As of February 26, 2013, five of America’s largest internet service providers will be putting into effect a copyright policing and enforcement program aimed at curbing online piracy of copyrighted digital content. Officially known as the “Copyright Alert System” but dubbed “Six Strikes” by the media and watchdog groups, the program is the result of a collaborative effort between the entertainment industry and the five ISP’s (AT&T, Cablevision, Comcast, Time Warner Cable and Verizon) aimed at stemming illegal piracy made trivial and commonplace by peer-to-peer filesharing protocols like BitTorrent and popularized by infamous sites like The Pirate Bay. According to the Center for Copyright Management (formed specifically to manage this program), the aim of CAS is not punitive, but educative. ISP customers suspected of engaging in infringing behavior will be warned multiple times, may have their bandwidth limited or accounts temporarily disabled until they attend what you might think of as the copyright law version of traffic school.
What this means for you:
The subject of copyright infringement is a touchy subject on the digital frontier. As you might have suspected, there is a lot of money at stake, and the entertainment industry has enough lawyers to invade a small country. They also have plenty of powerful friends in Washington, DC who aren’t above floating ruinous legislation to protect Hollywood’s royalties at the expense of hard-won digital freedoms and privacy. Rather than seeing everything setback decades by politicians and lawyers, the ISPs have struck a deal with Hollywood to police themselves to keep the government out of their business. Digital rights activists have raised a stink about the “Six Strikes” program, primarily because several of the big 5 haven’t really formalized the rules that will be used to govern how infractions will be handled. On top of this, there is a $35 charge to appeal any supposed infraction, driving the “innocent until proven guilty” crowd into a frenzy. It’s still way too early to tell if or how this program will work, but it’s moving forward, whether the internet likes it or not.
Just this past week I received 2 emails that looked very legitimate, but were in actuality very cleverly designed phishing emails meant to trick unwary individuals into making some bad decisions. And when I say “cleverly designed” I mean that even to my experienced eye, the emails looked very real, with properly implemented graphics, clever use of recognizable branding and even using text from actual legitimate emails to camoflauge the hook.
How did I know they were not the real deal? Well, first off, Gmail’s spam filters flagged them right away (score one for Google!) but there were a couple of other things that immediately marked them as fishy, and a little more investigation revealed the true colors of these sophisticated phishing attempts. These types of emails will happen more frequently once the cybercriminals realize how much more effective they are, so I think it’s time I showed you some techniques for spotting counterfeits before they trick you.
Apply Common Sense
Are you a customer of the company, service or brand that sent you an email asking you to do something? Is what they are asking you to do something that makes sense for that particular company/service/brand? In the example here, I received an email that looks like it was from ATT notifying me that my monthly account was ready for review. OK, this would have passed the “smell test” for me a couple years ago, but I’m not an ATT customer anymore. However, ATT is the largest cellular provider in the US, so it’s not inconceivable that many, many people thought this was a legitimate email.
Who’s the email from? And who is the actual recipient?
In the fake ATT email, you can see clearly that the sender on this email is totally bogus (outlined in RED at the top). Why would ATT be sending an email from the IRS? Always look closely at who the sender was on the email, especially if it looks like it’s something you might expect to see in your email box. Is that email address actually correct. Call up the sender to ask if they actually sent the email.
In my second example, the sender actually looks like it might be legitimate at a passing glance. They got the domain right, so now you have put your security glasses on and take a harder look. This particular email was sent to a recipient address that is an alias for a webmaster inbox for one of my clients. I know for a fact she uses Quickbooks, but I also know she would never have used this particular email address to register the product or create an account because it goes to my email box, not hers. On top of this, there are several other addresses in the CC field (including 2 that weren’t actually email addresses), something you should never see when receiving a legitimate, automated email from a company like Intuit.
But once again, the content looks legitimate, and it’s not unlikely that the phisher landed a few hooks, considering how widely used Quickbooks is in the business world. So, let’s dig a little deeper!
Are the embedded links legitimate?
Outlook provides a handy feature that allows you to roll over a link in an email and see the actual URL of the link, even if it isn’t typed out in the email (which it never will be in a phishing attempt). Webmail users may not have this function handy, depending on the browser and the service you are using. Regardless of what program you are using, NEVER CLICK LINKS THAT YOU CAN’T ACTUALLY VERIFY, AND IF YOU HAVE THE SLIGHTEST HINT OF DOUBT, STOP CLICKING AND START DIALING FOR A HUMAN! (If ever there was a justified need for all caps and bold, that was it.)
In my two examples, you can clearly see that neither of the “call to action” links actually go to sites that have even the remotest connection to either of the services they purport to represent. Why would my American ATT account need me to click a domain in Australia? Why would I ever download US Withholding Data from a domain with “latina dot com” in the name?
What this means for you:
These types of emails will continue to become harder to spot, and I will guarantee you that the cybercriminals will continue to improve their counterfeiting techniques once they see how effective they are as compared to the past easy-to-spot and detect trash that normally fills our Junk folders. Unless the good guys come up with better ways to protect us (and they haven’t yet!), the best defense is (as my good friend Prof. Moody likes to shout) “Constant vigilance!” Take the time to read all emails carefully, and think twice before clicking once.
In a rare public admission, Apple has indicated that some of its own internal Macintoshes have been compromised in a cyberattack that security researchers believe similar to the one that breached Facebook last week. Announcements from Apple of this type are very rare, as Apple has long touted one of the strengths of its platform was how “unhackable” it was compared to Windows. In this particular case, Apple has little to lose, as it’s pointing the finger of blame for the hack at Java and a vulnerability that was taken advantage of to gain access to Apple employee computers.
What this means for you:
Apple’s recent breach is just one more notch in cybercrime’s belt that includes a long list of illustrious companies like the Wall Street Journal, Twitter, Facebook, Jeep, and Burger King, not to mention the numerous intrusions of government agencies and countless hacks of businesses that go unnoticed and un-reported. In the case of the Apple and Facebook breaches, the source has been tied to a mobile development website that both company’s employees accessed, and according to both companies, there appeared to be no evidence that customer data was compromised in the attacks. As I’ve maintained all along, the business world is now entering a new age of security unknowns as serious criminals continue to exploit technology to serve their needs, and are able to outspend and outgun the average small and medium size business. Before the age of computers and the internet, your odds of being targeted by a criminal organization were minute compared to today, where organized crime can now “crowd-source” affiliate-based networks that pay anonymous hackers in any number of a dozen untraceable ways to rent out zombified computers and webservers by the hour for a handful of dollars, and use pre-scripted attacks to launch massive, shot-gun targeted campaigns that only need to snag a small percentage of victims in order to be profitable. This is not some imaginative, cyberpunk movie plot – it’s happening right now, as you read this article. Moving forward, the only way to combat this growing threat will be a combination of vigilance and smart investments in security technology, policy and training.
Industry analysts are taking off their rose-colored glasses after examining the results of BlackBerry’s largely lackluster launch of their OS 10 platform. Original estimates had the newly renamed company (formerly Research In Motion) selling as many as 1.75 million new phones following the Jan 30 debut. Using words like “soft launch” and “modest demand”, analysts are now revising their estimates down by as much as 83%, putting BlackBerry’s comeback into serious doubt.
What this means for you:
It’s probably too early to call it, but BlackBerry really needed a big splash with the 10 launch and to keep surging forward with momentum to stay on par with upcoming anticipated Samsung and Apple launches on tap for Summer. Early reviews indicate that version 10 phones have caught up with the competition, but the technology hasn’t leapfrogged the competition, something BlackBerry really needs to do to gain any footing in this market, as they can’t outspend Google, Apple or even Samsung. If your company is heavily invested in BlackBerry and still supports it for corporate communications, you can’t go wrong with a Z10 or Q10, as long as your IT department has committed to keeping their BB infrastructure current. If they seem even the littlest bit wishy-washy on that subject, or they already support Android and iOS devices, you’ll make a safer investment in another platform.
Microsoft is (re)launching Outlook.com and consolidating its various “free” email service domains under the Outlook.com brand in an effort to regain the former glory it once held with Hotmail.com which has since fallen to a distant third behind Google’s Gmail and Yahoo Mail. Microsoft estimates it will be spending anywhere from $30 to $90 million in marketing in all the major media over the next 3 months on a combination of attack ads aimed at Gmail users as well as informational campaigns they hope will help persuade users to switch (back, in many cases) to Microsoft.
What this means for you:
If you already have a Hotmail.com or MSN.com email address and you haven’t already converted over, you’ll be migrated over to Outlook.com gradually as Microsoft consolidates the services under the new brand. If you are considering switching (or opening another webmail account), the only feature Outlook.com is offering that differs from the competition is Contacts stored in your online address book will automatically update information based upon information available on social media platforms like Facebook, Twitter and LinkedIn. Gmail does this with G+ but you have to resort to third-party extensions and services to mine the other social media sites for this information. Beyond this feature, Outlook.com is mostly playing catch-up to Gmail, though their marketing dollars may steal some of Yahoo’s marketshare despite the company’s revamp of its webmail service a little over a year ago.
Windows users will probably be unsurprised to note that Adobe’s ubiquitous Flash plug-in requires yet another patch. This time, unfortunately, Adobe is scrambling to release version 11.6 to rectify 2 serious security holes that are already being exploited in the wild, and not just on Windows machines; Macs and even Linux is affected by the latest flaws.
What this means for you:
The flaws fixed by the above release may allow malicious websites to install malware either from just visiting a compromised website, or by redirecting your browser to open infected Microsoft Word documents or Adobe PDFs. There are malware websites being found on the web right now that can take advantage of unpatched Flash plugins and they will wreak havoc on your computer.
Patch Flash now. Here’s how:
- Go to Adobe’s website: http://get.adobe.com/flashplayer/ (works for any platform)
- Windows: Go to your Control Panel and look for the “Flash Player” control panel icon. Click the “Advanced” tab and then the “Check Now” button.
If you want to verify you’ve updated to the correct version, you can check it by visiting this link after patching: http://www.adobe.com/software/flash/about/
Microsoft seems to be taking Fat Tuesday to heart: this month’s package of software updates includes a whopping 57 fixes for security flaws across most of its current product line. Microsoft isn’t the only one patching: Adobe also has a handful of security fixes for its products – the most commonly installed are Flash and Acrobat. The security exploits patched are just as potentially dangerous as the vulnerabilities patched in Internet Explorer.
What this means for you:
Ideally, you either have an IT department watching out for you and making sure your software is being updated in a timely fashion, or you have Automatic Updating turned on and will automatically download and apply all critical and important patches released by Microsoft and Adobe. In the case of the former, it may actually be a week or two before the actual patches are applied, as many IT departments routinely test all MS patches before distributing them through the enterprise, mostly to ensure Microsoft doesn’t break something proprietary to your company’s platforms. And in the case of this month’s Patch Tuesday, they will have much more to test and deploy.
If your computer is relying on automatic updates received via the internet, make sure you pay attention to the little message popups in the lower right corner of your screen. Windows Update will let you know when its doing its thing, and will also notify you when it has finished applying the necessary patches. Not sure whether your machine has been patched? For most versions of Windows (XP, Vista, 7) you can click the Start Menu and select “All Programs” and scroll until you find “Windows Update”. Review the information on the screen, and if you have any questions, don’t hesitate to call us for a second opinion!
If Forbes is writing about it, then it must be entering the mainstream, right? According to their calculations, the latest jailbreak for the iPhone’s iOS 6 has been installed over 7 million times since its release last week, which is roughly equivalent to about 2% of the overall iPhone population, and that number is likely to grow over time to 10% according to Jay Freeman, the administrator of the “unofficial” jailbroken iPhone app store, Cydia.
“Jailbreaking” (similar to “rooting” in the Android world) is basically a process that removes the restriction of installing apps from a third-party app store not controlled by Apple. Apps found at Cydia commonly enable iPhones to do things that normally wouldn’t be possible under Apple’s strict programming and content guidelines, such as (before iOS 6) multitasking or something as simple as setting Google’s Map app as the default mapping application when you click on addresses on your iPhone.
What this means for you:
The explosion in popularity of smartphones and tablets has infused cultures everywhere with elements of hacking and tinkering as people become more comfortable with customizing the phone rather than just using “as directed”, right up to the point where they hit the limitations of the device, and in the case of the iPhone, the (sometimes arbitrary) limits set by Apple. Over the years, jailbreaking, once considered arcane and only for the most foolhardy hacker, has now become something simple enough that you could walk your grandmother through the process.
Let’s be real – jailbreaking your grandmother’s iPad is probably not necessary, but if she could do it, then surely you can do it. And if it means being able to finally get rid of Apple’s miserable Maps application and return to trusty Google Maps once and for all, jailbreaking starts to look a lot more inviting. In the end, jailbreaking is about deciding whether Apple’s vision for how you should use your phone or tablet meets your needs (which it does for the majority of Apple customers) or whether you are really ready to “think different.”
Caveat: Jailbreaking your iPhone or iPad, while legal in the USA, will void your warranty according to Apple.
In case you haven’t been keeping up on your popular internet news, Applebees has stumbled into the hornet’s nest known as the “Internet backlash” following the termination of food server Chelsea Welch. Ms. Welch posted a receipt she received from a customer who wrote a decidedly controversial message on the bill, refusing to pay the restaurant-suggested tip that Applebees (not the food server!) adds for serving large parties. Being of the digital age, Ms. Welch did what many do (right or wrong) when something offends them: they share it on the internet. And as things sometimes do on the internet, outrage happens.
Here’s where the fun begins. Instead of circling the lawyers around the Applebee’s camp and running some professional damage control, someone with control over Applebee’s Facebook page took it upon themselves to argue with the entire internet. They did it poorly and clearly without “adult supervision.”
Rule #1 of the internet: “Don’t get into an argument on the internet.”
Rule #2 of the internet: “Don’t post in anger.”
What this means for you:
If you are in business, and your business has an online component: Facebook page, Twitter account, G+ presence, etc., how you use that account is possibly one of the most powerful brand management tools in your arsenal. As a famous superhero is known to say, “With great power comes great responsibility.” Part of that responsibility is understanding exactly what impact your status update, tweet, post, etc. can have. In the case of Ms. Welch, she didn’t have a large audience to start with. I’m sure she shared the photo with only a handful of friends…who then went on to share with their friends…and so on, and so on. You get the picture. Also keep in mind that if you have employees, make sure they understand the responsibility they have in representing your company’s brand on the internet, officially, or informally. You don’t need to police their Twitter postings and friend them on Facebook, but it doesn’t hurt to gently remind them that if they are representing themselves as employees of your firm, that representation doesn’t end the minute they clock out at work, especially if they clearly (and proudly) display you as their employer on their social media profiles.
You may have already come across this strain of malware before: a big, official looking notice pops up on your screen accusing you of software piracy. You are offered the opportunity to pay your “fine” online, which appears to be the only way to remove the notice and get back the use of your computer. This form of extortion scam is known as “scareware” and has been around for years. Most technology users are savvy enough these days to no longer fall for this particular tactic, but a new form of scareware accusing users of viewing child pornography is now circulating that is giving even the most hardened malware veterans cause to pause. As you can imagine, being accused of this particularly heinous activity puts potential victims into the uncomfortable position of sharing this with someone else, something that they may be willing to avoid by paying what now may seem like a reasonable “fine”. Cybercriminals are counting on the squeamish and privacy-conscious nature of most people in this regard, and it’s likely we’ll see a huge uptick in this type of scareware tactic.
What this means for you:
No law enforcement agency in the United States issues fines via the internet, and they certainly don’t hold your computer hostage until the fine is paid. If your computer is infected with a scareware virus, immediately disconnect it from the network and contact your IT department or technology consultant, regardless of what you are allegedly accused of doing by the scareware notice. Any IT professional worth a darn will be intimately familiar with this particular type of malware and should be able to remove it from your computer, BUT, depending on the level of infection, your data and identity may be at risk, as well as your personal information, especially if you’ve accessed online bank accounts or other sensitive online information. You’ve backed up your important data on that computer right? Because many times, it’s easier to wipe a computer completely clean and start with a fresh operating system rather than cleaning up a malware infection. This is yet another reason in a long list on why you should be backing up your data regularly.
Image courtesy of Stuart Miles / FreeDigitalPhotos.net