the best defense

PandaLabs, Panda Security’s anti-malware laboratory has drawn up a ranking of the most widely used scams over the last few years. These confidence tricks, which are still in wide circulation, all have the same objective: to defraud users of amounts ranging from $500 to thousands of dollars.

Typically, these scams follow a similar pattern: initial contact is made via email or through social networks. The intended victim is then asked to respond, either by email, telephone, fax, etc. Once this initial bait has been taken, criminals will try to gain the trust of the victim, finally asking for a sum of money under one pretext or another.

According to Luis Corrons, Technical Director of PandaLabs, “As with all the classic scams that predate the Internet, many of the numerous users that fall for these tricks and lose their money are reticent to report the crime. And if recovering the stolen money was difficult in the old days, it is even harder now as the criminals’ tracks are often lost across the Web. The best defense is to learn how to identify these scams and avoid taking the bait”.

More information at the PandaLabs website.

My answer is ‘Almost‘!

These sites (and there are plenty of copycats) appear to operate as eBay-type auctions, but they have several important unlike eBay, when the auction ends, it doesn’t!

These are not real, fair auctions like you’d expect – you bid in tiny increments, say a penny – but, every penny costs you around 60 cents (or equivalent local currency) and every bid costs money so the more bids, the more money the ‘house’ gets.

It’s obvious;y a huge money spinner – a few ordinary goods seem to be going for $5, when in reality they can be paid for many times over by the losing-but-paying other bidders.

This system and the interminable nature of these auctions (the clock gets reset every time a new bid is received) means that the end result is a lottery. This is a fact that these sites want very much to suppress as the legal rules change a great deal if this is the case, but the fact remains that any logical examination of the system points to a lottery or some other form of gambling.

I tried this out for a day, lost $50 and helped the profits of Swoopo incrementally. I’m sure there are plenty of people who have the time and money and persistence (and luck) to actually snag one of those HDTVs for $20, but they are very much in the minority.

My advice? Avoid these sites like the plague that they are – if you want to gamble, buy a lottery ticket or play online poker, just don’t waste your time and money on Swoopo!

Large parts of West Africa have communications blackouts after damage was found on the major undersea fiberoptic cable, known as SAT-3, which supplies countries such as Benin, Togo, Niger and Nigeria. The cable runs from Portugal and Spain to South Africa, via West Africa and has cut 70% of Nigeria’s bandwidth, causing severe problems for its banking sector, government and mobile phone networks.

The effects are expected to last as long as two weeks and I will be interested to see if this makes any difference to the numbers of 419 (aka AFF or simply ‘Nigerian’) scam solicitations, considering that the major source of the scourge is the West coastal coutries of Africa due to the endemic corruption and poor policiing in the region.

I look forward to the first email ….

“Due to the recent undersea cable fault, banking institutions had to resort to using cash-only transactions and I have found a large chest containing a huge amount of cash in US Dollars – I need someone in the west to help me to move it to the USA …..”

A backup, the West Africa Cable System linking southern and western African countries with Europe should be in service by 2011. This link will massively improve Internet speeds for South Africa, Angola, the Canary Islands, Cameroon, Nigeria, Ghana, Cote d’Ivoire, Cape Verde, Portugal and the United Kingdom. It will also bring submarine links online for the first time to the countries of Namibia, the Congo and Togo.

We shall see….

The US Trustee Program, part of the US DoJ, runs the Federal bankruptcy system, monitoring the conduct of people involved in bankruptcy cases, ensuring compliance with applicable laws and investigating bankruptcy fraud and abuse.
They recently issued the following warning for people who are already overwhelmed by the legal juggernaut of a bankruptcy filing and are at serious risk of being scammed out of what little they have left.

DON’T GET “LOCKED OUT” OF YOUR HOME BY A BANKRUPTCY SCAM OPERATOR

Are you having trouble making your home mortgage payments? Are you facing foreclosure on your home? Get all the facts before you pay someone to help you work out your mortgage problems.
“Bankruptcy foreclosure scams” target people whose home mortgages are in trouble. Scam operators advertise over the Internet and in local publications, distribute flyers, or contact people whose homes are listed in the foreclosure notices. Sometimes they direct their appeals to specific religious or ethnic groups.

These scam operators may promise to take care of your problems with your mortgage lender or to obtain refinancing for you. Sometimes they also ask you to pay your mortgage payments directly to the scam operator. They may even ask you to hand over your property deed to the operator, and then make payments to the operator in order to stay in your home.

But instead of contacting your lender or refinancing your loan, the scam operator pockets all the money you paid, and then files a bankruptcy case in your name — sometimes without your knowledge.

A bankruptcy filing often stops a home foreclosure, but only temporarily. If a bankruptcy is filed in your name but you don’t participate in the case, the judge will dismiss the case and the foreclosure proceedings will continue.

If this happens, you will lose the money you paid to the scam operator — AND YOU COULD LOSE YOUR HOME. You will also have a bankruptcy listed on your credit record for years afterward.

Proceed with care if an individual or company:

• Calls itself a “mortgage consultant,” “foreclosure service,” or similar name.
• Contacts or advertises to people whose homes are listed for foreclosure.
• Collects a fee before it provides services to you.
• Tells you to make your home mortgage payments directly to the individual or company.
• Tells you to transfer your property deed or title to the individual or company.

If you can’t pay your mortgage, call your mortgage lender or contact a lawyer for help. Your state or local bar association may be able to help you find low-cost legal help.
If you think an individual or company is running a mortgage foreclosure scam, contact the local office of the United States Trustee. The United States Trustee is a Justice Department official who monitors the bankruptcy system. Look for your local United States Trustee’s telephone number in your telephone directory or on our web site at www.usdoj.gov/ust/eo/ust_org/office_locator.htm.

Cyber Security Tip ST06-008        Safeguarding Your Data

When there are multiple people using your computer and/or you store  sensitive personal and work-related data on your computer, it is especially important to take extra security precautions.

Why isn’t “more” better?

Maybe there is an extra software program included with a program you bought. Or perhaps you found a free download online. You may be tempted to install   the programs just because you can, or because you think you might use them   later. However, even if the source and the software are legitimate, there  may  be hidden risks. And if other people use your computer, there are  additional risks.

These risks become especially important if you use your computer to manage  your personal finances (banking, taxes, online bill payment, etc.), store   sensitive personal data, or perform work-related activities away from the   office. However, there are steps you can take to protect yourself.

How can you protect both your personal and work-related data?

1. Use and maintain anti-virus software and a firewall – Protect yourself against viruses and Trojan horses that may steal or modify the data on  your own computer and leave you vulnerable by using anti-virus software and a firewall (see Understanding Anti-Virus Software and Understanding  Firewalls  for  more  information).  Make  sure to keep your virus definitions up to date.

2. Regularly scan your computer for spyware – Spyware or adware hidden in software programs may affect the performance of your computer and give  attackers access to your data. Use a legitimate anti-spyware program to   scan your computer and remove any of these files (see Recognizing and Avoiding Spyware for more information). Many anti-virus products have incorporated spyware detection.

3.  Keep software up to date – Install software patches so that attackers       cannot  take  advantage  of known problems or vulnerabilities (see       Understanding Patches for more information). Many operating systems  offer automatic updates. If this option is available, you should turn it on.

4.  Evaluate  your  software’s settings – The default settings of most       software enable all available functionality. However, attackers may be able to take advantage of this functionality to access your computer. It is especially important to check the settings for software that connects to the internet (browsers, email clients, etc.). Apply the highest level  of security available that still gives you the functionality you need.

5.  Avoid unused software programs – Do not clutter your computer with       unnecessary software programs. If you have programs on your computer       that  you  do  not use, consider uninstalling them. In addition to       consuming system resources, these programs may contain vulnerabilities       that, if not patched, may allow an attacker to access your computer.

6.  Consider creating separate user accounts – If there are other people       using  your  computer,  you  may  be worried that someone else may       accidentally access, modify, and/or delete your files. Most operating       systems (including Windows XP and Vista, Mac OS X, and Linux) give you       the option of creating a different user account for each user, and you       can set the amount of access and privileges for each account. You may       also  choose  to have separate accounts for your work and personal
purposes. While this approach will not completely isolate each area, it       does offer some additional protection. However, it will not protect your       computer against vulnerabilities that give an attacker administrative       privileges. Ideally, you will have separate computers for work and       personal use; this will offer a different type of protection.

7.  Establish guidelines for computer use – If there are multiple people       using your computer, especially children, make sure they understand how       to  use  the  computer and internet safely. Setting boundaries and       guidelines will help to protect your data (see Keeping Children Safe       Online for more information).

8.  Use passwords and encrypt sensitive files – Passwords and other security       features add layers of protection if used appropriately (see Choosing       and  Protecting  Passwords  and  Supplementing  Passwords for more       information). By encrypting files, you ensure that unauthorized people
can’t view data even if they can physically access it. You may also want       to consider options for full disk encryption, which prevents a thief       from  even starting your laptop without a passphrase. When you use       encryption, it is important to remember your passwords and passphrases;       if you forget or lose them, you may lose your data.

9. Follow  corporate  policies  for handling and storing work-related       information – If you use your computer for work-related purposes, make       sure to follow any corporate policies for handling and storing the       information.  These  policies  were  likely established to protect       proprietary information and customer data, as well as to protect you and       the company from liability. Even if it is not explicitly stated in your       corporate policy, you should avoid allowing other people, including       family members, to use a computer that contains corporate data.

10. Dispose of sensitive information properly – Simply deleting a file does       not completely erase it. To ensure that an attacker cannot access these       files,  make  sure  that you adequately erase sensitive files (see       Effectively Erasing Files for more information).

11. Follow good security habits – Review other security tips for ways to       protect yourself and your data.
_________________________________________________________________
Author: Mindi McDowell   Produced 2006 by US-CERT, a government organization.
<http://www.us-cert.gov/cas/tips/ST06-008.html>

I am an old Unix dude, I have installed more different versions of Unix than most people – Everything from Sco Xenix/286 thru to Centos5.2 and I don’t usually have much problems – but as time wears on, my brainDisk is starting to squeal and it’s not as fast at random access as it used to be so I was really happy when I rented a server with Cpanel/WHM installed on it.
For those who don’t know, Cpanel is the web-based interface to everything you will never learn on a Unix server – plus, the WHM super system allows you to carve off a chunk and sell it or give it away to your pals, reasonably confident that they won’t/can’t screw it up.
Add in virtual web/mail/log server management and lots of useful pre-installed tools and you have a system where you rarely have to get your hands dirty under the #hood.

Well, I love Cpanel now and I have grown to rely on it (curses!) so when it comes to creating my own server, so I can save money on a dedicated one I find I need it to get things done (and my old stuff transferred.

The problem with CP is that it costs $$money. between $30 and $48/month. and. I. just. don’t. want. to. pay. that. any. more….. so….

Piracy is out – mainly because you need to register the license with CP and also because that’s bad!:’(

Perhaps I could install it, setup my system the way I want and then after a month or so, hand it back??

well, no apparently – most people (Including themselves) seem to be of the opinion that to uninstall CP, you should really re-install Linux…. kind of defeats my object here!

so…. alternatives, anyone?

There are a few – some other commercial (pay $$ for) such as DirectAdmin and some Public Domain ones (Web-CP, WebMin/VirtualMin). So I started evaluating these free Cpanel Alternatives ….

1. WebMin/VirtualMin

Looks like it will do the job – only one of the alts that I’ve heard of and actually used before. Installs easily enough and looks nice – has a fine range of functionality but what lets it down is it’s non-simplicity. Cpanel’s approach is to show you a bunch of things that you may want to do and asks sensible questions (with usually relevant tooltips close by) so help you accomplish your requirements.  WebMin takes the ‘I’ll help you to write the configuration files correctly’ approach – you really have to know what you’re doing and in a lot of cases, the input fields are just blank with no clue as to what to put there.

WebMin Configuring Backup Example Screenshot

This probably highlights the major difference between CPanel/WHM and the rest of the Server Admin systems out there – CP/WHM does some pretty radical things to your server when you install it and this is why it’s so hard to uninstall. The other systems kind of leave things as they are and just act as configuration helpers. As an example, see the two screenshots of the ‘backup’ functions.

Cpanel Domain Owner Backup Page

2. Web-CP

Much, much, harder to install and harder to find the installation instructions too. but seems pretty good so far.

I had problems with the PHP startup scripts being written with DOS line endings which confused the life out of me for a while until I found it.  Still not able to start the system up but suspect it’s something to do with the line that reads:

$args = trim(next($HTTP_SERVER_VARS["argv"]));

# Shouldn’t that just be ARGV for shell scripts?)

… I’ll continue and let you know how I get on.

The Internet Watch Foundation (IWF) is a UK-based Hotline for reporting illegal content. Specifically Child sexual abuse content hosted worldwide and criminally obscene and incitement to racial hatred content hosted in the UK.

It’s remit is to protect the citizens of the UK from illegal and offensive online content by allowing the public and IT professionals to report sites with potentially illegal online content. They work in partnership with the ISPs, law enforcement, government, the education sector, charities, international partners and the public to minimize the availability of this content.

They seek to find and report on child sexual abuse content hosted anywhere in the world and criminally obscene and incitement to racial hatred content hosted in the UK.

They use a ‘notice and take-down’ service which alerts ISPs to potentially illegal content on their servers and provide information to law enforcement partners in the UK and abroad.

As a direct result, less than 1% of child sexual abuse content, known to the IWF, has apparently been hosted in the UK since 2003, down from 18% in 1997.

As sexually abusive images of children are primarily hosted abroad, they provide a dynamic list of child sexual abuse URLs.

The IWF want web citizens, in the UK and abroad to report all and any content to them http://www.iwf.org.uk/reporting.htm

Scamdex is of the opinion that only community-led notification can help protect our children from being exposed to this obscenity and hopefully prevent children being exploited to feed this industry.

Report illegal Content

The scam that inspired a poem
WalesOnline – United Kingdom

I JOINED our local OAP group last year and was asked to bring along my favourite poem. Not having an interest in poetry or having a book of poems meant I was in quite a quandary. However, the day before the meeting I received a scam letter, so I wrote this poem:

It’s a Scam

Today I received a letter that contained some very good news,

I’d like to impart its message and ask you for your views.

The letter said that I had won nearly 50,000 pounds.

So why am I suspicious, I surely had no grounds?

The letter came from Holland and it said it was not a joke.

So I’d like to share this fortune with all of you good folks.

They asked me to send them a very little cheque.

I’m writing to thank them, and thought what the heck.

Deduct the £20 I owe – deduct it from the prize.
And send the balance back post haste. I await a big surprise.

DILYS MORGAN, Church Terrace

6 Bay Area Women Arrested In Gift Card Scam
CBS 5 – San Francisco,CA,USA
Sacramento police announced Tuesday the details of a gift card scam that has netted the arrests of six women, some from Richmond in the Bay Area of Northern California, that are allegedly part of an international crime ring.

A group of women, who investigators are calling the “Richmond Girls,” allegedly went on shopping sprees around Northern California, using gift cards with stolen credit card information on them, police said.

Sacramento County Sheriff’s Department Detective Sean Smith said that the women, who targeted stores from Hayward to Roseville in eastern Sacramento County, earned the nickname because all of them are either from or have close ties to Richmond. Smith also said that there’s a “significant number of other suspects we’re attempting to identify” in the investigation.

The women allegedly wired more than $120,000 to various countries in Eastern Europe, where investigators believe individuals paid for the stolen account numbers. Sanna Louise “Shilo” Cross, 23, and Dawn Edward, 31, were arrested on Dec. 30, 2007. Cherice Dempsey, 37, and Melissa Anderson, 29, were both arrested on Jan. 19.

Davina Hollier, 27, was arrested Feb. 19, while Ebony McDowell, 21, the last woman of the group to be arrested, was taken into custody on April 10.

The suspects are being held at the Sacramento County Main Jail, and face more than 180 charges of identity theft and fraud between them. Investigators recovered more than 65 re-encoded gift cards and more than $1 million in fraudulent credit card transactions, along with $45,000 in cash and an estimated $80,000 in merchandise.

The investigation, spearheaded by the Sacramento Valley Hi-Tech Crimes Task Force, is still ongoing, and has involved various police organizations in Northern California, including Richmond police. The U.S. Secret Service also joined the investigation to look into the international aspect of the case.

Scamdex advises all US-based victims of Internet Crime to contact their local Police Unit for  ‘High-Tech’ Crimes.

Scam uses text messages to lure victims
Kentucky.com – Lexington,KY,USA

Last month, hundreds of people in Lexington, KY, received an automated telephone message that states it is from Commonwealth Credit Union and claims the person’s account has been suspended because of suspicious activity. The message told the people to call a phone number, which asked people for bank account numbers. The text message read, “Dear Commonwealth CU Member, Your online account is limited for security purpose.”

The text message asked the person to call a number with a Vermont area code for more information.

Callers told the BBB that an automated message then asks callers to enter their debit or credit card numbers.

Gloria Thomas, the fraud and loss-prevention manager at the credit union, said the credit union isn’t the only place being targeted. But she said last month that the CCU might be targeted because it’s a large