Tag Archives: Amazon

What is ‘Brushing?’

In theory, getting free stuff sounds great. But what if it’s stuff you don’t particularly need or want, and it just keeps coming?

A new scam called “brushing” involves exactly that. Reports are growing of people receiving shipments from Amazon of items they didn’t order, sometimes the same item over and over, with no real mechanism available to stop the unwanted deliveries.

What exactly are they up to?

Shady sellers are creating fake Amazon accounts, then buying their own products and shipping them to random addresses. They then post five-star reviews of their own products. Since the system shows the item was actually bought by the reviewer, this review appears as a “Verified Purchase,” which makes the review more prominent, and the great average customer rating boosts the item’s rank in Amazon’s search function. The ultimate goal is to sell sub-par products to consumers tricked by the high average product rating.

What should you do if unordered shipments start showing up?

First, contact Amazon to let them know you’re getting them. Amazon will attempt to figure out who is behind the scam and delete the seller.

For the most part, Amazon has been telling people to either keep, donate or discard the actual items shipped. That part is up to you.

So far it doesn’t appear that the people receiving the shipments have had their accounts compromised. However, if you start getting things you didn’t order, go ahead and change your Amazon password (which you should do now and then anyway). The addresses used for shipping seem to be chosen at random, though there may be a link between previous purchases from overseas sellers using the Amazon platform. When you’re shopping on Amazon, pay attention to the “sold by,” “fulfilled by” and “ships from” information, and favor domestic sellers (or Amazon itself) and orders that are fulfilled by Amazon.

Fakespot.com is a good resource for checking out products on Amazon for fake reviews (it also works with Yelp, TripAdvisor and the Apple App Store). It’s not foolproof, but it can at least give some insight as to how trustworthy an item’s reviews are. All you have to do is paste the URL of the Amazon item into Fakespot, and it will give a letter grade and a percentage of high-quality reviews as determined by the site’s algorithm. Anything with less than 80% high-quality reviews, I would avoid. Pay attention to the negative reviews, too, to see what customers who didn’t like the product are saying. If fewer people buy items with tons of fake five-star reviews, the motivation for the brushing scam might dry up a little.

How to avoid spyware and adware

I’ve said before that I don’t have the tech chops to get into an extremely detailed description of computer security issues, but I think its important to at least understand the basics. The minutiae of VBS or C+ programming doesn’t matter for our purposes here much as the following facts:

  1. There is a lot of malicious software out there
  2. It is important to know how to recognize it and how to avoid it
  3. It is important to keep your security software updated, and to make sure it is legitimate software from a trusted source

Let’s dive right in. Warning: this is one of my longer posts.

Basic Definitions

Malware: This is sort of an “umbrella term” for software intended to harm your computer. It includes (but is not limited to) spyware, misleading adware, viruses, worms and trojan horses.

Spyware: This is a term for software that, in some form, sends information from your computer to another entity without your consent. This information can be anything from words typed into search engines (Google, e.g.), websites visited or even keystrokes. Spyware can pose a serious identity theft risk, as it can relay financial account information (account numbers and passwords) to a third party.

Adware: Adware is software that displays advertising in some form. Not all adware is necessarily malicious (the free version of the Eudora email client contains benign adware), but sometimes it is. Often, spyware and adware are bundled together.

How Spyware and Adware Infect Your Computer

Some spyware is intentional. Some companies install keyloggers on their computers to keep tabs on employee computer use. I’m just guessing, but I’ll bet every letter you type into an FBI computer is logged.

However, the spyware I’m talking about is the kind that installs itself on your computer without your knowledge or consent. These programs can install through a variety of channels. Some of them are:

Backdoor: These programs exploit “holes” in your web browser or computer’s security features. You can become infected simply by visiting a website that has been set up to install malware, and you probably won’t even know it at the time.

Piggybacking: Sometimes software you want is bundled with software you might not want. Adware often shows up in this form, but other malware uses this method as well. I mentioned the free Eudora email client earlier. This is pretty benign adware—in return for not paying for the full version of the software, you put up with some banner ads, from which the software company earns revenue. However, you’ve also got examples like Bonzi Buddy, which was designed to appeal to children (and secretly send information about their web browsing habits to a third party). Bad scene.

Trojan Horses: A trojan horse is software that poses as useful or desirable software, but is actually spyware, adware or other malware. Some of the most common examples right now are Fake Virus Scan Pop-Ups, which I talked about a couple weeks ago. While visiting a website, a window pops up with a frantic message telling you that your computer is infected with a virus, and to click “OK” to run a scan now. This downloads software, some of which may actually even look like a real virus scanner, that can wreak havoc on your computer, to say nothing of the financial threat it could pose if it contains some really nasty spyware. I want to touch on a few examples of trojan horse software here:

MS Antivirus: This is a fake virus scanner that can disable your real antivirus and anti-spyware programs. Other than that, it’s mostly just annoying, but turning off your security software opens the door to all kinds of other infections. MS Antivirus goes by about a million different names, and it is constantly being updated to evade detection by legitimate security software, which just illustrates the importance of keeping your antivirus software updated. Pay for the subscription. It is worth it.

No-Adware: This was a trojan horse designed to confuse you with a name similar to Ad-Aware, which is a legitimate product. No-Adware is supposedly no longer considered “rogue” software, but you know what? I still haven’t forgiven them.

Tattoodle: This is an application that usually gets installed (intentionally) through Facebook. I don’t know yet if it’s malicious or just annoying, but I don’t think I care: it changes your browser’s homepage, makes itself difficult to remove and its logo is designed to make you think it’s related to Google. If it looks like malware and acts like malware, I call it malware. Just my opinion.

What To Do About Spyware and Adware

Sometimes spyware doesn’t have a whole lot of symptoms. A sudden increase in popup advertisements, constant frantic popups that claim your computer is infected, or just a sudden decrease in system performance can all be signs of a malware infection. I suppose having your identity or financial account information stolen could also be signs, but we’re not going to let it get to that point, are we?

First and foremost, it is of vital importance to install good antivirus and anti-spyware software, and to keep this software updated, even if that means paying for a subscription every year. Second and also foremost, it is vital to make sure this software is the real thing. Here are what I think of as the “Big Three” real, actual, non-malware computer security programs, along with some other software:

Norton: This is what I use. It currently comes in three versions for home users—AntiVirus, Internet Security, and 360, which range in price from $39.99 to $69.99 (although I’m pretty sure 360 is normally $79.99). As with all security software, you also have to subscribe to the updates every year, but it is well worth it.

McAfee: The Pepsi to Norton’s Coke, McAfee is another good one. It’s not my favorite, but I think that has to do more with the look and feel of the software than its actual functionality. As of this writing, its home computer versions range from $29.99 to $39.99, so it’s definitely more of a “budget” option. It works fine, though.

Kaspersky: This one actually originates from Russia. It is excellent antivirus software, and I’m pretty sure at one point years ago it was absolutely free to download and update. Alas, you have to pay for it now; prices are similar to Norton, ranging from $39.95 to $79.95.

Spybot Search & Destroy: This is free software that I highly recommend. It is not a replacement for any of the three antivirus softwares above, as it only concentrates on spyware and adware, but it is a great little backup program to have on hand. You’d be surprised how much potentially harmful stuff slips past your antivirus software. Beware of trojan horses with similar names—only get it from the website I’ve linked here.

Ad-Aware: This is similar to Spybot Search & Destroy. There is a free version still available, but you can also buy software from their site. To be honest, I haven’t used this one in a long time. Again, beware of imitators.

One final word on avoidance: I think there are certain types of websites that tend to contain more malware than others. You’re mostly safe when it comes to the giant corporate sites like Amazon, but I would never suggest you stick only to huge corporate sites.  You miss out on the whole democratic, DIY side of the Internet if you do that.

However, any time you’re viewing sites that offer pirated software, movies or music, or sites that appeal to the…ahem…prurient interests, you’re going to run into a lot more malware, especially in the form of trojan horses, than you might otherwise. So my advice is to go forth and browse, have fun and don’t be afraid to venture outside the “mall,” but try to avoid the seedy side of town.

Identity Theft Myths: Online banking and shopping are unsafe

I know, most people already know that shopping and banking online are pretty darn safe. Amazon wouldn’t be the leviathan it is today if people were still afraid to shop online. However, there are still some folks out there who think doing anything online is an open door to getting your identity stolen.

The truth is, it’s probably safer.

Think about your monthly bills. Your paper bill starts by passing through who-knows-how-many hands. Then it sits in your mailbox unattended until you take it (assuming it’s still there). Later, you write out a check (with your full name, address and account number on it), place it in an envelope with your bill (which has yet another account number on it), and leave it unattended in the mailbox with the little red “Hey There’re Checks In This’n!” flag sticking up. Assuming nobody steals it from your box, it once again passes through who-knows-how-many hands on the way to its destination. At the end, a human being (i.e., an entity capable of error) has to manually input your payment and handle your paper check.

If you receive and pay online, however, you receive an email that only you can see. It probably won’t even have your full account number in the message. You go online to pay the bill, logging in with a password only you know. Your payment is taken from your account right away, and it is processed by a machine, which will usually only make an error if you make an error.

Additionally, the security at online retailers and financial institutions is unbelievably tight. The only time anyone really runs into trouble is when they fall for a phishing scam and give their passwords out to other people, or when they use a site that shouldn’t have been trusted to begin with. Your credit union, bank, and the major retailers are fine. If you’re not sure if a business is trustworthy, check them out on the Better Business Bureau.