Internet Security Zone Blog

Three Things to Fix on the Net

By Laura Yecies

These aren’t necessarily security concerns, but I also think security companies tend to be in a good position to be consumer advocates for good netiquette. In that spirit, here are three things that I’d like to see pass into the annals of Internet history:

#1 – Pop-Ups.
I hate pop-up ads. I don’t mind advertising per se, but pop-ups disrupt the fun. Even more, I can’t stand the “click” pop-ups, IE pop-up ads that only appear when you accidentally click your mouse on some area of a Web site (even without a link). For example, sometimes when I’m reading a long story, I’ll highlight text with the curser in order to not lose my place and better follow the content. But on some sites, this triggers a pop-up ad. Or even a pop-under (so when I close out my browser, I have 12 windows open). I think these bypass pop-up blockers because I’ve somehow initiated it. Even more, I’m annoyed when my pop-up blocker blocks a pop-up that I actually needed to see.

#2 – Blocked “back” actions.
Like most people, when I surf the Web I jump around a lot between sites and within sites. Recently, I’ve encountered a number of sites using that old 1998 trick of preventing my browser from returning to a previous page in my history that’s “off site.” In order to actually leave, in IE I have to hold the back-button and go back two pages and avoid the block. Why? Does the Web site actually believe I will stay? That I was accidentally leaving? And didn’t Google ban sites that do this from search results along time ago? Is it no longer enforced?

#3 – Sound.
I keep my sound function on, because I like to watch videos and listen to music directly out of iTunes. But in general, when I’m surfing the Internet, I do not want Web sites to make a peep. But alas, that’s another trend that seems to be reappearing, especially as advertisers seek “richer” ways to get in your face and companies put podcasts and steaming video to showcase products. But it’s incredibly startling and annoying when you drop in on a Web site and unexpectedly it talks to you. Or plays a cute jingle (or concerto). And unfortunately my home PC has no external mute button, so I have to click the volume icon, and wait for it to come up, and then mute it. And smile sheepishly at anyone nearby.

So how about a few compromises to Web operators: don’t pop-up things I don’t need or want, don’t hold my browser hostage, and allow me to choose if I want to listen to something or not. That would make me a happy surfer.

McColo Lesson Illustrates Bot Challenges

By Laura Yecies

In Mid-November, botnet herders and spammers took a major hit when San Jose, Calif.-based ISP McColo was shut down by its upstream ISP when it was reported to be acting as a host and conduit for cybercrooks. The effect on global spam numbers was immediate and significant, with some estimates claiming a drop of 60% or more.

Less understood was the effect on the distribution of other malware and child pornography, but regardless, it was a victory for the good guys.

But it was short-lived. Within a matter of days, the hackers behind the botnets managed to relocate to ISPs overseas and re-activate the networks of zombie PCs.

So while McColo might be out of McLuck, the crooks barely skipped a beat.

What’s the answer? If the Internet is going to stay true to its origins, a mish-mash of various independent networks all inter-connected; there may not be an easy one. ISPs are under the domain of local governments, and in many countries the government could either care less or may even be complicit thanks to rampant corruption or bribery. All cybercrooks need is a place to host their activities and connect to the Net.

And some overseas ISPs are proving all too willing to provide them a home.

Like other types of crime, I don’t think it works to only stop the criminal. Certainly, we want to pursue these guys to the ends of the earth, and I cheered the McColo shutdown. But even if you succeed in shutting down one crook, someone else will take their place. The only way to reduce cybercrime is to significantly reduce the opportunity.

That means more secure code, better proliferation of security software, and better education to help prevent people from turning into a zombie.

A little more about what McColo meant to you:

Botnets are groups of individual PCs (maybe yours) controlled by a remote hacker. People who have zombie PCs at some point were compromised by malware that infected their PC and enabled a hacker to gain full control…in many cases unbeknownst to the owner. Sometimes, the only symptom may be a sluggish PC or processing activity when you’re not doing anything.

Hackers steal the bandwidth (IE your connection to your ISP) of these networks of zombie bots to send out millions of spam messages that cannot be tracked back to the sender (they’re hiding because of the CAN-SPAM laws). They’ll also use your PC to host illegal pornography to avoid getting caught (and yes, the cops could show up at your door, and it’s not easy to explain how it got on your PC when you maybe didn’t even know it was there!). Additionally, hackers will use your PC to send out more malicious software in order to add even more victims to the network.

When McColo got shut down, if you were part of one of the botnets being hosted through them, your PC would have been freed, albeit temporarily.

How to avoid becoming a bot? Besides the normal proactive measures we advocate here, be aware. If your PC starts acting up, don’t blow it off. Run a security scan ASAP. If you are a bot, security software can remove the malware and give you back control of your PC.

Is your browser safe? Studies Say No.

By Laura Yecies

Last July, Brian Krebs at the Washington Post cited some daunting statistics regarding the security of browsers used by everyday people.

http://blog.washingtonpost.com/securityfix/2008/07/40_percent_of_web_users_surf_w_1.html?nav=rss_blo

The study, conducted by researchers from Google, IBM and the Communication Systems Group in Switzerland, relied on data from server logs provided by Google for search requests between Jan. 2007 and June 2008. The researchers found that of the 1.4 billion Internet users worldwide at the end of March 2008, 576 million surfed with outdated versions of Web browsers.

That means 40% of surfers are have little-to-no defense against browser attacks, most commonly attacks that target you when you arrive at an infected Web site.

For a long time, we’ve been strong advocates for patching all your software. It’s the first line of defense in an ideal world. But how many of us update every piece of software on our PC the minute it’s available? When was the last time you updated Acrobat? RealPlayer? Firefox? Your IM client? Flash? How many other programs have you downloaded that might occasionally have vulnerabilities or even exploits? It’s not practical to think you’ll always be patched 100% of the time.

This was exactly why we created ZoneAlarm ForceField a year ago (anniversary two weeks ago, congrats team!).

ZA ForceField creates a virtual bubble around your browser to prevent drive-by downloads and other browser flaws. It primarily runs in the background, so you don’t have to change your behavior or avoid typically risky places. Unlike warning mechanisms, ForceField protects you even if you make a mistake.

ZoneAlarm ForceField not only guards against Web-based attacks, but it can save you from making a costly phishing error. With advanced anti-phishing capabilities to protect you even from new phishing sites newly launched, even if you are fooled by a fraudulent e-mail posing as your bank or PayPal, ForceField will stay true.

We were first out of the gate with a true multi-layered consumer browser virtualization solution, but the strategy has been validated by other vendors in the enterprise space, and even by Google, who included a segment of browser virtualization in Google Chrome. We believe it’s the wave of the future available today, like a firewall for your browser.

You can get a free trial at www.zonealarm.com/forcefield

Facebook Virus Typifies Modern Attacks

By Laura Yecies

Is the current virus making the rounds on Facebook potentially devastating? Yes. Is it surprising? No.

Is it Facebook’s fault? No.

As I’ve said before, social engineering tactics are quickly becoming the attack-of-choice for hackers. There’s a simple reason – between security advances in the OS, more awareness of the critical nature of patches, and the evolution of security software (both in sophistication and user adoption), the most viable intrusion method is good old fashioned trickery.

According to the Telegraph…
http://www.telegraph.co.uk/news/worldnews/northamerica/3568900/Koobface-virus-targets-Facebook-members.html
“The virus spreads by sending enticing messages to Facebook friends with subject headers such as "Look you were filmed all naked!" or "You look just awesome in this movie".
If the recipient clicks on the supplied link, he is taken to a page that looks like the video-sharing website YouTube.
He is then told that he needs to download new software, supposedly the latest version of Adobe Systems Inc's Flash player, in order to watch the film clip.
The downloaded file contains the virus, which will then infect the computer and take users to contaminated sites when they try to use Google, Yahoo or other search engines.”
There are three main things you can do to drastically reduce your chances of being a victim, and allow you to enjoy all the fun of social networks like Facebook:

1. If a friend sends you anything to download, simply ask them first before actually opening it. This goes for e-mail, social networks or IM. BE SUSPICIOUS.
2. Keep your PC patched. This goes a long, long way, because most hacks take advantage of vulnerabilities in your operating system or browser.
3. Use and update security software, including: browser security with virtualization and download protection, a firewall, and anti-virus/anti-spyware.

Eye on…ZA’s Parental Control

By Laura Yecies

 

In a recent post, I talked about the challenges of protecting your kids on the Internet. Now, I want to talk about one of key weapons in your arsenal – the Parental Control feature in your ZoneAlarm Internet Security Suite.

 

You’ll find the Parental Control feature in the tabs on the left-hand navigation bar in your ZA user interface. It’s a deceptively simple feature – essentially, you can pick and choose what types of Web sites your kids are allowed to visit.

 

There are a wide variety of categories, enabling you to customize your protection depending on the age and risk of your particular child. For example, for a very young child with little experience on the Internet, you may want to restrict all “at risk” categories, and perhaps bookmark a few that your child is allowed to roam freely. This allows your child to learn how to use the Internet for research and entertainment.

 

For my children, because they are older (12 and 15), I chose to unmark some categories, such as MP3s, News, Online Games, Message Boards etc. Many of these sites aren’t inherently dangerous, but can lead to dangerous behavior or situations. So before I lowered the settings, I spent a little extra time discussing with them the dangers and helping them understand how to stay safe (although, in reality, they were also teaching me!). But it’s important for them to know that I’m aware of their activities.

 

Along that line, I also recommend keeping Internet-connected PCs in a central part of the home, so you can always keep an eye on Internet surfing. As long as kids think there’s a chance mom might walk by when their online, it’s unlikely they’ll push the envelope too far.

 

But what if you don’t have children, does this feature offer any benefit to you?

 

YES! Why?

 

Because this feature can prevent your browser from being redirected to dangerous Web sites. Or it can correct a mistake – for example, if you mistype a url or click on a trick link in a search engine. So even if you don’t have kids, use it!

 

Of course, if you’re using ZoneAlarm ForceField, you’ll also have protection against malicious Web sites. But every layer of security helps.

 

Ultimately, Parental Control is about giving you the means to keep your kids safe on the Internet. The Internet is a fun, educational and social tool that will enable your child to grow into tech-savvy adults, and you want to let them get the most out of it while keeping them safe.

Phishing E-Mails Still Clog Inboxes – How Do You Spot Them?

By Laura Yecies

As PC and browser security closes more and more holes, hackers are spending more time and effort finding ways to try to trick you into giving them access to your PC or giving up your personal data.

Phishing, or fraudulent e-mails posing as legitimate messages, remains a popular tactic by hackers. There’s little technical knowledge required to set up a phishing scam. All a person has to do is set up a real-looking Web site and spam hundreds of thousands of e-mail addresses, and wait for an unsuspecting victim.

Bank-related phishing e-mails remain the most popular, because we all notice a message from our bank and are likely to feel a sense of urgency to act. One common format is the “warning” e-mail. Ironically, hackers will base the theme on the premise that your account has already been hacked! One phishing e-mail I recently received came with the subject line, “Suspicious Activity Logged on Your Account – Please Respond Immediately.” The e-mail had very convincing graphics, and sounded alarming. I instinctively knew it was a fake, but because the e-mail did happen to branded with my bank’s name, just in case I called to make sure there were no issues with my account.   If you ever question an e-mail from a bank or credit card institution, just call you bank’s main number (but NOT the one in the e-mail…hackers use fake numbers too).

PayPal and eBay are also common themes used in phishing e-mails. In fact, a week ago I surfed over to Phishtank.com, a reporting site for phishing Web sites. Out of the top 50 most recently reported, 18 were fake PayPal sites, 6 were fake eBay sites, 22 were banks, and 4 were misc (including a fake MSN login Web site and a UK customs site).

There are two new ones that recently showed up in my inbox that I haven’t seen before. The first was from FedEx, telling me that my package was not delivered. Since I had recently sent a package, I was fooled! Luckily, when it asked me to track the package using my credit card, I wised up and went directly to FedEx.com to track my package (it had been delivered).

The second was from a dating site. The phishers put together a realistic looking dating site and ask you to join. It looks like a scheme to capture your passwords (based on the assumption you use the same or similar passwords for many different sites).

The lesson? Phishing e-mails have not abated. So when you receive a suspicious e-mail in your inbox, be wary. And when in doubt, use the phone. Your bank (assuming it’s still in business!) and other financial institutions won’t mind.

What Makes a Good Password?

By Laura Yecies

I have to admit, I got blocked out of an old Web e-mail account the other day. After I ran through my entire list of passwords I’ve used over the past decade or so, the system booted me out and locked my account.

It wasn’t that tragic. It’s probably been three years since I last even thought to check this particular account. I’d long ago trained just about everyone to use my Yahoo account. But during the (many) login tries, I was reminded of just how bad some of my passwords have been over the years. I mean, for the first five years I was on the ‘Net, I actually used my children’s name. Yes, true. BUT…in my defense, there was little to be concerned about in those days. Not only were hacks pretty unsophisticated, but the info in my e-mail was limited to kid pics and joke chain e-mails.

Passwords today are a prime commodity for hackers. Across multiple Web properties, we all tend to use the same password over and over, or variations. So once they’ve cracked it, chances are the damage can go much further than reading your love letters in your e-mail.

My best advice, be creative, and conscientious when choosing a password.

• Use a minimum of eight characters
• If allowed, use both upper-and-lower case letters
• Include at least one number and at least one character (IE # $ @ &)
• Use random characters instead of words or phrases found in the dictionary
• Make it easy enough to remember!
• Reset your passwords immediately if you have any suspicion it’s been stolen
• IF you must write it down, make sure you keep the paper in a secure location. Do not tape it to your PC or leave it in the desk drawer.

And don’t pick your pets, your (or your spouse’s) maiden name, birthdays, anniversaries etc. These are all commonly used and even more commonly guessed.

Also, did you know that we offer a Password Manager in our Partner Store? You can find it here: http://www.zonealarm.com/store/content/catalog/catalog_partners.jsp

Six Steps to Security

By: Laura Yecies

 

Everyday, the news reports new Internet/PC vulnerabilities, exploits, and dangers. To anyone serious about security, it can seem pretty daunting. So I decided to boil down my top strategies and tactics to protect you against the vast majority of attacks. It takes a little technology and a little behavior modification, but it can be done without a lot of effort, if you arm yourself with a little knowledge.

 

1. Avoid Web Traps: I don’t ever click a link in an e-mail that appears to be from a bank, eBay, my stock brokerage etc. I simply visit the site directly, or call if the e-mail indicates a potential problem. It’s an easy step to avoid phishing attacks. When using search engines, I’m always wary of possible “bait” sites set up to direct me to a malware-infested trap. There’s no easy indicator of a search trap, but if something seems amiss or my PC suddenly acts up, I immediately disconnect from the Net and run a security scan.

 

2. Shop with a Singular Purpose: When I want to buy something online, I typically visit shopping sites directly, instead of following links in e-mails, portals, coupon sites or shopping directory Web sites. It’s the best way to know that I’m shopping at the right site, and not a spoof. I also have a low-limit credit card that is only for use on the Internet. If it’s compromised, I won’t lose much and won’t have to disrupt the rest of my life with a new credit card number. And I always, always check to make sure my transaction session is encrypted using SSL security (the URL will be “https” and a little lock icon should appear in your browser).

 

3. Keep an Eye on Your Identity: I signed up for a service that monitors my credit report every 90 days. In fact, adding the ZoneAlarm ID Theft Protection Service to the ZA suite was one of my first initiatives at the company a couple of years ago.

 

4. Reveal as Little as Required: The more a hacker knows about you, the more valuable your profile becomes on the black market. On social networking sites etc, I try to leave a little to the imagination. Once you post personal info and pictures, it can be almost impossible to wipe it clean. I also usually avoid viral links being passed around, unless I know the person who actually created the content. And I research new applications before downloading them. A simple Google search can be very revealing.

 

5. PATCH YOUR PC!!! I’ve previously mentioned this, but I wanted to reinforce it (again and again!). Keeping all the software on your PC up-to-date is the single most effective way to keep your PC inaccessible to hackers. So whenever I get a little alert saying that I have out-of-date software, I immediately accept the offer to update it. And I always, always make sure my operating system and browser have all the latest security patches. I even have a calendar reminder set up to remind me of Patch Tuesday!

 

6. Turn On Your Technology. A two-tier technology solution is necessary in the current threat environment. I secure my OS (I still run XP, but this goes for

Vista

too) with a firewall, antivirus and antispyware with the ZA security suite. I also have taken the time to configure all my settings and spam filter. And, not surprisingly, my favorite new technology is ZoneAlarm ForceField.  It allows me to virtualize my browser to keep the Web junk and drive-by spyware from reaching my PC. That way, even with all my other precautions, if I make a mistake I’ll still be safe. 

 

What are some of the ways you stay safe online?

Browser Bugs Can’t Beat the Bubble

By Laura Yecies

 

We keep getting reports of Web sites being compromised. Whether it’s a hacker hosting a new malware-infested site and baiting Web surfers through popular search engines, or ad servers on legitimate Web sites being compromised, the browser continues to grow in popularity as the latest attack vector for cyber crooks.

 

ZoneAlarm ForceField was created to specifically to block and repel Browser Bugs. By encapsulating your browser in a sort of virtual “bubble,” any attacks that manage to bypass all the security layers are kept within the bubble, neutralized and away from your sensitive files.

 

ZA Forcefield currently secures Internet Explorer and Firefox. Recently, Google launched a brand-new browser called Google Chrome. Interestingly, Chrome appears to include an application virtualization technology (reported by the media as utilizing technology from Google’s 2007 acquisition of GreenBorder Technologies). While ZoneAlarm ForceField’s virtualization and security features are far more complete and engineered specifically for browser threats, we couldn’t have asked for a better validation and endorsement of our browser security strategy, even if we’re pretty sure that wasn’t Google’s intention.

 

You can read more about ZoneAlarm ForceField’s browser virtualization technology and benefits here. What do you think? Are you using ForceField? Have you come across Browser Attacks? I’m definitely interested in your feedback.

 

On an unrelated note, this is a very interesting story about so-called Password Recovery services.

 

http://www.darkreading.com/document.asp?doc_id=163471&WT.svl=news2_2

 

Advertised as a way to break into your own Web-based e-mail (IE Yahoo Mail, AOL Mail, Hotmail, Gmail etc), these services found usually through search engines can be hackers masquerading as legit. Beware. While some may provide a good service, more likely than not they’re making their money off people trying to break into someone else’s e-mail.