PC Pro News has published an article suggesting that “Over 90 per cent of Internet users have changed their online behaviour due to concerns about spyware”. The article quotes a study on US Internet users, finding that a large percentage are now aware and cautious when it comes to opening suspicious e-mail attachments, steering clear of Internet Explorer due to security threats, and “visiting particular websites due to the fear they might deposit unwanted programs”. There has also been a reduction in the volume of multimedia downloaded via p2p programs due to risks of unwittingly installing spyware.

What makes the article a good read, is that it provides some validation that Internet users are heeding the plethora of warnings about spyware, viruses, and other security threats. Certainly in my experience I have found you can warn people about these things until you’re blue in the face, but seeing changed behaviours can be another thing altogether. The massive uptake of Firefox over Internet Explorer has shown us that people are concerned about their online security, but it is nice to see that people are thinking beyond that to other equally-serious threats too.

Every day thousands and thousands of computer users fall victim to the multitude of online security threats. Viruses, SPAM, Trojan horses, Spyware, Phishing, and just plain old fraud are rife. We all know it, many of us make it our business to minimise the risks, but for many others it is all just too hard or too confusing. This breeds both paranoia and victims.

The victims of online security attacks pay a high price. Their personal information is stolen and used in the worst of ways, loans are advanced in their names, their credit cards are charged with fraudulent transactions, and entire savings (or even entire mortgage offset accounts) are transferred out for the credit of criminals. While some of these victims are able to recoup their losses through claims, their ‘victim-ship’ is transferred to the credit card merchants and banks who ultimately foot the bill when a claim is paid.

Meanwhile, the paranoia builds amongst the rest of us. Our trust takes a battering, and we start losing faith in E-Commerce. If we let it get to us we reduce (or altogether cease) our online purchases, and this time the merchants suffer from a decrease in sales volumes. We know where it goes from there: they lose, we lose.

Responding in some way to the limited consumer understanding of online security, the Australian High Tech Crime Centre and the Australian Bankers’ Association have developed a Fact Sheet entitled Protecting Your Information Online [PDF]. This is a “Complete Idiot’s Guide” to the subject (but without lame jokes), with content including:

1. Avoid being caught by fraudulent e-mails;
2. Tips for protecting your computer [a good prelude to our tips]; and
3. Using Internet Banking [safely!].

What makes this publication especially valuable is that the advice in it is for everyone, not just confident computer users or people working in IT, but for our parents, wider family, and friends: the potential victims of a future security threat. While it is an Australian publication, the advice is well and truly global. This is the kind of document that should be sitting in the E-mail Inboxes belonging to our family and friends (along with the jokes you forward), and I can only think of one way you could get it to everyone in your address book. 😉

Meanwhile, the Australian Institute of Criminology High Tech Crime Brief reports that Identity Crime and Phishing are on the up and up (and up!). Perhaps we could all do our bit to try to reverse this trend by spreading the news?

I one single slip by a third party processor, one in each seven US Mastercard Accounts was exposed to possible identity theft as detailed at Security Focus. Fortunately the amount actually compromised will be much less. What makes this different than many other similiar glitches is that it exposed information for multiple branded cards issues on different financial institutions and organizations. Issues like this will continue to grow.

The day is coming where greater checks, perhaps pin numbers confirmed via independant routing for example will have to become common-place on purchases. Likewise with the advent of automated fingerprinting identification, I think prints or other equivalents must soon be required for the issuing of credit. Merely having my personal information and card numbers cannot be sufficient to allow access to my accounts or the granting of new credit.

In yet another cell phone caper, a phone belonging to Jimmy Buffet is reported to have been found and used to call former President Bill Clinton, according to the Smoking Gun Website. The memory card from the cell phone is still missing.

If you have a cell phone with any sensitive information you should immediately enable a user password that locks the phone against outside use. In addition, consider using coded names or nicknames for your aquaintences so that any Tom, Dick or Marvin could be dialing your friends and selling your contacts. With the advent of pda type of phones, even more sensitive information is often saved in them including financial information.

A couple of articles in the Register and Cnet claim that iPods are targets for bandits in muggings. It wasn’t that long ago that a pair of Jordon shoes (okay I guess it was a while ago) or a Starter Jacket marked you as a target for thiefs. I guess it makes sense that an iPod might be next. What is interesting that two articles from opposite sides of the world “coincidentally” note the same thing. I am wondering, is is a coincidence, or a scare tactic from some unknown source to discourage use of iPods?

Me thinks me smells a rat.

Security Focus has a nice two part article on tracking a hacker (family member or employee) on your system. It shows how you can use some readily available tools to search internet browser caches.

A security researcher in France was just busted and given a suspended 5000 Euro fine for publishing security exploit information for Tegam Viguard antivirus. Tegam was not happy about the published research and instigated legal action that resulted in the suspended fine. The prosecution alleged that intellectual property laws were broken by the researcher. This is not good news for Security Research in France and sets a worrying precedent for the rest of the world. The same argument that is often quoted when discussing gun control applies here. If you take all the legally owned guns, then only criminals will have guns. Likewise, if you make finding and publishing security flaws illegal, then only criminals will look for flaws, (they are not likely to publish them though.). Zdnet has the full story.