Is SpyZooka spyware?

• Tweet

April 30th, 2009 - Posted by Caitlin

The following post in our Reader Question series is an actual user submitted question. To maintain the integrity of the original question, we do not edit or change reader questions in any way.

Q: Last night, I purchased SpyZooka. I have run it five or six times. During this session on the internet, I have 27 oops messages. I've been on for about an hour now. Is SpyZooka spyware?

A: We have not yet reviewed SpyZooka at NextAdvisor.com, so we can't offer specific or detailed advice on this particular software or its features. However, SpyZooka does not appear to be a Trojan horse, delivering spyware to your computer. We were unable to find any reviews for SpyZooka in reputable publications, but it has received high praise from some consumers.

Supposedly, SpyZooka is adept at locating spyware and viruses that other Internet security programs miss, so it is possible that you have either stumbled on to some malware in the past day or so, or that SpyZooka is simply finding malware that has already been infecting your computer for some time.

While we do not have reason to believe that SpyZooka is malware in disguise, we are not particularly familiar with this software and cannot vouch for it emphatically. To learn more about the Internet security software that we have reviewed at NextAdvisor.com, see our reviews and comparison chart.

New Facebook phishing scam

• Tweet

April 30th, 2009 - Posted by Caitlin

Two new Facebook imitation sites have popped up in the past couple of days, attempting to steal Facebook users' login names and passwords. The phishing sites, fbstarter.com and fbaction.net, appear virtually identical to facebook.com. Phishers lure users to the fake websites by sending Facebook messages that say, "Look at this!" and link to an imitation Facebook page, where users are prompted to log in with their names and passwords.

Once the phishers have your Facebook login information, they can access a wealth of personal data, which puts you at risk for identity theft. They can also perpetuate the scam by sending messages to all of your contacts, luring them to the phishing sites as well.

If you recieve a Facebook message that says, "Look at this!" you should delete it. Do not click on the link. When logging into Facebook, check the address bar to be sure that it reads, "facebook.com." If it doesn't, leave the page immediately.

To learn more about protecting yourself from identity theft, see our reviews and comparison of identity theft protection services.

Privacy is an illusion

• Tweet

April 30th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

A CEO of a major software company declares, "You have zero privacy, get over it." In response, the FTC states, "Millions of American consumers tell us that privacy is a grave concern to them when they are thinking about shopping online."

Do you agree? Is privacy dead? Do you share your "status" on Facebook? Twitter? Do you have a MySpace page? A blog? Do you post your family photos on any of the above, or on Flicker?

The statement, "You have zero privacy, get over it," was made by Scott McNealy, former chief executive officer of Sun Microsystems, in 1999. That was 10 years ago. Before the phrase "social networking" or the word "blog" entered our lexicon.

Here we are in 2009, when that statement is 100 times more true than it was 10 years ago. When you ask people if they are concerned about online privacy, they respond with a big, loud, angry "YES!" Then they hypocritically use their Facebook pages to inform the world that they are about to go on vacation. Which means that the lights are off and nobody's home.

It isn't just web users voluntarily giving up their privacy, it's also corporations and government agencies gathering data as a form of intelligence. This data might be used to sell you something or it could be used to protect us in the form of Homeland Security.

Our personal information can be bought and sold. "Information brokers" sell our data to anyone with a credit card. One of the largest publicly traded information brokers in the world is a company called ChoicePoint. Last time I checked, they had 19 billion records on file. And one of their biggest customers is the US government.

So even if you don't update your Facebook status to tell the world you just made a tuna sandwich, chances are, your phone number, your most recent address, or even your anonymous chat handle can be found on Zabasearch.com or iSearch.com. If you've ever committed a felony, your data may be on CriminalSearches.com Heck, just Google yourself.

If you are reading this, you are participating in society. The price you pay is sacraficing your personal identifying information in order to get an Internet connection, credit, a car, medical attention, to go to school or buy a pair of shoes. While many citizens scream against Big Brother and corporate America abusing their trust, many will also give up all their privacy for ten% off a new pair of shoes.

All this makes it very easy for criminal hackers to commit identity theft. They use this available data to become you. Since your data is already out there, you'd better invest in identity theft protection and make sure your PC is up to date with Internet security software.

For more information, I recommend You Have Zero Privacy – Enjoy It! by Mike Spinny, and Cyberwar's First Casualty: Your Privacy by Preston Gralla.

Robert Siciliano, identity theft expert, discusses background checks.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.

Will someone act on my behalf if my identity is stolen?

• Tweet

April 29th, 2009 - Posted by Caitlin

The following post in our Reader Question series is an actual user submitted question. To maintain the integrity of the original question, we do not edit or change reader questions in any way.

Q: Do any of the identity theft protection companies you feature offer an advocates service if my identity is compromised or stolen? Will someone be assigned to act on my behalf with creditors, banks, retailers, etc to work through rectification?

A: Yes. If you subscribe to an identity theft protection service and you subsequently become a victim of identity theft, recovery experts will advice you on your options and leverage their network of resources in order to help restore your identity. Most of the identity theft protection services reviewed on NextAdvisor.com guarantee a certain amount of money, usually up to $1,000,000, to cover the costs associated with restoring your identity. Each service approaches identity recovery and restoration differently, so it is important to research each service to understand what it does and does not cover in the unfortunate case that a subscriber does become a victim.

To learn more about identity theft protection services, see our reviews and comparison chart.

Criminal hackers use P2P file sharing to commit identity theft

• Tweet

April 29th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

The House Committee on Oversight and Government Reform is responding to reports that peer to peer file sharing allows Internet users to access other P2P users' most important files, including bank records, tax files, health records, and passwords. This is the same P2P software that allows users to download pirated music, movies and software.

What's interesting is that they didn't already realize this was going on. Most of the committee members probably have kids, and their own home PCs probably have P2P software installed.

An academic from Dartmouth College found that he was able to obtain tens of thousands of medical files using P2P software. In my own research, I have uncovered tax returns, student loan applications, credit reports and Social Security numbers. I've found family rosters which include usernames, passwords and Social Security numbers for entire family. I've found Christmas lists, love letters, private photos and videos (naughty ones, too) and just about anything else that can be saved as a digital file.

Installing P2P software allows anyone, including criminal hackers, to access your data. This can result in data breaches, credit card fraud and identity theft. This is the easiest and, frankly, the most fun kind of hacking. I've seen reports of numerous government agencies, drug companies, mortgage brokers and others discovering P2P software on their networks after personal data was leaked.

Blueprints for President Obama's private helicopters were recently compromised because a Maryland-based defense contractor's P2P software had leaked them to the wild, wild web.

The House Committee on Oversight and Government Reform sent letters to the Attorney General and FTC Chairman, asking what the Department of Justice is doing to prevent the illegal use of P2P. Which is kind of ridiculous, because it's not illegal to use P2P programs. Even if it were made illegal, P2P file sharing is a wild animal that can't be tamed.

The letter also asks what the government is doing to protect its citizens. Okay. I've sat with both the FTC and the DoJ. These are not dumb people. I‘ve been very impressed by how smart they are. They know what they are doing and they see the major issues we face. But they are not in a position to prevent an Internet user from installing a free, widely accessible software, and subsequently being stupid when setting it up and unintentionally sharing their C-drive with the world. No government intervention can prevent this. The House Committee on Oversight and Government Reform should focus more on educating the public about the use of P2P file sharing.

Politicians are most likely being lobbied and funded by the recording and motion picture industries to put pressure on the providers of such software. Letters and government noise will not do anything to stop file sharing. While there have been plenty of witch hunts leading to prosecutorial victories, the public will always be vulnerable. It is up to us, as individuals, to protect ourselves.

• Don't install P2P software on your computer.
• If you aren't sure whether a family member or employee has installed P2P software, check to see whether anything unfamiliar has been installed. A look at your "All Programs Menu" will show nearly every program on your computer. If you find an unfamiliar program, do an online search to see what it is you've found.
• Set administrative privileges to prevent the installation of new software without your knowledge.
• If you must use P2P software, be sure that you don't share your hard drive's data. When you install and configure the software, don't let the P2P program select data for you.
• Because you don't have control of what others do on their PCs, make sure you invest in identity theft protection and Internet security software.

Robert Siciliano, identity theft speaker, uses P2P software to access lots of fun data.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.

Phishing and spam are more targeted than ever

• Tweet

April 28th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

It wasn't long ago that most phishing emails were from a supposed Nigerian general. And you and I were flattered that we were the chosen ones to help the general transfer 35 million out of the country, because the Nigerian government was a bunch of jerks and wouldn't let him keep the inheritance his wife had inherited from her deceased uncle.

I distinctly remember getting a Nigerian phishing email in 1994, back when I had an AOL account, and actually calling my bank and asking them what their thoughts were and what I should do. I mean 10% of 35 million, which the scammer offered in exchange for my help transferring the funds, was quite a fee for nominal work. All I had to do was front 10 grand in a wire transfer to make it all happen. My bank thought my Nigerian general and I were both nuts, and really didn't know what I should do.

We didn't have a lot of data on 419 scams or affinity fraud back then, or at least we didn't have reliable access to that data, so I relied on what my mom told me early on: if it sounds too good to be true, it's probably isn't. So I deleted the email. Then I began to see more and more emails from others in the same quandary as the general.

Times have changed dramatically.

Today, with low cost delivery of email, billions of fraudulent emails are sent out every year. Any sales person knows it's a numbers game. With billions of emails, you'll eventually get someone to buy in.

Not too long ago, most spam emails came from a few legitimate servers. Once the government cracked down with the Can Spam Act, spam went underground. Most of today's phishing emails originate from botnets. But what hasn't changed much is the fraud victims' sophistication, or lack thereof. The scammers are smarter, but the victims, not so much.

While phishing emails keep pouring in, their methods are changing rapidly. Posing as a Nigerian prince is still common, but not as effective. Even posing as a known bank or Paypal, asking to update an account for various reasons and requesting a potential victim's user name and password is not as effective as it used to be.

Much of the phishing that occurs today is targeted "spear phishing," in which the spammers are after a localized target. Recently, the usernames and passwords for 700 Comcast customers were posted on a document-sharing website, possibly as a result of a phishing attack. A Comcast employee with access to this type of data could easily have been tricked by a phisher posing as Comcast's own IT staff, and foolishly released the customer information.

Going after a CEO is called "whaling." Who better to take down than the biggest phish of them all? Most corporate websites offer plenty of data on the company officers and administrative contacts, which makes it relatively easy to create a sucker list. If scammers send an email blast to the entire company, eventually someone is likely to cough up enough data to allow the scammers to tap into the company's intranet. Once the scammers have accessed the intranet, all further phishing emails will appear to be coming from a trusted, internal source.

Phishers even follow a similar editorial calendar as newspaper and magazine editors, coordinating their attacks around holidays and the change in seasons. They capitalize on significant events and natural disasters, such as Hurricane Katrina and most recently, swine flu. Since the swine flu outbreak, as much as 2% of all spam has the words "swine flu" in the subject line. Numerous websites referencing swine flu in the address have also been registered.

Perhaps the most insidious type of phishing occurs when a recipient clicks a link, either in the body of an email or on the spoofed website linked in the email, and a download begins. That download is almost always a virus with a remote control component , which gives the phisher full access to the user's data, including usernames and passwords, credit cards details, banking and Social Security numbers. Often, that same virus makes the victim's PC part of a botnet.

How to avoid becoming a victim? Delete.

And of course, update your Internet security software and make sure your PC's operating system has the latest critical security patches.

Robert Siciliano, identity theft speaker, discusses scam-baiters.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.

Responsible social media means that you need to be responsible

• Tweet

April 24th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

CNN invited me to discuss the murder of a young woman who was stalked and harassed via social media, specifically YouTube and Facebook. She was eventually shot and killed in her college classroom by her stalker, who then put the gun in his own mouth.

Anyone who reads this blog does so because they are intent on improving their personal safety by way of information security. With almost 50,000 reads a month on a variety of portals, I've come to understand the reader a bit. You guys want and need news that's going to help save you time and money by preventing criminals and scammers from trying to take it.

I got my legs in personal security as it pertains to violence prevention. I started doing this in 1992, teaching self defense. My background as a scrawny, greasy Italian kid growing up in the Boston area, fighting my way though life and meeting other victims along the way brought me to a place where teaching others how to protect themselves gave my life a purpose. As my business grew, I needed more technology. I also needed "merchant status," which is the ability to accept credit cards, which led to even more technology. In the early 90s, I set up my IBM PS1 Consultant PC, Windows 3.1, 150mb hard drive, and became hooked on technology. Soon after, I was plugged into the Internet. Within weeks, my business was hacked. Thousands of dollars in orders and credit card information went out the window. Now, personal security meant self defense from a different kind of predator: identity thieves and criminal hackers.

My passion is personal security as it relates to violence and fraud prevention. It's all encompassing. I talk about the things that mom and dad didn't teach you. Lately, I've been discussing broad issues that no parent is prepared to discuss. Really, neither am I. But somebody's go to do it.

I love technology. But it has a very dark side to it. And predators have rapidly figured that out. I'm not blaming technology for this. Just its users.

Social networking is changing the world. Everybody's information is everywhere, and access is instant. Predators use these tools more than ever to stalk children online. Stalkers can anonymously harass and harangue women or men, and law enforcement's hands are tied.

Anyone can post relatively anonymous rants and raves, saying anything they like with little or no repercussions. Simple online newspaper articles meant to provide information about some innocuous issue devolve into hateful rants against the author or the source, thanks to the first few comments on the thread. A single comment can lead people in this dangerous direction. Newspapers need eyeballs, so they rarely police these comments, and the public puts up with them. Hate, racism, sexism and overall ignorance permeate every online newspaper and social network. Not a day goes by that I don't see something entirely inappropriate for public consumption.

With social media, everyone gets a say. The KKK used to be a bunch of cross burning hillbillies. Terrorists lived in caves. Militias and skinheads were small groups that held an occasional rally. Now, they have an international platform, which they use to promote their agendas and recruit believers. Lots of people have very bad things to say and it's hurting a lot of people. Words incite. What we say leads to action. We become what we think about. If we are fed hate, we act hatefully.

Most school shooters have read the manifests of what occurred at Columbine. Many serial killers study other serial killers. Every story we read about the Craigslist Killer and others like him reveals a bag with a knife, duct tape, rope, and wire ties. They all consume this information.

Coming from a personal security perspective, I am seeing lots of bad things happening to good people. Bad things are being said and bad things are happening. Totally unacceptable and hateful rants have become acceptable, when 10 years ago those kinds of rants would have been unheard of. Let's get this straight, I'm no puritan. I'm certainly no saint. I've been there, done that, and have plenty of skeletons in my closet. I'm capable of saying anything and doing almost anything, and nothing offends me. I've lived a hard life and danced with the devil on plenty of occasions.

Hurtful, hateful ranting isn't freedom of speech. It's irresponsible and it's bad karma. It will only lead to hurt and hate. Its okay to have beliefs, but when those beliefs have a tonality of hate and you express hate in your words, the problem mushrooms.

I spend more energy not saying what I want to say. My mother and father taught me tact. And it's taken a lifetime to apply it, believe me. I use social media to spread what I hope is a better message, tactfully. I hope you rise against what is happening here and spread a better word. Lead. Don't be led.

If you'd like to learn how to protect your identity on social media sites, you may be interested in NextAdvisor.com's Facebook and MySpace guides. You should also consider Internet security software with built-in parental controls to protect your children online.

Robert Siciliano, identity theft speaker, discusses hate on CNN.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.

AT&T shuts down CallVantage VoIP service; Subscribers have strong replacement options

• Tweet

April 22nd, 2009 - Posted by Joe

Subscribers of AT&T's CallVantage began receiving notification this week that the VoIP service would be phased out between now and the end of the year. This announcement comes just about a year after AT&T stopped signing up new CallVantage subscribers.

This is the second time this year that a traditional phone service provider has decided to shutter a VoIP service. Verizon shutdown the VoiceWing Internet phone service in January.

Luckily, CallVantage subscribers have several great options to choose from when looking for a replacement VoIP service. CallVantage plans ranged from about $20 to $30 per month, so most former subscribers could save a significant amount of money by switching to a VoIP service like Vonage or PhonePower. These providers offer plans starting at $9.95 and $8.33 per month respectively.

Whether you are a current CallVantage subscriber looking for an alternative or simply interested in learning more about VoIP, we suggest that you read our comparison and detailed reviews of VoIP services.

Does Carbonite's unlimited backup storage include data on other drives?

• Tweet

April 20th, 2009 - Posted by Caitlin

The following post in our Reader Question series is an actual user submitted question. To maintain the integrity of the original question, we do not edit or change reader questions in any way.

Q: Does Carbonite's unlimited backup storage include data on other drives (D, E, etc., which are either internal or external) in addition to the C drive?

A: By default, Carbonite backs up everything in your Documents and Settings folder, as well as all of your music. The default backup does not include programs, system files, temporary files, videos, or individual files greater than 4GB. You can manually add any of these, from any internal hard drive, to your Carbonite backup. Carbonite does not guarantee support for external hard drives, and we have heard conflicting reports as to whether or not it is possible to successfully back up an external hard drive with Carbonite.

Mozy, another of the online backup services reviewed on NextAdvisor.com, does back up external hard drives.

To learn more about Carbonite, Mozy, and other online backup services, see our reviews and comparison chart.

American citizens' identification is a joke

• Tweet

April 20th, 2009 - Posted by Robert Siciliano

Robert Siciliano is a NextAdvisor.com Expert Guest Blogger

Like it or not, you will soon be effectively identified. And by "soon," I mean within the next 10 years. Big Brother, whatever that means, will have your "number." Governments across the globe have been gearing up and introducing numerous technologies to identify, verify and authenticate.

Identity is a simple idea that has become a complex problem. It has become complex due to fraud. Fraud, motivated by money, easy credit, and the ease of account takeover. Because identity has yet to be effectively established, anyone can be you. "Identity has yet to be established" is a bold statement that really requires an entire blog post. I'll explain briefly here and in detail another time.

We have as many as 200 forms of ID circulating from state to state, plus another 14,000 birth certificates and 49 versions of the Social Security card. We use "for profit" third party information brokers and the lowly vital statistics agency that works for each state to manage the data. All of these documents can be compromised by a good scanner and inkjet printer. This is not established identity. This is an antiquated treatment of identity and ID delivery systems. Identity has yet to be established.

Proper identification starts with government employees, who basically have little say in the matter. Small, specific segments of society such as airport employees, those of immediate concern to Homeland Security, are also first in line to be identified.

Security Management reports that as of this month, all workers and mariners attempting to access secure maritime and port areas nationwide will have to flash a government-approved Transportation Worker Identification Credential (TWIC), biometric identification card before entry. As expected, the system is riddled with problems and complaints.

HSPD-12, or Homeland Security Presidential Directive 12, set universal identification standards for federal employees and contractors, streamlining access to buildings and computer networks, but not without some glitches.

Many privacy advocates scream in horror about a national ID. The fact is, we already have a national ID and it's the Social Security number. While the Social Security number was never intended to be a national ID, it became one due to functionality creep. And it does a lousy job, because anyone who gets your SSN can easily impersonate you.

Privacy advocates and others who believe that there is or ever was true privacy are operating under an illusion. The issue here isn't really privacy, its security. It's managing our circumstances. Growing up, my mother was a privacy advocate. She advocated that privacy was a dead issue as long as I lived in her house. At any given time, she could rifle thorough my stuff if she even got a hint of glazed eyeballs.

I've always been fascinated with identification and what it means. Over the years, as I've dug deeper into information security and then identity theft, I have been floored by the ineffectiveness of the existing system. Numerous identity technologies use software or hardware as the delivery system. A Smartcard is a delivery system, it isn't your identity. Identity may include biometrics and verification questions.

Then there is the issue of properly identifying a person. How? And what is the difference between authentication and verification? I've always used them interchangeably, so I asked an expert, Jeff Maynard, President and CEO of Biometric Signature ID, who is in the game of properly identifying his clients' clients through dynamic biometrics, for his take on authentication vs. verification. There is a distinct difference. "Authentication is the ability to verify the identity of an individual based on their unique characteristics. This is known as a positive ID and is only possible by using a biometric. A biometric can be either static (anatomical, physiological) or dynamic (behavioral). Examples of each are: Static – iris, fingerprint, facial, DNA. Dynamic – signature gesture, voice, keyboard and perhaps gait. Also referred to as something you are. Verification is used when the identity of a person cannot be definitely established. Technologies used provide real time assessment of the validity of an asserted identity. We don't know who the individual is but we try to get as close as we can to verify their asserted identity. Included in this class are out of wallet questions, PINS, passwords, tokens, cards, IP addresses, behavioral based trend data, credit cards, etc. These usually fall into the realm of something you have or something you know."

Identity proofing means proving identity, which, as I see it, is the foundation for identity and one of the most overlooked and under discussed aspects of identity amongst industry outsiders. This is a most fascinating topic. I will get into that soon.

To learn about identity theft protection services, check out NextAdvisor's reviews and comparison chart.

Robert Siciliano, identity theft speaker, discusses Social Security numbers.

Robert Siciliano is CEO of IDTheftSecurity.com , an identity theft expert, professional speaker, security analyst, published author and television news correspondent. Siciliano works with Fortune 1000 companies and startups as an advisor on product launches, branding, messaging, representation, SEO and media. Siciliano's thoughts and advice on all these matters appear often in both the televised and print news media including CNN, MSNBC, CNBC, FOX, Forbes and USA Today. He has 25 years of security training as a member of the American Society of Industrial Security. He is the author of 2 books, including The Safety Minute: Living on High Alert; How to take control of your personal security and prevent fraud. He's also partnered with Uni-Ball to help raise awareness about the growing threat of identity theft and to provide tips on how you can protect yourself.