GiaKonda Ltd

A basic introduction to eFraud, and the measures you can take to prevent, or at least minimize your exposure.

TYPES OF eFRAUD
Phishing
Emails are presented so as to seem official communications of a bank, retail organization or government department. They then ask the victim to “confirm” confidential data. Information asked for includes login details, credit card or banking account details, Date of Birth etc. The pretext is a security measure being implemented or response to some possibly fraudulent use of the account. The scam can be made to look real by use of images often taken from the real organisation. The attacker frequently makes use of a link in the email apparently taking the victim to the official site but in actuality leading to a hacked server. The gathered data is then either stored to a hidden area on the same server, or to a different hacked server or sent to a throw-away email account that the hacker will monitor for the duration of the scam. This sort of attack is also called “carding”, “web spoofing” or “brand spoofing”.
Spear-Phishing or Sniping
This is more complicated, effective and targetted form of phishing, involving online identity theft. The criminal has some prior knowledge of the company’s data or the victim’s private data so the email bait can be personalized with information that appears genuinely from the target individual. This addition of a cleverly constructed use of social information makes these attacks so much more effective.
Pharming
A type of phishing involving more technical expertise and organisation to accomplish. It is just part of the broad use of the term phishing.
Advanced Fee Fraud
Represented in large part by Nigerian Scams, these typically take the form of emails purporting to be from someone having large funds available overseas that, if not moved out of country soon, would be lost. The fraudster pleads with the victim for help in moving these funds to the victim’s country, in return for which the fraudster generously gives a portion of the funds. However, having once baited the victim’s interest, the victim needs to outlay some funds of his or her own in order to initiate the process. Similar scams exist for Lottery winners who need to send a fee in order to receive their winnings and also emails from friends abroad who due to some mishap need money urgently.
The email plays on greed, pity and kindness on the part of the victim to complete the scam.
Identity Fraud
Identity fraud is the process of stealing another person’s identity, usually by first stealing personal details as outlined previously, in order to profit financially at the victims expense. Any subsequent activity on the part of the attacker would be traced back to the victim. Disassociating themselves from the activities of their attacker is a long, tedious and not always successful task.
Credit Card Fraud
Whether obtained via phishing or key-logging (malware that reads the keys on your computer as you type), credit card information is actively traded publicly in Web forums and IRC channels or via more discreet means such as private Instant messaging networks or emails. This information is then used to purchase goods or services, using various techniques to make it difficult to trace the recipient. The transactions are done on sites (called ”cardable”) that do not restrict shipment of goods to the same address or region as the billing address of the card owner. Delivery is frequently made through drops that are handled by others for a fee and subsequently re-shipped to the fraudster.
See our next blog for the security measures that will help you – along with a good deal of common sense.

This document has been adapted from work done by the United States Computer Emergency Readiness Team. www.us-cert.gov
Protect your computer against power surges and brief outages
Some power strips protect your computer against power surges but these alone will not protect you from power outages. There are specific products that do offer an uninterruptible power supply. During a lightning storm or construction work that increases the odds of power surges, consider shutting your computer down and unplugging it from all power sources. Also be sure to unplug your network cable!
Back up all of your data
Even if you take steps to protect yourself, there will always be a possibility that something will happen to destroy your data. You have probably already experienced this at least once— losing one or more files due to an accident, a virus or worm, a natural event, or equipment failure. Regularly backing up your data on a CD/DVD or network reduces the stress and other negative consequences that result from losing important information. A one Terabyte usb external hard drive costs as little as £60. Determining how often to back up your data is a personal decision. If you are constantly adding or changing data, you may find weekly backups  the best alternative; if your content rarely changes, you may decide that your backups do not need to be as frequent. You don’t need to back up software that you own on CD-ROM or DVD-ROM—you can reinstall this from the original media if necessary.
Use and maintain anti-virus software and a firewall
Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable by using anti-virus software and a firewall. Make sure to keep your virus definitions up to date.
Regularly scan your computer for spyware
Spyware or adware hidden in software programs may affect the performance of your computer and give attackers access to your data. Use a legitimate anti-spyware program to scan your computer and remove any of these files. Many anti-virus products have incorporated spyware detection.
Keep software up to date
Install software updates (also called patches) so that attackers cannot take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should turn it on.
Evaluate your software’s settings
The default settings of most software enable all available functionality. However, attackers may be able to take advantage of this functionality to access your computer. It is especially important to check the settings for software that connects to the internet (browsers, email clients, etc.). Apply the highest level of security available that still gives you the functionality you need.
Avoid unused software programs
Do not clutter your computer with unnecessary software programs. If you have programs on your computer that you do not use, consider uninstalling them. As well as consuming system resources, these programs may contain vulnerabilities that, if not fixed with the latest version, may allow an attacker to access your computer. Think before you download programs on a whim.
Consider creating separate user accounts
If there are other people using your computer, you may be worried that someone else may accidentally access, modify, and/or delete your files. Most operating systems (including Windows XP and Vista, Mac OS X, and Linux) give you the option of creating a different user account for each user, and you can set the amount of access and privileges for each account. You may also choose to have separate accounts for your work and personal purposes. While this approach will not completely isolate each area, it does offer some additional protection. However, it will not protect your computer against vulnerabilities that give an attacker administrative privileges. Ideally, you will have separate computers for work and personal use; this will offer a different type of protection. It is not a good idea to give yourself Administrative Privileges.
Establish guidelines for computer use
If there are multiple people using your computer make sure they understand the risks and how to use the computer and internet safely. Setting boundaries and guidelines will help to protect your data.
Use passwords and encrypt sensitive files
Passwords and other security features add layers of protection if used appropriately. By encrypting files, you ensure that unauthorized people can’t view data even if they can physically access it. You may also want to consider options for full disk encryption, which prevents a thief from even starting your laptop without a passphrase. When you use encryption, it is important to remember your passwords and passphrases; if you forget or lose them, you may lose your data.
Follow corporate policies for handling and storing work-related information
If you use your computer for work-related purposes, make sure to follow any corporate policies for handling and storing the information. These policies were likely established to protect proprietary information and customer data, as well as to protect you and the company from liability. Even if it is not explicitly stated in your corporate policy, you should avoid allowing other people, including family members, to use a computer that contains corporate data.
Dispose of sensitive information properly
Simply deleting a file does not completely erase it. To ensure that an attacker cannot access these files, make sure that you adequately erase sensitive files.
Follow good security habits
Review other security tips for ways to protect yourself and your data.

My next article will recommend the best free software available to help secure your PC.
GiaKonda IT Ltd can be contacted on 01792422616 or visited at
3 Humphrey Street Swansea SA1 6BG. wendy@giakonda.com