Missouri State University
Information Security News & Info

5 ways to secure your Facebook profile in a post-Timeline world

Timeline’s rollout is unstoppable. Are you suddenly sharing more than you should?

With the ongoing rollout of Facebook’s Timeline feature, security and privacy have never been more important to your digital life. The new layout presents all of your current and past activities on Facebook — posts, photos, comments, likes and so on — in a handy timeline format to anyone with access to your profile, which may include friends of friends, colleagues, executives at your company, a potential future boss … well, you get the idea.

If you’ve made the jump to Timeline — and if you haven’t, you will within the next few weeks, like it or not — you should know that Facebook has changed a few things, and there are certain settings you need to pay attention to if you’re concerned about what parts of your life others can see. Here’s how to lock down your profile in the post-Timeline world.

1. Limit your connections Most key privacy settings are accessible by clicking the arrow in the upper right-hand corner of your profile screen (next to your name and the Home button). From here, select Privacy Settings in the drop-down menu.

2. Tailor your tags An easily missed entry in the Privacy Settings is one innocuously labeled How Tags Work. However, it is essential to tweak the settings found here if you want to take control of your profile’s privacy, as some tagging actions can be pretty invasive.

3. Rein in app permissions Speaking of permissions, the permission window that used to appear frequently when Facebook apps wanted to access your profile information is pretty much MIA now. Currently, apps need to ask you only once for permission. Once they do, they’ll mine your profile information as often as need be, sometimes even when the app isn’t being used.

4. Stop others from taking your information with them The Apps, Games and Websites privacy settings also contain some other features that security hounds would be wise to disable.

5. Reduce your social footprint Sharing is the whole point of Facebook, but the Timeline layout sometimes takes this to extremes, making it easy for others to see all your activity from years gone by. The good news is that you can disable Recent Activity updates, which broadcast new friendships, groups you’ve joined and any other changes in your basic information (such as relationship status or political views). Just click on the X next to a Recent Activity update on your timeline and select Hide Similar Activity from Timeline.

Step-by-step ‘how to’ on each item is provided at the source of this article:  http://www.computerworld.com/s/article/9223862/5_ways_to_secure_your_Facebook_profile_in_a_post_Timeline_world?taxonomyId=84&pageNumber=1

 

Send feedback to the author
Posted in Uncategorized | Leave a comment

Anatomy of an ATM Skimmer Scam

Skimmers could steal your financial information at the ATM—or even at your local supermarket. Here’s how to protect yourself.

You may already know that it’s important to protect your financial information when you shop online. But a high-tech threat can steal your credit card information when you’re out shopping around town. Scammers can steal your ATM or credit card information without your even noticing, and the technology behind their tricks is getting more and more advanced.

The crime called credit card “skimming” has become increasingly common in the past few years. In fact, authorities recently uncovered a large, sophisticated skimming operation where scammers attached their devices onto the self-checkout machines at 24 Lucky supermarkets in Northern California. The scam caught hundreds of customers who used the self-checkout machines in October and November 2011 and had their account information stolen.

Obviously, skimmers are a serious security threat. But how exactly do these devices work, and how do you protect yourself from them?

How a Skimmer Operates

Credit card skimmers are essentially devices that thieves place over the actual card readers on an ATM or credit card terminal to collect your financial information for fraudulent use. As your card passes through it, that skimmer reads your card’s magnetic strip, thereby collecting your card’s information. Beyond that, though, a surprising amount of variation exists in the hardware and exact methodology behind these scams.

The hardware itself can range from small, cheap skimmers that can be spotted fairly easily to elaborate 3D-printed rigs that are almost indistinguishable from an actual ATM.

Skimmers also vary wildly in exactly how they collect your information. Just collecting your card number isn’t enough, so most skimmers also include some way to capture and store your PIN and your card’s security code (typically a three-digit code that’s found on the back of your card). Some skimmers include a false keypad that’s placed atop the actual keypad that collects your PIN, but newer devices utilize harder-to-detect pinhole cameras mounted above the keypad–cameras that collect images of you entering your personal information.

The skimming devices can store the information locally and be physically picked up by criminals, but more and more of these devices transmit information to their owners. Some skimmers simply connect to a phone line, but skimmers that send information wirelessly are becoming more common. Some will even transmit data information to the scammer’s cell phone via Bluetooth.

Steps to Protect Yourself

With all these tools at criminals’ disposal, it can seem impossible to protect yourself from an skimming operation. Fortunately, you can take a few simple steps to avoid falling prey to skimmer scams. The first and most obvious is to take a careful look at an ATM before you use it. It takes an expert to spot the most sophisticated skimmers, but those are the exception and not the rule.

Be suspicious if something looks like it’s sticking out too far or if it doesn’t match with the rest of the machine’s design. Many skimmers are fairly shoddy pieces of equipment that are weakly tacked onto to the card reader. Kevin Haley, director of Symantec’s Security Technology & Response Team, says you shouldn’t be afraid to get physical. “I wouldn’t hesitate to pull on something if it looks like it doesn’t belong,” he told PCWorld. Before you insert or swipe your card, give the reader a good tug, or jostle your card around the slot to see if anything is loosely attached.

Even if you don’t think an ATM or credit card terminal has a skimmer attached to it, you should take some basic security precautions. Pinhole cameras can be almost impossible to detect, but they’re also fairly easy to thwart. The next time you’re entering your PIN just use your free hand to block the view of you entering your PIN. That way, a camera mounted above the PIN pad can’t tell what you’re entering, which will help prevent criminals from being able to access your bank account.

Other warning signs you should watch for may not involve the device itself. Beth Givens, the director of the Privacy Rights Clearinghouse, says you should also be on the lookout for anybody hanging around your ATM for long periods of time–some skimmers need someone nearby to collect captured information. Also, avoid using ATMs in isolated locations that don’t seem to be part of a store or financial institution. Scammers have been known to set up entire false ATMs on occasion. (In 2009, attendees at the Defcon hacker conference in Las Vegas spotted a fake ATM at a hotel.)

As always, pay close attention to your credit card bill and bank statements–fraudulent charges or unauthorized cash withdrawals are often the first indication that your account information has been stolen. If you see such unauthorized charges or withdrawals on a statement, contact your bank or financial institution as soon as possible. By keeping a vigilant eye on your ATM and on your credit card bill, even the most sophisticated credit card scam shouldn’t be able to cause you too much grief.

Source: http://www.pcworld.com/article/247235/anatomy_of_an_atm_skimmer_scam.html

Send feedback to the author
Posted in Uncategorized | Leave a comment

12 Scams of Christmas

 1. Mobile Malware

2. Malicious Mobile Applications

3. Phony Facebook Promotions and Contests

4. Scareware, or Fake Antivirus software

5. Holiday Screensavers

6. Mac Malware

7. Holiday Phishing Scams

8. Online Coupon Scams

9. Mystery Shopper Scams

10.  Hotel “Wrong Transaction” Malware Emails

11.  “It” Gift Scams

12. “I’m away from home” Scammers

Read details and information on how to protect yourself here: https://blogs.mcafee.com/consumer/mcafee-twelve-scams-of-christmas

Send feedback to the author
Posted in Uncategorized | Leave a comment

How safe are you online? Now you can find out

Is your computer set to automatically check for software and security updates? Do you type your name in search engines to see what personal information is online? Have you customized your security and personal information settings on social networks?

These are all ways to own your online presence by controlling privacy and security settings.

But according to a new Microsoft study, Americans aren’t doing all that they can to protect themselves and their families when they go online.

Microsoft’s Trustworthy Computing Group recently studied online safety behavior and online security use among more than 2,000 Windows users in the United States, the United Kingdom, France, Germany and Brazil.

Based on the research, Microsoft (an NCSA Board Member company) created the Microsoft Computing Safety Index (MCSI), a scoring system of more than 20 steps that can protect you online. The more steps you take, the higher your online safety score.

The highest rating possible is a 100. In 2011, the average score across the five countries was 34. The score shows that people are taking steps to help protect them online—but there is also opportunity to do more.

  • The scores are divided into three tiers: 80-100, 20-79 and 0-19. A score in the 80-100 range shows you are well-aware of the various threats—both existing and emerging—as well as the steps necessary to help guard against them.
  • A score in the 20-79 range suggests you may have the basics covered, but there are opportunities to learn about new and emerging threats, particularly in the social realm.
  • A score in the 0-19 range indicates you may not be taking advantage of the most basic – and oftentimes free – protections available.

One great aspect of the survey is that anyone can take it. The survey is online take and find out your score.

In the past, online threats were primarily technical in nature, such as viruses or malware on your computer. But now, online threats are evolving and becoming more social, such as phishing ads based on your online searches, stolen passwords, identity theft and cyberbullying.

Microsoft found that people across the globe are getting smarter about the “set and forget” precautions, such as installing anti-virus software and enabling automatic updates. But people aren’t actively managing security and privacy settings as frequently as they should to avoid social threats. Small steps, such as monitoring your privacy settings and limiting what personal information you put online, can help you control your online identity.

One of the key pieces of advice from the STOP. THINK. CONNECT. campaign is own your online presence. Take the time to adjust settings to your comfort level of information sharing.

Learn more about the MCSI  and find other ways to protect yourself by visiting NCSA’s Tools and Resources page.

 STOP. THINK. CONNECT. Source: http://staysafeonline.org/blog/how-safe-are-you-online-now-you-can-find-out

Send feedback to the author
Posted in Uncategorized | Leave a comment

National Cyber Security Awareness Month Kicks Off Today

National Cyber Security Awareness Month Kicks Off Today With Extensive Activities Across U.S. Throughout October by National Cyber Security Alliance on Monday, October 3, 2011 at 1:34pm

 WASHINGTON, DC October 3, 2011 – The National Cyber Security Alliance (NCSA), a non-profit public-private partnership focused on cyber security awareness and education for all digital citizens, today marks the beginning of the 2011 National Cyber Security Awareness Month, building upon an expansive agenda targeting new audiences and partnerships both in the U.S. and overseas. In addition to traditional awareness themes such as cyber security practices at home and in schools, this year’s National Cyber Security Awareness Month will explore how cyber security impacts and affects small businesses, law enforcement, the nation’s workforce, and professional development.

NCSA, along with the U.S. Department of Homeland Security and the Multi-State Information Sharing and Analysis Center, has sponsored National Cyber Security Awareness Month every October since its founding in 2004.  Together, these organizations strive to empower consumers, schools, businesses and government agencies to stay safe online, devoting the full month of October to public awareness and education.  

http://www.facebook.com/staysafeonline for full article.

 National Cyber Security Alliance

Send feedback to the author
Posted in Uncategorized | Leave a comment

Wells Fargo Reminds College Students to Safeguard Their Personal and Financial Information

Wells Fargo offers 10 tips and resources to help young adults prevent fraud and identity theft
 
To help prevent fraud and identity theft, Wells Fargo recommends these 10 tips for college students:
1. Forward It: The Better Business Bureau recommends having sensitive mail sent to a permanent address such as a parent’s home or a P.O. Box. This should include all financial and medical information, which may contain confidential details. Ask if a paperless statement is an option so you can access account information online instead.
2. Don’t “Over Share” It: Social media is increasingly popular, but it’s a good idea to keep personal information private. Fraudsters can use personal information such as birth date, mother’s maiden name and pet’s name, to help gain access to an account. Also, it’s a good idea to keep other information private such as mobile and home phone numbers; email address; and dorm, apartment and home addresses.
3. Doubt It: Use a healthy dose of skepticism if someone – claiming to be from your bank or another legitimate company – calls, texts or sends an email asking for personal information. Never click on links sent in unsolicited emails from strangers.
4. Sign Up for It: Consider signing up for online and mobile banking. This will enable you to monitor your accounts regularly, when it’s convenient for you. Research has shown electronic banking is the quickest way to detect account fraud. Many financial service providers offer online and mobile banking.
5. Ask for It: Ask your financial services provider if it offers alerts, which can quickly detect unauthorized use of a bank account. Customized alerts can also be set up in advance. Alerts can be sent to an email address or mobile device based on criteria you select, such as when an account balance drops below a certain amount or your credit card is charged more than a certain amount.
6. Lock It: Secure your laptop and desktop computer with a password, firewall and anti-virus software so no one else can access your files, and with a desktop cable lock so no one can remove it. For your mobile devices, be sure to use the keypad lock or phone lock function when they are not in use. These functions password-protect your device so that no one else can use it to view your information. Also be sure to store your device in a secure location.
7. Shred It: Use a shredder and shred all unwanted credit card offers, insurance or loan applications, bills, credit card receipts and documents that contain your personal information. Thieves steal information from many sources, including the mail and even garbage cans, and can use it to help gain access to financial accounts.
8. Protect It: Consider using a room safe, or secure online safe for copies of important documents. Be sure to keep any credit cards and documents that contain personal information locked up when not in use, such as a passport, Social Security Card and your bank statement.
9. Hide It: Never leave a wallet or purse in plain sight in a dorm room. The same goes for documents with personal or account information.
10. Learn More About It: Ask your financial services provider what other services it offers to protect your personal and account information.
 
Send feedback to the author
Posted in Uncategorized | Leave a comment

Mobile Device Security

What is a Mobile Device? Mobile devices include cell phones, smartphones, laptops, netbooks, tablets, and external storage such as USB-connected drives.  Actually, it is any computing device that can easily be carried and used.  These devices have become indispensable tools and are part of our everyday life.  You will most likely use a mobile device for your homework, social activities, and entertainment.  A smartphone today is so powerful that it doubles as a small laptop computer.

How Important is Your Mobile Device? If your smartphone is lost, stolen, or damaged, how will that affect your life?  If your thumb drive is lost, how will that affect your work at school?  Do you use your device for banking?  Online purchases?  You may not realize it, but personal details of your life may be on these devices.  These devices provide valuable productivity benefits, but along with these benefits, they are also subject to threats that may jeopardize your data, your identity, and your personal safety.  Mobile device threats are predicted to escalate significantly in 2011.  Your loss may be someone else’s gain.

What are the Threats Affecting Your Mobile Device and Data? The most common threat against mobile devices is loss. If it is not password protected or the data is not encrypted, your information is open to whoever has your phone.  Data that is not backed up is simply lost. Other threats include theft, breakage, malware through text messaging, e-mail, social networking apps, Bluetooth hacking, and location services. For example, geo-tagging automatically records your location on pictures you take on some devices unless you turn the feature off.  If the picture is posted to a public site, anyone can see where you are or where you have been.  Other apps can tag your location if you allow it.  When an iPhone is jailbroken, there are no guarantees that the image you use is malware-free. If the only copy of your semester’s work is on a thumb drive, losing it can lead to academic disaster.  These drives can also become corrupted, too.

What Can You Do to Protect Your Device and Data? You should think of your mobile device as a debit card with the PIN written on it.  Sounds silly, but your mobile device, such as a smartphone, may have enough information on it to actually be used as a debit card.  Keep track of it at all times. Back up your data to a safe place.  Avoid keeping sensitive information, such as personal and financial account information on a mobile device.  If you absolutely must store account information on your device, encrypt it.  The extra expense of the encryption software is a small price to pay.  Don’t keep old text messages.  Always beware of unusual messages.  Don’t configure your apps for auto login – require a password for every use.  Bluetooth should never be left in “discover” mode.  Only download apps from trusted sources – check the app’s privacy policy.  Check for apps (or with your service provider) for device protection options such as remote wipe or kill, location services, and contacts backup.

Send feedback to the author
Posted in Uncategorized | Leave a comment

AvoID Theft: Deter-Detect-Defend

AVOID ID THEFT

The FTC’s Identity Theft Site is a one-stop national resource to learn about the crime of identity theft. It provides detailed information to help you deter, detect, and defend against identity theft.  

On this site, consumers can learn how to avoid identity theft – and learn what to do if their identity is stolen.  Businesses can learn how to help their customers deal with identity theft, as well as how to prevent problems in the first place.  Law enforcement can get resources and learn how to help victims of identity theft.

Send feedback to the author
Posted in Uncategorized | Leave a comment

Epsilon Email Breach – ‘Phishing’ Reminders

4-5-11 Were you affected by Epsilon data breach? The breach, which took place last week but was announced over the weekend, compromised the e-mail addresses and some names belonging to the customers of many major U.S. companies that outsource their marketing and e-mail communications to Epsilon. The list of Epsilon clients whose customer e-mail addresses were stolen is not complete, and is likely to grow. But so far Target, Kroger, TiVo, US Bank, JPMorgan Chase, Capital One, Citi, Home Shopping Network, Ameriprise Financial, LL Bean Visa Card, McKinsey & Company, Ritz-Carlton Rewards, Marriott Rewards, New York & Company, Brookstone, Walgreens, The College Board, Disney Destinations, and Best Buy have notified their own customers about the breach. Hilton Hotels and Ethan Allen are also said to be affected. Here are some tips on what to do if you did receive an e-mail from one of the companies above or if you believe one of them does have your e-mail or name, and what could happen next.

What should you do about it?
Do not open e-mail from someone you don’t know. That’s pretty simple. But you’ll also need to be extra vigilant now that phishers may know specifically where you shop, what airline you fly, or where you bank. Look at the e-mail address–if it’s purportedly from one of the companies above but ends in something other than .com, especially an international domain like .uk, that’s a good indication it’s a scam since most phishing attempts originate outside the U.S. Also be on the lookout for spelling errors in the e-mail address, URL, or body of the e-mail, or e-mails whose tone sounds particularly urgent.

If you do open the e-mail, don’t click any links. A common phishing practice is to ask people to click a link to update their personal information.

If in doubt, call the company
If you get an e-mail from one of the companies listed above asking for any information, and you’re unsure if it’s legitimate, you can always call them. Many retailers affected by the Epsilon breach are notifying their customers now that they would never ask for sensitive information via e-mail.

Additional resources
You can forward suspected phishing e-mails to reportphishing@antiphishing.org and spam@uce.gov.

Source: http://news.cnet.com/8301-31021_3-20050555-260.html?tag=topStories1

Send feedback to the author
Posted in Uncategorized | Leave a comment