Cyber Security Tip from US CERT

Adding to the post below, I received the following cyber security tip from US CERT today, (United States Computer Emergency Readiness Team is a partnership between the Department of Homeland Security and the public and private sectors.)

Cyber Security Tip ST06-007
Defending Cell Phones and PDAs Against Attack

As cell phones and PDAs become more technologically advanced, attackers are finding new ways to target victims. By using text messaging or email, an attacker could lure you to a malicious site or convince you to install malicious code on your portable device.

What unique risks do cell phones and PDAs present?

Most current cell phones have the ability to send and receive text messages. Some cell phones and PDAs also offer the ability to connect to the internet. Although these are features that you might find useful and convenient, attackers may try to take advantage of them. As a result, an attacker may be able to accomplish the following:

* abuse your service - Most cell phone plans limit the number of text messages you can send and receive. If an attacker spams you with text messages, you may be charged additional fees. An attacker may also be able to infect your phone or PDA with malicious code that will allow them to use your service. Because the contract is in your name, you will be responsible for the charges.

* lure you to a malicious web site - While PDAs and cell phones that give you access to email are targets for standard phishing attacks, attackers are now sending text messages to cell phones. These messages, supposedly from a legitimate company, may try to convince you to visit a malicious site by claiming that there is a problem with your account or stating that you have been subscribed to a service. Once you visit the site, you may be lured into providing personal information or downloading a malicious file (see Avoiding Social Engineering and Phishing Attacks for more information).

* use your cell phone or PDA in an attack - Attackers who can gain control of your service may use your cell phone or PDA to attack others. Not only does this hide the real attacker's identity, it allows the attacker to increase the number of targets (see Understanding Denial-of-Service Attacks for more information).

* gain access to account information - In some areas, cell phones are becoming capable of performing certain transactions (from paying for parking or groceries to conducting larger financial transactions). An attacker who can gain access to a phone that is used for these types of transactions may be able to discover your account information and use or sell it.

What can you do to protect yourself?

* Follow general guidelines for protecting portable devices - Take precautions to secure your cell phone and PDA the same way you should secure your computer (see Cybersecurity for Electronic Devices and Protecting Portable Devices: Data Security for more information).

* Be careful about posting your cell phone number and email address - Attackers often use software that browses web sites for email addresses. These addresses then become targets for attacks and spam (see Reducing Spam for more information). Cell phone numbers can be collected automatically, too. By limiting the number of people who have access to your information, you limit your risk of becoming a victim.

* Do not follow links sent in email or text messages - Be suspicious of URLs sent in unsolicited email or text messages. While the links may appear to be legitimate, they may actually direct you to a malicious web site.

* Be wary of downloadable software - There are many sites that offer games and other software you can download onto your cell phone or PDA. This software could include malicious code. Avoid downloading files from sites that you do not trust. If you are getting the files from a supposedly secure site, look for a web site certificate (see Understanding Web Site Certificates for more information). If you do download a file from a web site, consider saving it to your computer and manually scanning it for viruses before opening it.

* Evaluate your security settings - Make sure that you take advantage of the security features offered on your device. Attackers may take advantage of Bluetooth connections to access or download information on your device. Disable Bluetooth when you are not using it to avoid unauthorized access (see Understanding Bluetooth Technology for more information).
_________________________________________________________________

Author: Mindi McDowell
_________________________________________________________________

Produced 2006 by US-CERT, a government organization.

Caveat emptor - Let the buyer beware

You know that your bank does not contact you and ask that you provide your account number, debit card number or PIN. Many of us have seen those emails and many, if not most, are from banks we don't even have account with. These are phishing expeditions where every email address a scam artist can send the message to, will get it.

Hello texting on your cell phone. Phishing expeditions are growing on cell phones as texting is becoming a common means of communication, and as many new cell phones were given as holiday gifts. Recently the Pittsburg PA police department warned that customers in dozens of states are getting messages on their Sprint cellular phones from dozens of banks, asking for confidential information.

Customers need to be suspicious. This is the case even if your caller ID tells you it is your bank calling or sending you a text message. "Spoofing" is a trick that allows the caller to contact you and make it appear as though it is your bank.

Remember, most banks simply will not call or text you and ask that you give them your information. If you have a question or receive a text message or email, call your bank using a known telephone number and not a "special one" provided in the message. You are your first line of defense. And by defeating these scam artists, the dollars saved may be your own.

Undue Enrichment

USA Today recently had a story about a couple in Pennsylvania. They deposited a check to their account for $1,772.50. The bank made an encoding error and gave them credit for $177,250.00. This does happen on occasion. People key in the numbers, and people make mistakes.

When the couple transferred money to another account, bought a car, and were looking to buy a new home in Florida with this "bonus," they turned what would have been an embarassing moment for the bank into a criminal act.

When an obvious mistake like this happens, the couple has no right to spend the money. Checks and balances are in place so the mistake would be caught. It may take a day, or a week or a month. It depends on how often each bank and each party involved with that check balances their account. And if this couple doesn't have the financial resources to replace that money, what would they expect to happen? We call it "undue enrichment" and it means you can't take what isn't yours, even if you received it because of someone's error.

We were happy to see that many readers of that story posted comments that the couple should have known better. One person questioned the possibility of criminal charges. That is up to the bank and the district attorney. But if someone spends large sums of money that are not theirs, and they can't repay it, what else should happen? The bank has little choice as it has to recover the money.