Online Crime Bytes

College students and identity theft

Normally I never just print a vendor alert in its entirety. But this time it's personal. A few months ago, my daughter, who's away in college, got her wallet stolen. In a panick I called the CEO of Lifelock, an identity theft protection company, and asked him to make sure she didn't get her identity stolen. A few weeks later, copies of her credit report arrived from all three reporting agencies and it appears her identity is intact.

Today the company sent me this report on the FTC's latest report that college-age students are the number one victim group to get taken by identity theft. Below is Lifelock's suggestions to young people on how to protect their identities:

Take some of your graduation money and buy a paper shredder—It’s nowhere near as cool as getting a new iPod, but it could save you thousands of dollars and lots of headaches by keeping your personal information out of the bad guys’ hands.

Place a fraud alert with the major credit bureaus—Fraud alerts mean creditors have to contact you directly and get your approval every time someone tries to open a new credit account in your name. This way, even if the bad guys DO get your information, you can stop them from opening new accounts. You can place those fraud alerts yourself, or you can pay LifeLock a small monthly fee to take care of the fraud alerts for you.

Stop pre-paid credit card offers—Credit card companies love sending these to new graduates because they know you’re going to be spending a lot on furniture, cars, work clothes, etc. Identity thieves can pull these out of your mailbox or trash, and in minutes fill out those applications, change the address to their own address and steal your good name. You can stop those offers yourself, or LifeLock can do it for you, and will pay up to $1 million to help you if you still end up becoming an ID theft victim.

Just because you’ve protected your information, don’t assume everyone else will—You can take all of these steps and thieves can still get your personal information. How? They steal it from businesses, government offices, and even universities. So far in 2006 there have been more than 50 reported security breaches at places like H&R Block, The University of Texas, Ohio University and the Department of Defense.

Check your credit report—The major credit bureaus are required to give you one free credit report a year. If you see something that doesn’t look right, check it out. Checking your credit report won’t prevent bad guys from opening new accounts in your name. That’s why placing fraud alerts is so important—even more important than simply checking your credit report. But they can give you an overview of what’s happening with your credit.

How two worms infect my ultra-secure computer

Since 1995, I’ve been writing about the dangers of online computing and ridden the storm relatively unscathed. I’m one who knows the dangers, who keeps my security software up to date and surfs safely. Still I get hit during a moment of weakness sometime in April  when I was running a new <security software package that was supposed to make all this pain go away. Unfortunately, the software wouldn’t update through my secure firewall router (see previous blog). And so, for a few days, my computer was hanging out there unprotected.

After I replace it with Panda Platinum (another all in one that claims to be less complicated), I again receive no updates. This time it's my fault for ignoring the part that says I need to authenticate my security settings with a separate username and password so it can update. Knowing my vulnerability, I practice safe computing by making my deadlines on my Mac and keeping my XP turned off except when trying to configure the software. 

When I finally do get around to configuring Panda, I can’t get either of my browsers to open and do the updates.  With several zero days against IE (which I updated against last week) and on Firefox (which there was no update for last week), I'm thinking I’ve probably got two trashed browsers. Until after some research, when I realize Panda's firewall has been blocking the browser connection attempt at start up. So I reboot, tell it to allow the connection and I get back my browsers. Panda updates its malware signatures. I turn on Panda's 'heuristics’ to look for anomalous behavior indicative of malicious software trying to do something on my computer. And then I run a manual scan.

In about ten minutes, Panda finds and cleans 17 infected files, mostly tracking cookies. But where'd those two mass-mailer worms come from? MyDoom.M and Netsky.P, both of which originated in 2004, and both memory hogs, were discovered and eliminated from my PC. Curious about how I’d get such old worms during my moment of vulnerability, I go on the Internet and do some reading. At least one of them, MyDoom.M, had a resurgence last month, according to an article in e-Securityplanet. And security experts I talk to say that most of their worms are old code that even  outdated antivirus should have in its signature database.

All cleaned up and rebooted, my Mozilla browser updated today with its new auto update feature introduced in its last service pack. So I'm feeling safe again -- enough to use my XP in creating this blog. Because I know it could have been much worse. It could have been keystroke logging software, remote-control ware, rootkits and other malware that's epidemic out there. Watch for my articles about all that in Networkworld (May 22), Enterpriseleadership.org (May 15) and SC Magazine (June or July).