Featured Article

Robert Halsey

Apr. 16, 2009

The Real Cost of Data Breach (It’s more than you think—and you’re more at risk than you know.)

Confusion. Denial. Plain old wishful thinking. That’s what we hear when we talk to people about the real cost of data breach. Whether you’re an ISO, an acquirer, or a merchant, maybe you’ve even said (or at least thought) some of these things yourself...

Unfortunately, that’s just the kind of thinking that gets businesses into trouble—the kind of trouble that all too often ends in bankruptcy. (And that’s not media hype—the U.S. National Archives & Records Administration reports 50% of businesses that lose their critical data for 10 days or more have to file for bankruptcy immediately.)
Read more...

http://www.pcicomplianceguide.org/

Beware the “Bahama” Botnet

Just when you thought the fraudsters couldn’t get any more sophisticated … they surprise you. Click Forensics researchers have recently discovered one of the most advanced sources of click fraud we’ve seen. We’ve named it the "Bahama Botnet" because when first discovered it was redirecting traffic through 200,000 parked domain sites located in the Bahamas. It has since been reprogrammed to redirect through other intermediate sites hosted in Amsterdam, the U.K., and even San Jose, CA, but the Bahama name stuck.

Interestingly, the Bahama botnet appears to be closely related to the recent spate of "scareware" attacks, such as the one perpetrated against The New York timesdigital site just a few days ago, reported by Computer World. Visitors to the NYTimes.com site were greeted with a pop-up informing them their computer was infected and directed to an authentic-looking site where they could install a program called Personal Antivirus. Users duped into purchasing this phony software were then infected with a Trojan that gave control of their computer to an unknown third party that we now know to be part of a gang in the Ukraine.

We believe the Bahama botnet is controlled by this same gang, or their neighbors down the street. More info about the We’re pretty sure the Bahama botnet is related to the Ukranian fan club and the NYTimes.com scareware because they each phone back to a bogus "Windows protection" domain located on the same IP address.

These sources were originally identified by the Black Hat community, but we believe Click Forensics is the first to discover the breadth and depth of click fraud being perpetrated by the botnets it controls. And the botnet is incredibly insidious.

As seen in this video of the botnet in action, caught on film and narrated by Click Forensic’s own Matt Graham, the infected machine will exhibit some really funky behavior. Clicks on organic search results are redirected through a series of parked domains across a number of top-tier ad providers (search engines and ad networks), eventually arriving at an advertiser unrelated to the original query. The user is momentarily confused, but likely just performs the search again, this time with easy success.

What makes the botnet so insidious is that it operates intermittently so that the user doesn’t really know that anything is wrong. Additionally, it can operate independently of the user because the authors appear to be building a large database of authentically user-generated search queries. And because the queries come from many different machines (IPs) across a broad segment of the Internet population, it is very difficult to find and identify these clicks as fraudulent. But these auto-generated clicks were not able to disguise themselves well enough to escape Click Forensics anomaly detection algorithms. Additionally, large amounts of non-converting clicks were spotted in the data we receive from advertisers. From there, our team was able to hone in on the source of the Bahama botnet.

Beware the “Bahama” Botnet

The Doctors Are ‘In’

In February of 2006, Click Forensics was just getting off the ground. We recognized the problem of click fraud was a big problem and that building a solution would be tough technical challenge. We decided to bring in an expert in the field of data mining and anomaly detection in clickstream analysis. That expert was Dr. Alex Tuzhilin. Alex spent the day with us at our offices in San Antonio and provided us a roadmap for the evolution of our approach to indentifying invalid traffic.

His contribution to us at that point was essential and provided tremendous insight. After reviewing our approach he commented,

"Click Forensics has good data and this is a source of their advantage over the search engines. To work with them to refine the scoring methodology to improve accuracy. Their approach is to incorporate as much data as possible to improve accuracy. The search providers simply don’t have enough data to have the most accurate approach."Shortly after Alex’s visit to Texas, a call from the lead attorney representing Lane’s Gifts in their lawsuit against Google. He said, "just hired your Ph.D!" The judge in that case had mandated that an outside consultant review Google’s click fraud detection methods and publish a paper on the efficacy. Alex spent many weeks at Google and wrote an insightful paper detailing their approach, ultimately describing it as "reasonable". The Lane’s Gift case was settled and Alex returned to his role as a professor at NYU.

Today we are thrilled to announce that Dr. Tuzhilin has joined the Click Forensics Advisory Board. Few individuals have had more real-world and academic experience in the measurement of online traffic quality and its effect on advertisers. His work has helped move the industry toward standards and cooperation. After visiting us in Austin a few weeks ago and meeting with our technology team, Alex said,

"Having firsthand experience reviewing the state of the art in ad network traffic management, I was impressed with the level of technical sophistication the team exhibits and I was impressed with the directions they are going, Click Forensics has played a leadership role in helping the online advertising community to monitor quality of clicks on ads, including identification of invalid clicks. Look forward to continuing to work with the team.

"In addition to Dr. Tuzhilin, we have also added Dr. William Wright, the Chief Scientist at Paypal. Dr.Wright, a Ph.D. in cognitive science, is an artificial intelligence expert who has built numerous analytical and predictive systems over the past twenty years, including the Falcon Credit Card Fraud Detection System at HNC, the Advanced Fraud Screen system at CyberSource, and numerous adversarial modeling systems for the U.S. military. After spending time with our team, William concluded,

"Click Forensics has built a strong team of developers using very advanced machine learning and data mining techniques to detect fraud and measure traffic quality, they are pioneering a new area of fraud detection and I’m finding it satisfying to work closely with them on leveraging lessons from my past experience combating credit card and banking fraud.

"One out of every five employees at Click Forensics holds a Ph.D. Adding the expertise of Alex and William dramatically enhances our ability to meet our goal of providing the state of the art approach to traffic quality management. Appreciate their contributions and look forward to benefiting from their knowledge in the future.

The Doctors Are ‘In’

Pay per Click Fraud Scammers Are Increasingly Resorting To Botnets

Recently, extremely bad news for advertisers running PPC campaigns, Click Forensics has seen some horrific scenarios in which as much as 30 percent of a monthly ad budget is swallowed by Bahama botnet click-fraud traffic. This is why being educated on cybersecurity issues is:

CRITICAL for your financial survival as a marketer! This is no joke and no small matter! If you are or have been running any pay-per-click campaigns (and notice funky things happening), you could likely be a victim of click fraud.

Sophisticated Botnet Causing a Surge in Click Fraud Click Forensics has been warning recently that click fraud scammers are increasingly resorting to botnets, which are networks of computers that have been secretly compromised for a variety of malicious tasks.

The Bahama botnet is masking the source of its clicks to convince click-fraud filters they are coming from high-quality, legitimate sources, such as U.S. libraries and schools. The botnet is also altering the "interval and breadth" of the attacks from the compromised PCs, according to

Click Forensics.

Click Forensics is a company which provides services to monitor ad campaigns for click fraud and they report on click fraud incidence every quarter of each year. Click Forensics has been warning recently that click fraud scammers are increasingly resorting to botnets, which are networks of ordinary consumers’ PCs that have been secretly compromised for a variety of malicious tasks.

A new botnet has caused a sharp spike in click fraud because it is skirting the most sophisticated filters of search engines, Web publishers and ad networks, according to Click Forensics.

The company, which provides services to monitor ad campaigns for click fraud and reports on click fraud incidence every quarter, said on Thursday that the botnet's architects have figured out a way to mask it particularly well as legitimate search ad traffic.

Click Forensics is calling this the "Bahama botnet" because initially it was redirecting traffic through 200,000 parked domains in the Bahamas, although it now is using sites in Amsterdam, the U.K. and Silicon Valley.

Click fraud affects marketers who spend money on pay-per-click (PPC) advertising on search engines and Web pages. It happens when a person or a machine clicks on a PPC ad with malicious intent or by mistake.

For example, a competitor may click on a rival's PPC ads in order to drive up their ad spending. Also, a rogue Web publisher may click on PPC ads on its site to trigger more commissions, which is probably what's behind the Bahama botnet.

Click fraud also includes nonmalicious activity that nonetheless yields a click of little or no value to the advertiser, such as when someone clicks on an ad by mistake or two consecutive times.

In a piece of extremely bad news for advertisers running PPC campaigns, Click Forensics has seen worst-case scenarios in which as much as 30 percent of a monthly ad budget is swallowed by Bahama botnet click-fraud traffic.

Ordinary users' PCs are made part of the Bahama botnet with malware. Click Forensics found links to the malware in search results for queries about the non-existent Facebook Fan Check virus.

Last week, security company Sophos and Facebook both warned that malicious hackers were setting up malware-infested Web sites that falsely claimed to remove a non-existent virus from a new Facebook application called Fan Check.

False rumors spread that Fan Check infected PCs with malware, so scammers tried to capitalize on the concern that many Facebook members had about the application.

As Facebook members used popular search engines to find antivirus information about Fan

Check, they got results that pointed to sites that offered false virus removal kits and instead infected their computers with malware.

Social Network Users Fail At Security

The fast-growing, widespread use of social networking Web sites is putting users in "serious danger" of cybercrime, according to a study by the Chief Marketing Officers Council.

Furthermore, despite concerns about the overall security of such public spaces, few users are taking even basic precautions to protect themselves against online crimes.

Indeed, the study found that the majority of social networking users are afflicted by Web borne security problems, but fewer than one in three are taking actions to protect themselves online.

"As social networking populations grow globally and the proliferation of niche social networks and mobile offerings extends the reach of social communities, the threats and vulnerabilities are escalating accordingly," said Donovan Neale-May, executive director of the CMO Council.

"More frequent breaches and outbreaks on popular social sites are a testament to the need for a more preventative mindset and threat-alert culture among community users."

The survey, entitled "Bringing Social Security to the Online Community", polled a random sampling of more than 250 consumers during the second quarter of 2009.

Study participants indicated concern over growing phishing, spam and malware attacks, with nearly 50 percent of those surveyed saying they were "very concerned" about their personal identity being stolen in an online community.

According to the poll results, despite widespread use (86 percent) of social networks, most failed to conduct basic security measures on a consistent basis.

For example, 64 percent reported changing their passwords only infrequently or never, while 57 percent said they adjusted their privacy settings infrequently or never. Meanwhile, 90 percent said they rarely or never informed their social network administrator of potential problems.
Despite the security risks, participants identified several practices that could cause harm to unprotected users. For instance, 21 percent said they had accepted contact offerings from members they didn’t know, while more than half allowed acquaintances or roommates to access social networks on their machines.

The poll also found that 64 percent of respondents had clicked on links offered by community members or contacts, while 26 percent shared files within their social networks. This proliferation of files, links and unsolicited contacts has led to a number of breaches. Indeed, nearly 20 percent have experienced identity theft, 47 percent have been victims of malware infections and 55 percent have seen phishing attacks.

The company hopes to reverse this trend, MacDermott said.

"Our Data Snatchers campaign is a viral effort that will not only get consumers thinking about their personal security but will also provide them with simple tools to do something about it when they are in the spaces that make them feel the most vulnerable."

MacDermott also advises users to follow six steps to maximize their cyber: security

- Do not accept pop-ups or prompts for software, unless you're armed with software that scans each site for infections prior to access.

- Never provide, post, or submit any confidential personal data.

- Change your password at least once a month, and do not change it if you're prompted to (this can be a third party malicious link).

- Do not allow others to access their social networks on your computer, nor yours on their machine. This could introduce infections to your computer through unsafe practices, or your login security could be compromised via cookies saved on your computer.

- Never auto save your password information, and clear your history at least once a week.

- Do not accept friend requests from people you do not personally know.
---

On the Net:

Chief Marketing Officers Council

REPORT: Bringing Social Security to the Online Community

Cybercrime Trend !

Cybercriminals never sleep. At least it sure seems like it. As the Internet turns 40 we should realize that everything that makes the Internet useful to us opens up opportunities for cybercriminals.

We must all be aware of our vulnerabilities on the net and do everything we can to stay safe and secure.

It's our goal to give you valuable information to help you better understand the problems we face in the 21st Century.
Social Network Users Fail At Security

The fast-growing, widespread use of social networking Web sites is putting users in "serious danger" of cybercrime, according to a study released Wednesday by security software maker AVG Technologies and the Chief Marketing Officers Council.
Furthermore, despite concerns about the overall security of such public spaces, few users are taking even basic precautions to protect themselves against online crimes.

The Invisus Direct Difference:

Tech support when you need it at the right price.

Are you like most people? Do you put off computer repair because you are afraid of the price? Do you wait until the horrible "blue screen" before you look for help?
What if there was a way to get computer help when the problem first came up and you didn't have to face those horrible problems again. Would that make life better for you?

You can be a raving fan, too. Call me and I'll share the details with you.
Keep an eye out for the Identity Theft Trend Next Newsletter September 15th...
until then be safe out there,

Rosemarie Grabowski,

PC Security & Identity

Theft Protection

(308) 687-6085

http://www.topsecretfreereport.com/makeadifference-x

Tough times are ripe for ID theft

If you don't know what 'vishing' is, you could be a scammer's next sucker. As the economy turns down, you need to wise

Your job and your portfolio aren't the only things you have to worry about during a recession. You need to keep an eye on your identity as well.

Crime tends to increase during hard economic times, and security experts believe we may see a reversal in the recent trend of declining identity-theft cases. (The percentage of adult Americans victimized by ID theft was 3.58% last year, according to Javelin Strategy and Research, down from 4.25% in 2004.)

So it's timely that MSN Money has joined with the National

Foundation for Credit Counseling, or NFCC, in promoting ID-theft awareness on a new Web site. On the site, you'll find:

A quiz to assess your ID-theft risk.

Recommendations for people who've been victimized.
Consumer tips.

A map with links to local events that promote ID-theft awareness during National Protect Your Identity Week, Oct. 19-25.

In addition, credit bureau Experian has partnered with MSN Money and the NFCC to give away 10,000 credit-monitoring subscriptions Tuesday, Nov. 25, through the Ask a Credit Counselor message board. We'll remind you as the date approaches.

Think you already know everything that’s needed to protect your identity? Try the following pop quiz:

Data breaches, in which personal information such as Social Security numbers are stolen or exposed by hackers, have become the leading cause of identity theft. True or false?
Consumers can prevent criminals from accessing their bank accounts by not writing down their personal identification numbers (PINs). True or false?
What is "vishing"?


For the answers, read on.

The biggest worry

Database breaches certainly get a lot of news coverage, probably because they remind us how much of our personal information floats around in the ether, beyond our ability to protect it.
As of this writing, more than 245 million consumer records have been exposed in data breaches in the past four years, according to the Privacy Rights Clearinghouse. We know about these incursions thanks to state laws enacted since 2004 that require companies and governments to report such cases.

Only a small fraction of those breaches were used to commit fraud, however.