Thursday, March 10, 2005

A Simple, Elegant Information-Delivery Solution or Theft Vulnerability [The article describes the solution to data transportation/delivery problem involving 12GB that was delivered to a consultant on 30 CD-R discs. The consultant considered other media/methods to return the data to the client- DVD-RW, FTP, external hard drives, USB drives, and finally settled on a "small" MP3 player - the Entempo Spirit 20GB MP3 player for $130 delivered. He plugged in the Spirit, copied the data to it, wrapped the device in a sheet of bubble wrap along with a USB cable, stuck it in a flat-rate USPS Express Mail envelope, and dropped it off at the post office. He didn't need to include a power supply or any software; the software was unnecessary (at least using Windows XP), and the internal battery will run the unit for about 10 hours. Neat huh? Scary huh!] 4:51:19 PM    comment []

SANS "Ouch" Newsletter ( Vol. 2 Num. 3) Excerpts What To Avoid This Month I. Email from people trying to get you to divulge private details These are often trying to steal your identity (and your money) I.1 Washington Mutual Bank - 'Unauthorized Access to Your Washington Mutual Account' I.2 SouthTrust Bank - 'Notification From SouthTrust Online Banking' I.3 Huntington Bank - 'Huntington Bank Security Update Notification' I.4 Paypal - 'Unauthorized Access...' I.5 MSN - 'Microsoft Network customer data verification' I.6 KeyBank - 'SECURE YOUR ACCOUNT NOW' I.7 Google - Email Lottery International Details About Things To Avoid I. Email from people trying to steal your identity (and your money) I.1 Washington Mutual Bank - 'Unauthorized Access To Your Washington Mutual Account' The Bait: An email sent to you for Unauthorized Access to your account. What it tries to make you do: Click on the link within the email. Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-24-05_Wamu/02-24-05_Wamu.html I.2 SouthTrust Bank - 'Notification From SouthTrust Online Banking' The Bait: Email stating that your account may have been accessed by someone else. What it tries to make you do: Click on the suspect link. Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-22-05_SouthTrust/02-22-05_SouthTrust.html I.3 Huntington Bank - 'Huntington Bank Security Update Notification' The Bait: New payment security for the bank. What it tries to make you do: click on the link within the email. Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-18-05_Huntington/02-18-05_Huntington.html I.4 Paypal - 'Unauthorized Access...' The Bait: An email that alerts you to unauthorized access to your PayPal account. What it tries to make you do: Click on the link it provides Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-17-05_Paypal/02-17-05_Paypal.html I.5 MSN - 'Microsoft Network customer data verification' The Bait: Email sent to you to verify your information on your account. What it tries to make you do: Click on the link within the email Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-15-05_MSN/02-15-05_MSN.html I.6 KeyBank - 'SECURE YOUR ACCOUNT NOW' The Bait: Create a secure code for access to KeyBank. What it tries to make you do: Click on the picture link Where you can see how it actually appears: http://www.antiphishing.org/phishing_archive/02-08-05_Key/02-01-05_Key.html I.7 Google - Email Lottery International The Bait: Google Lottery Winner What it tries to make you do: Reply to the email and take money from you. Where you can see how it actually appears: http://www.hoax-slayer.com/google-lottery-scam.html IV. Avoiding Phishing Scams: Tips from Fraud.org: Information, tips and contact information for avoiding and reporting phishing. http://www.fraud.org/tips/internet/phishing.htm V. Email Worm Spoofing: Spoofing Explained: Easy-to-understand information on how worms use spoofing to spread. http://www.hoax-slayer.com/email-worm-spoofing.html 4:25:26 PM    comment []