Cyber Security from US CERT

Adding to the post below, I received the following cyber security tip from US CERT today, (United States Computer Emergency Readiness Team is a partnership between the Department of Homeland Security and the public and private sectors.)

Cyber Security Tip ST06-007
Defending Cell Phones and PDAs Against Attack

As cell phones and PDAs become more technologically advanced, attackers are finding new ways to target victims. By using text messaging or email, an attacker could lure you to a malicious site or convince you to install malicious code on your portable device.

What unique risks do cell phones and PDAs present?

Most current cell phones have the ability to send and receive text messages. Some cell phones and PDAs also offer the ability to connect to the internet. Although these are features that you might find useful and convenient, attackers may try to take advantage of them. As a result, an attacker may be able to accomplish the following:

* abuse your service - Most cell phone plans limit the number of text messages you can send and receive. If an attacker spams you with text messages, you may be charged additional fees. An attacker may also be able to infect your phone or PDA with malicious code that will allow them to use your service. Because the contract is in your name, you will be responsible for the charges.

* lure you to a malicious web site - While PDAs and cell phones that give you access to email are targets for standard phishing attacks, attackers are now sending text messages to cell phones. These messages, supposedly from a legitimate company, may try to convince you to visit a malicious site by claiming that there is a problem with your account or stating that you have been subscribed to a service. Once you visit the site, you may be lured into providing personal information or downloading a malicious file (see Avoiding Social Engineering and Phishing Attacks for more information).

* use your cell phone or PDA in an attack - Attackers who can gain control of your service may use your cell phone or PDA to attack others. Not only does this hide the real attacker's identity, it allows the attacker to increase the number of targets (see Understanding Denial-of-Service Attacks for more information).

* gain access to account information - In some areas, cell phones are becoming capable of performing certain transactions (from paying for parking or groceries to conducting larger financial transactions). An attacker who can gain access to a phone that is used for these types of transactions may be able to discover your account information and use or sell it.

What can you do to protect yourself?

* Follow general guidelines for protecting portable devices - Take precautions to secure your cell phone and PDA the same way you should secure your computer (see Cybersecurity for Electronic Devices and Protecting Portable Devices: Data Security for more information).

* Be careful about posting your cell phone number and email address - Attackers often use software that browses web sites for email addresses. These addresses then become targets for attacks and spam (see Reducing Spam for more information). Cell phone numbers can be collected automatically, too. By limiting the number of people who have access to your information, you limit your risk of becoming a victim.

* Do not follow links sent in email or text messages - Be suspicious of URLs sent in unsolicited email or text messages. While the links may appear to be legitimate, they may actually direct you to a malicious web site.

* Be wary of downloadable software - There are many sites that offer games and other software you can download onto your cell phone or PDA. This software could include malicious code. Avoid downloading files from sites that you do not trust. If you are getting the files from a supposedly secure site, look for a web site certificate (see Understanding Web Site Certificates for more information). If you do download a file from a web site, consider saving it to your computer and manually scanning it for viruses before opening it.

* Evaluate your security settings - Make sure that you take advantage of the security features offered on your device. Attackers may take advantage of Bluetooth connections to access or download information on your device. Disable Bluetooth when you are not using it to avoid unauthorized access (see Understanding Bluetooth Technology for more information).
_________________________________________________________________

Author: Mindi McDowell
_________________________________________________________________

Produced 2006 by US-CERT, a government organization.

Phishing with Text

Banks need to remind their customers that you do not contact them in emails or text messages, asking them to send you account numbers, debit card numbers and PINs over these unsecured channels. Phishing expeditions are continuing to thrive and now we see more and more attempts to gain information with text messaging.

Hello texting on your cell phone. Phishing expeditions are growing on cell phones as texting is becoming a common means of communication, and as many new cell phones were given as holiday gifts. Recently the Pittsburg, PA police department warned that customers in dozens of states are getting messages on their Sprint cellular phones from dozens of banks, asking for confidential information.

Customers need to be suspicious. Even if your caller ID tells them it is your bank calling or sending you a text message. "Spoofing" is a trick that allows the caller to contact you and make it appear as though it is your bank.

I recently read a news article where hackers in Asia were able to infect cell phones and initiate money transfers using those phones. In many areas of the world cell phones are used for banking where small purchases are made solely on the phone. This has not been popular in the U.S. But the message is the same, security and awareness are keys to protecting your customers.

If your customer has a question or receives a text message or email, they should be warned to call your bank using a known telephone number and not a "special one" provided in the message. Your bank then has to know where to send these calls for information. Infrastracture starts with you. Precautionary warnings should also appear predominantly on your web site as a constant reminder.

Scammers send these messages because when a small percentage of a very large number do respond, they get money, your money. Stop the crime before it starts.

Phishing with the web

In-Session Phishing

A JavaScript vulnerability in most web browsers can be used for "in-session phishing," a new form of phishing attack that doesn't depend on email to deliver its lure to vulnerable phish. The trick uses a pop-up window that emulates a security alert and asks for password and login information.

Amit Klein, the chief technology officer at security vendor Trusteer, has notified browser makers of the flaw. The process to complete this in-session phishing includes hacking a site to enter HTML code that looks like a security warning. A JavaScript bug allows this pop-up to appear valid and legitimate to the web site. It has the user re-enter user names and passwords. Klein believes the hacker could write code that recognizes the user's location, and pops up the verification window to knowingly capture bank logon information.

Banks need to monitor their web sites, keep their systems updated, and continue to urge their users to keep their systems updated as well.