Don't Believe the Scams, the Facebook Timeline is Here to Stay

I’m not going to lie; I’m not a fan of Facebook’s new Timeline layout.

Sure, it may have been fun at first.

You know, going through Facebook posts from years ago, repeatedly changing the cover image until you could finally settle with one you liked and, of course, removing anything from your Timeline that you didn’t want others to see.

However, I quickly realized that it took forever to load posts from a specific month (like when you’re scrolling down the page), the option kept switching from my selection of ‘All Stories’ to ‘Highlights’ (making it hard to play clean up and just driving me bonkers in general) and the new look just refused to get along with Google Chrome.

On top of that, I soon found myself getting tired of having to look back and forth in order to read updates in order. What was so wrong with listing everything in a single column?!

As it turns out, I’m not the only one that feels this way.

In fact, some Facebook users have gone as far as creating pages just to voice how much they think the new Timeline sucks.

Unfortunately, scammers have also noticed how much of the public dislikes the new look and they’ve launched a variety of scams in order to take advantage of those of us who just want the old layout back.

For example, searching for ‘Deactivate Timeline’ on Facebook will bring up a variety of results, most of which appear to be scams designed to trick you into liking a bunch of useless pages whose sole purpose is to flood your News feed with useless garbage.

Take the “Deactivate Your FB Timeline” app for example.

The page claims that in order to get your layout to switch back, you have to click TWENTY-SEVEN (27)  “Like” buttons, share the app with your friends, provide your country, and then invite all of your online friends to join in on the “fun” via chat.

That seems like quite the odd set of requirements in order to deactivate a layout that was enabled with a single button click on the official Timeline page. (Assuming Facebook didn’t just force it on you.)

Perhaps the scammers are hoping the obnoxious amount of spam overwhelming your News feed will distract you from the fact that you hate the new Timeline?

Either way, we must all come to terms that unless the Facebook Team considers offering users 2 layout options (old layout & Timeline) or that they’re getting rid of the Timeline altogether (highly unlikely) that we’re stuck with the Timeline look and anyone that says otherwise is flat-out lying.

Don’t fall for any “remove the Facebook Timeline” tricks and warn your fellow Facebook friends about the scams lurking about.

Follow us on Twitter at @hyphenet or “Like” us on Facebook or add us to your circle on Google+ to stay up-to-date on the latest tech news and PC security alerts.

Fake LinkedIn Emails Link to Blackhole Exploit Sites Serving Malware

Do you have a LinkedIn account?

You may want to think twice about clicking links within any emails that claim you’ve received a new message on the social networking site geared towards professionals.

Cybercriminals have been busy pumping out spam emails that pose as legitimate LinkedIn notices, enticing you to click on a link in order to read what message some random stranger has left for you.

In reality, the links will send you directly to a site housing a blackhole exploit kit that will attempt to take advantage of any system vulnerabilities in order to infect your PC with malware. This sneaky form of attack – also known as a “drive-by-download” –   is especially dangerous due to the potential of the attack being executed without detection unless your PC and antivirus software is up-to-date.

Although the spammers did a good job crafting the bogus LinkedIn notices – LinkedIn logo at the top left, familiar blue coloring, no obvious spelling mistakes, disguised links and even a spoofed sender’s address – it’s pretty easy to spot the fake emails when you see them.

How can you tell the real from the fake? That’s easy.

The REAL emails include the subject and body of the message that was sent to you on LinkedIn. The FAKE emails only have a date and invitation to click on a link in order to read the message.

Here’s a comparison of the real email vs. the fake. Note that the crook has disguised the malicious URL to make it appear as if points to the LinkedIn website:








Always be sure to hover over links to check the real destination URL and feel free to investigate any suspicious looking URLs before actually clicking on them.

Have you received any questionable emails claiming to be from LinkedIn or LinkedIn users? Share your experience below!

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

New Ramnit Worm Variant (Successfully) Targeting Facebook Login Credentials

Security researchers at Seculert have discovered a new variant of the Ramnit worm that is targeting Facebook login credentials.

Since it was first spotted in April of 2010, Seculert has been monitoring the evolution of the Ramnit worm, which has been described as “a multi-component malware family which infects Windows executable as well as HTML files” in order to steal “sensitive information such as stored FTP credentials and browser cookies.”

Infact, Ramnit was so successful in infecting computers that Symantec’s July 2011 Intelligence Report [PDF] estimated that variants of the Ramnit worm accounted for a 17.3% of all new malicious software infections!

As if that didn’t make Ramnit scary enough, word hit in August of 2011 that malware authors had incorporated parts of the infamous Zeus malware into Ramnit, enabling the worm to “bypass two-factor authentication and transaction signing systems, gain remote access to financial institutions, compromise online banking sessions and penetrate several corporate networks.”

Using a sinkhole, Seculert discovered that Ramnit had managed to infect 800,000 machines between September – December 2011.

However, with the New Year comes a new target: Facebook login credentials.

Recently, our research lab identified a completely new 'financial' Ramnit variant aimed at stealing Facebook login credentials. Since the Ramnit Facebook C&C URL is visible and accessible it was fairly straightforward to detect that over 45,000 Facebook login credentials have been stolen worldwide, mostly from users in the United Kingdom and France.

But why would crooks go from stealing financial data to social networking logins?!

The answer is quite simple: to post malicious on Facebook links to help spread Ramnit and take advantage of the fact that folks have the tendency to use the same password across multiple websites!

It seems cybercriminals have taken notice to the fact that they can easily abuse Facebook’s viral sharing capabilities in order to spread malware - along with whatever other mayhem they choose to unleash.

It’s important that Facebook users – or computer users in general – protect themselves and their sensitive data by running antivirus software and do their best to avoid malicious links, files, and/or programs.

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

Rolling Back Time Can Expose Locked Photo Albums on iOS 5

Tech consultant and iPhone tinkerer Ade Barkah has discovered a flaw within iOS 5 photo album security that will reveal locked photo albums should the clock on your iPhone be rolled back.

With iOS 5, users can now access the Camera app on a locked phone simply by double-clicking the home button. However, since the phone is still “locked”, you will only have access to whatever pictures you snap during your new session and you won’t be able to access any images stored within the pre-existing photo albums.

How does the iPhone know what images to show you? As Barkah explains, it

Turns out Apple’s restriction is just a simple filter based on the timestamp when the Camera app was invoked.

So in the event that your iPhone’s clock is rolled back, all of your “protected” images will be for all who double-click your “locked” phone’s home screen to see!

Of course, this brings up the immediate question on why anyone would roll the clock back on their phone – or how it could even be done.

After all, time always moves forward and waits for no one, right?

While that’s true, Barkah offers a few scenarios that could potentially result in time going backwards on your iPhone:

 

• It could be due to user error.  E.g., maybe while traveling across timezones you accidentally set the iPhone’s date or time incorrectly (rather than simply resetting the timezone).   If you set the clock ahead of what it’s supposed to be, then this vulnerability will appear when you reset to the correct time.  If you accidentally set the clock to the past, then your images will immediately become unprotected.


• It could be an iPhone glitch.  E.g., a software or hardware issue could reset your iPhone’s clock to epoch time — iPhone’s “zero” time at midnight January 1, 2001.  In this case all your images are exposed.


• It could be an infrastructure error.  E.g., if you automatically sync from an erroneous external time source (cell phone company, etc.)

For those who want to see it for themselves, Barkah states the vulnerability is easy to test. All you have to do is set your iPhone’s clock to a time in the past (like 2010 or 2011) and access the Camera app while your phone is still locked.

Although it’s unlikely that someone is that desperate to hijack your phone to roll the clock back just to rifle through your photo albums, it’s still something to keep in mind. This especially rings true considering iPhones tend to be popular with thieves and folks tend to take a lot of incriminating pictures with cellphones.

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

EFF Warns Against Upgrading to New AIM Due to Privacy Concerns

The Electronic Frontier Foundation is advising users to think twice about upgrading to the new version of AIM due to privacy concerns.

The build in question is the revamped version of AIM that AOL debuted back in November of 2011 that offers fresh features like message syncing and in-chat media embedding.

The EFF’s concerns stem from the fact that once users login using the new AIM, “a flag is permanently set on your account to begin storing all of your conversations on AOL’s servers for up to two months, and perhaps indefinitely.”

While this feature is meant to provide users with the convenience of having full-access to their chat history regardless of the device they’re using to login to their account, it also potentially leaves user’s chat history open to the eyes of a party that wasn’t included in the original conversation. For instance, law enforcement officers armed with a warrant or even hackers targeting AOL’s servers.

There is an off-the-record feature within the new AIM client, but it must be enabled on a per-contact basis and cannot be applied to any Group Chats. The ‘off-the-record’ feature doesn’t work for third-party chat clients like Pidgin or iChat either.

Another concern was the fact that the new AIM automatically scans messaged links in order to retrieve and embed any shared media, whether it’s an image or video.

While on-the-fly media embedding is fine for the most part, the problem lies in the fact that links are scanned regardless of their type or purpose and may point to private network resources, contain authentication data within the URL or even be single-use URLs like unsubscription links.

The EFF has voiced their concerns to AOL, who has agreed to make changes to the new AIM chat client – including updating marketing content to make it crystal clear to users what information is being scraped, shared and stored.

However, due to the fact that merely signing onto the new version of AIM permanently changes your account settings to store ALL chat conversations on AOL’s servers, the EFF strongly recommends that existing AIM users do NOT upgrade to the new version.

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

Facebook Scam Using the "World's Most Beautiful" Tushy to Drive Traffic to Ads

If by chance you login to Facebook and see one (or a couple) of your friends posting a video titled “Laura Frisian: the most beautiful ass in the world!” make sure that you don’t bother clicking on it.

Cybercriminals have launched yet another spam campaign in hopes of driving traffic to multiple sites that contain a host of advertisements.

Upon investigating the attack, Kaspersky Labs Expert David Jacoby found that it wasn’t that much different from the average Facebook scam.

Once you click the link, you’re taken to a webpage decorated with fake video player and plenty of ads.  If you’re logged into your Facebook account, the video player will demand that you share the page/video before watching it to ensure that the scam continues to survive by luring in your Facebook friends.

Jacoby noted that the crooks behind this scam are using multiple domains and redirects in order to dodge Facebook’s harmful URL blocking features. In addition to the Laura Frisian page, the crooks have another 300-something pages that also hope to collect Facebook likes and page shares via "must-see" videos.

Some of the other video titles used in the scam include:

• If you like Nutella, never look this video!!!


• Drill a tooth abscess! Disgusting :s


• Compilation of Embarrassing and Busted! Photos, Awesome :D


• Transgender 10-Year-Old, Boy Happier As A Girl !


• A Really Giant Baby ! Amazing it looks so real :D


• Air Race Plane Crashed in the crowd during a show !


• The worst thing that can happen to a girl!


• A fisherman catches a couple when they make ... :D

Users that stumble across suspicious videos that appear to be linked to this campaign are advised to report it as spam to help Facebook identify the offending domains.  Messages can easily be marked as spam by hovering your mouse over it and clicking on the 'x' on the right that appears.

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.

3 Ways to Investigate Suspicious URLs BEFORE Visiting Them

Every once in a while you will come across a website link that just doesn’t feel right.

The link may have been sent to you by a close friend; maybe it was embedded in an email you received this morning; or perhaps it was shared by a Twitter user whom you suspect is actually a spam bot.

Regardless of how it was received, you somehow find yourself sitting at your desk with your index finger hovering over the left-mouse button as you silently weigh the risks of following it in your head.

Instead of making a blind decision that could lead you straight to a phishing site or worse (like a drive-by-download), try investigating a link BEFORE you actually click on it.

Expand All Shortened URLs

It’s pretty much impossible to determine whether or not a link is dangerous if it’s been docked and cloaked by a URL shortening service, so the first thing you will want to do is figure out the destination of shortened URL.

Here are a few online websites that allow you to expand shortened URLs:

• Untiny


• LongURL


• Get real URL

Now that you have the actual destination URL, you’ll have a better idea of what you’re dealing with.

Still can’t decide whether or not it’s safe?

Run the Link Through a URL Scanner

There are a number of URL scanning tools out there; some require you download a browser plug-in while others are an online service that will scan the URL you provide. I’ve provided the URL scanners that do NOT require any type of download or installation:

• VirusTotal File and URL Scanner


• Symantec's Norton SafeWeb


• McAfee Site Advisor


• MyWOT


• AVG LinkScanner

It is important to note that although these online scanners are backed by a variety of highly-regarded & well-known antivirus engines, nothing it’s ever 100% guaranteed. However, it does add another layer of protection aside from your intuition and whatever antivirus software you have installed on your PC.

Google the URL

If a suspicious link you’ve ran through an online scanner passed with flying colors and yet you still can’t pull yourself to click on it, you could always try Googling it.

That way, if anyone has publicly called foul-play on a URL, you’ll find out about it. For instance, when we blow the whistle on survey scams circulating on Facebook, we often provide the offending URL to help people recognize the scam when they see it.

By completing background checks on links, you can greatly reduce your chances of visiting phishing sites, malware-serving pages, or any other website that you may not find suitable.

Happy web surfing!

Photo Credit: el_itur

Follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news and PC security alerts.