STILL THINK ONLINE DATING IS OK? READ THIS!

Warning sounded over 'flirting robots'

Those entering online dating forums risk having more than their hearts stolen.

A program that can mimic online flirtation and then extract personal information from its unsuspecting conversation partners is making the rounds in chat forums, according to security software firm PC Tools.

The artificial intelligence of CyberLover's automated chats is good enough that victims have a tough time distinguishing the "bot" from a real potential suitor, PC Tools said. The software can work quickly too, establishing up to 10 relationships in 30 minutes, PC Tools said. It compiles a report on every person it meets complete with name, contact information, and photos.

"As a tool that can be used by hackers to conduct identity fraud, CyberLover demonstrates an unprecedented level of social engineering," PC Tools senior malware analyst Sergei Shevchenko said in a statement.

Among CyberLover's creepy features is its ability to offer a range of different profiles from "romantic lover" to "sexual predator." It can also lead victims to a "personal" Web site, which could be used to deliver malware, PC Tools said.

Although the program is currently targeting Russian Web sites, PC Tools is urging people in chat rooms and social networks elsewhere to be on the alert for such attacks. Their recommendations amount to just good sense in general, such as avoiding giving out personal information and using an alias when chatting online. The software company believes that CyberLover's creators plan to make it available worldwide in February.

Robot chatters are just one type of social-engineering attack that uses trickery rather than a software flaw to access victim's valuable information. Such attacks have been on the rise and are predicted to continue to grow.

Mike Greene, vice president of product strategy at PC Tools, said that the company learned of CyberLover's existence earlier this week as part of its regular monitoring of IRC chat rooms and other places where talk about malware takes place.

Greene said that it is hard to tell how prevalent use of the program is.

"We don't have exact statistics, but I think it's early on," he said.

Greene said that the perceived anonymity of the Internet has desensitized people to the fact that information disclosed in an online chat can cause real-world damage.

"People are used to not opening attachments or maybe not clicking on a link that shows up in their IM," he said. "But this emulates a real conversation, so you more are likely to give over personal information, click on a link or send your photograph."

MORE HERE

Doctor of Economics Sentenced for Cyber-Stalking, Extorting Ex-wife

By Nicholas Phillips

(Missouri, USA) ​Jovica Petrovic, a 62-year-old native of Croatia, was sentenced today to 97 months in prison for cyber-stalking and extorting his former American wife.

Last November, a jury found him guilty upon learning of the bizarre events that transpired after the couple's divorce: Petrovic posted on a website some images of them having sex (which he'd secretly recorded). He also added personal information about the woman's past and her children.

In addition, the jury learned how Petrovic printed that web address on about 150 postcards and mailed them to her colleagues, friends, family -- even the local Walgreens. He told her he'd take down the site if she gave him furniture, her wedding ring and $100k.

"I was out of my mind," Petrovic told the court today in a long, meandering statement delivered with a heavy German accent (he was born in Croatia but grew up in Germany; he also has a doctorate in economics).

His attorney, Steve Stenger, added that the government had "overreached" in a private dispute, and sought to "demonize" his client.

Assistant U.S. attorney John Sauer, however, countered that Petrovic "made himself into a demon" by committing acts that were "vile, appalling and disgusting." The defendant's deeds were coldy calculated in advance, Sauer added, to destroy his ex-wife and inflict as much personal pain and humiliation as possible.

In the end, it came down to the opinion of U.S. district court judge Henry Autrey.

"We can do so many things with the Internet," Autrey said drily. "Nobody can see us as we slink and stalk and covet. It's fun. The Internet is a beautiful thing."

But Petrovic was trying to diminish his responsibility, the judge observed, by suggesting that his ex-wife was complicit in his crimes. Autrey -- like the jury -- found such a version of events "inconceivable."

The government had asked for a sentence above the guideline range for a total of 87 months. Judge Autrey went above and beyond that, sending Petrovic away for 96 months.

Petrovic said he would appeal.

original article here

What Happens Online Stays Online?

By Robert Weiss LCSW, CSAT-S

Today’s omnipresent fear that one’s personal identifying data (e.g., social security number or credit card information) may be vulnerable to hackers and identity theft has pushed millions of subscribers into the arms of “identity theft protection” companies like LifeLock.

But is anyone really paying attention to what will happen when the sexually explicit language and photos that are sent via the latest “friend finder” smart-phone app or sex website get hacked or otherwise exploited?

When “joining” sites like Ashley Madison or downloading apps like Blendr, participants are offered some measure of comfort via a click-it guarantee that personal information will be securely maintained. But somehow it seems off the radar to the same professionals and/or married individuals, who would never send their social security number online via an unsecured site, that when you sext and arrange app-based sexual hook-ups, every word and pic sent via these apps also resides in a far-away server. And that information lives there for a whole lot longer than the instant it takes to sext a potential hook-up.

What happens to all the intensely personal, intimate sexual imagery and language now housed in the servers of companies like Ashley Madison (currently reporting over 9 million members), Adult Sex Finder and Grindr, to name just a few, if these business are bought out, go under or just plain get hacked? If recent news stories are any indication, online sexual activity isn’t nearly as private as many may naively believe:

Last month, Grindr, a popular smartphone app that enables gay men to meet other gay men using their phone’s GPS, was compromised by a Sydney hacker, who then placed users’ personal chats, explicit photos and private information online. This app currently has more than one million users worldwide. Security experts warn that the same vulnerabilities are present in other hook-up apps such as Blendr (the straight version of the app) and Ashley Madison.

Last week, a young man affiliated with hacker group Anonymous claimed to have hacked into a website operated by pornography provider Brazzers. The emails, usernames and other personal information of more than 350,000 users may have been exposed, a small sample of which were posted publicly online.

Anonymous has also just claimed responsibility for taking down the CIA website. Previously, the group took aim at the FBI, the Department of Justice, entertainment companies and the Church of Scientology, among others. Similar groups have targeted the U.S. Census Bureau, Interpol and various state public safety departments.

Over 20 years as a specialist in the field of adult intimacy disorders and sexual addiction has taught me (and you can see it clearly in the film Shame), that those intellectually stable, but emotionally challenged adults with problem patterns of sexual behavior can and do destroy their careers and tear apart their relationships without meaning to do so. All the while they believe they were somehow “safe” from being found out.

Unfortunately nearly all of these men and women prior to getting help expressed feeling when they are in the pursuit or “bubble” of their sexual and romantic highs that:

• They are “in control” and “know what they are doing”
• “No one will ever know or find out” if they’re “careful”

I need only cite Fmr. Congressman Anthony Weiner as one of the many unfortunate examples of this type of denial. And there are many more such individuals with stories in and out of the media nearly every day.

As technology becomes more intimately threaded into our lives, perhaps we need to broaden our ideas about what is truly “private” and what can be readily uncovered and shared in a public forum. If not, when the day comes (and it will) that the personal data currently maintained by any of the friend-sex-finder websites/apps are exposed and posted on a U.S. website, the Anthony Weiner sexting story, his subsequent marital separation and congressional resignation are going to look like a Girl Scout party by comparison.

Robert Weiss is the author of three books on sexual addiction and Founding Director of the premiere sex addiction treatment program, The Sexual Recovery Institute. He is Director of Sexual Disorders Services at The Ranch and Promises Treatment Centers. These centers serve individuals seeking sexual addiction treatment, love addiction treatment, and porn addiction help. Specifically, the Centers for Relationship and Sexual Recovery at The Ranch (CRSR) offer specialized intimacy, sex and relationship addiction treatment for both men and women in gender-specific, gender-separate treatment and living environments.

original article here

Stalking Privacy on Facebook, One Psycho at a Time

phisby John Fontana

If you were asked who could harvest a trove of personal data from 10 million Facebook users in just three weeks you might guess company CEO Mark Zuckerberg over Jason Zada. You'd be dead wrong.

Who is Zada? He offered something scary at Halloween and nearly 10 million strangers stepped up and provided him access to their personal Facebook information to get it. Unwittingly walking him past their privacy settings and into their policy-protected data vaults. Maybe you were one of them?

Certainly more than 10 million people viewed Zuckerberg's private photos a few weeks ago when a Facebook bug exposed them to the public. But Zuckerberg was hacked, Zada's millions were socially engineered, accomplices in their own fleecing.

What sophisticated tool did he use? Facebook Apps.

Zada was the creator of TakeThisLollipop.com, a viral Facebook app that collected your Facebook pictures and profile information and put it in the middle of a psycho stalker video.

It was hailed as brilliantly scary. The video ends with the psycho getting out of his truck at a house. Your photo taped to his dashboard. Zada said it was a message about privacy.
"If you look at the video, the scariest part is that your information is in the video. The piece is scary because a person is violating your privacy, not because it's bloody or there's anything jumping out," he told AdAgeDigital.

Actually the scariest part is that your information is in the hands of the Facebook application developer - in this case Zada, who it turns out is benign. His intent was to entertain and his app clearly stated it was not saving your information. But what's to stop a real life psycho from doing the same thing and saving the data? Nothing really.

Facebook has a set of usage policies for its Facebook Platform, which is what developers use to create apps. Among other requirements, the policies dictate application owners must delete all user data if they stop using the platform or Facebook shuts down their app. And policy says app developers must 'delete all data you receive from us concerning a user if the user asks you to do so.'

If developers are running a business, policy means something. If you're running a scam, policy talk is cheap.

How can a real-life psycho (or scammer, phisher) get your 'protected' data? Ironically, exactly the same way Zada did.

Set-up an app that lets users grant you access to their data, show them a video or offer a game, collect their information, stalk in real life.

In Zada's video you see the psycho is looking at a map to your house. Where do you think that information came from?

What Zada proved is that the Facebook stalker scenario is real-life. The potential psychos you block via privacy settings know your back door is unlocked. A scam would likely run the same as TakeThisLollipop. It sprung up on the Internet, went viral and disappeared in 20 days.

Could it have been sleuth hackers, the Russian mafia, the cliché computer hermit in his parent's basement?

It's an email phishing scam mimicked on the social web. It relies on user habit and social engineering - surfing, prurient interest, etc.

Do users know (or care) Facebook apps by-pass privacy settings? One developer I spoke to said after he wrote his first Facebook app he revoked access to every Facebook application he had signed on to. He was dumbstruck by the amount and depth of user information his app made available to him. When he tested it against his own Facebook account, no matter how tightly he screwed down his privacy settings, the app still had access to just about everything it requested.

TakeThisLollipop.com proves that a fool and his password (and data) are soon parted. Facebook is a ripe audience; unwittingly picked apart.


original article found here

When Your Online Life is Hacked

By Rowenna Davis

(NEW ZEALAND) In a technology-driven society, when an account gets hacked, you're suddenly hit with an organisational bombshell as the realisation dawns that the email account is the nexus of the modern world.

For the past week, a hacker has been occupying my email account. And he or she may still be there. A disembodied intruder, this person has been stalking my inbox, replying to messages, signing off with my nickname and refusing to let me in. He or she has been going through my personal history and making judgments about my character.

In the weirdest twist, the hacker even started writing to me. If it wasn't so unsettling, it could be the plot of a black postmodern comedy.

It started when my phone went crazy in the middle of a crucial meeting. Some 5000 contacts received an email from my account saying that I'd been held up at gunpoint in Madrid. My internet-savvy friends sent texts to say I'd been hacked, while my elderly, migrant and more vulnerable friends wanted to know where to send the cash. According to the story, my mobile phone and credit cards had been taken and I was badly in need of money. There was a number to call to reach me at my hotel - presumably chargeable - and a Western Union account had been set up in my name to wire a transfer.

Suddenly you're hit with an organisational bombshell: drop what you're doing; freeze your bank account, answer anxious calls, lose crucial messages; miss work deadlines, irritate bosses, reset all email-based passwords, forget to pay e-bills, irritate friends who think you're ignoring them. The realisation dawns that the email account is the nexus of the modern world. It's connected to just about every part of our daily life and, if something goes wrong, it spreads.

But the biggest effect is psychological. On some level, your identity is being held hostage.

Out of sheer frustration, I fired off an email to my occupied address labelled "to those who hacked my account", laying out how I felt and asking for my contacts. Shockingly, I got an almost instantaneous reply. The hacker said my address book would be returned for £500 ($989). It was unreal. Whoever it was must have been watching my account and responding. Who else was this person replying to in the same way?

I wrote back straight away, saying that I didn't have those kind of finances and pointing out that I had no reason to believe the deal would be kept even if I did send the money. I couldn't help but end with a rhetorical: "Do you ever feel even slightly bad about what you are doing?"

Just for a minute, the hacker seemed anxious to prove that he or she had any sense of morality. The reply: it "didn't feel great" to be a hacker, but they didn't have a choice. Why? They said their life "wasn't as nice and sweet" as mine. In what I guess was supposed to be a gesture of magnanimity, the hacker promised to release my contacts for just £300, and even offered to send me 20 contacts upfront as a sign of "goodwill".

I could tell this person thought this was being reasonable - that these actions weren't as bad as robbing people on the streets.

What I wanted to reply, but found difficult to articulate at the time, was that hacking can be worse than that. When someone holds you up in the street, you lose a set of isolated possessions and then get to walk away. But if someone colonises one of your chief platforms of interaction with the world, there's always a feeling of "what next?" They can read your most intimate emails and potentially pass them on. A simple search would allow them to find out not just my address, but also those of my friends and family.


Apparently around 3000 people reported such scams last year, but too few of these are brought to justice. When I did eventually get access to my account through Gmail a week later, I found that the hacker had written to more than 30 people who had asked about my problems in Madrid. The intruder said I'd had a "terrible experience" and signed off with my nickname, "Row". That someone could be so callous to people who cared about me - in my name - left me furious.

I was lucky. The only reason I was able to regain access to my account was through chance - a friend of a friend works at Google. Until then, my hacker had given me better feedback than Gmail and Google, following my attempts to get in touch with them. The company that presents itself as the friendly face of the web doesn't have a single human to talk to in these circumstances. The office just cut me off and, after a friend waited on hold for 20 minutes to ask if there was anything that could be done to help, the reply was a simple "nope".

When someone did bother to look into my problem, it took only five minutes to fix. The hacker had doubled the verification process on my password so I couldn't get in. Once Google disabled it from the inside, I was able to reset all my security checks without a problem.

Even now, I'm not sure it's over. In one last message, addressed from myself just two days ago, the hacker wrote: "I see you got the account back. Sorry for the trouble." I never replied, so I guess I'll never know what this individual's circumstances were. But I feel the need to understand them. Perhaps we believe that if we find reasons for things, we'll feel safer. Perhaps it's about restoring faith in human nature.

However, my hacker seems to have disappeared back into the ether. Of course, they could be reading this now.

Chatting with a hacker

Tuesday, 8.33am
From: Rowenna Davis
Hi, I can't believe you would do this. The poorest, most vulnerable of my contacts are the most worried about me and most likely to send you money. The most educated people with resources know it's a scam. I also find it difficult to make ends meet, but without access to this account I can't work because all my contacts are stored in the account you have taken over. I am totally paralysed. If there is any way you can send me my address book, I would be willing to pay for it. It's horrible to be forwarded messages that have been sent in your own name. I honestly don't know how you justify this to yourself.

8.42am
From: the hacker
Can you send me 500 quid?

10.33am
From: Rowenna Davis
1) I literally don't have 500 quid to give you. I can't make any more money until I have access to my account back - I work freelance and all my work contacts are being held by you. 2) How would I know if I gave you any money that you'd actually send me my contacts? 3) Do you ever feel even slightly bad about what you're doing?

10.38am
From: the hacker
Sure I don't feel great, but I don't seem to have a choice, it's way better than robbing you on the streets. I give you my word, if you send me money, I will give you back access to you account with all your emails and contacts intact. If you can't send 500 quid at least 300 quid will do. Send money by Western Union to Rowenna Davis Madrid Spain. Waiting

10.40am
From: Rowenna Davis
Why don't you have a choice?

10.44am
From: the hacker
You don't wanna the kinda life I am living. You think it's as nice and sweet as your life? But at least I don't rob on the streets

10.56am
From: Rowenna Davis
I'm not making judgments about your life - you are making judgments about mine. If you read some of those emails you'll know it gets pretty shit at this end too. And even if my life was really happy, I don't see why that justifies you taking over my emails. But I wonder why you feel that you have no choice.

10.58am
From: the hacker
Are you sending money?

11.17am
From: Rowenna Davis
I don't have £300. I have asked some of my friends if they can help, but they think it's a stupid idea because you can't be trusted to return the details.

11.23am
From: the hacker
I don't need your details for anything, to show some good will I could give you about 20 contacts, then when you send money, I give you the rest of it.

Thursday, 11.04pm
From: the hacker
I see you got back your account. Sorry for the trouble.


original article found here

Facebook - Not So Private!

By Daniel Emery Technology reporter, BBC News



(CANADA) The man who harvested and published the personal details of 100m Facebook users has spoken out about his motives.



Ron Bowes, a Canadian security consultant, used a piece of code to scan Facebook profiles, collecting data not hidden by users' privacy settings.



The list, which contains the URL of every searchable Facebook user's profile, name and unique ID, has been shared as a downloadable file.



Mr Bowes told BBC News that he did it as part of his work on a security tool.



"I'm a developer for the Nmap Security Scanner and one of our recent tools is called Ncrack," he said. "It is designed to test password policies of organisations by using brute force attacks; in other words, guessing every username and password combination."



By downloading the data from Facebook, and compiling a user's first initial and surname, he was able to make a list of the most common probable usernames to use in the tool.



The three most common names, he found, were jsmith, ssmith and skhan.



In theory, researchers could then combine this list with a catalogue of the most commonly used passwords to test the security of sites. Similar techniques could be used by criminals for more nefarious means.



Mr Bowes said his original plan was to "collect a good list of human names that could be used for these tests".



"Once I had the data, though, I realised that it could be of interest to the community if I released it, so I did," he added. I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too”



Mr Bowes confirmed that all the data he harvested was already publicly available but acknowledged that if anyone now changed their privacy settings, their information would still be accessible.



"If 100,000 Facebook users decide that they no longer want to be in Facebook's directory, I would still have their name and URL but it would no longer, technically, be public," he said.



Mr Bowes said that collecting the data was in no way irresponsible and likened it to a telephone directory.



"All I've done is compile public information into a nice format for statistical analysis," he said



Simon Davies from the watchdog Privacy International told BBC News it was an "ethical attack" and that more personal information had not been included in the trawl.



"This is a reputational and business issue for Facebook, for now," he said



"They can continue to ride the risk and hope nothing cataclysmic occurs, but I would argue that Facebook has a special responsibility to go beyond doing the bare minimum," he added.



Snowball effect

Mr Bowes' file has spread rapidly across the net.



On the Pirate Bay, the world's biggest file-sharing website, the list was being distributed and downloaded by thousands of users.



One user said that the list showed "why people need to read the privacy agreements and everything they click through".



In a statement to BBC News, Facebook confirmed that the information in the list was already freely available online.



"No private data is available or has been compromised," the statement added.



That view is shared by Mr Bowes, who added that harvesting this data highlighted the possible risks users put themselves in.



"I am of the belief that, if I can do something then there are about 1,000 bad guys that can do it too.



"For that reason, I believe in open disclosure of issues like this, especially when there's minimal potential for anybody to get hurt.



"Since this is already public information, I see very little harm in disclosing it."



Digital trends

However, he said, it also highlighted a new trend that was emerging in the digital age.



"With traditional paper media, it wasn't possible to compile 170 million records in a searchable format and distribute it, but now we can," he said.



"Having the name of one person means nothing, and having the name of a hundred people means nothing; it isn't statistically significant.



"But when you start scaling to 170 million, statistical data emerges that we have never seen in the past."



A spokesperson for Facebook said the list was "similar to the white pages of the phone book.



"This is the information available to enable people to find each other, which is the reason people join Facebook."



"If someone does not want to be found, we also offer a number of controls to enable people not to appear in search on Facebook, in search engines, or share any information with applications."



Earlier this year there was a storm of protest from users of the site over the complexity of Facebook's privacy settings. As a result, the site rolled out simplified privacy controls.



Facebook has a default setting for privacy that makes some user information publicly available. People have to make a conscious choice to opt-out of the defaults.





original article here

Posting Woman’s Data on Craigslist Brings Charges

By BILL BRAKSICK

(ILLINOIS, USA) A Sycamore man has been charged with a misdemeanor offense after reportedly posting a woman’s contact information and offers for sex on an Internet website.

Alexander P. Dominguez, 25, of the 700 block of South Main Street, is accused of posting a woman’s name, phone number and workplace information, along with offers of sexual contact, on the classified website Craigslist.

According to court documents, the woman received dozens of phone messages from unknown people propositioning her for sex.

Dominguez is charged with harassment through electronic communications, a Class B misdemeanor punishable by not more than six months in jail.

He appeared for a bond hearing Wednesday at the DeKalb County Courthouse via closed-circuit television from the DeKalb County Jail.

He was released on a $1,500 recognizance bond, which allows a person to be released from jail with no money posted but a signed promise to be present at future court dates.

He is due back in court July 19.


(our exposed cyberpath Dunetz/ Yidwithlid did this to his victims on MySpace... possible pending legal action)


original article here

Posting Woman’s Data on Craigslist Brings Charges

By BILL BRAKSICK

(ILLINOIS, USA) A Sycamore man has been charged with a misdemeanor offense after reportedly posting a woman’s contact information and offers for sex on an Internet website.

Alexander P. Dominguez, 25, of the 700 block of South Main Street, is accused of posting a woman’s name, phone number and workplace information, along with offers of sexual contact, on the classified website Craigslist.

According to court documents, the woman received dozens of phone messages from unknown people propositioning her for sex.

Dominguez is charged with harassment through electronic communications, a Class B misdemeanor punishable by not more than six months in jail.

He appeared for a bond hearing Wednesday at the DeKalb County Courthouse via closed-circuit television from the DeKalb County Jail.

He was released on a $1,500 recognizance bond, which allows a person to be released from jail with no money posted but a signed promise to be present at future court dates.

He is due back in court July 19.


(our exposed cyberpath Dunetz/ Yidwithlid did this to his victims on MySpace... possible pending legal action)


original article here

The 7 Deadliest Social Networking Hacks

Think you know who your real online friends are? You could be just a few hops away from a cybercriminal in today's social networks

By Kelly Jackson Higgins

It started with a stolen Facebook photo attached to an inflammatory profile. It led to online harassment, death threats, and emails to the victim’s boss questioning the victim’s character. But an online personal attack against Graham Cluley earlier this year is one example of how easy it is to use a social network to damage the identity of an individual -- or an entire company.

Cluley’s case shows just how rapidly social networks can spread a smear campaign or personal attack -- and how it can quickly spread to the victim’s professional life. Cluley, who is a senior technology consultant with Sophos, recently met another victim who experienced a similar attack on Facebook, Kerry Harvey. He says it was apparently an acquaintance of Harvey’s who built a phony Kerry Harvey Facebook profile that branded her occupation as a “prostitute,” complete with her cellphone number.

Could such a thing happen to you or employees at your company? You bet. Social networks are the next major attack venue for trolls, spammers, bot herders, cybercriminals, corporate spies -- and even jilted ex-lovers or enemies -- to make money, or just plain wreak havoc on their victims’ personal lives, security experts say.

“It's the easiest way to passively gain intelligence on the largest groups of society and nearly every walk of life,” says Robert Hansen, aka RSnake, founder of SecTheory LLC.

The root of the problem is that social networking sites by nature aren't secure. They typically don’t authenticate new members -- you can’t always be sure that your online friend is who she says she is -- and attackers can easily exploit and capitalize on the “trusted” culture within the social network. Users often don't deploy the security and privacy options that some of these sites offer, either.

Social networking application development tools like OpenSocial and third-party tools on Facebook, for example, can be abused by attackers to readily spread malware or lift personal information. There’s also the very real risk of corporate espionage, with attackers culling tidbits from personal or professional social net profiles to wage targeted attacks on businesses via their employees. And popular Web attacks, like cross-site scripting, can also be used against members of social networks.

And don’t think for a minute that your “private” or closed profile keeps you safe from an attack or potential personal embarrassment, either. “There is no such thing as privacy on the Internet,” says Adam O’Donnell, director of emerging technologies for Cloudmark. “You are only delaying the inevitable information leakage for any content you put online. My recommendation is to treat the Internet as if all content there lasts forever.”

Attacks on social networking sites have only just begun, so think twice before you get too personal with what you post on them, or too loose about accepting and trusting new friends and connections.

“You’re only going to see these attacks on social networks go up,” says researcher Nathan Hamiel, who along with colleague Shawn Moyer recently conducted some relatively simple but scary hacks recently on various social networks that they demonstrated at Black Hat USA and Defcon 16 this month. “We’ve noticed some weird social networking attacks since we did our talk” at those hacker conferences, he says.

Here's a look at the seven most lethal social networks hacks:

* 1) Impersonation and targeted personal attacks

* 2) Spam and bot infections

* 3) Weaponized OpenSocial and other social networking applications

* 4) Crossover of personal to professional online presence

* 5) XSS, CSRF attacks

* 6) Identity theft

* 7) Corporate espionage

1) Impersonation and targeted personal attacks
You’d think security experts would be relatively immune from social networking hacks since, well, they’re security experts. But a recent wave of nasty hacks targeting security industry figures such as Alan Shimel of StillSecure and Petko Petkov of GNUCitizen, where their personal email accounts and other private data were raided and posted on the Net, have demonstrated that a determined attacker can even get to the experts.

Putting yourself “out there” with a social network presence basically leaves you open for all kinds of attacks, even personal ones. Just ask Sophos’s Cluley, who faced hate messages, death threats to his wife, and his photo being superimposed on some pornographic images after his Facebook photo hack. “They didn’t use my name,” he says, but all it took was someone to recognize his face.

Twitter, the microblogging site where members post quick updates on what they’re doing or comments to multiple “followers,” introduces a whole other element to social networking security -- physical security, experts say. “I never talk about where I am, who I'm with, where I'm going, or any other specific details,” RSnake says. “But that doesn't stop anyone else who knows that same information from doing that behind my back - maliciously or not.”

Sophos’s Cluley says posting too much information on Twitter, such as your whereabouts or trip plans, leave you wide open to things like burglary or stalking. “Twitter is a fascinating thing. To be honest, it could lead to all sorts of physical problems, such as physical theft…or jealous ex’s” tracking what their ex is up to, says Cluley, who “tweets” his blog titles. “When I post to my blog, I’m not saying ‘I’m at the supermarket.’ First of all, who cares? I much prefer to wait until I get back” from the store to say what I’m doing, he says.

And as Hamiel and Moyer demonstrated at Black Hat USA and Defcon 16, you don’t even have to have a social networking profile to be targeted. The two researchers were able to easily impersonate security icon Marcus Ranum (with his permission) on LinkedIn, the social network for businesspeople. Ranum doesn’t have an account, so the two basically lifted Ranum’s photo off the Internet and gathered information on him online and built a convincing phony Ranum profile. (See LinkedIn Hack Demonstrates Ease of Impersonation.)

They channeled Ranum so well that they amassed 42 LinkedIn connections within 12 hour, even duping Ranum’s own sister into friending the phony Ranum profile.

2) Spam or bot infections
Spammers -- for plain old advertising, click fraud, or for bot recruitment -- need mechanisms that efficiently and effectively deliver and spread their messages, malware, or both. And attackers have already honed in on the social networking community, hijacking accounts and using their address books to spread spam, worms, or other malware.

“We’re seeing more and more malware via spam and links in spam. We’re seeing this with malware text on Facebook and Twitter that’s designed to draw people to particular pages,” Sophos’s Cluley says.

Most recently, attackers hijacked some Facebook accounts, and posing as members sent messages to their friends to dupe them into viewing a video clip link, which instead was actually a Trojan that silently downloaded malware onto their machine once they opened the link.

A recent report by ScanSafe found that in July, up to one in 600 profile pages on social-networking sites hosted some form of malware, mostly adware and spyware.

3) Weaponized OpenSocial and other social networking applications
Users often don’t think anything of installing an application in their browser. “But these applications can all have the same levels of access to their system, and some of the most private information is often [stored] in the browser, so it can be more dangerous,” Moyer says. “It blows my mind how people can think that downloading [these applications] is not as bad” as downloading some application to their system.

That makes third-party application services like OpenSocial a dangerously handy tool for attackers. “The addition of the third-party application service also allows for another avenue for code-based attacks to occur,” Cloudmark’s O’Donnell says.

It’s not that all of the developers of those social networking virtual kisses, secret crushes, or birthday reminder widgets are necessarily malicious. OpenSocial, for example, offers an option for writers of these tools to limit malicious JavaScript in these applications, but inexperienced developers typically don’t bother or know to use these measures, O'Donnell says.

“These are opt-in only, and a limited number of developers use the tools. What ends up happening is that developers with a limited amount of security-sensitive development experience create these applications that spread like wildfire, allowing a new vector for infection on many profiles -- and by infection, I primarily mean attacks focused inside the social network,” O’Donnell says.

Users don’t always realize that the third-party widgets for Facebook, for example, weren’t written by Facebook. Some have holes that collect more information on users than necessary or safe, and others have been written specifically to install adware or generate revenue. “To their credit, Facebook has closed down some of these apps that behaved inappropriately,” Sophos’ Cluley notes.

A rogue application called “Secret Crush” was circulating around Facebook earlier this year, spreading spyware instead of love. (See 'Secret Crush' Spreads Spyware, Not Love.) It sent victims an invitation to find out who has a secret "crush" on him or her, and lured them into installing and running the Secret Crush app, which spread spyware via an iFrame. The attack got more advanced and worm-like when it required the victim to invite at least five friends before learning who their “crush” was.

“They [these sites] are basically under constant attack,” Moyer says. “We think a lot of the Web 2.0 problems [with these sites] are more about how much trust is being placed on the client side.”

4) Crossover of personal to professional online presence
Even if you keep a MySpace account for personal use, and a LinkedIn one for professional networking, there’s no guarantee that those late-night partying pictures aren’t going to end up in front of your colleagues on LinkedIn, or worse, your boss.

“Consider everything on a social network to be public, whether it’s private photos or work history,” Hamiel says. “You can’t stop a ‘friend’ from copying your stuff and putting it wherever” they want.

There are some measures social networkers can take to prevent the details of their social and personal lives from spilling over to their professional ones. Cloudmark’s O’Donnell says he doesn’t bother with separate personal and professional social networking accounts: “For me I find it far easier to not keep them separate, and to present a professional face on both my personal and my professional profiles."

You can set up “limited” profiles on sites like Facebook. “I can add someone as a limited friend, and they don’t know they’re limited. They can’t see my holiday photos,” for instance, Sophos’s Cluley says. That way, “I’ve really tied down and parceled up what I want as my real close friends” on the site.

There are also privacy settings that can control what information you share with others on the social network, and what information Facebook apps can get and share about your profile.

5) XSS, CSRF attacks
Cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities are obvious attack vectors, and some social networking worms have used XSS flaws to help propagate themselves. But most social networks have tightened their defenses against XSS attacks, security experts say, and CSRF attacks are not yet common.

XSS and CSRF do pose a big risk to these sites, especially when it comes to social networking applications, experts say. In an XSS attack, malicious code is injected into vulnerable Web applications and users who view those pages can get hacked. In a CSRF attack, an attacker basically tricks the victim's browser into making a request on his behalf -- as the logged-in user.

“Anytime [that] you, an attacker, can force a user to load HTML, the potential is there for browser exploits, botnet infections, and account manipulation via XSS/CSRF,” says HD Moore, director of security research for BreakingPoint Systems.

A CSRF attack could potentially jump and spread across multiple social networking sites that the user is logged onto -- effectively spreading the attack from one social network to another. It could, for example, force a victim viewing a CSRF-infected page on MySpace to post something on his own wall on Facebook if the wall-posting function was vulnerable. “I think [CSRF] certainly is one useful vector that's being overlooked now,” Moyer says.

Meanwhile, with the openness of social networks, attackers don’t really need to bother with complicated XSS or CSRF attacks. “But if you [the attacker] combine attack vectors, you could be a lot more effective. We think as long as [social networks] allow users to create markup in profiles and comments and link to external content, this will continue to be a problem,” Moyer says.

6) Identity theft
A social network profile can give away some valuable tidbits –- victim’s name and date of birth –- that identity thieves can use to guess passwords or impersonate them, and even eventually steal their identity, some security experts say.

But that doesn’t mean that identity thieves are crawling all over social networks, Hamiel says. “I just think that the claims that social networks are an identity theft magnet are overblown."

Social networkers sometimes inadvertently hand over the goods themselves: In a study Sophos conducted over a year ago, about 41 percent of Facebook users in the study gave out their email address, date of birth, and phone number to someone they didn’t know.

One safety tip for social networkers is not to answer all the questions posed to them by the site, and don't provide your true date of birth, Sophos's Cluley says. “You don’t need to tell Facebook your educational background, your phone number, etc. You don’t even have to tell them your real date of birth,” he says. “I want the identity thief to get the wrong date of birth.”

You can even make up a phony maiden name for your mother. “Don’t make it something that’s a matter of public record,” he says.

Even so, social networks basically tap into human nature’s innate need to socialize, and the bad guys know it. “People aren't very good at security,” RSnake says. “We were built to work in teams, we're pack animals.”
7) Corporate espionage
Even if an employer blocks access to social networks from the office, the organization still could be susceptible to corporate espionage attacks via its employees’ personal profiles.

To pull off a spear phishing attack, for example, all an attacker has to do is search for Company A’s employees on a social networking site and then pose as someone within the organization -- such as the head of human resources -- and email the employee addresses he finds, for example. A phony HR spear phish could look something like this, Sophos’s Cluley says: “Dear Fred Jones, Congratulations on joining XYZ Company. Click on this link to access our HR Intranet and then log in with your regular network username and password so we can update our files.”

A newbie to the company could easily fall for the ploy and hand over access to the corporate network, he says.

The only shot at preventing this hack is for social networkers to limit what they post publicly and to keep their employer’s name out of their profile. “Keeping the name of your employer... far away from your personal profiles can reduce the chance that someone will target your employer through you,” BreakingPoint’s Moore says. “The trouble is that even with completely separate personal and professional identities, it only takes one scrap of public information linking the two to negate all of the time that went into separating them in the first place.”

That’s because the “six degrees of separation” rule applies on most social networks: You’re only a few hops away from a bad guy. “We know that there are bad people on these networks using them to steal information,” Cluley says. “You may be only a half a dozen hops from an identity thief if we’re all connected.”

Responses to: editors@darkreading.com

ORIGINAL ARTICLE

Many thanks to support group member, Gypsy for this gem!

The 7 Deadliest Social Networking Hacks

Think you know who your real online friends are? You could be just a few hops away from a cybercriminal in today's social networks

By Kelly Jackson Higgins

It started with a stolen Facebook photo attached to an inflammatory profile. It led to online harassment, death threats, and emails to the victim’s boss questioning the victim’s character. But an online personal attack against Graham Cluley earlier this year is one example of how easy it is to use a social network to damage the identity of an individual -- or an entire company.

Cluley’s case shows just how rapidly social networks can spread a smear campaign or personal attack -- and how it can quickly spread to the victim’s professional life. Cluley, who is a senior technology consultant with Sophos, recently met another victim who experienced a similar attack on Facebook, Kerry Harvey. He says it was apparently an acquaintance of Harvey’s who built a phony Kerry Harvey Facebook profile that branded her occupation as a “prostitute,” complete with her cellphone number.

Could such a thing happen to you or employees at your company? You bet. Social networks are the next major attack venue for trolls, spammers, bot herders, cybercriminals, corporate spies -- and even jilted ex-lovers or enemies -- to make money, or just plain wreak havoc on their victims’ personal lives, security experts say.

“It's the easiest way to passively gain intelligence on the largest groups of society and nearly every walk of life,” says Robert Hansen, aka RSnake, founder of SecTheory LLC.

The root of the problem is that social networking sites by nature aren't secure. They typically don’t authenticate new members -- you can’t always be sure that your online friend is who she says she is -- and attackers can easily exploit and capitalize on the “trusted” culture within the social network. Users often don't deploy the security and privacy options that some of these sites offer, either.

Social networking application development tools like OpenSocial and third-party tools on Facebook, for example, can be abused by attackers to readily spread malware or lift personal information. There’s also the very real risk of corporate espionage, with attackers culling tidbits from personal or professional social net profiles to wage targeted attacks on businesses via their employees. And popular Web attacks, like cross-site scripting, can also be used against members of social networks.

And don’t think for a minute that your “private” or closed profile keeps you safe from an attack or potential personal embarrassment, either. “There is no such thing as privacy on the Internet,” says Adam O’Donnell, director of emerging technologies for Cloudmark. “You are only delaying the inevitable information leakage for any content you put online. My recommendation is to treat the Internet as if all content there lasts forever.”

Attacks on social networking sites have only just begun, so think twice before you get too personal with what you post on them, or too loose about accepting and trusting new friends and connections.

“You’re only going to see these attacks on social networks go up,” says researcher Nathan Hamiel, who along with colleague Shawn Moyer recently conducted some relatively simple but scary hacks recently on various social networks that they demonstrated at Black Hat USA and Defcon 16 this month. “We’ve noticed some weird social networking attacks since we did our talk” at those hacker conferences, he says.

Here's a look at the seven most lethal social networks hacks:

* 1) Impersonation and targeted personal attacks

* 2) Spam and bot infections

* 3) Weaponized OpenSocial and other social networking applications

* 4) Crossover of personal to professional online presence

* 5) XSS, CSRF attacks

* 6) Identity theft

* 7) Corporate espionage

1) Impersonation and targeted personal attacks
You’d think security experts would be relatively immune from social networking hacks since, well, they’re security experts. But a recent wave of nasty hacks targeting security industry figures such as Alan Shimel of StillSecure and Petko Petkov of GNUCitizen, where their personal email accounts and other private data were raided and posted on the Net, have demonstrated that a determined attacker can even get to the experts.

Putting yourself “out there” with a social network presence basically leaves you open for all kinds of attacks, even personal ones. Just ask Sophos’s Cluley, who faced hate messages, death threats to his wife, and his photo being superimposed on some pornographic images after his Facebook photo hack. “They didn’t use my name,” he says, but all it took was someone to recognize his face.

Twitter, the microblogging site where members post quick updates on what they’re doing or comments to multiple “followers,” introduces a whole other element to social networking security -- physical security, experts say. “I never talk about where I am, who I'm with, where I'm going, or any other specific details,” RSnake says. “But that doesn't stop anyone else who knows that same information from doing that behind my back - maliciously or not.”

Sophos’s Cluley says posting too much information on Twitter, such as your whereabouts or trip plans, leave you wide open to things like burglary or stalking. “Twitter is a fascinating thing. To be honest, it could lead to all sorts of physical problems, such as physical theft…or jealous ex’s” tracking what their ex is up to, says Cluley, who “tweets” his blog titles. “When I post to my blog, I’m not saying ‘I’m at the supermarket.’ First of all, who cares? I much prefer to wait until I get back” from the store to say what I’m doing, he says.

And as Hamiel and Moyer demonstrated at Black Hat USA and Defcon 16, you don’t even have to have a social networking profile to be targeted. The two researchers were able to easily impersonate security icon Marcus Ranum (with his permission) on LinkedIn, the social network for businesspeople. Ranum doesn’t have an account, so the two basically lifted Ranum’s photo off the Internet and gathered information on him online and built a convincing phony Ranum profile. (See LinkedIn Hack Demonstrates Ease of Impersonation.)

They channeled Ranum so well that they amassed 42 LinkedIn connections within 12 hour, even duping Ranum’s own sister into friending the phony Ranum profile.

2) Spam or bot infections
Spammers -- for plain old advertising, click fraud, or for bot recruitment -- need mechanisms that efficiently and effectively deliver and spread their messages, malware, or both. And attackers have already honed in on the social networking community, hijacking accounts and using their address books to spread spam, worms, or other malware.

“We’re seeing more and more malware via spam and links in spam. We’re seeing this with malware text on Facebook and Twitter that’s designed to draw people to particular pages,” Sophos’s Cluley says.

Most recently, attackers hijacked some Facebook accounts, and posing as members sent messages to their friends to dupe them into viewing a video clip link, which instead was actually a Trojan that silently downloaded malware onto their machine once they opened the link.

A recent report by ScanSafe found that in July, up to one in 600 profile pages on social-networking sites hosted some form of malware, mostly adware and spyware.

3) Weaponized OpenSocial and other social networking applications
Users often don’t think anything of installing an application in their browser. “But these applications can all have the same levels of access to their system, and some of the most private information is often [stored] in the browser, so it can be more dangerous,” Moyer says. “It blows my mind how people can think that downloading [these applications] is not as bad” as downloading some application to their system.

That makes third-party application services like OpenSocial a dangerously handy tool for attackers. “The addition of the third-party application service also allows for another avenue for code-based attacks to occur,” Cloudmark’s O’Donnell says.

It’s not that all of the developers of those social networking virtual kisses, secret crushes, or birthday reminder widgets are necessarily malicious. OpenSocial, for example, offers an option for writers of these tools to limit malicious JavaScript in these applications, but inexperienced developers typically don’t bother or know to use these measures, O'Donnell says.

“These are opt-in only, and a limited number of developers use the tools. What ends up happening is that developers with a limited amount of security-sensitive development experience create these applications that spread like wildfire, allowing a new vector for infection on many profiles -- and by infection, I primarily mean attacks focused inside the social network,” O’Donnell says.

Users don’t always realize that the third-party widgets for Facebook, for example, weren’t written by Facebook. Some have holes that collect more information on users than necessary or safe, and others have been written specifically to install adware or generate revenue. “To their credit, Facebook has closed down some of these apps that behaved inappropriately,” Sophos’ Cluley notes.

A rogue application called “Secret Crush” was circulating around Facebook earlier this year, spreading spyware instead of love. (See 'Secret Crush' Spreads Spyware, Not Love.) It sent victims an invitation to find out who has a secret "crush" on him or her, and lured them into installing and running the Secret Crush app, which spread spyware via an iFrame. The attack got more advanced and worm-like when it required the victim to invite at least five friends before learning who their “crush” was.

“They [these sites] are basically under constant attack,” Moyer says. “We think a lot of the Web 2.0 problems [with these sites] are more about how much trust is being placed on the client side.”

4) Crossover of personal to professional online presence
Even if you keep a MySpace account for personal use, and a LinkedIn one for professional networking, there’s no guarantee that those late-night partying pictures aren’t going to end up in front of your colleagues on LinkedIn, or worse, your boss.

“Consider everything on a social network to be public, whether it’s private photos or work history,” Hamiel says. “You can’t stop a ‘friend’ from copying your stuff and putting it wherever” they want.

There are some measures social networkers can take to prevent the details of their social and personal lives from spilling over to their professional ones. Cloudmark’s O’Donnell says he doesn’t bother with separate personal and professional social networking accounts: “For me I find it far easier to not keep them separate, and to present a professional face on both my personal and my professional profiles."

You can set up “limited” profiles on sites like Facebook. “I can add someone as a limited friend, and they don’t know they’re limited. They can’t see my holiday photos,” for instance, Sophos’s Cluley says. That way, “I’ve really tied down and parceled up what I want as my real close friends” on the site.

There are also privacy settings that can control what information you share with others on the social network, and what information Facebook apps can get and share about your profile.

5) XSS, CSRF attacks
Cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities are obvious attack vectors, and some social networking worms have used XSS flaws to help propagate themselves. But most social networks have tightened their defenses against XSS attacks, security experts say, and CSRF attacks are not yet common.

XSS and CSRF do pose a big risk to these sites, especially when it comes to social networking applications, experts say. In an XSS attack, malicious code is injected into vulnerable Web applications and users who view those pages can get hacked. In a CSRF attack, an attacker basically tricks the victim's browser into making a request on his behalf -- as the logged-in user.

“Anytime [that] you, an attacker, can force a user to load HTML, the potential is there for browser exploits, botnet infections, and account manipulation via XSS/CSRF,” says HD Moore, director of security research for BreakingPoint Systems.

A CSRF attack could potentially jump and spread across multiple social networking sites that the user is logged onto -- effectively spreading the attack from one social network to another. It could, for example, force a victim viewing a CSRF-infected page on MySpace to post something on his own wall on Facebook if the wall-posting function was vulnerable. “I think [CSRF] certainly is one useful vector that's being overlooked now,” Moyer says.

Meanwhile, with the openness of social networks, attackers don’t really need to bother with complicated XSS or CSRF attacks. “But if you [the attacker] combine attack vectors, you could be a lot more effective. We think as long as [social networks] allow users to create markup in profiles and comments and link to external content, this will continue to be a problem,” Moyer says.

6) Identity theft
A social network profile can give away some valuable tidbits –- victim’s name and date of birth –- that identity thieves can use to guess passwords or impersonate them, and even eventually steal their identity, some security experts say.

But that doesn’t mean that identity thieves are crawling all over social networks, Hamiel says. “I just think that the claims that social networks are an identity theft magnet are overblown."

Social networkers sometimes inadvertently hand over the goods themselves: In a study Sophos conducted over a year ago, about 41 percent of Facebook users in the study gave out their email address, date of birth, and phone number to someone they didn’t know.

One safety tip for social networkers is not to answer all the questions posed to them by the site, and don't provide your true date of birth, Sophos's Cluley says. “You don’t need to tell Facebook your educational background, your phone number, etc. You don’t even have to tell them your real date of birth,” he says. “I want the identity thief to get the wrong date of birth.”

You can even make up a phony maiden name for your mother. “Don’t make it something that’s a matter of public record,” he says.

Even so, social networks basically tap into human nature’s innate need to socialize, and the bad guys know it. “People aren't very good at security,” RSnake says. “We were built to work in teams, we're pack animals.”
7) Corporate espionage
Even if an employer blocks access to social networks from the office, the organization still could be susceptible to corporate espionage attacks via its employees’ personal profiles.

To pull off a spear phishing attack, for example, all an attacker has to do is search for Company A’s employees on a social networking site and then pose as someone within the organization -- such as the head of human resources -- and email the employee addresses he finds, for example. A phony HR spear phish could look something like this, Sophos’s Cluley says: “Dear Fred Jones, Congratulations on joining XYZ Company. Click on this link to access our HR Intranet and then log in with your regular network username and password so we can update our files.”

A newbie to the company could easily fall for the ploy and hand over access to the corporate network, he says.

The only shot at preventing this hack is for social networkers to limit what they post publicly and to keep their employer’s name out of their profile. “Keeping the name of your employer... far away from your personal profiles can reduce the chance that someone will target your employer through you,” BreakingPoint’s Moore says. “The trouble is that even with completely separate personal and professional identities, it only takes one scrap of public information linking the two to negate all of the time that went into separating them in the first place.”

That’s because the “six degrees of separation” rule applies on most social networks: You’re only a few hops away from a bad guy. “We know that there are bad people on these networks using them to steal information,” Cluley says. “You may be only a half a dozen hops from an identity thief if we’re all connected.”

Responses to: editors@darkreading.com

ORIGINAL ARTICLE

Many thanks to support group member, Gypsy for this gem!

Staying Safe Online -- Are You REALLY Anonymous?

It's tempting to feel that you're anonymous online, protected from potential cyberstalkers by cryptic user names and website privacy settings. But is that really true? How easy is it for a malicious person to track someone down, based solely on personal information they've made available?

We launched an investigation to find out.

The process started by picking a random person on Flickr. She had an unusual user name that we're going to call French Puppy (although all personal details have been changed), so no obvious clues there, but her profile linked to a personal website, LeahTphotos.com. First name Leah, but what was the T?

Website registration details often include the name and address of the creator, so we searched for "LeahTphotos.com" at whois.net. No luck, though, as it was registered to the name of a web design company, presumably the folks who built the site.

People often use the same user name around the web, and so we next tried searching for "French Puppy" at Google. Some hits, but not the right person.

Maybe her website name was the key? We tried another Google search for "LeahTphotos.com" and Leah, and success - we found a reference on another site that included her full name, a real breakthrough.

Entering this at Facebook gave us several hits, but we recognised her photo as a match for others on Flickr. The account was private, but revealed that she was in the Brighton network, and provided a list of all her friends. Within 60 seconds we had her phone number from BT.com, while 192.com helped out with her address, details of the neighbours, and even a handy map revealing how to get to her house.

That was enough, and we then emailed our test subject to explain what we were doing and why. She's since removed the page that linked LeahTPhotos.com to her full name, and so is a little safer as a result.

But what's really worrying isn't just that we could uncover so much in less than five minutes work on the very first person we tried. It's that the next two individuals we investigated were even easier to track down. And that suggests your privacy could be compromised just as quickly, unless you follow very strict rules about what you say online.

Seven rules for staying safe online

1. Don't give away your real name unless it's absolutely necessary.

2. If you register a domain name for a website then consider getting privacy protection as well. This lets you register with your real details, but ensures they're not available to the public, and is an option now offered by many companies (1steuro.net say they include it for free).

3. Don't tell people where you live, or work. Don't hint at it, perhaps saying you've just visited a particular place because it's "just around the corner".

4. It really should be obvious to say don't post details like your phone number online, but astonishingly people do this quite frequently. Try a Google search like "my cell number is" site:myspace.com to see what we mean.

5. Don't post links between your various internet homes, for example telling people on favourite forum A that you also post on message board B. And don't register the same user name everywhere. This only makes it easier to stalkers to follow you around the web, put together clues from different places, and uncover useful information.

Staying Safe Online -- Are You REALLY Anonymous?

It's tempting to feel that you're anonymous online, protected from potential cyberstalkers by cryptic user names and website privacy settings. But is that really true? How easy is it for a malicious person to track someone down, based solely on personal information they've made available?

We launched an investigation to find out.

The process started by picking a random person on Flickr. She had an unusual user name that we're going to call French Puppy (although all personal details have been changed), so no obvious clues there, but her profile linked to a personal website, LeahTphotos.com. First name Leah, but what was the T?

Website registration details often include the name and address of the creator, so we searched for "LeahTphotos.com" at whois.net. No luck, though, as it was registered to the name of a web design company, presumably the folks who built the site.

People often use the same user name around the web, and so we next tried searching for "French Puppy" at Google. Some hits, but not the right person.

Maybe her website name was the key? We tried another Google search for "LeahTphotos.com" and Leah, and success - we found a reference on another site that included her full name, a real breakthrough.

Entering this at Facebook gave us several hits, but we recognised her photo as a match for others on Flickr. The account was private, but revealed that she was in the Brighton network, and provided a list of all her friends. Within 60 seconds we had her phone number from BT.com, while 192.com helped out with her address, details of the neighbours, and even a handy map revealing how to get to her house.

That was enough, and we then emailed our test subject to explain what we were doing and why. She's since removed the page that linked LeahTPhotos.com to her full name, and so is a little safer as a result.

But what's really worrying isn't just that we could uncover so much in less than five minutes work on the very first person we tried. It's that the next two individuals we investigated were even easier to track down. And that suggests your privacy could be compromised just as quickly, unless you follow very strict rules about what you say online.

Seven rules for staying safe online

1. Don't give away your real name unless it's absolutely necessary.

2. If you register a domain name for a website then consider getting privacy protection as well. This lets you register with your real details, but ensures they're not available to the public, and is an option now offered by many companies (1steuro.net say they include it for free).

3. Don't tell people where you live, or work. Don't hint at it, perhaps saying you've just visited a particular place because it's "just around the corner".

4. It really should be obvious to say don't post details like your phone number online, but astonishingly people do this quite frequently. Try a Google search like "my cell number is" site:myspace.com to see what we mean.

5. Don't post links between your various internet homes, for example telling people on favourite forum A that you also post on message board B. And don't register the same user name everywhere. This only makes it easier to stalkers to follow you around the web, put together clues from different places, and uncover useful information.

Browser Flaw Can Pick Up Your Porn Site Visits

Dozens of websites have been secretly harvesting lists of places that their users previously visited online, everything from news articles to bank sites to pornography, a team of computer scientists found.

The information is valuable for con artists to learn more about their targets and send them personalized attacks. It also allows e-commerce companies to adjust ads or prices — for instance, if the site knows you've just come from a competitor that is offering a lower price.

Although passwords aren't at risk, in harvesting a detailed list of where you've been online, sites can create thorough profiles on its users.

The technique the University of California, San Diego researchers investigated is called "history sniffing" and is a result of the way browsers interact with websites and record where they've been. A few lines of programming code are all a site needs to pull it off.

Although security experts have known for nearly a decade that such snooping is possible, the latest findings offer some of the first public evidence of sites exploiting the problem. Current versions of the Firefox and Internet Explorer browsers still allow this, as do older versions of Chrome and Safari, the researchers said.

The report adds to growing worry about surreptitious surveillance by Internet companies and comes as federal regulators in the U.S. are proposing a "Do Not Track" tool that would prevent advertisers from following consumers around online to sell them more products.

The researchers found 46 sites, ranging from smutty to staid, that tried to pry loose their visitors browsing histories using this technique, sometimes with homegrown tracking code. Nearly half of the 46 sites, including financial research site Morningstar.com and news site Newsmax.com, used an ad-targeting company, Interclick, which says its code was responsible for the tracking.

Interclick said the tracking was part of an eight-month experiment that the sites weren't aware of. The New York company said it stopped using the technique in October because it wasn't successful in helping match advertisers to groups of Internet users. Interclick emphasized that it didn't store the browser histories.

Morningstar said it ended its relationship with Interclick when it found out about the program, and NewsMax said it didn't know that history sniffing had been used on its users until AP called. NewsMax said it is investigating.

The researchers studied far more sites — a total of the world's 50,000 most popular sites — and said many more behaved suspiciously, but couldn't be proven to use history sniffing. Nearly 500 of the sites studied had characteristics that suggested they could infer browsers' histories, and more than 60 transferred browser histories to the network. But the researchers said they could only prove that 46 had done actual "history hijacking."

"Browser vendors should have fixed this a long time ago," said Jeremiah Grossman, an Internet security expert at WhiteHat Security Inc., which wasn't involved in the study. "It's more evidence that we not only needed the fix, but that people really should upgrade their browsers. Most people wouldn't know this is possible."

The latest versions of Google Inc.'s Chrome and Apple Inc.'s Safari have automatic protections for this kind of snooping, researchers said. Mozilla Corp. said the next version of Firefox will have the same feature, adding that a workaround exists for some older versions as well.

Microsoft Corp. noted that Internet Explorer users can enable a private browsing mode that prevents the browser from logging the user's history, which prevents this kind of spying. But private browsing also strips away important benefits of the browser knowing its own history, such as displaying Google links you've visited in different colors than those you haven't.

"It's surprising, the lifetime that this fundamental a privacy violation can stick around," said Hovav Shacham, an assistant professor of computer science and engineering at UC San Diego and one of the paper's authors.

Internet companies are obsessed with tracking users' behavior so they can target their ads better. Uproar has prompted the Federal Trade Commission to propose rules that would limit advertisers' ability to track Internet users to show them advertisements. The "Do Not Track" tool the commission is proposing could eventually take the form of a browser setting that tells advertisers which visitors are off limits; such a setting, though, wouldn't necessarily block history sniffing.

History sniffing is essentially a side-by-side comparison of Web pages you've already visited with Web pages that a particular site wants to see if you've visited. If there's a match, users likely would never know, but the site administrators would learn a lot about their audiences.

For instance, a popular porn site was checking its visitors' histories to see if they'd visited 23 other pornography sites, and the code used on the Morningstar and NewsMax.com sites looked for matches against 48 specific Web pages, all related to Ford automobiles.

Sites can carry on this kind of inspection very quickly. Grossman said modern programs can check as many as 20,000 Internet addresses per second.

original article here

Browser Flaw Can Pick Up Your Porn Site Visits

Dozens of websites have been secretly harvesting lists of places that their users previously visited online, everything from news articles to bank sites to pornography, a team of computer scientists found.

The information is valuable for con artists to learn more about their targets and send them personalized attacks. It also allows e-commerce companies to adjust ads or prices — for instance, if the site knows you've just come from a competitor that is offering a lower price.

Although passwords aren't at risk, in harvesting a detailed list of where you've been online, sites can create thorough profiles on its users.

The technique the University of California, San Diego researchers investigated is called "history sniffing" and is a result of the way browsers interact with websites and record where they've been. A few lines of programming code are all a site needs to pull it off.

Although security experts have known for nearly a decade that such snooping is possible, the latest findings offer some of the first public evidence of sites exploiting the problem. Current versions of the Firefox and Internet Explorer browsers still allow this, as do older versions of Chrome and Safari, the researchers said.

The report adds to growing worry about surreptitious surveillance by Internet companies and comes as federal regulators in the U.S. are proposing a "Do Not Track" tool that would prevent advertisers from following consumers around online to sell them more products.

The researchers found 46 sites, ranging from smutty to staid, that tried to pry loose their visitors browsing histories using this technique, sometimes with homegrown tracking code. Nearly half of the 46 sites, including financial research site Morningstar.com and news site Newsmax.com, used an ad-targeting company, Interclick, which says its code was responsible for the tracking.

Interclick said the tracking was part of an eight-month experiment that the sites weren't aware of. The New York company said it stopped using the technique in October because it wasn't successful in helping match advertisers to groups of Internet users. Interclick emphasized that it didn't store the browser histories.

Morningstar said it ended its relationship with Interclick when it found out about the program, and NewsMax said it didn't know that history sniffing had been used on its users until AP called. NewsMax said it is investigating.

The researchers studied far more sites — a total of the world's 50,000 most popular sites — and said many more behaved suspiciously, but couldn't be proven to use history sniffing. Nearly 500 of the sites studied had characteristics that suggested they could infer browsers' histories, and more than 60 transferred browser histories to the network. But the researchers said they could only prove that 46 had done actual "history hijacking."

"Browser vendors should have fixed this a long time ago," said Jeremiah Grossman, an Internet security expert at WhiteHat Security Inc., which wasn't involved in the study. "It's more evidence that we not only needed the fix, but that people really should upgrade their browsers. Most people wouldn't know this is possible."

The latest versions of Google Inc.'s Chrome and Apple Inc.'s Safari have automatic protections for this kind of snooping, researchers said. Mozilla Corp. said the next version of Firefox will have the same feature, adding that a workaround exists for some older versions as well.

Microsoft Corp. noted that Internet Explorer users can enable a private browsing mode that prevents the browser from logging the user's history, which prevents this kind of spying. But private browsing also strips away important benefits of the browser knowing its own history, such as displaying Google links you've visited in different colors than those you haven't.

"It's surprising, the lifetime that this fundamental a privacy violation can stick around," said Hovav Shacham, an assistant professor of computer science and engineering at UC San Diego and one of the paper's authors.

Internet companies are obsessed with tracking users' behavior so they can target their ads better. Uproar has prompted the Federal Trade Commission to propose rules that would limit advertisers' ability to track Internet users to show them advertisements. The "Do Not Track" tool the commission is proposing could eventually take the form of a browser setting that tells advertisers which visitors are off limits; such a setting, though, wouldn't necessarily block history sniffing.

History sniffing is essentially a side-by-side comparison of Web pages you've already visited with Web pages that a particular site wants to see if you've visited. If there's a match, users likely would never know, but the site administrators would learn a lot about their audiences.

For instance, a popular porn site was checking its visitors' histories to see if they'd visited 23 other pornography sites, and the code used on the Morningstar and NewsMax.com sites looked for matches against 48 specific Web pages, all related to Ford automobiles.

Sites can carry on this kind of inspection very quickly. Grossman said modern programs can check as many as 20,000 Internet addresses per second.

original article here