Thank you for visiting the Spyware-Net blog. As you’ve no doubt guessed, here we’ll talk about the latest happenings in the security space, provide you warnings about the latest malware tactics, and just overall talk about anything and everything spyware. And then some.

We hope you’ll visit now and then.

Jeffrey Pe Benito
Writer
FBM Software

The thing to remember when crunching the numbers for identity theft is that it isn’t strictly a cyber-crime ordeal. It’s really easy overlook that receipts in garbage bins, stolen wallets, or pilfered mail – all old school and all still highly effective- contribute to the over 50 billion dollars lost to ID theft annually. Phishing and credit card database hunting aren’t the only culprits. New technologies aren’t always the vectors.

That having been said, cyber-criminals seem to have developed a habit of finding new ways to steal your identity. The latest on that long line of worries is phishing via VOIP. An Info World article talks about how it’s being used - and why you should be concerned.

Jeffrey Pe Benito
Writer
FBM Software

It’s one thing for Direct Revenue to get sued. New York Attorney General Eliot Spitzer’s camp spared no media ammunition detailing their practices and motivations. About a month ago, when the suit was filed, internal emails between Direct Revenue’s management and the company’s exercises were made fair game. Their deliberate attempt to make their spyware stealthier, their experimenting with time intervals between showing pop-ups to see how those affect profit, their poring over how difficult the uninstallation should be – those were suddenly out of the closet, up for public scrutiny. And when Direct Revenue’s management called their own advertising tactics “hammering,” it really doesn’t leave very much to the imagination.

So again, it’s one thing for them to get sued. But Yahoo – altogether another matter. Ben Edelman has just filed a class action suit against the media giant, alleging that Yahoo’s practices included syndication fraud, among other things. An eWeek article talks about it here.

Jeffrey Pe Benito
Writer
FBM Software

So, ContextPlus has stopped distributing software. From their site, they prominently state,

Due to concerns over the practices of some of its distribution partners, ContextPlus has determined that it is no longer able to ensure the highest standards of quality and customer care and therefore is discontinuing further distribution of its software.

This is, of course, good news. But what’s particularly interesting about all this is the official reason they’re doing this - concerns over the practices of their distribution partners. This is all well and good, save for little concern that their behaviors - particularly Apropos rootkit techniques – are among the more documented ones in existence. And by the way, they mention this in the same breath as they state that there’s no uninstall available without contacting them. Nice.

Jeffrey Pe Benito
Writer
FBM Software

It happens in garbage bins and mailboxes, and in no small part, on user PCs as they surf. As last year’s databank heists have shown, it happens with big names that store millions of people’s credit card and social security numbers. Identity theft is not just happening, it’s happening on a scale larger than previously imagined.

But the thing that keeps identity theft from being a bigger threat than it already is – and remember, the costs are measured in tens of billions – is that personal data stored in databases aren’t easy to come by, even for serious thieves. Last year, 40 million credit card numbers were lost to hackers in the CardSystems fiasco. The FTC Chair had become a potential ID theft target thanks to a DSW data breach where 1.4 million numbers were lost. Those in mind, database mining still isn’t exactly commonplace - there are measures that require corporations to protect client information, although we won’t tackle HIPAA and GLBA here.

Which brings us to the 26.5 million veterans recently exposed as potential targets to identity theft. The scary thing is, their data wasn’t stolen in a company repository, in an office where there are required measures to minimize the chances of data theft. Their information was lost in an employee’s home, during a burglary. Which means that the only thing they actively carried out that made them susceptible to ID theft is complete information for the Department of Veterans Affairs. All a little bit scary.

A Reuters article talks about it here.

Jeffrey Pe Benito

Writer

FBM Software

It has been around for some time but it seems like, lately, it’s been picking up traction. Since last year, it’s become something of a common practice for malware creators to use tools that lock you out of your files – and then leave behind instructions to get your files back, effectively holding your system for ransom.

The coined term is “ransomware.” As with most things freshly coined and containing some measure of media hype, it’s probably smart to take all news regarding this with a grain of salt. Nevertheless, considering the quick pay off and the ease with which these can be launched, it’s yet another reason to keep your protection up to date.

Update: For a ransomware variant called “Archiveus,” BBC reports that the password used to unlock user drives has been cracked. The code, apparently contained within the malware itself, can be found in this article.

Jeffrey Pe Benito
Writer
FBM Software