Think twice about security

Submitted by mala on Tuesday, May 11th, 2010

Gabey Goh

Tuesday, May 11th, 2010 14:34:00

MALAYSIANS are complacent when it comes to their online security. About 60 per cent of Malay­sians were found to have inadequate protection, such as software older than two years, relying purely on freeware or no protection of any sort.

It is worrying, considering the trends noted in the recently released Internet Security Threat Re­port Volume XV by Symantec (see sidebar).

BE SAFE: Freer advises caution on information put up online — Pic: ASHRAF SHAMSUL AZLAN

"Malaysia retains the same ranking as it did last year, which has it sitting in the middle of the scale. The thing to keep in mind is that the scale has blown up immeasurably, so you're sitting in the centre of an even bigger storm," said Symantec vice-president of consumer business (Asia Pacific and Japan) David Freer, who was in town recently for a media briefing of the report's findings.

He added that the number of attacks detected by Symantec for 2009 was more than the num­ber of attacks dealt by the company in the last 19 years combined.

Freer stressed that updating security software is critical because of the ad­vancements and changes in the way cybercrime is conducted. Software released even a year ago cannot combat the latest manifestations of mali­cious code.

Of the trends highlighted, attacks targeted at websites and social networking sites saw the biggest jump. Drive-by downloads, in which nor­mal sites are infected with malicious software are popular, along with dummy sites which prey on unsuspecting users' curiosity on issues such as Michael Jackson's death or the 2010 World Cup.

Social engineering plays a big part in cyber­crime, with social marketing concepts and tar­geted approaches to drive traffic to malicious sites. The increase in attacks on social networking play on users' trust when operating on such plat­forms.

"Five years ago, people would say 'don't click on emails from people you don't know', and it's the same thing here. Be wary of accepting what your friends post on your wall because it might not be from them. The problem is that these networking sites are a huge trust environment," said Freer.

So what do these cybercriminals do once they get access?

"If you're an individual, the cybercriminals are looking for bank account details, login informa­tion, email accounts, credit card details or websites that you frequent," said Freer adding that contrary to popular belief, cybercriminals pay the most for email accounts and not credit card details.

"Where do you reset all your passwords to? Whenever you change your banking details, you do it via email or get it sent it to your email. So your email account is valued more than your credit card details," explained Freer.

After the cybercriminals get the cash, they then turn to a new trend -- the use of cybermules to launder the money.

Job ads which advertise the benefits of working from home is one method of recruitment. Unsus­pecting people are asked to either transfer money via their accounts and get paid or asked to accept online purchases and forward them on.

"You're seeing a lot of real world methodologies being incorporated into crime online. There's a lot of money being made and there's almost no risk as it is very hard to get caught. They never target the country they are based in and play the jurisdic­tion game well," said Freer.

Internet Security Threat Report volume XV Highlights

The report, which highlights key trends in cyber­crime from Jan1, 2009 to Dec 31, 2009 noted the following:

• The easy availability of attack toolkits make cy­bercrime easier than ever. As stated in the Syman­tec Report on Underground Economy released last year, the highest-priced attack tool, on average, was botnets, which sold for an average of US$225.

• An increase in the number of targeted threats focused on enterprises. The report found that at­tackers are leveraging the abundance of personal information openly available on social networking sites to make socially engineered attacks on key individuals within targeted companies. Hydraq gained a great deal of notoriety at the beginning of 2010, but was only the latest in a long line of such targeted attacks including Shadow Network in 2009 and Ghostnet in 2008.

• Web-based attacks continued to grow unabat­ed. Today's attackers leverage social engineering techniques to lure unsuspecting users to malicious websites. These websites then attack the victim's Web browser and vulnerable plug-ins normally used to view video or document files. In particu­lar, 2009 saw dramatic growth in the number of Web-based attacks targeted at PDF viewers; this accounted for 49 per cent of observed Web-based attacks. This is a sizeable increase from the 11 per cent reported in 2008.

• Malicious activity takes root in emerging coun­tries. The report saw firm signs that malicious activ­ity is now taking root in countries with an emerging broadband infrastructure, such as Brazil, India, Po­land, Vietnam and Russia. In 2009, these countries moved up the rankings as a source and target of malicious activity by cybercriminals. The findings from the report suggest that government crack­downs in developed countries have led cybercrim­inals to launch their attacks from the developing world, where they are less likely to be prosecuted.

How much is your information worth?

Here's a quick breakdown of the value of items sold in the underground economy in US dollars (US$1 = RM3.2):

• E-MAIL ACCOUNTS: $15
• FULL IDENTITIES: $10
• CREDIT CARDS: $0.98

Four tips for a safer online experience

1. Think twice before you put anything up on the Internet. Act as though that in­formation is public knowledge because that is where it can potentially end up.

2. Be very careful who you accept as a "friend" on social networking sites.

3. Be very wary of Scareware - malware parading as a security software. If it is not from a reputable company, do not download or accept it.

4. Ensure that you have a comprehensive and pro-active security suite installed on your computer.

• To learn more about the dangers of webcams, go to http://www.mmail.com.my/content/36081-dangers-webcams

Source & Credit : http://www.mmail.com.my

Kes curi identiti pengguna internet terus meningkat

Oleh Mohd Anwar Patho Rohman
wananwar@bharian.com.my
2010/05/06
Pelanggan didapati tak sedar laman web bank dilayari palsu

KUALA LUMPUR: Sebanyak 446 daripada 1,329 kes pencerobohan internet yang dilaporkan pada suku pertama tahun ini membabitkan cubaan mencuri identiti pengguna internet, termasuk kata nama dan kata laluan akaun internet.

Ketua Bahagian Khidmat Pengurusan Kawalan Mutu Cyber Security Malaysia, Dr Solahuddin Shamsuddin, berkata jumlah itu meningkat 52 peratus bagi tempoh sama tahun lalu yang mencatatkan 214 kes.

Beliau berkata, cubaan mencuri identiti pengguna internet itu berkaitan dengan pencerobohan maklumat akaun pelanggan bank, khasnya bagi mencuri kata nama atau ‘username’ dan kata laluan atau password’ rahsia.

“Penipuan berlaku apabila pelanggan bank tidak menyedari laman web bank yang mereka layari adalah palsu kerana memiliki ciri-ciri yang hampir sama dengan laman web asli.

“Apabila mereka memasukkan kata nama dan kata laluan pada laman web palsu, maklumat peribadi dan akaun mereka dapat dicuri oleh penggodam yang kemudian dimanipulasi untuk pelbagai tujuan penipuan termasuk mengeluarkan wang milik mangsa,” katanya ketika sesi bual bicara sempena pelancaran produk pelindung komputer Kapersky PURE, di sini semalam.

Kapersky PURE adalah produk yang berupaya melindungi komputer daripada pencerobohan dan gangguan termasuk antivirus, kawalan terhadap internet, aplikasi, kata laluan, kata kemasukan, maklumat peribadi dan sistem operasi.
Ketika ditemui selepas majlis itu, Solahuddin berkata, berdasarkan siasatan Siber Security Malaysia, laman web bank palsu yang dilayari mangsa itu berpangkalan di luar negara.

Beliau berkata, apabila menerima aduan berhubung pencerobohan internet, Cyber Security Malaysia menerusi Pasukan Tindak Balas Kecemasan Keselamatan Komputer Malaysia (MyCert) akan melaporkan kepada pasukan bertindak di negara yang dikenal pasti menjadi pusat penceroboh supaya memotong khidmat penyedia khidmat internet (ISP).

“Biasanya kita dapat menghentikan gangguan internet ini dengan pantas hasil hubungan baik Malaysia dengan negara memiliki pasukan seperti MyCert,” katanya.

Sementara itu, Solahuddin berkata, 80 peratus atau 504 daripada 1,329 kes pencerobohan internet yang dipandang serius pihaknya ialah perbuatan merosakkan laman web termasuk milik agensi kerajaan.

Beliau juga berkata, sebanyak 3,564 kes pencerobohan internet dilaporkan sepanjang 2009 dengan 1,766 membabitkan pencerobohan terhadap sistem, manakala cubaan mencuri identiti pengguna internet sebanyak 1,022 kes.

“Kita mengambil berat perbuatan merosakkan laman web kerana ia akan mengganggu perjalanan sistem internet agensi yang terbabit, proses capaian dan perayauan selain menimbulkan kekeliruan kepada pengguna,” katanya.

Sumber & Kredit : http://www.bharian.com.my/

BUSINESSES, GOVERNMENTS AND CONSUMERS MUST WORK TOGETHER TO SECURE CYBERSPACE, SAY PRIVATE- AND PUBLIC-SECTOR LEADERS

FOR IMMEDIATE RELEASE
May 3, 2010

BUSINESSES, GOVERNMENTS AND CONSUMERS MUST WORK TOGETHER TO SECURE CYBERSPACE, SAY PRIVATE- AND PUBLIC-SECTOR LEADERS

DALLAS. May 3. Cybersecurity demands cooperation from all sectors and all users, said leaders from businesses and governments at an EastWest Institute dinner in Dallas. A panel of experts called on all parties to share information and coordinate efforts to reap the benefits of the digital economy while avoiding its dangers.

"Cybersecurity is the responsibility of everyone," said Teri Takai, California's Chief Information Officer. "The most critical threat is us. We have to be sure that we're using the technology correctly and we're protecting it."

A crucial issue is attribution, according to Michael Dell, Chairman and Chief Executive Officer of Dell, Inc. "We have an enormous number of bad actors who are able to be completely anonymous," he said. "Can you think of any secure system where people can operate anonymously?"

Both public and private sectors have a critical role to play to secure cyberspace, the panel suggested. "Industry has a responsibility to share its best practices," said Melissa Hathaway, former Acting Senior Director for Cyberspace on the U.S. National Security Council, while Dell stressed the need for public sector leadership. "It's not a decision for any individual or a business to make," he said. "It's a societal decision."

Phillip Reitinger, Deputy Undersecretary at the Department of Homeland Security, emphasized the need for a longer-term focus on the issue. "I fear that we're going to let the urgent overtake the critical," he said, arguing for a thoughtful, sustained cybersecurity initiative.

Dell echoed the need to avoid knee-jerk policies. "It's important not to demonize the technology," he said. "The vast majority of people using the Internet are good people."

Panelists agreed that the consequences of inaction are dire. "If we let our attention waver for a second, we will be in a world of hurt -- now and in the future," said Reitinger.

Source : http://www.facebook.com/pages/CyberSecurity-Malaysia/283232114039?ref=mf#!/notes/cybersecurity-malaysia/businesses-governments-and-consumers-must-work-together-to-secure-cyberspace-say/388330208162

Kontraktor didenda 'ceroboh' akaun e-mel Menteri Kewangan

PUTRAJAYA 3 Mei - Dengan pengetahuan yang dimiliki dalam bidang komputer, seorang kontraktor berjaya menceroboh akaun e-mel Menteri Kewangan di laman web www.treasury.gov.my.

Pemuda berusia 28 tahun itu kemudian menyamar sebagai Menteri Kewangan dengan menghantar e-mel kepada dua pegawai Kementerian Kewangan untuk mendapatkan tender projek atau peluang perniagaan.

Namun kecekapan pegawai kementerian tersebut berjaya mengelak daripada terpedaya dengan 'e-mel palsu' itu sekali gus menghindarkan kredibiliti kementerian itu daripada terjejas dan mengalami kerugian.

Hari ini, pemuda itu menerima padah apabila dia didenda RM12,000 oleh Mahkamah Sesyen di sini setelah mengaku bersalah atas dua tuduhan menceroboh akaun e-mel tersebut sebelum menyamar sebagai Menteri Kewangan.

Mengikut pertuduhan, Muhammad Rashid Narayanan didakwa melakukan capaian tanpa kuasa terhadap e-mel ybmk@treasury.gov.my di laman web www.treasury.gov.my dengan menyamar sebagai Menteri Kewangan dengan niat untuk mengakibatkan kerugian kepada kementerian itu.

Perbuatan itu didakwa dilakukan di Kompleks Kementerian Kewangan di sini pada pukul 9.42 pagi, 12 April lalu.

Bagi tuduhan kedua, pemuda yang beralamat di Jalan Lengkok Abdullah, Bangsar, turut didakwa melakukan perbuatan yang sama di tempat dan tarikh yang sama.

Kedua-dua dakwaan terhadapnya dikemukakan mengikut Seksyen 4(1)(a) Akta Jenayah Komputer 1997 yang memperuntukkan hukuman denda RM150,000 atau penjara tidak lebih 10 tahun atau kedua-duanya.

Hakim Suzana Hussin menjatuhkan denda RM6,000 atau penjara 10 hari bagi setiap pertuduhan terhadap Muhammad Rashid yang merupakan tertuduh pertama dihukum di bawah Seksyen tersebut.

Mengikut fakta kes, e-mel pertama dihantar tertuduh ke alamat e-mel milik Setiausaha Bahagian Perolehan, Kementerian Kewangan, Datuk Fauziah Yaacob untuk meminta nombor telefon bimbit pegawai berkenaan.

E-mel kedua pula dihantar ke alamat e-mel pembantu peribadi Fauziah, Zaleha Yusof yang antara lain mendakwa beliau (Menteri Kewangan) ketika itu berada di Amerika Syarikat dan memintanya melayan permohonan 'orang beliau' yang akan mencarinya bagi tujuan peluang perniagaan.

Kedua-dua e-mel itu turut menyatakan ia adalah rahsia dan tidak boleh didedahkan kepada sesiapa.

Tertuduh kemudian didakwa menghubungi Zaleha dengan memperkenalkan diri sebagai Adam daripada syarikat Rectro Sdn. Bhd. yang ingin menyemak tender.

Siasatan dengan sebuah syarikat telekomunikasi menunjukkan panggilan itu dibuat daripada telefon bimbit tertuduh dan semakan di Suruhanjaya Syarikat Malaysia pula mendapati isteri tertuduh, Yusliza Abdul Rahim ialah ahli Lembaga Pengarah Rectro.

Terdahulu, dalam rayuannya, Muhammad Rashid yang tidak diwakili peguam bela memohon hukuman ringan dan berjanji tidak akan mengulangi kesalahan tersebut.

Timbalan Pendakwa Raya, Nahra Dollah yang mengendalikan pendakwaan bersama Hamidi Mohd. Noh memohon hukuman setimpalkerana perbuatan menceroboh akaun e-mel Menteri Kewangan boleh menyebabkan orang ramai tidak mempercayai keselamatan laman web kementerian itu.

Tegas beliau, pencerobohan itu mencemarkan nama Menteri Kewangan yang juga Perdana Menteri sendiri kerana ia seolah-olah menunjukkan pemimpin negara memberikan projek kepada orang yang dikenalinya.

Tertuduh dibebaskan selepas membayar denda.

Source : http://www.utusan.com.my/utusan/info.asp?y=2010&dt=0504&pub=Utusan_Malaysia&sec=Mahkamah&pg=ma_03.htm

Sophos's recommendations for Facebook settings

Introduction

ID fraudsters target Facebook and other social networking sites to harvest information about you. Here's how we recommend you set your Facebook privacy options to protect against online identity theft.

How to adjust your settings

This guide walks you through Sophos-recommended privacy settings in Facebook, and shows you how to set more secure levels of privacy and reduce the chance of becoming a victim of online identity theft.

General security tips for Facebook

Adjust Facebook privacy settings to help protect your identity

Unlike some other social networking sites, Facebook has provided some powerful options to protect you online - but it's up to you to use them!

Read the Facebook Guide to Privacy

At the very bottom of every page on Facebook, there's a link that reads "Privacy." The linked page is "A guide to privacy on Facebook," which contains the latest privacy functions and policies. For example, with the latest changes in December 2009, Facebook discloses what it calls "Publicly available information." This is information that is publicly viewable to anyone visiting your profile, and includes sensitive information like your name, current city and gender.

When in doubt, use the "How others see you" tool on Facebook's privacy guide to check and make sure your privacy settings are properly set.

Think carefully about who you allow to become your friend

Once you have accepted someone as your friend they will be able to access any information about you (including photographs) that you have marked as viewable by your friends. You can remove friends at any time should you change your mind about someone.

Show "limited friends" a cut-down version of your profile

You can choose to make people 'limited friends' who only have access to a cut-down version of your profile if you wish. This can be useful if you have associates who you do not wish to give full friend status to, or feel uncomfortable sharing personal information with.

Disable options, then open them one by one

Think about how you want to use Facebook. If it's only to keep in touch with people and be able to contact them then maybe it's better to turn off the bells and whistles. It makes a lot of sense to disable an option until you have decided you do want and need it, rather than start with everything accessible.

source : http://www.sophos.com/security/best-practice/facebook/

Safety tips on blogging

Recent studies show that teenagers write roughly half of all blogs today, with two out of three providing their age, three out of five revealing their location and contact information, and one in five revealing their full name.

There are potential risks in sharing this type of detailed personal information. And, as more young peers create more blogs, they tend to compete increasingly with each other for attention. Sometimes this can lead to kids posting inappropriate material such as provocative pictures of themselves or their friends.

A quick blogging primer for parents

Although keeping a blog offers potential benefits, including improved writing skills and communication, it's important to educate your kids about the Internet and blogging before they begin-much like completing driving school before hitting the road solo. Here are a few suggestions to get started:

• Establish rules for online use with your kids and be diligent.
• Screen what your kids plan to post before they post it. Seemingly innocuous information, such as a school mascot and town photo, could be put together to reveal where the author goes to school.
• Ask yourself (and instruct your kids to do the same) if you are you comfortable showing any of the content to a stranger. If in doubt, have them take it out.
• Evaluate the blogging service and find out if it offers private, password-protected blogs.
• Save the Web address of your child's blog and review it on a regular basis.
• Check out other blogs to find positive examples for your kids to emulate.

Basic guidelines for bloggers

The following tips are a good place to start for kids interested in blogging, although by no means comprehensive. It's a good idea for parents to add more guidelines to suit their family's particular needs. Start by telling kids that they should:

• Never offer any personal information including your last name, contact information, home address, phone numbers, school's name, e-mail address, last names of friends or relatives, instant messaging names, age, or birth date.
• Never post provocative pictures of yourself or anyone else, and be sure any images you provide do not reveal any of the previously mentioned information. Always remember to look at the background of a picture too.
• Assume what you publish on the Web is permanent. Anyone on the Internet can easily print out a blog or save it to a computer.
• Use blogging provider sites with clearly stated terms of use, and make sure they can protect the actual blogs, not just the user accounts, with password protection. (Even so, it's better to assume anyone can see it.)
• Avoid trying to "outdo" or compete with other bloggers.
• Keep blogs positive and don't use them for slander or to attack others.

Source : http://www.microsoft.com/protect/parents/social/blogging.aspx