By Coenraad De Beer
Green means "Trust", the catchphrase for EV SSL certificates, the new authentication standard for secure web sites. Lets be clear on one thing. SSL encryption is a necessity for any web site collecting sensitive information from its visitors and it is great to see that certificate authorities are making it harder for swindlers to obtain these certificates. But does it mean that an already trustworthy web site, owning an EV SSL certificate, is now even more trustworthy and an already trustworthy web site, not owning an EV SSL certificate, is no longer trustworthy?
The one thing that makes EV SSL stand out from normal SSL certificates is its colour coding system. Green means trust, yellow means suspicion and red means danger. The address bar of Firefox turned yellow for secure web sites using SSL encryption, long before Microsoft came with the idea to make Internet Explorer's address bar green for sites owning an EV SSL certificate. Internet Explorer 7 added tabbed browsing, something that was already part of Firefox, Internet Explorer 7 added an anti-phishing filter, something you could always add to Firefox with the Google Toolbar, so it was of no surprise to me when Internet Explorer 7 suddenly started to make use of colour codes to classify the safety status of web sites.
In a study done by Rachna Dhamija, a Postdoctoral Fellow at the Centre for Research on Computation and Society at Harvard University, it was found that most phishing attacks succeed because of the human factor and not because lacklustre security standards, bugs in the operating system or a faulty browser. Many people simply ignore the warnings and messages given to them, they are not aware of the security features of a browser and therefore don't care if the address bar turns purple for that matter (You can read more about this study at http://www.securityfocus.com/columnists/407). So the colour coding system will only work if people are properly educated about it. But I still have a problem with this system. It can make people completely paranoid when browsing the web. If they don't see the address bar turning green, they will immediately have a negative attitude towards the web site they are visiting. Isn't the main purpose of EV SSL to build trust and customer confidence among Internet users?
Green means "Trust", is only another way of saying a little padlock in the bottom-right corner of your screen means secure. It is a good thing to know that applicants for EV SSL certificates undergoes a very strict validation and authentication process, but this will only last until the standards are weakened again. EV SSL is like normal SSL certificates combined with rigorous validation procedures and a colour coding system, so the core of the certificate itself stays the same. Lets say the user starts to depend on this "Trust" built by EV SSL certificates. Will the user learn how to identify dangerous web sites without this technology? No. What happens if someone bypasses the rigorous validation procedures of EV SSL certificates, will the user blindly trust this site because it has an EV SSL certificate? Yes, most definitely. A driver of a car has an unconditional trust in its brake pedal and will not be able to identify sudden brake failure until it is too late. The trust is placed on an object that cannot guarantee your safety. It is not the pedal that provides the safety, but the mechanical system behind it. The same holds true for EV SSL. You need to teach people how to identify a dangerous web site without the fancy colour coded signs of EV SSL, just like teaching someone on how to identify brake failure without relying on the brake pedal to warn you about it.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software.
Wednesday, February 14, 2007
Friday, February 09, 2007
Cyber Crime - A Look Behind The Scenes
By Coenraad De Beer
One evening Victor Victim sits in front of his computer, downloading his latest e-mails. He gets an e-mail with a subject line reading "CONGRATULATIONS YOUR EMAIL ADDRESS WON 1.5 MILLION UNITED STATES DOLLARS". Victor can't believe his eyes and immediately opens the e-mail to see what it is all about. The sender, Mr. Scammy Scammer, requests a lot of personal information including his banking details, in order to transfer the funds to Victor's bank account. Victor is so amazed by the simplicity of the process that he immediately hits the reply button to send Mr. Scammy Scammer the information he requested.
The next morning Victor cannot wait to see if Mr. Scammer replied. He is really impressed to see that Mr. Scammer replied in a timely manner and hastily he opens the e-mail to see when the funds will hit his bank account. To Victor's disappointment he discovers that he needs to transfer $1500 to a foreign location through a money transfer service called Western Union. Victor doesn't have this amount of money on hand and decides to forget about the whole thing. He deletes all the e-mails from Mr. Scammer with disgust and goes to work.
On the other side of the world is Mr. Scammer waiting for a reply from Victor. A week goes by without a reply from Victor and Mr. Scammer realises that Victor did not fall for his scam. He decides to call his friend Phishy Phisher, an expert designer of phishing scam e-mails. Mr. Scammer tells his friend about Victor and sells his information to Mr. Phisher for $300. This may seem like a generous offer but Mr Scammer does business with Mr. Phisher on a regular basis and sells him the information of all the victims who were unwilling to fall for his scam. And even if he scammed the person successfully, he sells the information anyway. Mr. Phisher gives Mr. Scammer a further 20% of the funds he steals from bank accounts compromised with his phishing scam e-mails.
Two weeks later Victor receives a notification from his bank, informing him that they performed a scheduled software upgrade to their online banking system. They urgently request that Victor visits their web site to confirm his banking details. Failing to do so before the end of the week will result in a temporary suspension of his online banking facilities. He wonders why they need to confirm his details, but eventually click on the link provided in the e-mail. Victor does a lot of online banking and cannot afford to loose online access to his bank account. Unfortunately Victor did not take a good look at the URL, failing to realise that he was taken to a fake web site looking like the one he normally use for his online banking transactions. He enters his bank account number and pin and hit the submit button. A page appears within seconds informing Victor that his bank account details have been verified. "Wow, that's fast!" Victor says to himself and logs out of the online banking system.
Three days later Victor tries to withdraw cash from the ATM. The system simply tells him that he has insufficient funds. "That's impossible", says Victor, "I always have money in my bank account." Victor goes to his bank manager to find out what the problem is. His bank manager asks him whether he received an e-mail requesting confirmation of Victor's banking details. Victor confirms this and tells the bank manager that he thinks it is a stupid way of confirming a client's details. The bank manager explains to Victor that this is a phishing scam e-mail and that no bank ever sends e-mails like that to their clients. He also explains how the scam works and that the people behind the e-mail are responsible for the withdrawals from Victor's bank account. The bank is unfortunately not responsible for this breach and cannot compensate Victor for the financial loss. An angry, shocked and disappointed Victor heads home to get some sleep, maybe he will wake up tomorrow realising that this is all just a bad dream.
In the mean time Mr. Phisher decided to contact his colleague Mr. ID Thief. Mr ID Thief is an expert in Identity Theft and often buys personal information of scammed victims from Mr. Phisher and Mr. Scammer. A month later Victor goes through his mail only to find statements and bills for several credit cards, personal loans and retail credit accounts all opened in his name. To make things even worse, each account's credit limit has been fully utilised. The personal loans are settled in instalments and the other accounts have to be settled before the end of the month. Mr ID Thief used Victor's identity to open these accounts in Victor's name and after that he utilised and withdrew all the cash from these accounts. Victor slowly starts to become overstressed about all his financial problems, giving him sleepless nights. Eventually he loses his job because of poor work performance. The debt collectors start to take possession of Victor's personal belongings to settle his debt and in the end he has to move in with his sister just to have a roof over his head. Victor is declared insolvent and his name is placed on the credit bureau's black list of insolvent people. This makes it impossible for Victor to apply for a loan or any kind of credit.
Another month goes by and Mr. Sydney Syndicate from Russia is waiting for his agents to tell him how much money he made during the last couple of months. Mr. Scammer, Mr. Phisher and Mr. Thief are all working for Mr. Syndicate, stealing money from hundreds of people every month. They are allowed to keep 30% of the money stolen from the victims, the rest belongs to Mr. Syndicate and has to be transferred to Russia. The problem is, all the money they stole so far has grown to quite a large amount and cannot be transferred to Russia without the government officials asking some uncomfortable questions. So Mr. Scammer has to think of something to get all this money to Russia. Mr. Scammer comes up with a great idea.
Depressed Victor Victim sits in front of his sister's computer downloading his e-mail. He gets an offer from a very large company to act as the company representative in the United States. Victor is really excited, because he needs a job and the money desperately. The best of all he only needs to deposit cheques from U.S. clients, keeping 10% of the amount for himself and transferring the remaining 90% to the headquarters of the company through Western Union Money Transfer. The company looses money when they have to wait for cheques from the U.S. to clear in their country and need to follow this method in order to speed up the cash flow of their business. Victor does not think twice about this opportunity. He immediately completes the application form and sends it back to the company. The next day he receives a reply from the company informing him that his application was successful and first cheque to be deposited is already on his way.
Two days later he receives a cheque for $1500. He deposits the money into his bank account and waits for the cheque to clear. He keeps $150 for himself, withdraws $1350 and sends it to the headquarters of the company somewhere in Russia through Western Union Money Transfer, exactly like they told him to do. Victor can't wait for the next cheque to arrive. Another cheque arrives a week later, this time a whopping $20000. Victor follows the same routine earning him another $2000. A third cheque arrives for $2388.89. But Mr. Scammer has earned the trust of Victor by now and Victor does not wait for the funds to clear before withdrawing the 90% for the company. Victor withdraws the 90% ($2150 in this case) from his bank account and sends it off to Russia. Only this time the cheque doesn't clear and bounces. Victor looses all his money again and never hears from the company again. Two months later federal agents arrest Victor for money laundering and put him in jail for five years.
Mr. Syndicate is very pleased with his agents, they have served him well. Mr. Theft decides to sell Victor's e-mail address to Mr. Spammy Spammer, because the e-mail address if of no use to him anymore. Mr Spammy Spammer constantly sends Victor spam e-mails about stock quotes, online medications, pornography, business opportunities and instant university degrees.
When Victor finally got out of jail after 5 years he returned to his sister's home with the hopes of finding a job soon. But being blacklisted with a criminal record is not going to make things any easier for him. Later that evening he sits down in front of his sister's computer to download some e-mails. His sister downloaded his e-mails for him while he was in jail and stored them in a separate folder. He almost fell of the chair when he saw thousands of junk e-mails, scams and unsolicited advertisements that came through while he was gone. Victor decided to close his e-mail account and sworn never to use an e-mail account ever again.
This may be excessively exaggerated case of online fraud, but it clearly demonstrates what can happen to you after replying to a cyber scammer appearing to be completely harmless. It all starts with a trivial thing like your e-mail address landing in the wrong hands. It may not always be that easy for scammers to steal your money or commit Identity Theft, but you always walk the risk of financial loss if you don't take care of your personal information. Your personal information is your identity and your identity is a valuable asset to cyber scammers. Be vigilant, don't become a victim of cyber fraud.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. Educate yourself with examples of real hoaxes, spam e-mails and scams send to real people.
One evening Victor Victim sits in front of his computer, downloading his latest e-mails. He gets an e-mail with a subject line reading "CONGRATULATIONS YOUR EMAIL ADDRESS WON 1.5 MILLION UNITED STATES DOLLARS". Victor can't believe his eyes and immediately opens the e-mail to see what it is all about. The sender, Mr. Scammy Scammer, requests a lot of personal information including his banking details, in order to transfer the funds to Victor's bank account. Victor is so amazed by the simplicity of the process that he immediately hits the reply button to send Mr. Scammy Scammer the information he requested.
The next morning Victor cannot wait to see if Mr. Scammer replied. He is really impressed to see that Mr. Scammer replied in a timely manner and hastily he opens the e-mail to see when the funds will hit his bank account. To Victor's disappointment he discovers that he needs to transfer $1500 to a foreign location through a money transfer service called Western Union. Victor doesn't have this amount of money on hand and decides to forget about the whole thing. He deletes all the e-mails from Mr. Scammer with disgust and goes to work.
On the other side of the world is Mr. Scammer waiting for a reply from Victor. A week goes by without a reply from Victor and Mr. Scammer realises that Victor did not fall for his scam. He decides to call his friend Phishy Phisher, an expert designer of phishing scam e-mails. Mr. Scammer tells his friend about Victor and sells his information to Mr. Phisher for $300. This may seem like a generous offer but Mr Scammer does business with Mr. Phisher on a regular basis and sells him the information of all the victims who were unwilling to fall for his scam. And even if he scammed the person successfully, he sells the information anyway. Mr. Phisher gives Mr. Scammer a further 20% of the funds he steals from bank accounts compromised with his phishing scam e-mails.
Two weeks later Victor receives a notification from his bank, informing him that they performed a scheduled software upgrade to their online banking system. They urgently request that Victor visits their web site to confirm his banking details. Failing to do so before the end of the week will result in a temporary suspension of his online banking facilities. He wonders why they need to confirm his details, but eventually click on the link provided in the e-mail. Victor does a lot of online banking and cannot afford to loose online access to his bank account. Unfortunately Victor did not take a good look at the URL, failing to realise that he was taken to a fake web site looking like the one he normally use for his online banking transactions. He enters his bank account number and pin and hit the submit button. A page appears within seconds informing Victor that his bank account details have been verified. "Wow, that's fast!" Victor says to himself and logs out of the online banking system.
Three days later Victor tries to withdraw cash from the ATM. The system simply tells him that he has insufficient funds. "That's impossible", says Victor, "I always have money in my bank account." Victor goes to his bank manager to find out what the problem is. His bank manager asks him whether he received an e-mail requesting confirmation of Victor's banking details. Victor confirms this and tells the bank manager that he thinks it is a stupid way of confirming a client's details. The bank manager explains to Victor that this is a phishing scam e-mail and that no bank ever sends e-mails like that to their clients. He also explains how the scam works and that the people behind the e-mail are responsible for the withdrawals from Victor's bank account. The bank is unfortunately not responsible for this breach and cannot compensate Victor for the financial loss. An angry, shocked and disappointed Victor heads home to get some sleep, maybe he will wake up tomorrow realising that this is all just a bad dream.
In the mean time Mr. Phisher decided to contact his colleague Mr. ID Thief. Mr ID Thief is an expert in Identity Theft and often buys personal information of scammed victims from Mr. Phisher and Mr. Scammer. A month later Victor goes through his mail only to find statements and bills for several credit cards, personal loans and retail credit accounts all opened in his name. To make things even worse, each account's credit limit has been fully utilised. The personal loans are settled in instalments and the other accounts have to be settled before the end of the month. Mr ID Thief used Victor's identity to open these accounts in Victor's name and after that he utilised and withdrew all the cash from these accounts. Victor slowly starts to become overstressed about all his financial problems, giving him sleepless nights. Eventually he loses his job because of poor work performance. The debt collectors start to take possession of Victor's personal belongings to settle his debt and in the end he has to move in with his sister just to have a roof over his head. Victor is declared insolvent and his name is placed on the credit bureau's black list of insolvent people. This makes it impossible for Victor to apply for a loan or any kind of credit.
Another month goes by and Mr. Sydney Syndicate from Russia is waiting for his agents to tell him how much money he made during the last couple of months. Mr. Scammer, Mr. Phisher and Mr. Thief are all working for Mr. Syndicate, stealing money from hundreds of people every month. They are allowed to keep 30% of the money stolen from the victims, the rest belongs to Mr. Syndicate and has to be transferred to Russia. The problem is, all the money they stole so far has grown to quite a large amount and cannot be transferred to Russia without the government officials asking some uncomfortable questions. So Mr. Scammer has to think of something to get all this money to Russia. Mr. Scammer comes up with a great idea.
Depressed Victor Victim sits in front of his sister's computer downloading his e-mail. He gets an offer from a very large company to act as the company representative in the United States. Victor is really excited, because he needs a job and the money desperately. The best of all he only needs to deposit cheques from U.S. clients, keeping 10% of the amount for himself and transferring the remaining 90% to the headquarters of the company through Western Union Money Transfer. The company looses money when they have to wait for cheques from the U.S. to clear in their country and need to follow this method in order to speed up the cash flow of their business. Victor does not think twice about this opportunity. He immediately completes the application form and sends it back to the company. The next day he receives a reply from the company informing him that his application was successful and first cheque to be deposited is already on his way.
Two days later he receives a cheque for $1500. He deposits the money into his bank account and waits for the cheque to clear. He keeps $150 for himself, withdraws $1350 and sends it to the headquarters of the company somewhere in Russia through Western Union Money Transfer, exactly like they told him to do. Victor can't wait for the next cheque to arrive. Another cheque arrives a week later, this time a whopping $20000. Victor follows the same routine earning him another $2000. A third cheque arrives for $2388.89. But Mr. Scammer has earned the trust of Victor by now and Victor does not wait for the funds to clear before withdrawing the 90% for the company. Victor withdraws the 90% ($2150 in this case) from his bank account and sends it off to Russia. Only this time the cheque doesn't clear and bounces. Victor looses all his money again and never hears from the company again. Two months later federal agents arrest Victor for money laundering and put him in jail for five years.
Mr. Syndicate is very pleased with his agents, they have served him well. Mr. Theft decides to sell Victor's e-mail address to Mr. Spammy Spammer, because the e-mail address if of no use to him anymore. Mr Spammy Spammer constantly sends Victor spam e-mails about stock quotes, online medications, pornography, business opportunities and instant university degrees.
When Victor finally got out of jail after 5 years he returned to his sister's home with the hopes of finding a job soon. But being blacklisted with a criminal record is not going to make things any easier for him. Later that evening he sits down in front of his sister's computer to download some e-mails. His sister downloaded his e-mails for him while he was in jail and stored them in a separate folder. He almost fell of the chair when he saw thousands of junk e-mails, scams and unsolicited advertisements that came through while he was gone. Victor decided to close his e-mail account and sworn never to use an e-mail account ever again.
This may be excessively exaggerated case of online fraud, but it clearly demonstrates what can happen to you after replying to a cyber scammer appearing to be completely harmless. It all starts with a trivial thing like your e-mail address landing in the wrong hands. It may not always be that easy for scammers to steal your money or commit Identity Theft, but you always walk the risk of financial loss if you don't take care of your personal information. Your personal information is your identity and your identity is a valuable asset to cyber scammers. Be vigilant, don't become a victim of cyber fraud.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. Educate yourself with examples of real hoaxes, spam e-mails and scams send to real people.
Friday, February 02, 2007
The Obstacles Facing Cyber Law Enforcement
By Coenraad De Beer
I recently had an interesting encounter with a specific individual while following a lead on a money laundry scam. I am not going into any details of this encounter but this person completely misunderstood my intentions as a pursuer of law and order in the digital world and jumped to all kinds of conclusions. Once again this made it clear to me that many people is under the false impression that fighting cyber crime is an easy task.
The online community is cruel and ruthless leaving no margin of error for anyone. Once you make a bona fide mistake you get crucified immediately. It is because of this general attitude among many people in social communities, that people jump to unfair and unjustified conclusions. Most participants of these communities are used to this behaviour and are not bothered by it too much. Most of these unjustified remarks often cause embarrassment for the comment maker, which is well deserved, because you should take the consequences of your actions for speaking out loud without thinking. Where am I going with this? What does this have to do with fighting cyber crime?
Let me explain with an example: When a big company like Microsoft cause a security risk for users of Internet Explorer out of negligence, you can be sure that the press (including the online community) will throw some big stones at them. This response is justified because the safety of innocent users is put at risk because of the negligence of a respectful organisation. But when Microsoft makes a remark that is misunderstood by some people, without causing any security threats because of this ill formulated remark, why should they be crucified? Microsoft is run by people and people make mistakes. If the community wants to rant and rave about something, then find something that deserves some ranting and raving and stop wasting time on things that can be excused. The company has to waste valuable resources to put out the fires caused by this overreaction instead of using those resources to improve the security of their products. No, I am not a Microsoft prophet, I am simply using them as an example.
Investigating spam and determining the origin of a scam letter is not as simple as tracking an IP address. Most people think so, but that is because they never really tried to locate a spammer on their own after being spammed. It is very easy to forge an e-mail header and that makes it almost impossible to locate the real sender of the e-mail. Even if the header is not forged, you never know whether it is a case of identity theft. Computer criminals hack into e-mail accounts, they hijack web sites and use it to their advantage under the identity of an innocent victim. This enables them to operate undetectable by moving from one account to another. Jurisdictional constraints makes it is hard for federal organisations of one country to prosecute crimes committed in another crime, not even to speak of locating the criminal.
Abuse departments of hosting companies and service providers are so swamped with so many daily reports of spam and network abuse that it is impossible for them to respond to each and every spam report individually. It obviously creates the impression that they do not really take action against the guilty parties. Of course, some companies appear to have an abuse department, but it is only a front to make people believe that they take action against spammers. This discourages people from reporting cyber crime and it effectively allows cyber criminals to operate in the open without the risk of getting caught.
People take cyber crime lightly, cyber crime is being handled as crime committed in another dimension, a dimension not regulated by law. Cyber crime is just like any other crime committed in the normal world, the only difference comes in the methods of investigation. Cyber swindlers are real life criminals, they should never be underestimated. The fact that they operate behind a computer screen makes no difference. Law enforcement agencies do not really care about the person robbed from a couple of dollars, they only pursue the big fish. Unfortunately this is how most scammers operate. They steal a bit from one victim, they steal a bit from another victim, they steal a bit from hundreds of helpless victims and pocked thousands of dollars in the end. Law enforcement agencies will take this crime more serious if everyone starts to report it to their local police department. Sooner or later they will realise that something has to be done. Many police departments are also not equipped to handle digital evidence effectively and many police officers still do not have the skills to conduct proper cyber crime investigations.
Cyber crime is very volatile and cannot always be solved using conventional methods, so I appeal to the online community not to question the unconventional methods of cyber crime investigators. At least they are doing something about an epidemic that is ignored by many influential and powerful organisations.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. You can report scams to them for investigation by using their Report Spam page.
I recently had an interesting encounter with a specific individual while following a lead on a money laundry scam. I am not going into any details of this encounter but this person completely misunderstood my intentions as a pursuer of law and order in the digital world and jumped to all kinds of conclusions. Once again this made it clear to me that many people is under the false impression that fighting cyber crime is an easy task.
The online community is cruel and ruthless leaving no margin of error for anyone. Once you make a bona fide mistake you get crucified immediately. It is because of this general attitude among many people in social communities, that people jump to unfair and unjustified conclusions. Most participants of these communities are used to this behaviour and are not bothered by it too much. Most of these unjustified remarks often cause embarrassment for the comment maker, which is well deserved, because you should take the consequences of your actions for speaking out loud without thinking. Where am I going with this? What does this have to do with fighting cyber crime?
Let me explain with an example: When a big company like Microsoft cause a security risk for users of Internet Explorer out of negligence, you can be sure that the press (including the online community) will throw some big stones at them. This response is justified because the safety of innocent users is put at risk because of the negligence of a respectful organisation. But when Microsoft makes a remark that is misunderstood by some people, without causing any security threats because of this ill formulated remark, why should they be crucified? Microsoft is run by people and people make mistakes. If the community wants to rant and rave about something, then find something that deserves some ranting and raving and stop wasting time on things that can be excused. The company has to waste valuable resources to put out the fires caused by this overreaction instead of using those resources to improve the security of their products. No, I am not a Microsoft prophet, I am simply using them as an example.
Investigating spam and determining the origin of a scam letter is not as simple as tracking an IP address. Most people think so, but that is because they never really tried to locate a spammer on their own after being spammed. It is very easy to forge an e-mail header and that makes it almost impossible to locate the real sender of the e-mail. Even if the header is not forged, you never know whether it is a case of identity theft. Computer criminals hack into e-mail accounts, they hijack web sites and use it to their advantage under the identity of an innocent victim. This enables them to operate undetectable by moving from one account to another. Jurisdictional constraints makes it is hard for federal organisations of one country to prosecute crimes committed in another crime, not even to speak of locating the criminal.
Abuse departments of hosting companies and service providers are so swamped with so many daily reports of spam and network abuse that it is impossible for them to respond to each and every spam report individually. It obviously creates the impression that they do not really take action against the guilty parties. Of course, some companies appear to have an abuse department, but it is only a front to make people believe that they take action against spammers. This discourages people from reporting cyber crime and it effectively allows cyber criminals to operate in the open without the risk of getting caught.
People take cyber crime lightly, cyber crime is being handled as crime committed in another dimension, a dimension not regulated by law. Cyber crime is just like any other crime committed in the normal world, the only difference comes in the methods of investigation. Cyber swindlers are real life criminals, they should never be underestimated. The fact that they operate behind a computer screen makes no difference. Law enforcement agencies do not really care about the person robbed from a couple of dollars, they only pursue the big fish. Unfortunately this is how most scammers operate. They steal a bit from one victim, they steal a bit from another victim, they steal a bit from hundreds of helpless victims and pocked thousands of dollars in the end. Law enforcement agencies will take this crime more serious if everyone starts to report it to their local police department. Sooner or later they will realise that something has to be done. Many police departments are also not equipped to handle digital evidence effectively and many police officers still do not have the skills to conduct proper cyber crime investigations.
Cyber crime is very volatile and cannot always be solved using conventional methods, so I appeal to the online community not to question the unconventional methods of cyber crime investigators. At least they are doing something about an epidemic that is ignored by many influential and powerful organisations.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. You can report scams to them for investigation by using their Report Spam page.
Saturday, January 20, 2007
Designing IE Exclusive Sites Is Counterproductive And Puts Your Visitors At Risk
By Coenraad De Beer
Ever came across a notice reading: "This site has been optimised for Internet Explorer" or "This page requires Internet Explorer?" Did you ever have trouble opening a specific page and when you sent a complaint to the web master, you got a blunt answer: "Please ensure that you are using the latest version of Internet Explorer when visiting our site." So many web designers still use this outdated practice of designing web sites exclusively for Internet Explorer (or any other browser for that matter).
Excuse me for being so forthright, but designing a web site exclusively for a specific browser is downright stupid. The time when the Internet was monopolised by a single browser is long over. Internet Explorer, Firefox, Opera and Safari are some of the most popular browsers used by surfers today, with Internet Explorer and Firefox taking up the biggest part of the browser market share. It is a dreadful Internet marketing mistake and you loose thousands of visitors by focussing on one specific browser and shutting out the rest. But choosing the wrong browser does not only have economical effects on your web site, it also puts the security of your visitors at risk.
The history of Internet Explorer has been plagued by security flaws and rendering bugs. Many web designers know how hard it is to display a perfectly coded site correctly in Internet Explorer. A site may display beautifully in Mozilla Firefox, but may appear completely broken in Internet Explorer. The rendering bugs in Internet Explorer require clever tricks and "hacks" to work around them. This means double production time when developing a web site. You first need to develop the site in general and then test it with Internet Explorer to see where you need to employ these workarounds. By restricting your visitors to Internet Explorer only, you force them to use an insecure browser and you waste your time by patching its rendering flaws with clever workarounds. Who knows, a rendering flaw may be exploitable and you are promoting those flaws by forcing your visitors to use a browser that is the direct cause of the rendering problems of your site. By working around these flaws you may even make it easier for hackers to exploit them. I know I am exaggerating a bit, but I will feel much safer using a browser without these rendering issues. At least I know there is no chance of exploitation.
Another thing is the basic HTML coding errors that are automatically fixed by Internet Explorer. I have seen inexperienced web developers spending hours developing a web page, experiencing no problems when displaying it with Internet Explorer, but suddenly encountered difficulties displaying the page in Firefox. Firefox is not there to cover up for your mistakes, coding standards are there for a reason. Imagine developing a compiler for a programming language that has to fix common coding errors made by programmers. It is a complete waste of time and code, you can simplify the code of the program substantially by removing these useless error-controlling routines. It will make debugging much easier and faster. Why do you think does Microsoft take so long to get security flaws fixed, I reckon Internet Explorer has far more complex code than Firefox? You can cut your web development time in half if you test your web site in a browser like Firefox, which is far more compliant with W3C standards than Internet Explorer.
There is nothing wrong in "fixing" your web site for Internet Explorer visitors, you are only making your web site accessible to more users, without forcing them to use a different browser. But the whole irony behind "fixing" your web site comes down to fixing something that is not broken. A standards-compliant Cascading Style Sheet (CSS) must be amended with redefinitions of widths and heights to make your site compatible with Internet Explorer. When you run the style sheet through a CSS-validator, you will receive warning messages for a document that was actually 100% compliant before these changes. Some bugs are not always that easy to fix. For instance the transparency bug with Portable Network Graphics (PNG) files. You either must choose to keep the PNG files and live with the bug or convert all your PNG images to Graphics Interchange Format (GIF) files.
Every web designer must aim to develop a web site that is compliant with web standards, not a specific browser. An open source browser like Firefox supports most of the features in Internet Explorer and you can easily add functionality that is not supported by default, with the use of an extension. So this brings me only to one conclusion, web designers designing Internet Explorer specific sites are only spiteful. The only reason why you are unable to open a specific page, is not because your browser does not support it, it is because the designers are deliberately blocking it. Why block a browser, which most probably does a better job than Internet Explorer with that specific page of your site? I can only see it as childish jealousy over other browsers doing things better than Internet Explorer. You may end up creating security flaws on your own site by being so narrow minded and making things so complicated. If a web site requires a visitor to use a specific browser, it implies that that certain client side processing is required, that is dependent on a specific browser and cannot be done on the web server. That is extremely dangerous, especially when it comes to capturing sensitive information. The visitor never knows whether the web site owner wants to exploit a flaw in a specific browser or steal your private information without raising any alarms caused by certain browsers.
Many people may argue: "Hey you are fast to point the finger to other designers. You have a notice Best Viewed With Firefox displayed at the top of each and every page of your site, for every user not browsing with Firefox". But there is a huge difference between "Best Viewed" and "Optimised For". A site is best viewed in a specific browser, but you can still view it with any other browser. A pure standards-compliant web site should render correctly in any of the latest mainstream browsers, which is the main goal of HTML and CSS coding standards. It is not my fault if a browser cannot render my web site correctly when I adhere to these standards. Best Viewed With Firefox simply means that if my web site appears broken, then it is because you are using an inferior browser. Rediscover the web by using a browser that displays a site as it is supposed to appear on your screen, without the need of clever monkey tricks and coding workarounds. Do not let selfish companies force you to substitute your security for access to their web site.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software.
Ever came across a notice reading: "This site has been optimised for Internet Explorer" or "This page requires Internet Explorer?" Did you ever have trouble opening a specific page and when you sent a complaint to the web master, you got a blunt answer: "Please ensure that you are using the latest version of Internet Explorer when visiting our site." So many web designers still use this outdated practice of designing web sites exclusively for Internet Explorer (or any other browser for that matter).
Excuse me for being so forthright, but designing a web site exclusively for a specific browser is downright stupid. The time when the Internet was monopolised by a single browser is long over. Internet Explorer, Firefox, Opera and Safari are some of the most popular browsers used by surfers today, with Internet Explorer and Firefox taking up the biggest part of the browser market share. It is a dreadful Internet marketing mistake and you loose thousands of visitors by focussing on one specific browser and shutting out the rest. But choosing the wrong browser does not only have economical effects on your web site, it also puts the security of your visitors at risk.
The history of Internet Explorer has been plagued by security flaws and rendering bugs. Many web designers know how hard it is to display a perfectly coded site correctly in Internet Explorer. A site may display beautifully in Mozilla Firefox, but may appear completely broken in Internet Explorer. The rendering bugs in Internet Explorer require clever tricks and "hacks" to work around them. This means double production time when developing a web site. You first need to develop the site in general and then test it with Internet Explorer to see where you need to employ these workarounds. By restricting your visitors to Internet Explorer only, you force them to use an insecure browser and you waste your time by patching its rendering flaws with clever workarounds. Who knows, a rendering flaw may be exploitable and you are promoting those flaws by forcing your visitors to use a browser that is the direct cause of the rendering problems of your site. By working around these flaws you may even make it easier for hackers to exploit them. I know I am exaggerating a bit, but I will feel much safer using a browser without these rendering issues. At least I know there is no chance of exploitation.
Another thing is the basic HTML coding errors that are automatically fixed by Internet Explorer. I have seen inexperienced web developers spending hours developing a web page, experiencing no problems when displaying it with Internet Explorer, but suddenly encountered difficulties displaying the page in Firefox. Firefox is not there to cover up for your mistakes, coding standards are there for a reason. Imagine developing a compiler for a programming language that has to fix common coding errors made by programmers. It is a complete waste of time and code, you can simplify the code of the program substantially by removing these useless error-controlling routines. It will make debugging much easier and faster. Why do you think does Microsoft take so long to get security flaws fixed, I reckon Internet Explorer has far more complex code than Firefox? You can cut your web development time in half if you test your web site in a browser like Firefox, which is far more compliant with W3C standards than Internet Explorer.
There is nothing wrong in "fixing" your web site for Internet Explorer visitors, you are only making your web site accessible to more users, without forcing them to use a different browser. But the whole irony behind "fixing" your web site comes down to fixing something that is not broken. A standards-compliant Cascading Style Sheet (CSS) must be amended with redefinitions of widths and heights to make your site compatible with Internet Explorer. When you run the style sheet through a CSS-validator, you will receive warning messages for a document that was actually 100% compliant before these changes. Some bugs are not always that easy to fix. For instance the transparency bug with Portable Network Graphics (PNG) files. You either must choose to keep the PNG files and live with the bug or convert all your PNG images to Graphics Interchange Format (GIF) files.
Every web designer must aim to develop a web site that is compliant with web standards, not a specific browser. An open source browser like Firefox supports most of the features in Internet Explorer and you can easily add functionality that is not supported by default, with the use of an extension. So this brings me only to one conclusion, web designers designing Internet Explorer specific sites are only spiteful. The only reason why you are unable to open a specific page, is not because your browser does not support it, it is because the designers are deliberately blocking it. Why block a browser, which most probably does a better job than Internet Explorer with that specific page of your site? I can only see it as childish jealousy over other browsers doing things better than Internet Explorer. You may end up creating security flaws on your own site by being so narrow minded and making things so complicated. If a web site requires a visitor to use a specific browser, it implies that that certain client side processing is required, that is dependent on a specific browser and cannot be done on the web server. That is extremely dangerous, especially when it comes to capturing sensitive information. The visitor never knows whether the web site owner wants to exploit a flaw in a specific browser or steal your private information without raising any alarms caused by certain browsers.
Many people may argue: "Hey you are fast to point the finger to other designers. You have a notice Best Viewed With Firefox displayed at the top of each and every page of your site, for every user not browsing with Firefox". But there is a huge difference between "Best Viewed" and "Optimised For". A site is best viewed in a specific browser, but you can still view it with any other browser. A pure standards-compliant web site should render correctly in any of the latest mainstream browsers, which is the main goal of HTML and CSS coding standards. It is not my fault if a browser cannot render my web site correctly when I adhere to these standards. Best Viewed With Firefox simply means that if my web site appears broken, then it is because you are using an inferior browser. Rediscover the web by using a browser that displays a site as it is supposed to appear on your screen, without the need of clever monkey tricks and coding workarounds. Do not let selfish companies force you to substitute your security for access to their web site.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software.
Thursday, January 11, 2007
The Key To Beating Spam
By Coenraad De Beer
Unsolicited junk mail is one of the biggest problems faced by Internet users everyday. We have spam filters keeping spam out of our mailboxes, but these filters are far from perfect and many legitimate e-mails are filtered as spam because of this. So what exactly is the true key to beating spam?
Spammers have changed their tactics a lot over the last few years and the amount of spam circulating the Internet is rising at an alarming rate. The vast diversity of spam messages and different techniques used by spammers make it hard to identify spam accurately, whether it is a human being or a computer program doing the identification. Identifying spam will not have a direct impact on the amount of spam distributed each day, but over a long period of time it can make spam an ineffective method of marketing. Spammers continue to distribute unsolicited bulk e-mails because it works and they need active readers to make it work. If nobody read their e-mails anymore they will have no reason for wasting their time on unresponsive recipients, except for the lunatics who like sending junk e-mails for no reason at all.
Spammers link to remote images or JavaScript from within their e-mails to track their performance. These linked objects are loaded from a server each time a recipient opens one of their e-mails. They monitor the logs of these servers to see how many times the images or scripts were loaded, which will effectively give them a good indication of how many times their e-mails were opened. If they continue to see activity from these linked objects, they will continue sending spam. An e-mail client like Thunderbird can be configured to block remote images in e-mails. Images embedded into the e-mail or images sent as attachments, will still be displayed, because embedded and attached images cannot send tracking information to the sender. Blocking remote images will not cause any discomfort while reading legitimate e-mails, all remote images in a legitimate e-mail can easily be unblocked with the click of a button. Disabling JavaScript in your e-mail client is not a bad idea either, very few legitimate e-mails use JavaScript so you will not miss a thing by disabling it. In fact, it is anyway safer reading e-mails without the execution of JavaScript. By blocking images and disabling JavaScript you make it impossible for spammers to monitor the performance of their e-mails.
The main reason why spammers embed images into their e-mails instead of using text, is to bypass the spam filters. Certain phrases within the text of an e-mail may trigger a spam filter, but spam filters cannot read the contents of an image, so it is perfectly safe to put the text inside an image and embed the image into an e-mail. This worked for a while until spam filters started to flag these messages as spam. Spammers started to add random text from various books at the end of their e-mails to fool the spam filters. Spam filters cannot read the text of an e-mail in context with the rest of the e-mail, so e-mails containing an image and some senseless text at the end, may appear perfectly legitimate to most spam filters. Spammers also add CAN-SPAM banners and fake unsubscribe links in their e-mails to make it appear as legitimate and compliant with anti-spam legislation. Anyone can add a CAN-SPAM banner to an e-mail and the only purpose of the unsubscribe link is to confirm that your mailbox is active. You may believe that you will be removed from their list by clicking on the unsubscribe link, but that will only cause your e-mail address to be moved to their priority list and you will be exposed to even more spam.
Links in spam e-mails normally contain affiliate or tracking codes. The affiliate code will only be beneficial to the spammer if you buy something from the web site referred by the link. You should never buy anything from a web site referred by a spam e-mail, not even a well-known and trustworthy site. You always run the risk of becoming a victim of a phishing attack. Links containing tracking data may be linked to your e-mail address and can have the same effect as a fake unsubscribe link. Sophisticated spammers can create a unique link connected to the e-mail address of each e-mail they send out, so they can easily confirm that your e-mail account is active when you click on one of those links.
So what is the bottom line of all this? To battle spam effectively, you need to ignore it. But you can only ignore it if you are able to identify it. Identifying spam often means that you need to open the e-mail. Opening the e-mail may cause tracking information to be sent to a server (through remote images or JavaScript), informing the spammer that your mailbox is active or the information may be used to monitor the effectiveness of the e-mail. To prevent this tracking information from being sent you need to disable JavaScript and block remote images with your e-mail client. Links provided in these e-mails should never be trusted and you should never click on any of them.
Ignoring spam does not mean you should not report it. Ignoring spam simply means that you should not respond to the spam like the spammer would like you to do. Making spam less effective for the spammer and reporting it to the appropriate authorities is the crucial key to beating spam.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. Cyber Top Cops is dedicated to fighting spam, do your part in the battle against spam and report it.
Unsolicited junk mail is one of the biggest problems faced by Internet users everyday. We have spam filters keeping spam out of our mailboxes, but these filters are far from perfect and many legitimate e-mails are filtered as spam because of this. So what exactly is the true key to beating spam?
Spammers have changed their tactics a lot over the last few years and the amount of spam circulating the Internet is rising at an alarming rate. The vast diversity of spam messages and different techniques used by spammers make it hard to identify spam accurately, whether it is a human being or a computer program doing the identification. Identifying spam will not have a direct impact on the amount of spam distributed each day, but over a long period of time it can make spam an ineffective method of marketing. Spammers continue to distribute unsolicited bulk e-mails because it works and they need active readers to make it work. If nobody read their e-mails anymore they will have no reason for wasting their time on unresponsive recipients, except for the lunatics who like sending junk e-mails for no reason at all.
Spammers link to remote images or JavaScript from within their e-mails to track their performance. These linked objects are loaded from a server each time a recipient opens one of their e-mails. They monitor the logs of these servers to see how many times the images or scripts were loaded, which will effectively give them a good indication of how many times their e-mails were opened. If they continue to see activity from these linked objects, they will continue sending spam. An e-mail client like Thunderbird can be configured to block remote images in e-mails. Images embedded into the e-mail or images sent as attachments, will still be displayed, because embedded and attached images cannot send tracking information to the sender. Blocking remote images will not cause any discomfort while reading legitimate e-mails, all remote images in a legitimate e-mail can easily be unblocked with the click of a button. Disabling JavaScript in your e-mail client is not a bad idea either, very few legitimate e-mails use JavaScript so you will not miss a thing by disabling it. In fact, it is anyway safer reading e-mails without the execution of JavaScript. By blocking images and disabling JavaScript you make it impossible for spammers to monitor the performance of their e-mails.
The main reason why spammers embed images into their e-mails instead of using text, is to bypass the spam filters. Certain phrases within the text of an e-mail may trigger a spam filter, but spam filters cannot read the contents of an image, so it is perfectly safe to put the text inside an image and embed the image into an e-mail. This worked for a while until spam filters started to flag these messages as spam. Spammers started to add random text from various books at the end of their e-mails to fool the spam filters. Spam filters cannot read the text of an e-mail in context with the rest of the e-mail, so e-mails containing an image and some senseless text at the end, may appear perfectly legitimate to most spam filters. Spammers also add CAN-SPAM banners and fake unsubscribe links in their e-mails to make it appear as legitimate and compliant with anti-spam legislation. Anyone can add a CAN-SPAM banner to an e-mail and the only purpose of the unsubscribe link is to confirm that your mailbox is active. You may believe that you will be removed from their list by clicking on the unsubscribe link, but that will only cause your e-mail address to be moved to their priority list and you will be exposed to even more spam.
Links in spam e-mails normally contain affiliate or tracking codes. The affiliate code will only be beneficial to the spammer if you buy something from the web site referred by the link. You should never buy anything from a web site referred by a spam e-mail, not even a well-known and trustworthy site. You always run the risk of becoming a victim of a phishing attack. Links containing tracking data may be linked to your e-mail address and can have the same effect as a fake unsubscribe link. Sophisticated spammers can create a unique link connected to the e-mail address of each e-mail they send out, so they can easily confirm that your e-mail account is active when you click on one of those links.
So what is the bottom line of all this? To battle spam effectively, you need to ignore it. But you can only ignore it if you are able to identify it. Identifying spam often means that you need to open the e-mail. Opening the e-mail may cause tracking information to be sent to a server (through remote images or JavaScript), informing the spammer that your mailbox is active or the information may be used to monitor the effectiveness of the e-mail. To prevent this tracking information from being sent you need to disable JavaScript and block remote images with your e-mail client. Links provided in these e-mails should never be trusted and you should never click on any of them.
Ignoring spam does not mean you should not report it. Ignoring spam simply means that you should not respond to the spam like the spammer would like you to do. Making spam less effective for the spammer and reporting it to the appropriate authorities is the crucial key to beating spam.
About the Author
Coenraad is webmaster and founder of Cyber Top Cops, leaders in Internet security, prevention of online fraud and educating users against online scams and malicious software. Cyber Top Cops is dedicated to fighting spam, do your part in the battle against spam and report it.
Subscribe to:
Posts (Atom)
