Posts tagged 'conspiracy'

Are cyber-scammers creating their own fake news stories to exploit? Jon Thompson investigates.

The UK media recently exploded with news of a new phone-based scam. Apparently, all that’s needed for fraudsters to drain your bank account is a recording of you saying “yes”. It runs as follows:

1. Someone calls and asks if you can hear them
2. They record you saying “Yes”
3. They take your ID and money

What doesn’t ring true is the lack of detail between steps 2 and 3. How, exactly, do attackers use this snippet of audio without the rest of your identity? Myth busting site Snopes has the answer: they don’t. A good half hour of searching also failed to turn up a single verified victim of the scam despite a huge number of almost identical news reports warning people about it.

Whether it’s a hoax or not, it’s certainly easy to see how cyber-scammers can take advantage of the generated fear. Your “bank” calls, says you’ve been the victim of this very scam, and asks you to visit a special web site to enter your details and get your money back. Previous cybersecurity incidents certainly provide good evidence that such secondary scams may soon plague a phone near you.

Remember the TalkTalk hack of October 2015 and the scandalised headlines that followed? Four million customers were suddenly at risk, according to some ill-informed reports. The supposed Russian jihadist gang behind the attack was ransoming the purloined data. The Daily Express even reported that they were already raiding the accounts to fund their evil deeds.

The truth was far more mundane. A 17-year-old boy from Norwich had discovered an SQL injection using a vulnerability scanner, and syphoned off about 157,000 account records. However, with this data potentially in the wild, any attempted fraud experienced by TalkTalk customers was suddenly blamed on the hack.

In fact, telephone-based cyber-fraud is a numbers game. The more calls you make, the more likely it is that you’ll hit the right set of circumstances. It’s a brute force attack, and that’s exactly what the scammers started to do. Nearly 18 months later, they’re still finding ways to use the hack as a pretext to call unsuspecting customers.

At the time, some customers even reported that their broadband was being deliberately slowed by criminals, who then called them offering to fix the problem in exchange for visiting a phishing site and entering account details to get a special refund. Again, this is a numbers game: for every set of circumstances that make the scam work, there might be thousands of calls to people with the wrong broadband provider or who have no bandwidth problems. It’s never the precision spear phishing attack it’s reported to be by the bemused victims.

So, high profile hacks can subsequently spawn profitable campaigns for fraudulent callers keen to cash in on the chaos and fear. The problem is, juicy high profile hacks come along at random. What’s needed is something more dependable.

This brings us back to the supposed “Can you hear me?” scam. Several reports in the past few days on Who Called and other very active nuisance call sites have mentioned the scam in passing as something else to look out for, but none say that this was the focus of the call being reported. The story has begun to take on a life of its own, but without any direct evidence that the scam actually exists.

Could it be that scammers themselves have concocted and spread a fake news story, which they intend to subsequently exploit with a campaign? It’s not that great a leap of imagination, given the innovations developing in other areas of bulk cybercrime, such as ransomware. Only time will tell, but the next few months should be fascinating for both threat watchers and cyber-criminals alike.

Posted on March 7th, 2017 by admin and tagged conspiracy, cybersecurity, education, fake news, online banking, phishing, scam, talktalk

Anti-virus is bad, dead (again) and worse, its corpse is poisoning the ecosystem of good software.

There is, according to former Mozilla developer Robert O’Callahan, negligible evidence that anti-malware software produced by third-parties provides any additional security. His arguments have spread from his blog to Twitter and then to IT news websites like IT Pro and The Register.

We test anti-malware software and have, as a team, being doing so for years. We think we have plenty of strong evidence that third-party anti-malware software provides improved security over that which comes with Windows by default. Our enterprise, small business and consumer reports are free to download.

There is no doubt that updating your operating system makes it more secure. We’ve run tests to prove that this oft-quoted advice is based on real, reproducible data. But what we’ve also seen is that adding a decent anti-virus package to a good patching schedule raises protection levels even higher.

There is a difference

To say that all anti-virus software is equally (in)effective is just plain wrong, and there are plenty of results from different testing labs that show this. You may not trust all of those labs, and you may have problems with some (or all) of the ways that they test, but I would strongly suggest that we can’t all be wrong.

Our position on the Microsoft anti-malware included with Windows is that it is far better than it used to be, but that some commercial third-party packages are consistently stronger.

Why do people bash ‘anti-virus’ all the time?

Different individuals and companies have axes to grind when it comes to anti-virus or, to use a more modern and appropriate term, ‘anti-malware’ software.

• New anti-malware vendors sometimes disparage more established vendors as providing less sophisticated products as a marketing tool.
• Windows developers at Microsoft don’t like the perception (which is sometimes the truth) that anti-malware products slow down Windows. When a user has a bad Windows experience, for whatever reason, Microsoft feels the impact.
• Other developers hate that anti-malware products embed themselves into Windows in sometimes strange and unusual ways, causing potential havoc with their own efforts and possibly introducing new and powerful security vulnerabilities. Anti-malware vendors argue that they need to do this to prevent particularly nasty threats from digging in at the lowest security levels within the operating system.
• Users who have never (knowingly) suffered a malware attack often question the very necessity for anti-malware.
• Some testers/ researchers make it their life’s mission to discover technical problems with anti-malware, sometimes apparently taking the position that “anti-malware is bad for you,” rather than, “you need it, it’s a bit broken but here’s how to fix it.”

So is anti-virus the ultimate solution?

I have never seen a perfect anti-malware product, in terms of the protection that it offers, the performance impact that it makes and the additional attack surface that it exposes. But nor have I encountered a perfect operating system, browser or user.

We can throw away our anti-malware software when our operating systems are fully secure; we, as users, stop clicking on links to malware; and criminals and other ‘agencies’ stop attacking our computers en-masse.

Posted on January 27th, 2017 by Simon PG Edwards and tagged anti-virus, conspiracy, insecure security products, security testing, test results

One problem with the internet is that anyone can set themselves up as an expert. There’s money to be made from convenient messages. Examples abound in nutrition and health, as well as many other areas.

The ensuing nine pages of comments were a tour de force of ideas, theories and claims, but a recurring theme was distrust. Many commenters simply don’t trust what they don’t understand, and they don’t understand computers or AV. 

It took a few seconds to find similar examples from other forums, some dating back to 2005 and even 2002. There are many more and they usually cover the same ideas, but a common theme is still distrust. Compounding this, some commenters vaguely remember something about John McAfee once claiming to have written viruses to create demand for his first AV product, which of course proves everything.

 

When GCHQ recently proposed their DNS filtering technology to block malicious domains, there was instant outrage. The Guardian, which broke the Edward Snowden story, has little love for the Cheltenham Doughnut, and was predictably upset. As usual, it’s the public’s comments that are really interesting. 

If the public won’t listen to the government, who will it listen to? Who is it listening to?

Posted on September 20th, 2016 by admin and tagged anti-virus, conspiracy, education, insecure security products