Another Reason To Avoid ICS

I've told you so many times that using your computer to share your Internet service - using ICS - is not a good idea. My reasons center around the needless complexity, and load, placed upon the server.

Now we have a new reason to avoid ICS. This week, ICS is being used as an attack vector. NetworkWorld: New Windows attack can kill firewall points out

The code, which was posted on the Internet early Sunday morning, could be used to disable the Windows Firewall on a fully patched Windows XP PC that was running Windows' Internet Connection Service (ICS).

So, if you're running ICS because you have 2 computers, and you think that Windows Firewall protects you, think again. Even if your computer is fully patched, if you have ICS behind WF, you are at risk.

Perimeter protection, aka a NAT router, is the only real protection.

>> Top

And Now Fake Codecs

So an EBud just sent you an E-Card greeting, supposed to be soo cute. And you play it, and you get a notice

Your player needs an extra codec. Shall we find it for you?

STOP! Right now, it's time to close the browser, flush your cache, and restart the computer.

Sometimes, you may see the above advice when surfing to various web sites that provide free movies (and no, we won't discuss what type of movies, though this problem is more common on certain types). It's the same thing though. The content (E-Card, online movies, whatever) is the attraction. The trojans are the payload. It's all just another way of hacking your computer.

Lavasoft News Beware - Desktop Hijacks on the Rise Again says

Watch out for the Zlob Trojan that poses as a codec needed to view a video, then installs a fake virus and urges its victims to download a rogue anti-spyware program to remove it.

And again we see the repeated advice

...even a spoofed e-mail that claims to be Windows Update (Microsoft never sends updates via e-mail)

as if I haven't harangued you about that before.

The best prevention is avoidance. Stay safe.

Email Offering IE7? PASS!

Did you recently get email from "support@microsoft.com"? How many times have I pointed out that

Microsoft does not email software offers or updates.

Today, The Register: Trojan download site spoofs IE7 release outlet points out that

Hackers have created a bogus Internet Explorer 7 download site that attempts to load Trojan code onto the PCs of visiting surfers.

Traffic to the malicious website is being driven by a spoofed email message, claiming to be from support@microsoft.com, offering a link to download Release Candidate 1 (RC1) of Microsoft Internet Explorer 7.

Once again, here's a clue.

Microsoft does not email software offers or updates.

And, if you ignore the warning, yet another chance to become part of a growing trend: botnet membership, a club that you do not need to join.

Would You Like Fries With Your Virus?

A couple years ago, music giant Sony got caught loading their customers with hidden software, when they were stupid enough to load "extra content" from legally purchased CDs onto their computers.

Today, we hear of Apple, who shipped a small quantity of iPods infected with a virus.

As you might imagine, we are upset at Windows for not being more hardy against such viruses, and even more upset with ourselves for not catching it.

And earlier this week, we hear that MacDonalds in Japan gave out MP3 player infected with yet another virus.

We haven't seen these players ourselves, so we can't confirm how exactly you would get hit by this trojan, but some sources report you only had to plug it into your Windows PC.

Once again, practice Layered Security on all computers. Please. Botnets are more and more useful, so don't contribute to the population.

The Good Guys Win One

From Nigeria, actual tape of a cybercafe raid, with a band of 419 scammers arrested.

Interestingly, those not directly involved in the scamming still profit. Neighbours outside the cafe didn't react well to the arrests being made.

A New Security Risk: Your Old Cell Phone

In Dufus Or Joe Job Victim?, we looked at an idiot who sold a laptop computer, and came to regret it. Amir probably deserved what came to him, but it doesn't mean that we shouldn't learn from his mistake.

So how about your cell phone? You may be surprised to learn that it's a small computer. It may have an amazing storage capacity, and what's stored there can cause you embarassment, if you give away, lose, or sell the phone. Apparently, what's stored on your cell phone can be resurrected, even if erased - just as the contents of your computers hard drive can be recovered.

CNN Technology: Cell phones won't keep your secrets discusses experiences where

Curious software experts resurrected information on 10 used phones (purchased on eBay), including the racy exchanges between guarded lovers, and

• One company's plans to win a multimillion-dollar federal transportation contract.
• E-mails about another firm's $50,000 payment for a software license.
• Bank accounts and passwords.
• Details of prescriptions and receipts for one worker's utility payments.

The recovered information was equal to 27,000 pages -- a stack of printouts 8 feet high.

"Most people toss their phones after they're done; a lot of them give their old phones to family members or friends," said Miro Kazakoff, a researcher at Compete Inc. of Boston who follows mobile phone sales and trends.

Think next time, before you give your old phone away.

One Small Bit Of Good News

21 year old Christopher Maxwell was sentenced to 37 months in federal prison on Friday for hacking, that in the estimate of the Seattle FBI's cybersquad, netted Maxwell and two unnamed teenage accomplices "more than $100,000".

Maxwell, holding back tears, pleaded for probation in lieu of prison time.

I am a 21-year-old boy with a good heart and I made a mistake. I never realized how dangerous a computer could be. I thank God no one was hurt.

The judge was not taken by the tears, or the plea. While Pechman took Maxwell's age and lack of criminal record into account, she said the prison term was necessary to provide a deterrent to other hackers.

Victims of the hack included

• Colton Unified School District in California.
• Northwest Hospital in Seattle.
• The US Defense Department.

and doubtless thousands of unknown private computers that will never be identified.

He got off lightly, but it's a start. Hopefully the FBI is getting better at this now.