Categories
General

FCC to help protect your mobile privacy

On my way to Prague last month, I decided to pick up May’s print volume of PC Today. Coincidentally, the entire volume was focused on security.

The first article that caught my attention was about the Federal Communications Commission’s plans to help the victims of phone theft. The article goes on to say, “… when a given phone is reported stolen, wireless carriers can remotely shut down that phone.” What does this mean for you, the consumer?

First of all, the FCC is attempting to protect victims of data and identity theft. However, more than likely your data will be long retrieved by the time you notice your phone is stolen and call the wireless provider.

Secondly, the article cites the FCC’s statistic that 40% of New York City robberies are that of mobile phones. However, I doubt that the majority of those were for the purpose of data theft but rather for the theft of the hardware itself.

If you’re concerned about the data and identity theft aspect of losing your phone, you can take several steps to mitigate that risk:

  1. Don’t store sensitive data on your phone. This is pretty common sense. You wouldn’t want your credit card information easily accessible, but who stores that on their phone anyway? What’s more common is saving e-mail passwords and allowing the thief to gain easy access to your personal, or even more sensitive corporate e-mails.
  2. Another layer of passwords, such as locking access to your phone with a 4 digit number, is another excellent way to deter thieves.
  3. Use the software that comes with your phone. Instead of relying on the wireless carrier to deactivate the phone, or even to support the feature, use software that is prepackaged. For example, Apple’s iPhone comes with a nifty feature called Find My iPhone that can help you erase all of the data remotely. The article did not specify whether the FCC was going to require this for all wireless carriers.

In the digital age of today, our eyes are glued to our mobile phones. Don’t become a victim of mobile theft and make sure to have that phone glued to your side.

How else do you think the FCC can help?

Categories
Security

Don’t forget the cyber criminals

Continuing our media push, I wrote a guest post for Forbes.

High profile news throws a spotlight on how people feel about the privacy of their personal digital data, but for years, cybercrime has been stealing and selling it with very little coordinated public uproar.  This malaise must end.  The very real threat comes not from big faceless companies and governments, but those who seek to hide below the radar and the law.  A combined awakening needs to take place and governments, businesses and Internet users must pull together to fight this very current threat to personal data, because at the moment cyber crime is winning.

Check out the post and let me know what you think!

Categories
Security

Mysterious case of the broken browser

A friend of mine asked me to take a look as to why Google and Bing were inaccessible using Firefox. I dove in and realized that they were also unreachable using Internet Explorer, Chrome, and even command line ping. It became apparent that the hosts file had been hijacked. In fact, these entries were the only ones present:

87.229.126.50 www.google.com
87.229.126.51 www.bing.com

I swiftly removed them from the hosts file and both websites loaded fine. But what had put them there? With a working browser, a quick search revealed that those addresses were not legitimate and something had clearly hijacked the machine.

Knowing my friend to be an avid Malwarebytes Anti-Malware user, I checked the quarantine and found several objects. The main files appeared to be dplayx.dll and dplaysvr.exe and had several registry entries allowing them to start with the computer. I sent the files to Adam Kujawa, a Malware Intelligence Analyst working with me at Malwarebytes. Adam confirmed that this malware was responsible for the hosts file redirection.

However, a further analysis revealed a more cynical side. Adam continued by saying that “all binaries analyzed were heavily packed with custom obfuscation methods and employed anti-debugging tricks which made them a pain to get through” and that “the use of the filenames dplayx.dll and dplaysvr.exe is important because the names belong to legitimate applications and are integral parts of Direct X.”

While not new, the use of these particular filenames shows that malware authors are still trying to hide their executables behind legitimate names.

Categories
General

Holy spam, Batman!

As I arrived in London this morning I opened up my phone’s e-mail client and saw upwards of 1,000 e-mails downloading. At first, I had no idea what was going on, but then I realized they all had the same subject, “Please stop supporting the New York Times traitorous propaganda.” Spam, and lots of it. They are still coming in at one per minute.

Image of a sample e-mail attached. Anybody else getting these?

Categories
Security

Check if you’re a digital pirate

With all of the SOPA talk this month, I figured an article on piracy was deserving. Being able to pinpoint users of pirated software is becoming easier and more accurate. For example, check out YouHaveDownloaded.com, a website that lists the torrents you may have downloaded in a certain time span. While the website is not perfect, for those who have static IP addresses, it can get pretty close and provide you a list.

In one article on CNET, it was mentioned that “someone in the home of French President Nicholas Sarkozy, a strong proponent of anti-piracy legislation, has been using BitTorrent to download pirated versions of music and movies.”

If the Stop Online Piracy Act passes in the United States, I’m sure technology to track torrents and other illegal downloads will improve. Consequently, imagine the privacy concerns I have for Internet users. This proof-of-concept website is scary enough!