PC-Armor Computer Security News Blog

Confused about Cookies?

Stopbadware.org had a contest recently encouraging participants to create a short video explaining what web cookies are and how they could affect your personal privacy.  Many people submitted videos and they have selected a winner!

The contestants did a very good job of presenting how cookies work and you can view the videos  at: http://cyber.law.harvard.edu/cookiecontest

If you are confused about what cookies are and how they work, you may want to check out the videos.

How safe are your Stored Windows Passwords?

Windows operating systems have a feature known as the “Protected Storage”, which is a place within the operating system where sensitive information is stored for retrieval at a later time.  Protected Storage stores user names and passwords, web addresses, and data entered on forms.

Why should you know about this feature?  Well, it is possible, and in fact has happened, where an attacker who gained access to a system, either locally or remotely, is able to retrieve any information found in this repository.  The information found could include user name/password combinations for PayPal, eBay, online banking accounts, email, and pretty much any other type of authentication information.

This feature is enable by default to save time and make surfing more convenient; however, if you are concerned about computer security and protecting your personal information, it is possible to turn it off.  The only noticeable change is that you will be required to enter your user name and password for accounts that Windows previously stored.  I would prefer to enter the information and know that there are no traces that can be retrieved from my computer.

To turn this feature off, open Internet Explorer, click the “Tools” menu and then select “Internet Options” from the side menu.  You will now see the Internet Explorer “Properties” windows and will notice a number of tabs across the top; click the tab labeled “Content” and then click the “AutoComplete” settings button.

This will bring up another window with various autocomplete options that will most likely have check marks next to to them.  Remove all of the check marks, starting with the “Prompt me to save passwords” option, and then click the “OK” button.  If you have Internet Explorer version 6 or earlier, you should see two additional buttons allowing you to “Clear Forms” and “Clear Passwords”; if you have these buttons, click both of them to clear your history and then you are finished.  Otherwise, follow the next step, which is for Internet Explorer version 7.

Next, click the “General” tab and then click the “Delete Forms…” and “Delete Passwords…” buttons and confirm.  This will clear any data that was previously stored.

Now, you are just a little bit more secure!

Subject: CONGRATULATION

My friend received the following email today and asked me for my opinion as to its validity.

Received: from mta10.adelphia.net[1] ([IP Address Removed]) by vms169119.mailsrvcs.net

(Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006))

with ESMTP id <0JSM000TKR04J8N2@vms169119.mailsrvcs.net> for

[Removed]@verizon.net; Thu, 06 Dec 2007 07:33:40 -0600 (CST)

Received: from web34 ([68.168.75.141])

by mta10.adelphia.net (InterMail vM.6.01.05.02 201-2131-123-102-20050715)

with ESMTP id <20071206133339.JGVE16909.mta10.adelphia.net@web34>; Thu,

06 Dec 2007 08:33:39 -0500

Date: Thu, 06 Dec 2007 05:33:39 -0800

From: MICROSOFT AWARD PROMO 2007 <mic-msn01@adelphia.net>[2]

Subject: CONGRATULATION

X-Originating-IP: [IP Address Removed]

Bcc:

Reply-to: [Removed]@yahoo.com.cn[3]

Message-id: <22510592.1196948019494.JavaMail.root@web34>

MIME-version: 1.0

Content-type: text/plain; charset=utf-8

Content-transfer-encoding: 7bit

X-Priority: 3 (Normal)

Sensitivity: Normal

CONGRATULATION

You are No(5)you won

(1,000.000)One Million Great

Britain Pounds[4] MICROSOFT AWARD PROMO

Batch No: 452006/14/FIFA06/FL To claim your winnings you are expected

to contact your agent Mr Dan [Removed] via email immediately within

24hrs

with the following details below.[5]

 

1.Full name……………………….

2.Country…………………………

3.Contact Address………………….

4.Telephone Number…………………

5.Fax Number………………………

6.Marital Status…………………..

7.Occupation………………………

8.Age…………………………….

9.Sex…………………………….

Mr.Fred [Removed]

Head Winning Claims Dept.

Email: [Removed]@yahoo.com.cn

Sincerely,

Mr.Fred [Removed]

Microsoft Promotion Team

---

 

[1] Should have come from Microsoft.com if it were legitimate

 

[2] Again, email address would be been from “@microsoft.com” if it were legitimate

 

[3] Did you notice the domain? It is “.cn”, which is China. Do you think Microsoft would be send emails from Yahoo in China?

 

[4] Why would Microsoft be awarding a prize in British Pounds instead of American Dollars?

[5] And then there’s the kicker…the true giveaway that this is a scam; they are asking for personal information! As we have stated umpteen times - never, ever, give out your personal information to anyone asking for it. Unless of course, you do not mind becoming a victim of identity theft!

Now, if you notice the references to certain aspects of the email, it is obvious this is a scam intended to steal the user’s personal identity.  Just remember, a little investigative work and common sense can go a long way in protecting your personal information.

The latest Security Alerts

As Christmas approaches, everyone needs to be very cautious, especially when deciding to view eCards. F-Secure reported on their blog today that email Inboxes are receiving eCards from what appears to be “123Greetings.com”, when in fact, is pointing to an http://IP Address with an executable file that installs a backdoor on the unsuspecting victim’s computer after they land on the malicious site. You can read the story at:

http://www.f-secure.com/weblog/archives/00001327.html

UPDATE: F-Secure just released new information about another Christmas Card scam that will infect computers if the user clicks the link to download and install a malicious Flash player. You can read the story here:

http://www.f-secure.com/weblog/archives/00001330.html

Following up the the QuickTime vulnerability, the SANS Internet Storm Center has an updated list of malicious websites exploiting the vulnerability and you can read it at:

http://isc.sans.org/diary.html?storyid=3713

Be vigilant and careful; it will only get worse as we approach year end.