Subscribe For Free
Dec
7
Twitter, worms and an ounce of caution
Filed Under Malware, Security, Twitter | Leave a Comment
Social media sites like Twitter can be great fun. They can also be powerful mediums for getting messages out quickly. However like all things related to the Internet, an ounce of caution is always needed. Today a worm is threading it’s way through Twitter sending out Tweets with links using the URL shortener “goo.gl”. The link sends anyone who clicks on it to a hacked website loaded with malware. Variations of the actual link have already appeared; when one is blocked, another takes it’s place. One of the early links looked like this: goo.gl/R7f68.
The link is being sent out from both bogus accounts and legit Twitter accounts that have been infected with the worm. Never randomly click a link from anyone you don’t know. If the tweet was sent to you by an anonymous person, don’t click it, just don’t. If it came from a Twitter friend, ask them if they sent it to you. It’s stunningly easy to get caught up in a maleware honey-trap so protect yourself by ensuring your anti-virus and malware scanner/defender is up-to-date because Malware will screw up your computer and pretty much ensure you have a really pissy day.
Nov
26
Just because they call themselves tech support, doesn’t mean they are right
Filed Under advice, Bad tech support calls, Tech support issues | 2 Comments
I find talking to tech support frustrating. I go out of my way to avoid calling in lately because the information is unhelpful or downright incorrect. There are some great phone support people out there and when I find them, I send a message to the company commending them on their knowledge and patience. But too often, I end up talking to people that either don’t care about the problem or are reading from a set script. I’ve begun to suspect the real problem though is the people on the other end simply aren’t paying attention and it is happening a lot.
Take today’s support call. I was helping a customer with a spam problem. She has the opposite problem most of us have. She gets next to no spam, but most of her important emails are regularly caught up in the filter and this has begun to cause a problem. I contacted Bell Internet to see if there was a way of shutting off the filter. Here is the online conversation:
**** (SCI): Hi ****, welcome to Bell Internet Services, my name is ***** SCI. I see that you have questions regarding your e-mail, how may I assist you with this?
You: I need to shut off the Bell spam feature but there is no way of doing this… can you help
**** (SCI): I will certainly help you with that.
You: Thankyou
**** (SCI): Please login into your bell mail.’
You: I’m there
**** (SCI): Can you see options at the right cornet
You: I’ve logged into options
**** (SCI): Click options—> more options –> click safe and blocked sender list
You: I’m there
**** (SCI):Now select the level to exclusive,
You: Okay…
**** (SCI): Is there anything else that I could help you with Bell Internet services?
You: That is under filters and reporting not safe/blocked. It will also put the spam block into overdrive and HOLD EVERYTHING. This is not what I asked for. I want to shut it off
**** (SCI): If you select it , The spam will be decreased.
You: READ WHAT I ASKED. The problem is I get VERY LITTLE SPAM and want to shut the FILTER OFF because it is catching NON SPAM. You have given me instructions on how to ramp up the filter so EVERYTHING is caught.
**** (SCI): There is no option to shut off , However I will escalate your issue to concern department to fix it.
Now, was it so difficult to tell me in the first minute that the feature cannot be shutoff? Instead, he walked me through steps (incorrect ones at that) to increase the spam filter. If I had been someone who was unaware of what the tech support person was telling me to do, I would have ended up with an even worse situation.
So, don’t be afraid to question any instructions you’ve been given. If it doesn’t sound right, ask them again and have tech support explain why they want you to do something. A good tech support person will tell you. They may sigh to themselves, but they will explain things clearly. If they can’t tell you why, then they are simply reading from a list of solutions and will not be able to help when everything goes truly pear shaped.
Think I’m exaggerating? About a year ago, one customer was instructed to find the main breaker for her house and shut the electricity off to her entire home. Tech support assured her this would correct her e-mail problem. He was sure it had something to do with her electricity. She hung up and called me. The problem was simple, she could receive mail but couldn’t send it which means her SMTP mail needed to be assigned a new port – 2 minutes, problem solved and no trip to the basement to shut the power off. I ponder this piece of advice and for the life of me can’t figure out what was going through the techie’s mind to tell her to shut all hydro off to her house. How would this solve a port issue?
When dealing with tech support, be polite, be concise, try to explain the problem clearly and don’t be afraid to ask the techie for more information or an explanation. If in doubt, ask for another support person.
Nov
25
Lessons in Privacy – a cautionary tale
Filed Under Internet privacy, internet usage, Security, SSID, wifi | 4 Comments
A long while ago, I wrote about securing your wi-fi network. It has become painfully clear to me that many still do not take even the most elementary steps to protect themselves. There are pressing reasons why you should never leave your internet wi-fi connection unsecured – legal issues (do you really want the police thinking it’s you, who is downloading all the kiddie porn or have the recording industry knocking on your door because of illegal music downloading?) and privacy issues (never allow anyone the chance to wander through your personal files) come to mind first. But there is a monetary reason as well. If you leave your wireless internet connection open, you invite someone to use up your time. Don’t think this is an issue? Listen to this cautionary tale.
I was called in by a customer a few months back. He was completely gobsmacked by a bill he had just received from his internet provider. He was charged in excess of $400 in overage fees. Each company will allow you quite a bit in download allowance – that means every page you visit/every song you listen to/every movie you watch is added towards your monthly allowance. Once you hit your bandwidth cap (how many gigabytes you can use up in a month, regardless of whether it’s movies/email etc) you are charged an overage fee and these are hefty. Since my customer had been away for 2 weeks, he couldn’t fathom how he managed to run up such a high bill. In the past, he barely came close to using 1/4 of his allowance.
I looked over his account and yup, it showed a lot of activity, even when he was gone. It didn’t take much detective work to figure out what was going on. A quick peak under his desk told me everything I needed to know – low and behold sat a shiny new wireless router complete with little antennae. I asked him about it and he said a friend came by and gave it to him and set it up as well. This was a great gift, no doubt about that. However, simple security procedures were not taken. These steps were not taken:
Logging onto the router was too easy. No new password was set so I was able to access the router using the factory issued password. Big no no. ALWAYS change your router password and never use your street address, last name or your kids names. Also, change the login name as well. Don’t make it easy for freeloaders.
Looked at the logs and found an unknown person connected to the wi-fi. Someone in my customer’s building had logged onto his account and was doing massive downloads – who knows movies/music/gaming. Hard to say, but it adds up quickly and eats away at your usage cap. Mystery solved, the unknown neighbour had hooked up and enjoyed a hell of a ride on my customer’s nickel.
Checked the wireless settings and found a network setup which was wide open. Not even WEP security set. What makes this tragic, is this customer didn’t use wireless so this should have been shut off completely. At the very least a WEP key should have been assigned, but WPA2 would have been better. Higher encryption means better security. This would have blocked the freeloader completely. He/she would not have been able to even connect.
The SSID (network identifier) was still set at the default. That should have been changed. Leaving it at the default is a tip off there may be more security problems. First think I think when I see a default SSID is the person likely just plugged the router in and didn’t take care of the little details. When you choose an SSID don’t choose your address/family name or anything that can make it easier to identify where you are. Nothing screams BREAK IN like a router with your name on it. Privacy should be your biggest concern, no sense setting up a secure network but still advertise to the outside world where you are. If you can, take an extra step and hide your SSID, that way no one can see it. I don’t always do this with my customers because some of them simply can’t remember their SSID (let alone the piece of paper I wrote it down on and securely put into a folder and put into a drawer for them) and endlessly call me saying they forgot again.
So follow these basic steps for securing your network:
- If you don’t need wi-fi, shut it off.
- If you use wi-fi assign encryption.
- Change your SSID and preferably hide it.
- Change your router login and password.
These steps simple steps would have saved my customer $400. In hindsight, this was a hell of an expensive router.
Dec
7
Facebook Data Collection Hits the Fan
Filed Under Advertising on the internet, Internet privacy, Security | 4 Comments
Facebook has a big plate of eggs on its face after it came to light about their Beacon information collection. It has highlighted the current information gathering frenzy going on in the Internet.
It seems to be the vogue to collect streams of data and then claim it is part of a “technical checking process” as Facebook spokesman Matt Hicks claimed or that the information was not stored, used or sold. If this is the case, then why go to the bother of collecting all the data in the first place. Isn’t there a more efficient way of providing a “technical check” – that phrase is nothing more than marketing blather.
In this case the info gathering went far beyond gathering benign data – it was used to track purchases online. The data was then shared with other users and advertisers without consent. This flies in the face of Facebook’s claim the data was not used in any way. Sounds to me like what we used to call a bold faced lie. How Facebook can stand up and make their claims of innocence is beyond me.
If, what Facebook was up to is not entirely clear to you, then let me quote from The Nation’s article on the subject:
Facebook had launched Beacon, which was using “social advertising” technology to broadcast information about online purchases without many users’ consent. The idea was to convert private commerce into public endorsements: “Ben Bloom ate at the restaurant Junnoon,” read one ad, with a prominent head shot of Ben displayed next to the company logo. But what if Ben didn’t want his lunch date to be an ad? Beacon enrolled people automatically, offering users a choice to “opt out” of each ad on an individual basis.
The sharing and using of information is implicit in this program. To claim the information collected was not used or shared is false. How can this program work without the use of the data. I don’t hear any explanation of this ethical two-step anywhere. Just a resounding silence.
Sit back for a minute and ponder the implications of such unauthorized intrusions into your social life. Lets say you scooted on over to your favourite bookstore’s website to purchase a Christmas certificate for a friend. Next thing you know, your face is all over the internet advertising the fact you love the place so much you’ve done your Christmas shopping there – and what do you get for the use of your face and lose of privacy? Not a damned thing, except perhaps your friend now knows what their present is. Merry Christmas!
This isn’t “social advertising”. Its just plain old advertising done in a dishonest manner. No matter how you dress it up, this was not ethical. Sounds a lot like the Emperor’s New Clothing – oh and yes the Emperor is indeed naked. I can just imagine the corporate folks who thought up this gem sitting around the big table justifying Beacon software – Oh what money we’ll make, and how little we’ll have to pay. We can do an end run around the advertising firms – no costs! We can get our customers to do all our work for us! Wheeee…. what a scam.
I tend to be very wary of signing my name to anything on the Internet. Everyone wants my address, name, phone number, hat size… some companies want this information before I use their self-serve support to figure out issues with THEIR equipment. I now have a stock set of answers for their questions. My name is Piss Off – and yup I actually get unsolicited email, from companies that swore they would not use the information, to Dear Piss Off. My email is noneoff_your@damnedbusiness.com. My phone number 555-555-5555. My address is whatever large company ticks me off at the moment. This works everytime. You are welcome to use my technique in avoiding the useless info grabbing, its fun and cathartic at the same time. You might have to vary the email a bit, many of my customers use it and you may find it’s already used. I get downright rude in some of my answers because this is a waste of my time and an unwarranted intrusion upon my privacy.
I’m waiting to see which corporation gets it in the neck next month for this type of egregious behaviour. I just know it will happen again.
User Liability Information.
Information is supplied on a use at your own risk basis. Catpaw Computer Consulting offers no warranty or guaranty concerning the tips, hints and information supplied. Again, use at your own risk.
All content wholly owned by Catpaw Computer Consulting and may not be copied without permission.All comments are held for approval. If there is a link back to an obvious spam site the comment will be deleted, regardless of the comment.
Not all comments will be approved. Abusive and rude comments will end up in the trash with all the spam so please moderate your language.
