7th Oct 2013 | Defeating spam, General Information, Security and Safety
I am writing about this particular scam because it is so plausible. (First, this does not originate from Microsoft, just people purporting to be from Microsoft.)
I have received a phone call. The person on the other end of the phone informs me that I have a problem with my computer. This is causing issues and may cause my computer to be blocked from the internet. Now, as someone who knows the capabilities of malware, this is not beyond the realms of possibility. The main slip-up was that they told me how to access Windows control panel. I did play along for a while before revealing that I do not use Windows.
Here is an article from someone who played along for a little longer before revealing his hand. He was blocked from the internet, because they deleted his network driver!
[ss_screenshot width=’300′ site=’https://blog.malwarebytes.org/intelligence/2013/04/phone-scammers-call-the-wrong-guy-get-mad-and-trash-pc/’ align=’right’]
My expectation was that they would install a Trojan… I had not expected them to be so ‘hands-on’. Other scammers may try other ways to affect your computer. In the most recent call, I asked them who they were calling from – the line went dead.
Do you have experience of this type of scam? Let me know, as I am thinking of writing a tutorial, if enough people are interested.
By the way, the linked blog is from Malwarebytes. I have used their anti-malware software with Windows to great effect.
Thanks
13th Jul 2013 | Defeating spam, General Information, Salesforce, Web Hosting
I could not help but have a chuckle when I saw this article: Kremlin to revert to typewriters. Even the secret services are having difficulty keeping their information to themselves. [ss_screenshot width=’300′ site=’https://www.telegraph.co.uk/news/worldnews/europe/russia/10173645/Kremlin-returns-to-typewriters-to-avoid-computer-leaks.html’]
To my mind this means that security is not an absolute, but a best effort. Reassuring then, that we use Salesforce, which is regularly audited as secure enough to hold credit card details (in properly designed apps). That I have been trained in security and hold a CompTIA Security+ qualification. In my past I have designed and set up security for financial transactions for boutique banks, private equity companies and hedge funds. We always use strong passwords and store the gateways to our clients’ worlds in securely encrypted stores with two factor authentication. If our computers are stolen, the hard disks are fully encrypted – inaccessible without the correct password. They will be automatically wiped the moment they re-connect to the internet.
Do criminals go after hard targets or easy ones?
What security do your IT companies use? I have seen scary cases where clients’ passwords were stored in unencrypted spreadsheets and databases!
We keep our clients secure, they sleep at night and do great business in the day.
23rd Oct 2012 | Defeating spam, General Information, Websites
In this article I will look at how you can prevent your email addresses being harvested from your website. It continues on from Defeating the Spammers pt1
The ‘traditional’ method was to put up a graphic instead of an email address. This may have prevented spammers from harvesting emails, but it also reduced the ease of use of the site. With a link the legitimate surfer could just click to open an email. With an image of the email address the surfer would have to type the email address into his/her email app. (If you linked the image to a mail address you would be back in situation where the harvester could gain your email address.)
Fortunately there is a WordPress plugin that addresses this exact problem.
CryptX
This will find anything on your WordPress post or page that looks like an email address and create an encrypted link. It can convert it to one of several different formats: john@cloud-genius.com can become:
- John[at]cloud-genius[dot]com – which is human readable, but cannot be clicked on.
- Can be replaced with a link that goes elsewhere.
- Can be replaced with an image of the email address
Or, my favourite
- Be replaced with a link that a robot cannot follow, but a human can. The text on the page is obfuscated so that a bot cannot read it.
If you need a page to not receive the Cryptx treatment, there is a tick box on the page editing screen that allows you to turn it off.
In total, it is easy to use Cryptx does it all for you. (Warning techie bit: you do not even have to put ‘mailto:’ links on your page.)
26th Sep 2012 | Defeating spam, General Information, Websites
One of the most disheartening things about having a new website is spam. It can attack in several ways:
1) The email addresses on the site are ‘harvested’ by spammers. All those email recipients then receive ever-increasing levels of unwanted emails.
2) The lovely form designed to receive information from interested customers starts to receive lots of spurious messages that appear to be meaningless drivel.
3) Comments are received on the blog that are completely meaningless, irrelevant and full of strange links.
Fortunately there are ways to defeat all of these problems, or at least get them down to manageable proportions.
This week I am going to look at getting rid of email link spam:
One of the reasons it happens is that email addresses are worth money. If a spammer can send out emails to lots of people and 1% of people buy something as a result then the more emails the spammer sends the more money he or she makes. A spammer sending 10 million emails will make 10 times as much as a spammer sending 1 million emails (all other things being equal). But, you say, these emails are not selling anything, how does the spammer make money? The links and pictures in the emails are there to test whether the email address is ‘live’ before selling it on!
The best way to stop this process from happening is to have the email addresses on your website unreadable by the harvesting program. Many people do this by putting up a picture of the email address rather than a real link. This causes inconvenience to your real visitors as they can no longer click on the link to send you an email, they have to type it themselves (and will inevitably make mistakes). This results in you receiving fewer legitimate emails and, if you are selling something, making fewer sales.
How about setting up links that are unreadable to the harvesting programs but are fully readable by humans and work properly as links?
Try this one: john@cloud-genius.com
If you hover your mouse over it you will notice (normally in the bottom left of your browser) that it produces gibberish. This is what a harvesting program (‘bot’) would see. It will look something like: javascript:DeCryptX(‘kpioAdmpve.hfojvt/dpn’). Click on it [the one that looks like an email address, not the javascript!] and it will open up an email to send to me.
Clever? In the next article I will explain how you can set this up.
Defeating the Spammers pt2
