If Comcast calls, hang up!

Typically, Comcast doesn't call you unless they are trying to sell you something. Or maybe to survey you following a recent customer service experience. Today's story describes one situation where you definitely do not want to engage a purported Comcast rep who initiates a call with you.

My sister texted me this afternoon to say that someone claiming to be from Comcast called her and told her that her email has been reported as sending spam and pornography from Nigeria, Mexico and New Jersey. The caller had her run a command prompt (as Administrator, no less) and run the netstat command. Here is some sample output from that command:

Anyone who has used netstat knows that the output has a column heading called "Foreign Address." Based on my sister's story, it is clear that scammers are using that information to mislead unsuspecting computer users into thinking their computer is communicating with "foreign" computers. Hogwash.

My sister, who is not a "tekkie," was alert enough to put a halt to things right there, asking the guy to provide proof he is a Comcast employee. Wisely, she asked him to tell her what her account number is. He could not do that and hung up.

This is a very common "setup" that is staged to convince you something is wrong with your computer that you need to fix right away. From here, the hacker normally talks you into remotely accessing your computer, whereby he plants malware, such as a remote access Trojan, a keystroke logger, or ransomware on your computer. Or he gets a credit card number from you to charge you for fixing your problem.

I told my sister she did the right thing but that she needs to stay on her toes going forward because these guys will try again. She said she plans on changing all her passwords immediately, just to be safe. It's a good idea to change your passwords occasionally, so I couldn't agree with her more.

Remember, anyone who phones you to say your computer is infected with a virus or is showing up on their monitors as routing data to foreign countries, or anything similar to that, is a scammer. Hang up!

User: 1 - Hacker: 0.

I love a happy ending.

Beware fake charitable organizations asking for your money to help victims

It saddens us all greatly to witness the tragedies that unfolded in the Orlando area this week. As humans, we all want to do what we can to help. Being a good distance away from the scene, often our assistance is provided through funding various support and recovery efforts.

However, be aware that after any large-scale event like this one, often the con artists are the first to set up shop. Don’t give money to just anyone. Instead: 

• Stay on the alert and be safe online.
• Be wary of crowd-funding web sites.
• Be on the lookout for fraudulent charitable organization web pages (check URLs carefully).
• Validate the organization that you donate to—do your research first; ask how they intend to spend the money.
• Don’t click links in emails or text messages you receive asking you to give; instead, you navigate to the charity of your choice.
• Always: check URLs, verify message senders, and think before you click.

For more information and how to avoid being conned, see:

• Watch Out for Charity Scams in Wake of the Orlando Shooting
• NBC Los Angeles Donation Scam Warning After Orlando Nightclub Shooting (1 min. video)
• Better Business Bureau Scam Alerts

What to do if your identity is stolen

Yesterday a co-worker discovered that he'd been the victim of identity theft when he determined that an American Express card had been opened in his name and charges were run up to $20,000. He came to me for help.

It is a harrowing place to find yourself. The only way a credit account can be opened in your name is if someone has your name, Social Security Number (SSN) and date of birth. If that's the case, then you have be on your toes for the rest of your life. With your SSN, taxes can be filed in your name, credit can be opened in your name, insurance and medical benefits can be purchased in your name, etc.

In this case, my friend's data had been disclosed through the Premera Blue Cross breach of January 2015. It was not his fault.What do you do if this happens to you?

Your first four tasks:

• Contact all three credit bureaus to put fraud alerts on your credit and freeze your credit with all three bureaus. It is a good idea to freeze the credit of your spouse and children, as well.

• File a report with the Federal Trade Commission (FTC). All of the help you need to report identity theft and get a recovery plan together is at the FTC site https://www.identitytheft.gov/. Here is a great summary document to guide you through all the steps: Taking Charge: What to Do if your Identity is Stolen.

• Call your local police and make a report. Obtain a copy of the report.

• Call the bank where the scammer opened an account in your name and report it to the fraud department. 

As for calling the bank involved, know that you may not get very far with it because the perpetrator opened the account with your name and SSN but with different contact information (address, phone, email, etc.). The bank cannot discuss the account with you if they can't validate you as the account holder. Be prepared for this and don't let it frustrate you.

More tips:

Afterward, as an extra precaution, change your user names and passwords on all your sensitive accounts everywhere (banking, insurance, retirement, brokerage, credit bureaus, IRS.gov, TurboTax/Intuit, benefits, payroll, personal email, etc.). It is imperative that you employ unique, strong, long passwords. If two-factor authentication is available, use it.

Remember this forever: The fraudster has your SSN and may sit on that information for years before using it. This is why, in an earlier blog posting, I recommend that you freeze your credit, regardless of whether or not you think your SSN is in someone else's hands. For most of us, I suspect it's only a matter of time before we become victims too. 

In addition to freezing your credit, file your taxes early every year and, I repeat: do not use weak passwords on any online accounts. Make sure your passwords are unique, and don't share them with anyone. 

Why you never use the same password on more than one web site

It is a fundamental tenet of user security in 2016 that you do not re-use the same password simultaneously across different web sites and software programs. All the hacker has to do is crack your *one* password to hack all of your accounts. Oh, and he (or she) will.

Here is the latest reported breach caused by password re-use, a mistake made by none other than Mark Zuckerberg, founder of Facebook: Zuckerberg hacking adds to cloud of internet insecurity. Please read it.

The Zuckerberg error is just one example of many prominent people getting hacked because they use a weak password—and, worse, use it across multiple accounts. Use a long, complex password (the longer the better), and guard it like you would all of your liquid assets.

Here is another tip: For accessing your most sensitive data (online banking, insurance, brokerage accounts, medical records, etc.) use a different user name as well. Don't use the same login name that you use for your Gmail, eBay, Blogger, Twitter, Intuit, Facebook and other accounts.

It is never a good idea to use your email name as your banking login name. For example, if your email name is JohnDoe@myemail.com, make your banking login name JohnDoughBoy (or something else easy to remember, hard for others to guess). For extra security, throw in a special character (if allowed).

Another solution is discussed here: First Click: An easy way to quit reusing passwords.

Even Krebs is discusses this week how some online organizations are forcing password resets if they think you are re-using yours elsewhere: Password Re-user? Get Ready to Get Busy

Beware "overlay" skimmers installed at Walmart check-outs

Look before you swipe, and don't ever swipe your debit card. Wherever possible, dip your chip-enabled credit card instead of swiping it.

We've said this all before. Today, security journalist Brian Krebs gives us reason for a reminder.

The card skimmers that thieves use to steal the data about you and your account—data that is stored in the magnetic stripe—are so well crafted these days that it is difficult to tell they're a ruse. Take a look at the photo here. Can you tell it's a fake?



Probably not. Here is what it looks like before the thief snaps it onto the existing point-of-sale device:



This device records your account information when you swipe your card, including your PIN. The data is downloaded later when the fake front is retrieved by the thief.

These were found installed in Walmart stores in Virginia and Kentucky. But they can be installed anywhere that uses this particular Ingenico credit card terminal. Grocery store shoppers suffered card thefts when similar devices were installed at Safeway stores a few months ago.

For more information and a surveillance snapshot of criminals installing an overlay skimmer at a Walmart self check-out station, see Brian Krebs' blog posting Skimmers Found at Walmart: A Closer Look.

If your card is chip-enabled, dip it. And never swipe your debit card.

Can your phone be hacked?

Yes, of course that computer in our pocket is easily hacked. When that happens, the hacker can see all of your phone data—email messages, account information, credit card numbers, text messages, bank information—and the bad guy can even listen to your calls. What is even creepier than that is the fact that the hacker can turn on your video camera and watch you without your knowledge.

How hard is it to hack a phone? It's not. Watch this 13-minute CBS News 60 Minutes episode "Hacking Your Phone," for a live demonstration of hackers listening in on a congressman's phone.

They say there are two types of people in this world: Those who know that their phones have been hacked, and those who don't know that their phones have been hacked.

Want more protection for your phone? Stay educated and alert, don't randomly connect to public Wi-Fi networks, don't click unexpected links (or attachments) delivered to you via texts or email messages, encrypt your data, keep your operating system and apps up to date, and consider installing a security app like Lookout. That happens to be the app that I use.

Other tips:
- FCC Smartphone Security Checker
- Smartphone Security (by Kaspersky)
- 8 common sense tips to keep your smartphone secure (by Verizon)

Now is the time to uninstall QuickTime from Windows

Apple QuickTime is a media player that can be downloaded and installed for free on your Windows computer, not unlike Windows Media Player.

Last week, Apple ended support for QuickTime on Windows due to critical security flaws. Apple will no longer support or provide security updates for this software and recommends that it be removed. I have uninstalled it from my computer, and you should too.

For more information, see US-CERT for more information at https://www.us-cert.gov/ncas/alerts/TA16-105A, or read the TrendMicro article at http://www.zdnet.com/article/apple-deprecates-quicktime-for-windows-with-two-security-holes-unpatched-trend-micro/.

Instructions for removing QuickTime for Windows can be found on the Apple Uninstall QuickTime page.

Do it today!