LifeLock Blog

In the last month hackers have been attacking all kinds of websites including PBS, Sony, an FBI-affiliated non-profit, the CIA website, British law enforcement, Arizona Law enforcement, and others. All of these attacks are credited to hacking group Lulzsec who brags about their exploits on their Twitter profile and offers data dumps of usernames, passwords and other information from their hacks.

Other than these latest hacking attacks many other major websites, like the gawker network, have been compromised leaving users credentials vulnerable to hackers and spammers alike. So how do you know if your credentials were part of those exposed to the public? Well the website “Should I Change My Password” is here to help. They’ve placed all the publicly released credentials into a database and all you have to do is enter you email address and it will search to see if it’s was part of the released information.

The website doesn’t store any of the passwords, just the email addresses associated to the accounts so you don’t have to worry. The database is far from complete and limited to information publicly released to the public by hackers.

Remember to always use a different password for each site you use. If one username and password combination is compromised it wont effect your other accounts. Many people make the mistake of using the same username and password for all their accounts, and even though this is easy to remember it makes it easy for hackers and spammers to get into your other accounts and wreak havoc.

Well well another Facebook scam why am I not surprised. This one preys on people’s interests in the unreleased and mysterious iPhone 5. This scam works by exploiting Facebook’s new commenting system that posts comments made on a website to a user’s Facebook wall. This makes it seem as if your friend has already read and commented on the article linked in the post.

The scam starts with a friend’s post saying they’ve commented on an article entitled something like “Wired News: iPhone 5 – First Exposed.” When you click the link you will be given a Captcha like interface to prove you are human, when in fact the submit button actually authenticates their spamware to post to your Facebook account perpetuating the scam. This is called clickjacking and is becoming more common with Facebook scams.

This particular scam is a little different in that it doesn’t end in a survey it ends with a download for something called videogameboxinstaller 1.0. Malware? I think so and so does 4 other antivirus venders. The actual application is called pagerage which supposably allows users to pimp out their Facebook page and serve up it’s own ads of course. There’s also an affiliate program connected to pagerage, which might just be what the spammers are doing with their little scam.

For those of you who haven’t heard Sony has suffered a significant attack to their Sony Playstation network that has left millions of gamers cut off from it’s online gaming network. This is all people were complaining about for the first couple of day until Sony finally came clean telling everyone it’s network had been hacked and users information may have been stolen. How many users? An estimated 77 million users may be left open to identity theft.

Information stolen included: Name, address, country, email, address, birth date, PlayStation Network/Qriocity password and login and handle/PSN online ID. What makes the situation worse is Sony thinks it’s a possibility that the attachers may have also obtained credit card information. They don’t have any evidence the information was stolen, but they can’t rule it out either.

So what can users do to mitigate the possibility of the breach effecting them? Well first of all don’t panic! Things like this happen all the time maybe not to such a high profile company but still they do happen. The most likely scenario is the sale and use of the information stolen. The attachers, or the people they sell the information to, will most likely spam you and try and obtain things like social security numbers, and the like, making further financial identity theft possible.

They will also use your login credentials to gain access to other online accounts. So if you use the same login credentials for more than one online account you will need to change them, preferable to something different for each website. This will prevent them from gaining access to email accounts and online banking account where more damage can be done.

If the attackers really did steal credit card information you will want to have that card reissued to you to prevent it’s use. Also it’s not a bad idea to have a fraud alert placed on your credit accounts to make it more difficult for unauthorized lines of credit to be opened.

Taking these precautions will help prevent the information stolen during the breach from affect you in a negative way. It’s surprising that Sony could be taken down so easily and also surprising that their information wasn’t more secure. Some people are claiming Sony didn’t have their information encrypted and that they may not of followed the Payment Card Industry (PCI) data-security rules. This is a bit shocking considering Sony is one of the biggest advocates of DRM, digital right management. Sony has some of the best and more sophisticated DRM encryption and protection on it’s media like it’s movies. A bit ironic if you ask me.

My wife and I just purchased a car and because of this we both begun receiving credit offers on a daily bases. There were days we would receive 5 – 10 credit offers in the mail in a single day. This is simply ridiculous and not a good thing. Pre-approved credit offers are an identity theft’s best friend because it’s as simple as fill in the blanks without worry of rejection from the credit companies.

So what can be done about all these pre-approved credit offers? Luckily there is a simple way to opt-out using the website optoutprescreen.com. The opt-out process is simple and free. To opt-out for 5 years all you have to do is fill out the online form and submit it. If you want to permanently opt-out you have to fill out the form and send it in by mail. If for whatever reason you want to begin recievieving offers again all you have to do is opt back in using the same website.

This should reduce or eliminate credit offers coming to you by mail, and should reduce the likely hood of someone obtaining one. I simply got tired of shredding all of our credit offers because I didn’t want to simply throw them away, but it will also help protect me and my wife from a potential identity theft and credit card fraud.

https://www.optoutprescreen.com/

It’s amazing what information people throw away these days even businesses that are supposed to be responsible with your information seem no to care. So it seems to be the case in an identity theft case out of Twin Peaks, California. Three Los Angeles residents have been arrested who were in possession of counterfeit driver’s licenses, checkbooks and personal information belonging to about 1,000 people.

The three people who were arrested were Eugene Ross, 55, Debra Jones, 51, and Arthur Hill, 51. The police said the thieves received their information from going through garbage at banks, car dealerships, and other business. They then used the information to open up accounts for cell phone and cable accounts which they would open for people for money.

One elderly woman from Twin Peaks claims her identity has been compromised since 2007. Police say that over 10 accounts had been opened in her name. Purchases on one of those accounts is what lead them to the 900 block of East 81st Street in Los Angeles where they could the stolen personal information.

It’s amazing what people throw away. You would think with the rise in identity theft businesses would be more careful with what they do with other peoples personal information. I would like to think it’s harder than simply going through a dumpster to steal some’s identity, but I guess it’s not.

Identity theft is a terrible thing. It ruins your credit, costs you money, and is a pain to take care of take sometimes years to resolve. Medical identity theft is when someone uses another’s identity to get medical attention. Why is this so bad? Well for starters the hospital sends you the bill, so you have to take care of that, and second if you happen to live near the person who stole your identity the hospital could get your medical records confused with the thieves, which could result in deadly mistakes. For example if your blood types are different a simple blood transfusion could kill you!

What makes medical identity theft even worse is many hospitals will deny you access to the medical records created by the thieves records citing HIPAA, Health Insurance Portability and Accountability Act. Even though both the U.S. Federal Trade Commission and Health and Human Services say it that hospitals should give you access to the records. So many times you will have no idea what information is in there that could effect how the hospital treats you

Another problem is the fact there is no central agency who’s job it is to identify and correct medical records in the case of an identity theft. Even if a hospital is informed of an erroneous medical file there is no systematic way of fixing that record. A move toward networked electronic medical records has made medical records available to any doctor anywhere, which makes this type of problem even worse. Instead of having to deal with incorrect records at a hospital you both visit, you will have to worry about it effecting you no matter where you go.

Something needs to be done to stop this kind of crime. I would much rather have my credit ruined than be effected by bad medical records. There needs to be a centralized location to identify and correct this type of problem before it gets more people killed.

Facebook has constant malware attacks that most can void simply by not allowing the application access to their account. This recent malware attack, piggybacking on Charlie Sheen’s recent publicity, is much like the others except it uses a technique called click jacking to make it a little bit more effective.

The scam works like this. You see the article posted by a friend with a catchy title like “RIP! Charlie Sheen Found Dead at his House.” You click it and it takes you to a page that looks much like Youtube but isn’t. If you click anywhere on the page the malware gains access to your Facebook profile and it will start to post itself to others profiles. This is followed by a survey, that to this day I don’t know why people fill out, and then some reports of an actual virus that installs itself onto your computer.

If you click this link all you need to do is go to Account>>Privacy Setting.  In the bottom left you will see a section called ‘apps and websites’ click the link that says Edit your settings. Find the recent addition and remove the application’s access to your account. Then find the posts it made to friends walls and your own and remove them. That should take care of it.

Charlie Sheen has been all over the place this week, his show ‘Two and a Half Men’ has had the rest of it’s 8 episodes canceled, he had a very interesting interview with Pierce Morgan, and he joined Twitter making a world record for shortest amount of time to reach 1 Million followers. All that to say he is getting a lot of attention on the internet and elsewhere. Cyber criminals and mischief-makers start to see dollar signs and are seeking to poison search results with Charlie Sheen keywords.

Every time someone or some situation gets popular criminals seek to take advantage of it. We see it with Facebook issues and we saw it with Obama’s inaugural speech among many others. According to the spokesperson over at Invincea, a software security firm, criminals are looking to

“poison the search results and the link would appear to be taking you to a Charlie Sheen video, when actuality it is directing the user to a malicious site. Most of the time these malicious sites are fake anti-virus attacks … where the user thinks they’re infected when in reality, running the (anti-virus) scan is what installs the malware.”

Of course these fake malware sites are completely bogus and you should never click to scan for malware virus on any website. People are getting smarter about this kind of thing, but it seems criminals are getting sneaker too by attacking popular topics and keywords. Amoung the most dangerous keywords, other than Charlie Sheen, right now are “Jenni J-Woww” — Jenni “Jwoww” Farley of “Jersey Shore.” Be careful as you Google these popular search terms and don’t fall for their trickery.

Stay Safe – The Credit Protector

Well it’s tax season again and people are gearing up to prepare their tax returns in hope of getting just a little bit back from old Uncle Sam.  Every year however people are scammed into giving away important information that ultimately leads to an identity theft. Tax time can be a confusing and hectic time for some and leaves them open to scammers impersonating the IRS and other government agencies.

What the Scam looks like.

These tax related scams often times manifest themselves in the form of an email. The sender will often times impersonate the IRS or the treasury and include attention grabbing titles like “Tax Refund”  or “IRS Notice.” The email will then inform you that you need to provide information to them in order to receive your refund or to prevent from paying a penalty or fee. Also scammers use fake or phony websites to try and steal information from their victims. These websites might look identical to the IRS but are used by the criminals to trick users into entering data into them.

What you should know.

You should know that the IRS does not send unsolicited e-mails to tax pays. So if you do not contact them via email then it’s not really the IRS. Also many of these emails are sent by individuals who’s first language isn’t English. So look out for unusual grammar and sentence structure because these are dead giveaways. When presented with a IRS website make sure the URL starts with http://www.irs.gov/. If it does not it’s not the real IRS website and you should leave.

Every year new scams come out and scammers find new and interesting ways to take advantage of unsuspecting people. So keep your eyes open and your information safe this tax season.

Clairmail, a mobile banking and payment solutions company, that has added a new fraud management system to their offerings. What does this mean for you? Well if your bank or credit card company uses Clairmail you can expect to see a fraud alert system that not only alerts you to potential fraudulent situations, but also allows you to reply and resolve the situations on the fly.

This in my opinion is huge because it not only increases the communication between the company and customer, but also speeds it up. Not to mention you won’t have to call a 1-800 numbers and try to get the automated system to understand what you are trying to say.

The system might work something like this. You leave you credit card at the local bar by accident. Someone finds it and starts using it, charging several large ticket items. You credit card company recognizes the unusual behavior and sends you an alert asking if a specific dollar amount charged to your account is really you spending the money. All you have to do is reply to the SMS alert with “notme”  and it lets your credit card company know a fraudulent charge has taken place. Problem solved!

Keep an eye out for bank and credit card alert systems like this and take advantage of them where you can. Systems like this are going to make dealing with bank and credit fraud a lot faster and easier. It could save you a lot of heartache in the future.