Friday, October 29, 2010

More bad news on Terror - to close to election day to report?

US law enforcement officials are today investigating reports of suspicious packages on cargo planes in the eastern US cities of Philadelphia and Newark, New Jersey.
Transportation Security Administration spokeswoman Kristin Lee said the planes landed safely and are being swept by law enforcement.
The planes have been moved to a remote location so they can investigate.
Philadelphia International Airport spokeswoman Victoria Lupica said Philadelphia police and other agencies are with a plane at a remote part of that airport. Video from the airport shows emergency vehicles around a UPS jet.
A spokeswoman for United Parcel Service did not immediately know what prompted authorities to search the flight at Philadelphia. The company says it is working closely with authorities.
An unconfirmed report by CNN said that a bomb had been discovered on a UPS flight to Chicago from Yemen when it was stopped in London.
CNN said the alert in London centered on an ink toner cartridge converted into a bomb.
President Obama has called the incidents a “serious threat.”
In a statement from DHS: "As a precaution, DHS has taken a number of steps to enhance security. Some of these security measures will be visible while others will not. The public may recognize specific enhancements including heightened cargo screening and additional security at airports. Passengers should continue to expect an unpredictable mix of security layers that include explosives trace detection, advanced imaging technology, canine teams and pat downs, among others. As always, we remind the public to remain vigilant and report suspicious activity to local law enforcement."

Monday, October 25, 2010

Scrutinizing Facebook Spam

I ran across a great article regarding Facebook and thought I would share the information with you all.  Considering the great amount of people, young and old that are now involved in Facebook, we all need to pay attention to the risks that are out there from all over the world.  This article is a reprint of one I read in the American Society of Industrial Security publication this month.  BEE CAREFUL out there on the web.

Researchers downloaded 3.5 million profiles to see how accounts are used to send out spam.
By Tom Simonite

A study that involved downloading more than three million Facebook profiles has provided the largest-ever snapshot of the methods used by spammers on the world's biggest online social network.

The study, led by researchers at Northwestern University, turned up hundreds of thousands of spam messages, most of which were sent by compromised user accounts in coordinated campaigns similar to those carried out by e-mail spammers.
"For normal users, it mostly remains a myth," says Yan Chen of Northwestern, whose team led the study, "but spam has been a big problem to Facebook."
Reports of user credentials being sold online also motivated the researchers, says Ben Zhao at University of California, Santa Barbara, who with a colleague also contributed to the study, which will be presented at the Internet Measurement Conference in Melbourne, Australia, next month.
Zhao's group had previously collected a dataset of around 11 million Facebook profiles by exploiting the now-discontinued Facebook feature that caused people belonging to regional "networks" to share their profile information with other users by default. Three months worth of data, collected in mid-2009 and representing around 3.5 million people, were used in the study.
The researchers searched for spam in 190 million wall posts--messages posted on one user's profile page by another user--by hunting for Web addresses, even if those addresses were deliberately obscured. Wall posts were grouped into clusters containing the same Web addresses before the malicious clusters were separated from those not sharing spam links by screening the addresses using Web security services.
Altogether 200,000 spam posts from 57,000 different user accounts were picked out from 2.08 million posts containing Web links. These spam posts were generated by 23 million users in total. The study is the first to examine spam activity and features at scale, says Zhao, and it shows Facebook is now a major platform for such activity. "The results are quite surprising to me -- that even last year there was so much activity," he says. "I think this is the harbinger of things to come, as Facebook attracts more of the wrong kind of attention."
Many messages tempted users with offers of free swag such as ringtones, or used a social trap like announcing that someone had a "crush" on them. Around 70 percent of the messages were "phishing attacks," meaning they directed users to websites that attempt to trick them into divulging personal information. But most were attempts to gain Facebook account details, a strategy that could help send out more spam.
"We expected that attackers would mostly create new accounts to send spam attacks, but in fact, most are sent via compromised accounts," says Chen. "That may be harder than creating new accounts, but it is more effective to send spams to real friends."
Different accounts often sent the same spam, sometimes in simultaneous bursts of activity. "These are coordinated spam campaigns, as we see in e-mail spam," says Zhao.
A Facebook spokesperson noted that only about 0.1 percent of Facebook wall posts analyzed in the study were spam, "which is striking when compared to similar reports that have been done on e-mail." Multiple studies have reported that more than 90 percent of e-mails sent globally are spam.

"Overall less than 1 percent of all people who use Facebook have ever experienced a security issue, and that's since Facebook's founding more than six years ago," the spokesperson added. "This study appears to confirm our success at stopping spam and helping people stay in control of their accounts."
The patterns of activity discovered could, however, be used to fine-tune algorithms designed to automatically identify when an account has been taken over by spammers. One telling characteristic was the fact that compromised accounts generally sent most spam in the early hours of the morning (for that user's time zone), presumably to reduce the chance of someone noticing that his account had been compromised. Another was that compromised accounts showed sudden bursts of high activity, something that could be used to accurately identify more than 90 percent of compromised accounts, the researchers showed.
While people have become relatively skilled at spotting the spam e-mail, few expect it on Facebook, potentially making it more successful. The researchers couldn't show this to be the case, but researchers at antivirus software vendor BitDefender believe it is. "We did some experiments to see how much trust people place in others on Facebook," says Catalin Cosoi, a researcher with the company. One experiment, in March, found that around a third of people who were sent a friend request from an account created by BitDefender for the purpose would accept it and that a quarter of those would click on a link sent by their new contact.
Another trial, in August, involved sending friend requests from profiles with photos of young women to 1,000 men and 1,000 women ranging from 17 to 65 years old. There was negligible difference between the two groups, but 92 percent of requests were accepted. "When it comes to social media, people feel that [Facebook] is a company that looks after security for them and that they are in a safe place where other users have good intentions," says Cosoi.
The Northwestern study provides a valuable large-scale look at how spam functions inside Facebook, Cosoi says, although the spam detected still makes up a relatively small proportion of posts, and the company has since stepped up its security efforts. "Last year saw the appearance and spread of the Koobface worm, which was very successful," he says. "I know that things have changed at Facebook since then."
Outside researchers may not be able to repeat the study to see how spam strategies evolve, though. "With the removal of regional networks, it becomes harder to get crawled data in Facebook," says Chen.
Corsoi is certain, however, that the network will attract more spammers, for the same reason it attracts advertisers. "They see an opportunity to do things that marketers have long dreamed of--being able to see the interests of people and target messages based on that." That means users may have to become more suspicious of messages on the site.

Thursday, October 14, 2010

Introduction


Hi, this is the security wizard.  My name is Howard and I have been in the electronic security industry for over thirty years.  I have engineered, design and installed systems at large commercial clients, including NASA, Southern Command, Federal Courthouses, the largest of the Utility companies in Florida, Police Departments, Cities and towns.  I have worked with leaders of major companies to secure their homes as well as the homes of my neighbors.
With this experience I have learned much about the security industry including how our industry does business.  It is my experience that most buyers of security systems do not have the experience and knowledge to always make the right decisions.  The “consultants” or “sales representatives” that meet with the buyers, in many cases, are not well educated in our industry and in most cases in home alarm sales, are just there to get a contract signed and a commission earned.

What I am going to attempt to provide with the Security Wizard Blog is straight forward information that you can use when making important decisions regarding your security of property and yourself and family.  I will try to cover the basics of security systems, the companies that provide them, video systems including analog and IP based technology, basic fire alarm, duress, holdup and other electronic means of security.  I will cover residential and commercial security as separate subjects as the two are not really the same from equipment, design, installation and service standpoints.

I hope this information that will be following over the next three months is helpful to you, and of course I will try my best to answer any individual questions that anyone wants to ask.

My first, and maybe most important comment, is please read any contract that you are going to sign very carefully, and in almost any case, sleep on the purchase before making a decision.