Privacy Alert: Biggest Threats of 2010

1. Google's Wi-Fi Spying

Threat Level: GREEN

Google's Wi-Fi spying debacle didn't start out evil. By using its Street View vans to map out open Wi-Fi networks, Google could provide better location data to mobile users. If you use Google Maps from your phone, it could employ nearby wireless networks to determine where you are, no GPS required.

Has this car been spying on your Wi-Fi network?The problem: Besides the Wi-Fi network's name and location,Google's Street View vans were accidentally slurping up unencrypted data--including user passwords and e-mail messages. Over three years, Google gathered 600GB of extra data in more than 30 countries, resulting in international sanctions, civil lawsuits, and an FCC probe.

Even so, the impact on average consumers is minimal, says Peter Eckersley, senior staff technologist for the Electronic Frontier Foundation. You're in greater danger of being spied on by nosy neighbors or creeps parked outside your house.

The solution: Password-protect your wireless network (duh) and use encrypted HTTPS connections to browse the Web when possible (see item #3 below).

2. The iPad E-Mail Leak

Threat Level: GREEN

If you bought one of the first iPad 3G units to leave the stores, your e-mail address may have been compromised.If you bought one of the first Apple 3G iPads, an obscure security group may have purloined your e-mail address.

Last June, Goatse Security exploited a hole in AT&T's Website that displayed an iPad owner's e-mail address when it encountered an HTTP request containing that user's ID number. Goatse flooded AT&T.com with URLs containing random 20-digit numbers and collected 114,000 e-mail addresses of iPad owners. It then shared a few of them with Gawker.

The good news? The Goatse hack didn't reveal passwords, so the group couldn't access information beyond your name. And you're in select company--ABC's Diane Sawyer, New York Mayor Michael Bloomberg, and top government and military officials also had their addresses stolen.

The solution: None needed. AT&T quickly closed the hole--and if a spammer wants your e-mail address, there are easier ways to get it. So is the iPad magical and life-changing yet?

3. Facebook Wi-Fi-Jacking

Threat Level: YELLOW

Updating your Facebook status from a Wi-Fi café? A stranger can log in to your account and pretend to be you. Blame Firesheep, a free Firefox plug-in that captures login cookies as they fly by unencrypted. Programmer Eric Butler wrote the program to demonstrate how much data people send "in the clear" without realizing it. Using Firesheep, a hijacker can access your account on Facebook, Twitter, and two dozen other sites. Any information you thought was private now isn't. Feeling naked yet?

The failure of sites such as Facebook and Twitter to require secure logins is "an enormous privacy problem," says the EFF's Eckersley. "Google demonstrated this could be done on a colossal scale at minimal cost with Gmail. Now we need to get the rest of them to do that."

The solution: Use EFF and the Tor Project's HTTPS Everywhere plug-in for Firefox to force sites to use SSL encryption if available. And don't log in to sites containing sensitive info from a public network.

4. 'Naked' Security Scans

Threat Level: BLUE

TSA body scans may sound a little personal, but c'mon: How personal does this really look?If Firesheep doesn't make you feel naked, passing through airport security might. Major U.S. airports and federal buildings are deploying body scanners that can peer through clothing, rendering you virtually nude to security guards viewing the scan.

It gets worse. Last August, the U.S. Marshals Service in Orlando, Florida, admitted to storing some 35,000 body scans it was supposed to have destroyed. Naturally, some of those found their way onto the Net.

The Electronic Privacy Information Center filed suit against the Department of Homeland Security, attempting to keep airports from deploying the machines. A wave of protest ensued, including everybody from ordinary people to members of the Allied Pilots and U.S. Travel Associations.

The solution: In lieu of a scan, you can opt for an "If you touch me there, you'd better buy me dinner and a movie first" full-body frisk. But we don't think you'll feel any less violated.

5. Mobile Malware

Threat Level: YELLOW

The smartphone in your pocket is catnip to malware authors, yet mobile security is barely on most people's radar, says Winn Schwartau, chairman of security vendor Mobile Active Defense.

Kaspersky Lab identified the first malware known to target Android phones last August, androgue code targeting jailbroken iPhones and iPads has been available for over a year. Schwartau agrees with estimates that 20 percent of all Android and iPhone apps may be infected.

"Mobile apps are the best hostile-code delivery system ever invented," Schwartau says. "The entire mobile space is in chaos."

The solution: Before you install a new app, do some sleuthing to suss out potential red flags; avoid apps from unfamiliar vendors or sites. "Install Gotcha 1.0 from Bob's App Store?" says Schwartau. "I don't think so."

Source : http://www.pcworld.com

Latest Spam : Cameron Diaz Spam

The fourth annual McAfee Most Dangerous Celebrities report declares Cameron Diaz to be the biggest risk of all celebrity athletes, musicians, politicians, comedians and Hollywood stars on the Web when it comes to your computer security. Taking the pop culture appeal out of the popular hit list, though, the McAfee report illustrates the broader issue of just how effectively malicious attacks prey on hot topics and social trends to exploit gullible users.

According to the McAfee report, Cameron Diaz bumped former "most dangerous celebrity" Jessica Biel off the top of the list, and beat out Julia Roberts to claim the crown. An online search for the star of Shrek Forever After andKnight and Day has a 10 percent chance of infecting your system in some insidious way.

As McAfee cautions in the press release for the Most Dangerous Celebrities report, "Cybercriminals often use the names of popular celebrities to lure people to sites that are actually laden with malicious software. Anyone looking for the latest videos or pictures could end up with a malware-ridden computer instead of just trendy content."

The press release also shares this additional insight from Dave Marcus, Director of McAfee Labs Security ResearchCommunications. "This year, the search results for celebrities are safer than they've been in previous years, but there are still dangers when searching online," adding "consumers are getting smarter about searching online, yet cybercriminals are getting sneakier in their techniques. Now they're hiding malicious content in 'tiny' places like shortened URLs that can spread virally in social networking sites and Twitter, instead of on websites and downloads."

Malware attacks are not confined to pop culture, though. Malicious developers are becoming more clever as time goes on, and they are increasingly adept at manipulating news ripped from the headlines, and exploiting the inherent trust of social networks to lure gullible users.

AppRiver's Threat and Spamscape Report for the first half of 2010 highlights other concerning trends. When natural disasters such as the earthquake in Haiti occur, or global current events like the 2010 World Cup soccer competition capture the news headlines, malware developers take advantage by creating fake links, sites, and other lures to target the heightened interest.

Organizations should obviously have adequate security measures in place to guard against systems being compromised or infected by such attacks. It is important to have perimeter defenses such as firewalls, and spam filters in place, and to protect endpoint systems with antimalware protection.

T administrators can help prevent exploit from threats that might bypass those security measures, though, by ensuring that the users are educated and informed. Educate users on general online security precautions such as not clicking on unknown links or opening unknown file attachments, and inform users to be extra vigilant and exercise additional caution related to trendy topics, breaking news, and social networks.

New Trend of Cheating Using Internet

Cyber Crime Agencies had received reports of individuals' e-mail or social networking accounts being compromised and used in a social engineering scam to swindle consumers out of thousands of dollars. Portraying to be the victim, the hacker uses the victim's account to send a notice to their contacts.

The notice claims the victim is in immediate need of money due to being robbed of their credit cards, passport, money, and cell phone; leaving them stranded in London or some other location. Some claim they only have a few days to pay their hotel bill and promise to reimburse upon their return home. A sense of urgency to help their friend/contact may cause the recipient to fail to validate the claim, increasing the likelihood of them falling for this scam.

If you receive a similar notice and are not sure it is a scam, you should always verify the information before sending any money.

If you have been a victim of this type of scam or any other Cyber crime, you can report it to police station nearby.