogue program 

These are ONLY SOME examples of the mechanics of a scam; to make people secure in a relationship and then use this trusted relationship within a context that makes you vulnerable.  These scams mostly are trying to hook people by relating to issues based around love, pain, politics or money - and use this hook as a means to distract while hiding their real intent.

As a information technology security firm, our goal is to secure corporate networks, help enterprises design reliable backup plans, and make everyone more aware of the types of Internet and computer attacks that threaten enterprise intellectual property.

This blog - as well as our other Menlo Technical Word Press Blog - will be used by Menlo Technology Consulting to announce products, services and current trends in Information Technology Security.