Blog

It has come to our attention recently that a website is giving out instructions on how to use a low tech social engineering trick to view private Facebook profiles. To view the instructions, a third-party application must be first downloaded and installed. While this application is not malware, it may impact computer performance. The instructions then describe how to view private Facebook profiles, with the result being that a Facebook user may receive a friend request from a person that is already on their friend list. ...

We recently alerted our readers to spam campaigns using the H1N1 vaccination program to prompt recipients to open the mail. And we have frequently mentioned that crooks love to take advantage of news, disasters, and other events. Now that the final draw for the FIFA World Cup in South Africa next year has taken place, it is time to remind you that sports events are no exception to the rule. I’ve already found some examples. The first is a fake lottery. In this case, the source claims the recipient has won a large sum of money from the South African Football Association. After contacting the lottery manager, the victim of the scam will be asked to pay “processing fees” or “transfer charges” so that the winnings can be distributed. Don’t expect to ever see a payment. ...

It’s the second Tuesday of the month and there are important updates being released. From Microsoft, of course, but also from Adobe. There’s a critical security issue in Adobe Flash Player 10.0.32.18 and earlier. It’s important that organizations deploy these updates before the Christmas holiday reduces IT staffing. Fortunately, this patch cycle is as early as can be landing on the 8th so there’s still time to test and deploy. ...

Sunbelt analyst Adam Thomas came across this ugly new social engineering technique when he analyzed the DefenceLab rogue security product. It does the usual scare-ware stuff: a fake scan and fake “Windows Security Center” alert: Then it directs the potential victim to a Microsoft Support page, but injects html code into the page in his or her browser to make it appear as though Microsoft is suggesting the purchase of the rogue. This is the real Microsoft page: ...

Conficker (also known as Downadup) has dominated security headlines for months. Today — April 1, 2009 — media coverage peaks because variant Conficker.C is programmed to check a larger set of domain names for update instructions. The worm has not melted the internet overnight, but the attention is useful if it pushes lagging patches out the door. Defense is mostly discipline, not mystery. How It Spreads Conficker exploits failures administrators have warned about for years: ...

Matisyahu (born Matthew Paul Miller, June 30, 1979) is an American reggae musician. Known for blending traditional Jewish themes with Reggae, rock and hip hop sounds, Matisyahu is most recognizable for his single “King Without a Crown”, which was a surprise Top 40 hit, and for being an orthodox Jew. Since 2004, he has released two studio albums as well as one live album, two remix CDs and one DVD featuring a live concert, and a number of interviews. Through his short career, Matisyahu has teamed up with some of the biggest names in reggae production including Bill Laswell and duo Sly & Robbie. ...

It’s not possible to emphasise enough the importance of using sensible passwords on your network. Not just on the areas of your network that you don’t want your users to traipse through, but also on the default network shares that are present on installations of commonly used operating systems. The Windows versions Conficker targeted — NT, 2000, XP, and 2003 — are all end of life and no longer receive security updates. The lesson still applies to any machine with open shares today. ...

Treat passwords with as much care as the information they protect. For how to make them strong — and why a manager should generate them — see Passwords. These tips are about keeping secrets secret day to day. 1. Never provide your password over e-mail Phishing messages pretend to be a bank, a shop, or a social network and ask you to “confirm” your login. Legitimate services do not need your password by email. Learn how to spot phishing. ...

Communicating by using an instant messaging (IM) program has some of the same security and privacy risks as e-mail, but there are a few dangers that are unique to IM. The original 2009 version of this guide was written for desktop IM clients like AIM and MSN Messenger. The same principles apply to modern apps — WhatsApp, Telegram, Signal, Discord, Slack, and iMessage. 1. Never open files or links from strangers Never open pictures, download files, or click links in messages from people you don’t know. If they come from someone you do know, confirm with the sender that the message (and its attachments) is trustworthy. If it’s not, close the conversation. ...

Social networking Web sites like Facebook, Instagram, X (Twitter), LinkedIn, TikTok, and Threads are services people can use to connect with others to share information like photos, videos, and personal messages. As the popularity of these social sites grows, so do the risks of using them. Hackers, spammers, virus writers, identity thieves, and other criminals follow the traffic. Read these tips to help protect yourself when you use social networks. ...

TFC (Temp File Cleaner) was a small utility that cleared out temp folders for all user accounts — temp, browser caches, Java, and system temp directories — across every profile on a Windows machine. It showed the amount removed for each location and required a reboot afterward. The original 2009 version of this page recommended TFC for routine maintenance. TFC is no longer maintained and is not suitable for Windows 8.1, 10, or 11. On modern systems it can destabilize things by force-stopping Explorer and other running apps. ...

Strong passwords still matter, but the way we handle them has changed since this post first ran in 2009. The default today is simple: let a password manager create a unique random password for every site, turn on two-factor authentication (2FA) wherever it is offered, and use a passkey when a service supports one. What actually makes a password strong Attackers guess and crack passwords with dictionaries, leaked lists, and raw computing power. Strength comes from: ...

Three basic types of firewalls are available for you to choose from: Software firewalls (built into your OS) Hardware routers Wireless routers To determine which type of firewall is best for you, answer these questions: How many computers will use the firewall? What operating system do you use? (Windows, macOS, or Linux.) That’s it. You are now ready to think about what type of firewall you want to use. There are several options, each with its own pros and cons. ...

Three steps to keep Windows fast, stable, and secure. The original 2009 version of this guide recommended FileHippo Update Checker (later renamed AppManager) and the Secunia Online Scanner. Both are gone — FileHippo retired its updater, and Secunia’s consumer tools shut down years ago. Here is what still works. 1. Patch Windows and Microsoft products Turn on automatic updates and verify nothing is pending. Reboot when prompted — pending restarts leave patches half-applied. ...

The original 2009 version of this checklist recommended Symantec Brightmail and the Symantec State of Spam site. Brightmail is now part of Broadcom’s enterprise portfolio and is not a practical choice for home users. The do/don’t advice below is still sound. Do Unsubscribe from legitimate mailings that you no longer want to receive. When signing up to receive mail, verify what additional items you are opting into at the same time. De-select items you do not want to receive. Be selective about the Web sites where you register your email address. Avoid publishing your email address on the Internet. Consider alternate options — for example, use a separate address when signing up for mailing lists, get multiple addresses for multiple purposes, or look into disposable address services. Using directions provided by your mail administrators, report missed spam if you have an option to do so. Delete all spam. Avoid clicking on suspicious links in email or IM messages as these may be links to spoofed websites. We suggest typing web addresses directly in to the browser rather than relying upon links within your messages. Always be sure that your operating system is up-to-date with the latest updates, and employ a comprehensive security suite. For organizations, use a reputable e-mail security gateway (Microsoft Defender for Office 365, Google Workspace spam filtering, or a dedicated provider such as Proofpoint or Mimecast) to filter spam before it reaches inboxes. Keep up to date on recent spam trends — the Anti-Phishing Working Group publishes quarterly reports on phishing and spam activity. Do not Open unknown email attachments. These attachments could infect your computer. Reply to spam. Typically the sender’s email address is forged, and replying may only result in more spam. Fill out forms in messages that ask for personal or financial information or passwords. A reputable company is unlikely to ask for your personal details via email. When in doubt, contact the company in question via an independent, trusted mechanism, such as a verified telephone number, or a known Internet address that you type into a new browser window (do not click or cut and paste from a link in the message). Buy products or services from spam messages. Open spam messages. Forward any virus warnings that you receive through email. These are often hoaxes.