Security Researchers Warn Of Christmas Related Scams And Malware

Security researchers are warning online users that scammers and cybercriminals have ramped up the number of emails, text messages and social media posts used to spread scams and malware during the holiday season.

McAfee has issued it's 2012 edition of its 12 scams of Christmas list which features several approaches that aren't entirely new, but are rather new versions of some of the same old scams. These include social media scams utilizing channels, like Facebook and Twitter, malicious mobile apps, traditional phishing emails and even a new approach to instant messaging scam that targets Skype users.

As social media has grown so to have the numbers of scams targeting users. McAfee warns that users of Facebook and Twitter need to be extra cautious when liking Fan Pages, clicking on fake alerts from friends’ accounts that have been hacked, taking advantage of raffle’s, ads and deals that you get from “friends,” or installing suspicious “holiday deal” apps. Fake fan pages and app can be used to give your private data away or even target you for more dubious phishing attacks.

Smartphone are also a growing segment being targeted by scammers. Malicious Mobile Apps are becoming more prevalent as smartphone users are becoming more app crazy. To date there have been over 25 billion apps downloaded for Android devices alone! But as the popularity of applications have grown, so have the chances that you could download a malicious application designed to steal your information or even send out premium-rate text messages without your knowledge. Consider this: A recent study found that 33% of apps ask for more information than they need, such as access to your contacts or location.

Apps alone aren't the only risk smartphone users face. “SMiSishing” or phishing via text message is just like its email counterpart. Scammers send out official sounding/looking SMS Text messages to temp victims to reveal information or performing an action you normally wouldn’t do. This could be anything from logging into a fake account to verifying personal details and information.

Security researchers from Symantec are warning about a flood of the traditional email phishing scam "You Have Received a Christmas Card". A large number of emails have been intercepted by the security firm that follow the traditional greeting card scam that uses a legitimate looking "You Have Received a Christmas Card" email to trick users into download a malicious file for visit a malicious site.

These E-Cards type scams are nothing new having gained popularity several years back when E-Cards became a popular way to send a quick “thank you” or holiday greeting. While most e-cards are safe, some are malicious and may contain spyware or viruses that download onto your computer once you click on the link to view the greeting. Others ask you to click on an attachment to view the card, and then download a Trojan onto your machine. Users need to stay vigilant and pay close attention to the links contained in the email and the "from" line to make sure it is actually from a known source.

Tip: How to Protect Yourself Against Scams During the Holidays

1. Stay suspicious—Be wary of any offer that sounds too good to be true, and always look for telltale signs that an email or website may not be legitimate, such as low resolution images, misspellings, poor grammar, or odd links.
2. Practice safe surfing—Find out if a website is potentially dangerous before you click on it by using a safe search plug-in such as McAfee SiteAdvisor. SiteAdvisor uses easy-to-read red, yellow, and green check marks to rate websites when you search for them.
3. Practice safe shopping—Stick to reputable e-commerce sites and look for a trustmark that indicates that the site has been verified as safe by a trusted third-party, like the McAfee SECURE™ mark. Also, look for a lock symbol and  “https” at the beginning of the web address (as opposed to just “http”) to see if the site uses encryption to protect your data.
4. Use strong passwords— Make sure your passwords are at least eight characters long and contain a variety of letters, numbers and characters that don’t spell anything. Avoid using the same password for your important accounts, and never share your passwords with anyone.
5. Be careful when clicking—Don’t click on any links in messages from people you don’t know, and if you come across a shortened URL, use a URL expander to see where the link is directed to before you click.
6. Use a comprehensive computer security— You need complete protection that includes anti-virus, anti-spyware, anti-spam, and a firewall and make sure it is up to date. Online security and safety protection, such as McAfee All Access, can help protect all of your devices – PCs, Macs, smartphones and tablets – from holiday-related malware, phishing, spyware, and other common and emerging threats.
7. Educate yourself— Keep up-to-date on the latest scams and tricks cybercriminals use so you can avoid potential attacks. You can find helpful information on the McAfee Blog and the McAfee Advice Center.

New Scareware Targets Mobile Phone Users

A new fake antivirus suite has popped up this time targeting users of mobile operating systems like Android rather than traditional PC based OS's.

Late last week Kaspersky Lab researcher Denis Maslennikov posted details of the new threat on the Kapersky labs Securelist blog. As with traditional variants the new "scareware" or "ransomware" utilizes a replica of legitimate anti malware software to trick users into installing malicious programs that then steal private user information or encrypts hard drives and extorts money from the owner to decrypt the data.

Maslennikov says that cybercriminals are using black SEO for redirecting users to web pages which emulate AV scanning. All a user has to do is a basic Web search for some of the more popular mobile applications, such as the mobile version of the opera Web browser. The users are the redirected to scam Web sites offering "free" virus scans of mobile devices, including Android.

The website then proceeds with a fake scan of the device returning a false "positive" result. In turn encouraging the mobile device user to "activate" security protections on their device by clicking on a link in the scan results. Clicking that link downloads and installs a malicious application that Kaspersky detects as Trojan-SMS.AndroidOS.Scavir for Android. In the case of a non-Android device the user will be asked to download ‘VirusScanner.jar’: a file which is detected by us as Trojan-SMS.J2ME.Agent.ij.

When the application executes , the user is asked to press the ‘Continue’ button if he wants to launch VirusScanner with some options like ‘Turn on multi-level protection’, ‘Disable remote control of a device’ or ‘Turn on web site scanning’. But in fact after pressing ‘Continue’ this app will send SMS messages to expensive premium rate numbers.

The FTC Begins Reimbursing Rogue Antivirus Victims

The Federal Trade Commission (FTC) has begun sending out reimbursement checks to more than 300,000 people scammed by a rogue antivirus software (also know as scareware) which held a victims computer hostage demanding payment for bogus security software to alleviate the symptoms.

The payments come as the result of lawsuits and a subsequent $8 million settlement reached between the agency and several vendors of the malicious software.

Several companies agreed to surrender the more than $8 million total in ill-gotten gains to settle FTC charges that they used deceptive ads to trick consumers into thinking their computers were infected with viruses or spyware, and then sold them software programs such as Winfixer, Drive Cleaner, and XP Antivirus to "fix" their non-existent problem.

Will the software often charged users more than $100 the average amount of the checks will be $20, however the FTC has said the exact amounts will be based on the amount of individual loss.

Approximately 320,000 checks will be mailed by the FTC's settlement administrator, Epiq Systems. Consumers who believe they are entitled to a refund or have questions may call the settlement administrator toll free at 1-877-853-3541 or visit www.FTC.gov/refunds for more information.

Beware Japan Earthquake Scams And Phishing Emails

The sad reality of life is that scammers will use any chance they can to bilk unsuspecting people from their money. With all the attention the earthquake and tsunami in Japan are receiving its likely that we'll see an influx of scams and phishing emails related to the incident. Meaning people truly wanting to help the victims of this sad incident need to take caution and be on the look-out for suspicious emails and websites. Below is some very useful information that should help keep you safe and keep your money out of the hands of scammers.

The Internet Storm Center (ISC) issued a warning on its Web page Friday morning warning readers to expect "emails (sp) scams and malware circulating regarding the recent Japanese earthquake."Examples of Tsunami-related spam have already shown up in spam filters, according to the Web site spamwarnings.com.The ISC warns users should avoid opening questionable attachments or clicking suspicious links within any unsolicited emails. Users looking to make donations via website should also been warned that scammers have become adept at using search engine optimization (SEO) strategies to place scam Web pages high in the search results of major search engines like Google.

You should always verify your links and double check the websites and web address before you donate. For instance users wanting to donate to the Red Cross should go directly to RedCross.Org. When you decide to donate make sure you are on a secure page. Look in the address bar for the HTTPS:// security protocol.

Here's a good list of reputable organizations accepting donations (via MSNBC):

• Using your cell phone, you can text-message donations of $10 to the Red Cross. Text the letters REDCROSS to 90999 to make the $10 donation, or visit the organization's website.
• The International Medical Corps is putting together relief teams, as well as supplies. The organization is in "contact with partners in Japan and other affected countries to assess needs and coordinate our activities,” said Nancy Aossey, IMC president, on its website. You can donate here. Or, you can text MED to 80888 to donate $10 to emergency relief efforts.
• Save the Children is accepting donations for its Children's Emergency Fund. "We are extremely concerned for the welfare of children and their families who have been affected by the disaster. We stand ready to meet the needs of children who are always the most vulnerable in a disaster,' said Eiichi Sadamatsu of the organization in a statement. You can also text “JAPAN” or “TSUNAMI” to 20222 to donate $10.
• GlobalGiving, based in Washington, D.C., is providing relief and emergency services to victims of the earthquake and tsunami. Text JAPAN to 50555 to donate $10.
• The Salvation Army, which has had a presence in Japan since 1895, is sending an assessment team from Tokyo to the city of Sendai "to assess damage and will begin providing basic necessities (food, water, etc.) beginning as soon as possible tonight or tomorrow," a spokesperson said. In Tokyo, the Salvation Army "opened its main building to help shelter commuters who were unable to reach home. They served hot drinks and packed meals." You can text JAPAN or QUAKE to 80888 to make a $10 donation to the Salvation Army’s relief efforts.
• World Vision, with a staff of 75 in Japan, focuses its relief efforts on children. Visit the website to donate, or call 1-888-56-CHILD (1-888-562-4453). You can text “4JAPAN” or “4TSUNAMI” to 20222 to donate $10.
• The mGive Foundation, which helps with mobile donations, said these groups are also accepting text-based donations: Convoy of Hope, text TSUNAMI to 50555 to donate $10; World Relief Corp. of National Association of Evangelicals, text WAVE to 50555 to donate $10. "When prompted, mobile donors should reply with YES to confirm a one-time gift," the foundation says. "The $10 one-time donation will appear on the donor’s next mobile bill. All donations are tax deductible and receipts may be printed" from the mGive site. "Message and data rates may apply."
• Facebook has a Disaster Relief page with lots of good information about organizations that are offering aid, and that you can help, in turn.
• Portland, Ore.-based Mercy Corps  is "accepting donations to help survivors of Japan's earthquake and tsunami through our longstanding partner, Peace Winds Japan." Donations will go to meeting the "immediate and longer-term needs of the survivors," a spokesperson said. You can text “MERCY” to 25283 to donate $10.
• Microsoft has a Disaster Response Effort underway. "We are taking a number of steps, including ensuring the safety of our employees and their families and proactively offering customers, partners and local response agencies technical support to help ensure business continuity," the company said. (Msnbc.com is a joint venture of Microsoft and NBC Universal.)

ScareWare Now Features 'Live Tech Support'

Nicolas Brulez of Kaspersky Labs has discovered that scareware vendors have ramped up their rogue AVs and are now spreading this malicious software with an “Online Support” button. Users installing the fake anti-virus software Security Master AV and clicking on the 'Online Support' button are directed to a chat window in which they can ask questions, or get "tech support", directly from the scareware 'vendor'.

Pressing Support takes you into a live chat with the rogue AV Tech Support. Brulez says he wondered whether it was a bot answering questions based on keywords or real people – and he reports, "yes, they turned out to be real!"

Kaspersky Labs learned that they not only offer Technical Support by chat, but also by phone and email. The email is especially useful if you don’t speak English. The live chat tells you (in English) to send an email in your native language to a given email address to receive support in your native language.

Once you are in the live chat one of three 'tech support agents' (Debora Brown, Kendra Grace or David Lee) attempt to convince victims in fluent English that their free trial software is genuine adding that the first rogue AV is a ‘Free Scanner’ only and that in order to remove the infections users will need to install the bogus full product. The newer products “clean” the machine, unlike the previous ones.

Below are some videos captured by Brulez and the Kaspersky Labs team:

This new hands on approach is like nothing ever seen before. It shows how well organized some of these groups have become.

FTC Warns Of Stimulus Scams

Looking to cash in on the recent stimulus bill signed by president Obama scammers have begun setting up shop with phony sites and fake email scams.

The Federal Trade Commission (FTC) as well as the Better Business Bureau (BBB) have recently posted advisories warning consumers about advertisements from companies and websites that promise easy access to government money. The ads promise big money, as much as $12,000 in some case, or offer to sell consumers information that is readily available for free. The scammers use the collected information to commit identity theft often times draining the consumer's bank account.

"The bottom line on this is, these are scams," says Eileen Harrington, acting director of the FTC's Bureau of Consumer Protection. "The stimulus is not passing out checks to individual consumers."

In several phishing attacks consumers have reported e-mail messages asking for bank account information so that stimulus check deposits can be made directly to the consumers bank account. Instead, the scammers drain consumers' accounts of money and disappear. Or the bogus e-mails may appear to be from government agencies and ask for information to "verify" that you qualify for a payment. The scammers use that information to commit identity theft.

The FTC warns that some of the e-mail scams don't ask for information, but provide links to find out how to qualify for funds. By clicking on the links, consumers have downloaded malicious software or spyware that can be used to steal more information from the unsuspecting victims.

"Web sites may advertise that they can help you get money from the stimulus fund. Many use deceptive names or images of President Obama and Vice President Biden to suggest they are legitimate. They're not," says Eileen Harrington, Acting Director of the FTC's Bureau of Consumer Protection. "Don't fall for it. If you do, you'll get scammed."

Some sites suggest that for a small sum of money - as little as $1.99 in some cases - consumers can get a list of economic stimulus grants they can apply for. But two things can happen: the number of the credit card the consumer uses to pay the fee can fall into the hands of scam artists, or the $1.99 can be the down payment on a "negative option" agreement that may cost hundreds or thousands of dollars if the consumer does not cancel.

PCWorld found two such sites, PresidentObamaGrants.com and OfficialStimulusGrants.com, both of which have been removed at this time. The two sites promised to provide consumers with information on how to get thousands of dollars in free stimulus money if they paid about $2 to sign up. Users that failed to cancel the service were then hit with hefty monthly fees, as much as $99 a month if consumers didn't cancel within seven days. Both sites, and others like them, buried the terms in long user agreements, and the sites required consumers to go through a "detailed and complex" cancellation process

"Consumers who may already have fallen for these scams should carefully check their credit card bills for unauthorized charges and report the scam to the FTC," Harrington said.

Internet Scams At A New High

According to reports from the Internet Crime Complaint Center (IC3) money lost in Internet crimes reached nearly $240 million.

The 2007 Internet Crime Report compiled by the Internet Crime Complaint Center states they received 206,884 complaints of crimes perpetrated over the Internet during 2007. Of the complaints received, more than 90,000 were referred to law enforcement around the nation, amounting to nearly $240 million in reported losses. This represents a $40 million increase in reported losses from complaints referred to law enforcement in 2006.

The data shows that more men than women were scammed and at a costlier rate. The average loss for men was $765; for women, $552 men lost $1.67 to every $1 lost by women in online fraud.

Age was also a key factor in relation to losses, victims in their 20s lost $385 on average while people over 60 reported lost an average $760 per scam.

Although Internet auction fraud was the most widely reported complaint, others cited in the report include fraudulent activity such as non-delivery of purchases and credit/debit card fraud, and non-fraudulent activity such as computer intrusions, spam/unsolicited e-mail, and child pornography. In an effort to raise public awareness, the report also describes the characteristics of commonly reported scams such as those involving the purchase or sale of pets, check scams, e-mail spam, and online dating fraud.

The Internet Crime Complaint Center (IC3) is a partnership between the Federal Bureau of Investigation (FBI), the National White Collar Crime Center (NW3C), and the Bureau of Justice Assistance (BJA). They serve as the governments clearinghouse for all complaints involving Internet related crimes

Be On The Look Out For Tax Related Phishing

Scammers using very good phishing techniques are targeting people in both the US and the UK.

US IRS phishing emails redirect their victims to sites hosted in Russia and other former Soviet States and they mimic the actual Internal Revenue Service web site almost perfectly. As soon as you've entered your personal and financial information you get redirected to the actual IRS site. Fiendish! Message Labs reports that this type of spam spiked in January, hitting ten times the normal level.

The IRS has pointed out that "The IRS does not send unsolicited e-mail about tax account matters to individual, business, tax-exempt or other taxpayers." If you're wondering how your refund is doing, go directly to www.irs.gov and check the "Where's My Refund?" page. Don't click any links in email that claims to come from the IRS--it doesn't!

According to McAfee, UK phishers are pulling off a similar scam.

Currently an email is being sent out that claims that recipients can get an attractive tax refund from the Government by visiting what turns out to be a bogus website.

"After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of £215 ($420)," says the email. Clicking the links send you off to a bogus site, which is intended to steal person information for identity theft.