Why You Are Not “Good Enough” to Avoid Malware
Posted on by Beau AdkinsCategories Web SecurityLeave a comment on Why You Are Not “Good Enough” to Avoid Malware

Compiling CodeIn my line of work, most of my colleagues are very technically savvy. Sometimes I will ask them about their views on different computer security products. More often than I would expect, I receive this response: “Oh, I think that is really important, but I don’t need it because I know what I’m doing.” When I press more on what it is they are doing that makes them immune, here are some of the possible responses, and my thoughts on each.

I’m careful where I click

Hmm, thats good. How are they careful. Maybe they don’t go to any site they haven’t heard of? So googling something, and clicking that perfect result is out of bounds for this person? Never clicking any link that has been run through a URL shortener like is so common on twitter? Staying away from sites that show ads? Never going to a site which doesn’t have perfect server security? If they did all these things then they really aren’t browsing at all. ANY site can be bad.  There are just too many ways that even the most trustworthy site can be turned malicious –  I will save that for another post.

I don’t use Windows

First off, I love Windows. It is my OS of choice, but it saddens me to say that this tactic does help. But why? Because Windows sucks? Not really, it is just a matter of targeting. When a hacker writes an exploit, he wants it to work on as many people as possible. Since most of the world uses Windows, he writes his exploit for Windows. It doesn’t mean he couldn’t have written it for any other OS, and there are times when hackers do write the exploits for the other OS’s. So while using a different OS will get you by most of the malware on the web, you are still counting on luck.

I’ve never gotten a virus before…

This one is classic on so many levels. So you’ve never been infected with malware before, therefore you must be immune… Hmmm, ok, lets assume that to be true, even though a child could tell you that it’s NOT. If you never use anti-malware products, and you have never been infected by anything, that tells me that you have never been infected by a poorly-written, or relatively harmless piece of malware. Those are the ones that you would be aware of if you were infected. A relatively harmless piece of malware would have a juvenile purpose: changing your desktop wallpaper, or showing you popups for porn sites. Not so bad. If the malware were more sinister, they want to make sure you don’t know they are there. They want to steal things from you without your knowledge. But if they are poorly written, they can crash your computer or other applications. But if it’s a well-written sinister piece of malware, that’s bad. You will not know it is there just by using your computer normally. Software specifically designed to find this stuff is the only way to know if it is there. You know, like anti-virus products.

Don’t fall into the trap in thinking you are just too smart to get infected online. It is a dangerous place out there, and it’s actually getting worse. In the old days, hackers wrote malware just to mess with people. Now they make money off of it. They are smart, and persistent. Do everything that you can to protect yourself. Here is a good starting point.

Spammers Create Fake Facebook Profiles
Posted on by Zuly GonzalezCategories Web SecurityLeave a comment on Spammers Create Fake Facebook Profiles

Have you received a friend request on Facebook from a hot girl you don’t recognize? You say what the heck, I don’t know her, but she’s hot, so yeah I’ll be your friend. Bad move! Take a look at the profile below, see anything strange?

Fake Facebook User Profile Maybe you received a friend request from someone you don’t recognize with a lot of mutual friends. So you accept the request thinking, well I probably met this person at some point. Wrong again.

Facebook spammers are now creating fake user profiles to amass a large number of “friends” they can then sell to unsuspecting businesses. These businesses may have seen an ad similar to this one:

Spammer Advertising

Soon after you accept requests from these fake users, you start getting invitations to join Facebook fan pages. This is how spammers create artificial word of mouth marketing.

Worse yet, now these spammers have access to personal information you’ve marked as viewable by friends only. This includes two very important pieces of information, your birthdate and location. This can possibly lead to identity theft!

What Can You Do?

  • Avoid friending anyone you don’t recognize. Hot girls aren’t the only threat, it could be a hot guy, or a normal looking person.
  • Ask a real friend. If you get a friend request from someone with mutual friends, send your real friends a message and ask them about this person you don’t recognize. If several of your real friends tell you they don’t actually know this person, stay away!
  • Look through your current friend list. Remove anyone you don’t recognize, especially if they’re constantly inviting you to join Facebook pages.
  • Spread the word. Spammers get away with this because most people aren’t aware of these threats. So tell your friends.

Have you seen any other suspicious Facebook activity? Let us know.

Beware, Facebook Password Email Scam
Posted on by Zuly GonzalezCategories Web SecurityLeave a comment on Beware, Facebook Password Email Scam

There is yet another Facebook email scam going around. This time victims receive an email with the subject line “Facebook Password Reset Confirmation! Customer Support”. The email instructs the victim to click on an attachment in order to retrieve the password. The attachment is really a password stealer, and once installed it can potentially access any username and password combination utilized on that computer – not just for the user’s Facebook account. Here is an example of what the Facebook password reset scam email looks like.

Facebook Password Reset Email Scam Example

Facebook never sends emails alerting a user that they changed his or her password. If you receive this email, delete it right away and do not click on the attachment. To protect your computer from this type of cybercrime, follow The 5 Most Important Steps for Internet Security. Also, visit the Facebook Security page for tips on protecting yourself from scams on Facebook.

To get more details on this Facebook email scam, read the McAfee Labs Blog.

The 5 Most Important Steps for Internet Security
Posted on by Beau AdkinsCategories Web Security4 Comments on The 5 Most Important Steps for Internet Security

A closed lockThere are a lot of simple things you can do to keep yourself safe online. Here are the 5 most important things you can do today to maximize your web security. Most of these tips are simple enough for even the most novice user. Also, some of these tips assume you are using windows.

  1. Set a unique password for your administrator account – Some Windows flavors come with a built-in administator account with no password. This is the easiest way to allow a hacker to hijack your computer. You need to set it to something, and it needs to be something hard to guess (more about picking passwords later). To set it, go to Start -> Control Panel. Then click on the Administrative Tools icon. Once in there, there is a Computer Management icon. On the tree view on the left, you should see an entry for “Users”. Clicking on this should give you a view on the right of all the accounts. You can use these to enable or disable accounts, and change the passwords. If you are using Vista or Windows 7, this default admin account is turned off by default, so you shouldn’t have to worry about it.
  2. Use strong passwords – Setting your password is a waste of time if it can be guessed. What should you not use as a password? Anything that your closest friend could ever, EVER, guess. So don’t use your name, birthday, relative’s name, etc. Don’t use “password”, “123”, etc. Don’t make your password something you would find in a dictionary. What should you use? Use at least 8 characters total. Use something unguessable. Use upper and lowercase. Use numbers. Use symbols. Here is an example of a very strong password. “R8b#5kB2*”. This would take decades at best for a hacker to guess. At least it would have if I hadn’t written it here. Assume this one as guessable now. So this is a strong password. But it is very difficult to remember. To make a password that is almost as strong, but easier to remember, try making up words, mix up the case, and add a number or 2. Like this one “Flard9Glorb2”. This is just about as unguessable as the previous one. Except this one is pronouncable, which means you can remember it. Use a strong password important accounts you have (especially for logging on to your computer).
  3. Install an antivirus product – Everyone should have some sort of antivirus installed. More importantly, it should be up-to-date. This usually costs around $40 for a year or 2, but it is worth it. There are some free antivirus tools out there, but I have never used them, so I can’t offer any opinion on them. Some internet service providers offer free subscriptions to antivirus for its users. Even if you can’t get antivirus for free, you still need to get it. $40 is not a lot of money to help keep your personal info safe.
  4. Install (and configure) a software firewall – A lot of the antivirus suites come with a firewall. If your’s didn’t, find another one. There are a ton online, and I haven’t used enough of them to offer a recommendation of one over the others. But once you get one, make sure it is set up to monitor both incoming and outgoing traffic. Most of them only offer incoming protection by default, but if you are behind a router, this is basically useless. Once you turn on outgoing monitoring, you will start seeing notifications popping up asking your permission to allow a program to access the internet. Once you have allowed or disallowed all the programs on your computer which are trying to use the internet, you shouldn’t see any more popups, except when new (possibly bad) software is installed. Why should you care about a firewall? Assume a bad piece of software gets installed on your machine, and your antivirus doesn’t catch it. If it tries to send your personal info out to the internet, or contact its creator to get tasking, hopefully the firewall will stop it, and render it impotent.
  5. Turn on auto-updates – Both your operating system and your browser should have auto-updating capabilities. This means when a new version is released, you get it automatically, instead of having to go look for it. The most common reason for a new version of software is a patched vulnerability. If you continue using a piece of software with an unpatched vulnerability, you are at a very high risk of having your computer exploited.

Completing these 5 simple tasks shouldn’t take more than an afternoon, and will put you miles ahead of most everyone else on the internet. Hackers usually pick the low hanging fruit. It is quicker, easier, and sadly most of the “fruit” out there is hangs pretty low.

Now, don’t leave this article thinking you are invincible online. There are still some very sophisticated hackers out there. Consider these steps as a good starting point, because if you haven’t done all of these, doing the more advanced things is a waste of time.

Watch Out for Tax Season Phishing Scams
Posted on by Zuly GonzalezCategories Web Security1 Comment on Watch Out for Tax Season Phishing Scams

Online Phishing ScamsI found an interesting post on the McAfee Labs Blog on tax time phishing scams worth sharing.

Every year during tax season, online criminals create fake irs.gov domains in an attempt to trick taxpayers into revealing their personal and financial information. Victims might visit these phishing and malicious websites via any number of effective redirection methods, such as phishing attacks, forum postings, and black-hat search-engine optimizations.

If you get an email from the “IRS”, it’s probably a scam. The IRS Consumer Alert page says, “The IRS does not send taxpayers unsolicited emails about their tax accounts, tax situations, or personal tax issues.” Here is an example of a fraudulent IRS email. To prevent your personal information from being compromised, avoid replying or clicking on any links in the email, and delete these messages.

For the full article visit the McAfee Labs Blog.

Well I hope you found my tax season series to be helpful. Let me know if you have topic suggestions for next year’s tax time series.

Light Point Security Blog Intro
Posted on by Beau AdkinsCategories Light Point Security UpdateLeave a comment on Light Point Security Blog Intro

Welcome to the Official Light Point Security BlogBlogging on Laptop

Here we go, Post #1. First off, let me say that I have never posted to a blog before, so this is a pretty big deal for me. This whole site is still in its infancy, so expect things to change around.

Who Am I?

My name is Beau Adkins. I am 1 of 2 co-founders of Light Point Security. I am also the CEO and CTO. As of this point, it means I am in charge of all things technical. I am a software guy trying to become a business guy (who still does software).

What Is This Blog About?

Good question. I haven’t yet nailed down where I want the focus of this blog to be. But off of the top of my head, I can say that these are the most likely subjects to be discussed here.

  • Web security
  • Startups in general
  • Programming topics

Since I have zero experience with contributing to blogs, I don’t plan on hammering the subject matter out before I start. I am sure that as I try out different topics, the blog itself will naturally evolve into the best mix of subject matter that I can write on.

If you have any questions or comments for me or about the business, feel free to ask/contribute.

Categories
Archives