We are now entering the holiday shopping season, which always brings out the bad guys in a big way. With so many people eager to get their shopping done, spreading good cheer and generally being social, there are a lot of attackers licking their chops and looking for ways to steal some valuable information.

So, please be careful in the coming month, and take extra care when shopping or responding to great deals that present themselves to you.

See the list of topics on the left for a quick view of this issue's stories and content.

If you're not already a subscriber, and would like to sign up, please click HERE. You'll automatically receive a free copy of my Security Resource Guide that has links and source info for the tools I use on a daily basis.

You've probably heard of them, and may even have received a call from them. Somebody claiming to be from a technical support organization (often Microsoft or an antivirus company, or even the Tech Support department of the individual's employer) calls an innocent individual in a household or business and tells them that errors have been detected on their computer.

To prove that they are legitimate, they ask the individual to perform a quick check of their computer by getting them to view the Windows Event Viewer utility. The logs on any computer will show numerous unimportant errors or warnings. This is something the scammer knows, but the individuals often don't. So, once the scammer is able to convince the individual that there are real problems with their computer, and that the caller can help fix them, they can be convinced to download and run software provided by the caller, which performs a fake scan and may also infect the computer with malware. The objective is to get the caller to pay for the software, or the support call, in some way. There are many variations on this con-game.

The Federal Trade Commission (FTC) has identified and shut down a number of these scammers, located in Florida, in the last month. It looks like the authorities have so far been able to get a restraining order to shut down the operations and freeze their assets. Hopefully, they will be able to recover some of the ill-gotten funds and reimburse some of the victims.

Virtually no legitimate organization will call you up out of the blue to tell you that your computer has errors that need to be fixed. Try to get the name and phone number of the organization and say you'll call them back. Then contact somebody you trust - e.g. the police or the Better Business Bureau - to report the call.

If you receive a call like this at work, don't fall for it, no matter how convincing the caller is. Stall the caller, if possible, and immediately contact your organization's internal technical support (preferably on another phone, while still on the line with the caller). They may be able to trace the caller, or gather some information that can be used to report the incident to authorities.

There's not much that can be done to prevent people from starting these kinds of scams, although it should become easier to uncover them and shut them down in future. So, stay alert and tell your friends not to fall for these kinds of phoney tech support calls.

When would it be appropriate for you to share your network password with another person at work?

 

a)    When a system administrator asks you for it

b)    Never

c)    When you don't want to forget it

Answer: (b) Never. There is never a good reason to share your password for a network account at work. Even system administrators should not need to have access to your password. They can usually help you reset your password with a temporary password, but you should be forced to immediately change it the next time you log in - so the administrator will no longer know it. For email, you can use a delegation feature to let others read and send email on your behalf - maintaining individual accountability without anyone else knowing your password.