Talking to children about fraud prevention

August 7, 2014

I’ve been doing fraud and identity theft presentations for adults and high school and middle school students for several years now, but recently I realized I’d never presented to elementary school-aged kids, and had nothing prepared if the opportunity would arise.

Kids need to know this stuff, too. Sure we can all say, “Well, the parents shouldn’t let them on a computer without constant supervision in the first place,” but that’s not how it generally works in reality. Kids end up downloading things and talking to strangers and everything in between, and they work fast. You look away for five minutes because staring at a kid playing Minecraft in the name of “constant supervision” is one of the most boring things human beings are capable of doing, and suddenly your browser’s homepage has been hijacked and some weirdo knows your phone number.

So they need to learn, but what to tell them, and how to present it in a way they’ll understand?

I’ve been working on those questions while trying to come up with a fraud prevention presentation for the elementary school crowd, or at least the 3rd through 5th grade set. I’ve narrowed down a few things that I think are important:

1. Everything you see online was put there by a person

Kids trust everything and everyone. When they go online, they assume everything exists by benevolent magic. Show them a “Click here for free _____!” popup with Mario on it and they’re going to install anything it asks them to. What they need to understand is that everything they see was made by a person they don’t know and can’t see, and that not every one of those people are good. People lie because they make money tricking children.

2. Popup windows are not to be trusted

A popup window is probably bad news, especially if it offers free games, powerups for games, or prizes. Kids will accept anything if you tell them it’s a prize. Ask the tiny blue plastic mug I won at the school carnival in 1984. I still had that thing five years later.

3. A “virus” is a type of program that hurts your computer, phone or tablet

I’m still working on how to explain this one, but the gist is that the people who make things for you to download sometimes hide other programs inside it, and these can hurt your computers and devices, or even steal money from you.

4. Keep your passwords secret!

Parents need to know their kids’ passwords, but the kids need to know NOT to let anyone else know them. Not even their best friend. Not someone who asks for it really nicely. Nobody.

So this is a work in progress right now, but those four points seem like something a kid would be able to understand if explained properly. I’m sure I’ll rework some of these and add to it, but it’s a starting point.

 


New phishing attack poses as PayPal email…

June 27, 2014

…and it’s convincing.

I mean, I hate to sound almost impressed by some cruddy email scammer, but as far as “click here to log in and verify your account” phishing attempts go, this one is devoid of broken English, and uses information taken from a recent data breach at eBay to ratchet up the realism by using the target’s actual name. If there is a spectrum of phishing attacks that ranges from “laughable” to “frighteningly realistic,” this one falls much closer to the latter than the former.

The Consumerist blog has a full article that discusses it in greater detail. I strongly suggest you read it. In the example they use, the recipient only used that email address for eBay and PayPal, which added to the realism. It’s a good idea to have separate email addresses used only for online transactions because it helps weed out phishing (if you get a message on your OTHER account that supposedly comes from PayPal, you know it’s fake right away). However, as soon as there is a data breach, your specific-purpose email address can be targeted as well. My guess is that this guy is going to start seeing a ton of spam hitting his eBay/PayPal-only email, and he’ll have to abandon it for a new one.

At its core, this phishing attack was just another “click here to verify” attempt, but by using data from a breach, its success rate is bound to be higher than usual. It’s why you can never stop paying close attention to everything you click on.


Heartbleed is the name of a bug, not a virus

May 30, 2014

The Heartbleed Bug was a major story not that long ago. Lists of affected websites circulated with instructions to change your passwords if you had accounts at those websites.

In the whirlwind of online news articles, a lot of jargon got tossed around that the average computer user may not be familiar with, and any time there is a knowledge gap, scammers can and do take advantage of it. Spam emails began to circulate claiming to include a Heartbleed removal tool that was, naturally, a malicious program itself. The attachment, if opened, installed a keylogger on victims’ computers, which could transmit sensitive information to criminals. Symantec has a fine article about this particular attack.

Of course, if you’re an old hack hand at Computer Stuff like myself, you already knew that Heartbleed was a bug affecting servers, not a virus. But not everybody is familiar with all these terms, so I decided it would be useful to explain some of these concepts in layman’s terms.

DATA is digital information. If you’re looking at a website, your computer is taking data and presenting it in a readable, watchable, or listenable way. You’re looking at data, which happens to be mostly in text form, right now. When you have an account at Amazon or Facebook (for example), your username and password are part of your personal data, which is the stuff you don’t want being accessed by anyone but yourself. Websites keep this kind of data on servers that use various software to make it (hopefully) impossible to access by unauthorized people.

SERVER is a big computer where data is stored. When you watch a video on YouTube, the digital information that makes up that video is stored on an incredibly large computer, which transmits that data to your computer, which turns it into a video you can watch. Companies such as Facebook and Google have multiple servers that fill entire buildings. Your employer may have a smaller server that looks like a regular desktop computer, which hold all the business’s customer data, and only employees have access to it. Same concept, different scale.

OpenSSL is a particular type of server software that was affected by the Heartbleed bug. You know how your desktop computer runs Windows or MacOS, and your phone runs Android or iOS? OpenSSL is pretty much the same type of thing for servers. Your home computer uses Windows or MacOS to do home computer things, some (but not all) servers use OpenSSL to do server things, like store huge customer databases.

BUG is a flaw in a piece of software. You know how sometimes you download some goofy free app on your phone, and it works for a few seconds then crashes? That app has a bug that makes it function improperly. In the case of Heartbleed, the bug was a security flaw that potentially opened up account information (such as encrypted passwords) to hackers.

ENCRYPTED data has been scrambled in a way that unauthorized persons cannot access it. Servers don’t just store your username and password in text form because it would be too easy for someone to just steal the file and open it. They use complicated methods to make sure that, even if someone got the file, they wouldn’t be able to read it. (At least, this is how it would always work in a world without security bugs like Heartbleed; this is why you had to change your passwords at affected sites after the bug was fixed.)

HACKER: a person who breaks into computer networks. This in and of itself does not make them bad…many are actually hired to break in, in order to highlight security flaws so they can be fixed. Some use their skill for criminal purposes.

These are pretty simplistic explanations, but I think it’s important to at least have a concept of what these terms mean, so that when you read an article that says “security bug affecting servers running OpenSSL versions etc…” you can at least understand that they’re talking about software you’re NOT running on your home computer, and to ignore any emails offering a fix because Heartbleed wasn’t a virus in the first place.

But you’re not going to open attachments in any unsolicited emails, anyway, are you? If nothing else, remember this First Principle: “If you didn’t ask for it, don’t click on it.”


Don’t use your debit card for online transactions

May 9, 2014

Even if you’re the type that eschews credit cards on philosophical or financial grounds, if you do any online shopping at all, a credit card is still safer than using a debit card.

Think about this: fraud exists; more than ever lately, we’ve seen how bad people can break into networks and steal card credentials. If you use a debit card on a website that gets hacked, the thieves now have a direct link to your bank account.

And while most financial institutions offer debit cards with zero liability for fraud, what do you do for cash while you wait for the dispute to be resolved? Your whole account could be tied up for weeks (and you won’t have a debit card for everyday, non-online purchases).

Credit cards eliminate that, and their fraud resolution procedures are usually faster.

Of course, some people don’t like credit cards because of the revolving debt trap, but it just takes self-discipline: make your purchase online with a credit card, then pay it off as soon as the charges show up. You just can’t spend more than you can afford to pay in cash, which is how your debit card would have worked anyway, right?


Aaaaaand it’s time to change every password in the universe again…

April 11, 2014

Have you ever experienced déjà vu?

Have you ever experienced déjà vu?

Sorry. Couldn’t resist.

ANYWAY, doesn’t it seem like not too long ago that I told you to go ahead and change all your passwords, because data breaches (like the ones that hit Target Sally Beauty Experian) will be a common thing for quite some time?

Oh yeah. It was.

So now we have the Heartbleed bug, which affects websites running certain versions of OpenSSL on their servers. I won’t get into the technical details, mostly because I don’t know one thing about OpenSSL, but the effect for you, the Internet user and person-who-logs-into-websites, is this: about two-thirds of the entire Internet is/was affected by this vulnerability, and your login/password information could have been stolen over the past couple years or so.

Yes, this is very, very big.

So whattaya do about it? You change passwords after sites patch its OpenSSL software. Most sites are moving pretty quickly to install the patch, but some haven’t been as forthcoming when it comes to telling their users to change their passwords. Right now, this moment, go change the following passwords, if you have accounts there:

  • Facebook
  • Google/Gmail/YouTube
  • Yahoo!
  • OKCupid

Those are the big ones that were definitely using the vulnerable version of OpenSSL, and have now been patched. Change ‘em now!

Amazon, Twitter, and some other big sites, however, are safe. They were never running the vulnerable software.

Of course, there are also countless other websites that were, so you need to check those out as well. You can enter a web address at https://lastpass.com/heartbleed and find out if it a site is affected. If you get anything but a “No” on the result page, you need to change your password, but try to find out if the site has been patched first. If you change it before they patch it, your account could still be vulnerable (and, if the site forces a password change later, you’ll just have to do it all over again).

And use strong passwords, too. I don’t have to tell you that, though, do I?


Overpayment scams affect businesses, too

March 28, 2014

I thought I was onto some clever application of the “duck test” for the title of this post, about how “if it looks like a scam and quacks like a scam,” but I really couldn’t make it sound anything other than monstrously insane, so I dropped it and went with the title you see above.

Anyway, the old repayment scam has been explained a thousand times here, there and everywhere. You’re selling something on Craigslist (for example), and a buyer contacts you, usually from out of state. They send their payment, but instead of $200, it’s a cashier’s check for $3,200. “Cash it and use the extra for shipping, then wire the rest back to me,” they say when you contact them.

What happens next is fairly predictable: you cash the check, send the item, wire the excess money (thousands of dollars) to someone, then find out a week later that it was a counterfeit check and that you’re on the hook for the loss caused to your financial institution.

But did you know that scammers also target businesses with the same tactic?

And if you’re a business owner, you might fall for it because what might strike you as suspicious during a private sale might seem less so in a business context. I’ve heard of several cases where retail businesses, attorneys and rental property owners have been victimized by this scam.

However, the principle applies in every context, whether in a person-to-person or a business transaction: if someone sends you a cashier’s check and tells you to cash it and wire money back to them, you’re almost always dealing with a con artist.


This is why I don’t use ad-blocking plugins: so I can point out stuff like this

February 12, 2014

Today I checked out the weather forecast at Weather.com, mostly to confirm my suspicions that yes, this winter is going to be eternal and that it’s never going to rise above four degrees for the rest of my life.

(Okay, the actual forecast wasn’t that bad, and it’s actually going to get a little warmer very soon, but still.)

I noticed this banner ad in the right-side column where Weather.com usually puts them (among other locations):

2014-02-12-junkware

Looks important, don’it? Like your security software is telling you something is wrong, right?

Yeah, well, it’s not. It’s an advertisement. Good thing the ONLY indication is the little Google AdWords logo in the upper right corner, eh?

Now, I don’t know exactly what this advertisement leads to, but as far as I’m concerned, they’re using deception to trick people into clicking on it. That makes me think of ransomware, because it’s almost the exact technique used by makers of that type of malicious software. Click on it and you may find your computer locked down until you pay $80 or more to some crook.

I wish I could issue “just never click on anything” as a general rule, but it’s sort of hard to use the Internet without clicking on something now and then. I would suggest this, though: if you see an ad like this on a major website, click on that little triangle AdWords logo (click carefully…you don’t want to click on the ad itself!) and use the submission form to tell Google about it. Google’s AdWords system is great because it allows access to online advertising for businesses of all sizes, but that wide-openness also means a lot of scammers get their greasy little banner ads through. It’s like those “work at home” scans in the old print newspapers, only a couple hundred million times larger in scope.


Follow

Get every new post delivered to your Inbox.

Join 208 other followers