jaredrobinson.com

Netcraft: Phishing Attacks Continue to Grow in Sophistication
http://tinyurl.com/vwmvw

“The Year in PhishingPhishing attacks are continually evolving, as
fraudsters develop new strategies and quickly refine them in an effort to
stay a step ahead of banking customers and the security community. Here
are some of the phishing trends and innovations we noted in 2006”

• Plug and Play Phishing Networks
• Phlashing (Flash-based phishing sites)
• Two-factor Authentication: A July attack on Citibank demonstrated a technique that was able to defeat two-factor authentication tactics using a man-in-the-middle attack.
• Hacked Bank Sites
• Continued XSS (cross-site-scripting) Vulnerabilities
• MySpace Phishing

Read the article for more details. Is safe to do online banking? I know people
who say “no”. If someone hacks into your bank account and commits fraud, who
bears the burden of proof? You or the bank? Probably you. Who limits your
liability? Not the bank. Credit card companies limit customer liability to a
reasonable minimum, but with online banking, there is no such protection. If
you physically visit a bank office and
fraud happens, at least there are
records of who did what (video camera recordings, records of which bank teller
was helping with the transaction, etc.) With online banking, most of those
audit records don’t exist.

For my job, I write corporate employee monitoring software. Some people see it as Big Brother software, and it could certainly be abused in the wrong hands. I believe that technology itself isn’t good or evil; instead it is subject to ethical and unethical use by individuals.

There are many aspects of security. One of them is auditing, the purpose of which is to verify the trust we have placed in an individual. It’s a way of managing risk. The people in whom we place the most trust can do the most damage to us and to our organization. In many cases, we have no choice but to trust. To be distrustful of everyone and everything would be unproductive. I’ve heard the saying “Trust, but verify”, and that’s where our software comes in, because it allows companies to verify the trust they place in their employees — to pinpoint and mitigate risk.

Our software is a great solution in the corporate environment, but it’s not designed nor priced for home and small business use. In particular, I wondered what solutions exist for parents who want to reduce risk to their children who use the internet. I’ll get to that in a moment, because I believe that technology alone will never be a complete solution.

First and foremost, I believe we must teach our children correct principles of safety and responsibility. Teach them what is expected of them when they go online, and what dangers to avoid.

Second, place the computer in a public, high-traffic area in the home.

Third, talk to children about what they do online.

Fourth, since it’s not always possible to be at home monitoring what they do, consider using child monitoring software. As I understand it, it’s legal to monitor children under the age of 18 without their consent.

Fifth, review what the monitoring software collects.

The most complete website I’ve found about child monitoring software is www.1-spy-software.net.
The most mature and industry recognized solution, as far as I could tell from my google research, is Spectorsoft, which is available for Windows and Mac OS X computers.

I haven’t used child monitoring software (my children are too young to use the Internet), so I can’t vouch for its quality, its ease of use, or its effectiveness. What would I look for in a home solution?

1. Trustworthy.
2. Widely recognized and mature. Easy to use.
3. Doesn’t transfer collected information to a remote server.
4. Available from a local retail store.
5. Cost effective.

For my first computer job, I did half tech support and half programming at Brigham Young University. I enjoyed helping people because they were appreciative when I could solve their computer problems.

It was interesting that about a third of the time, all I had to do was walk into the office of the professor that was having a computer problem, and the problem would be solved. I didn’t have to do anything. It was like magic. The same scenario occurred for the other tech support guys.

That was in 1992, and I had forgotten about that magical aspect of computer support. Last night, however, I was reminded when I went to a neighbor’s house to help with a printer that wouldn’t print. I didn’t expect to find an iMac. It seems like most people have Windows computers. Here was an exception. The first task was to power it on. Where was the power button? I felt foolish that I couldn’t find it. Although I programmed in 4D and Foxpro for four years on a Mac, the experience with legacy systems didn’t help me with today’s hardware. I searched for the power button on the keyboard, on the monitor, and on the base of the iMac. Somehow, I missed the nearly invisible power button located near the back of the base. Fortunately, the 10 year old son showed up and powered it on. He also turn on the printer. I had him print a test page, and it worked. The 10 year old was shocked. It hadn’t worked before. He had tried fiddling with USB cables, etc., but to no avail. Once I showed up, it worked, magically.

Now I hope it continues to work.