CAUCE

Are You Donating to a Real Charity?

Please share this post.

After a tragedy, many of us want to donate to funds and charities to show our support for a community.

However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains created in the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, probably all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims?

Check out Charity Navigator, an online database that assesses charities based upon revenues, operating costs, and the percentage of funds that make it to the intended recipients.

Donate to the Red Cross / Red Crescent / Magen David Adom. The International Red Cross is a stalwart organization that is reliable, and extremely well-run. The Red Cross of America has a fund for the families and survivors of the Sandy Hook shootings.

News site CNN usually will make mention of an appropriate charity. They report that the United Way of Western Connecticut have set up a Sandy Hook School Support Fund at https://newtown.uwwesternct.org/

If you encounter what you believe to be a scam charity, report them to your local police, federal government or police force, and to the Internet Crime Complaint Center

TEN STEPS : What To Do if Your Data is Being Held for Ransom

 

We have your data. Fork over the money!

 

For the past few months, so-called 'Ransomware' has been very popular among online criminal gangs. A computer is infected with malware which encrypts some or all of the data on the computer, and the criminals demand a payment to restore the machine to normal.

This ofen comes with a fake warning from the national law enforcement agency of the location of the computer, such as the FBI in the US, and geo-locates the payment to dollars or Euros as appropriate. Sometimes the warning claims pirated content or illegal pornography has been found on your machine. While we don't know what you have been downloading, we can say this: Law enforcement won't infect your computer and demand ransoms.

It can happen to anyone: the Miami Family Medical Centre, in the Gold Coast of Australia has reportedly lost patients' medical records to this scheme.

So, what to do, and how to avoid being held to ransom for your favorite grandkid's pictures, your PhD dissertation, or that quarterly report you've been working on for weeks?

1. Do not try to remove the malware yourself. Some variants have trip-wires built in that erase your data permanently if you do the wrong thing.

2. Back up your files religiously.

By religiously we mean constantly, at least several times a day. You can do this automatically with many back-up programs like Apple's Time Machine that back up changed files every hour, and then all files once a day.

3. Use Cloud Services for important data - keep stuff you can't live without somewhere else, like a central server if your organization has one, or box.com, dropbox.com, Google drive, etc.

4. Keep your software and operating system up to date every day! Use Windows Update set to automatically install updates, and Secunia, to alert you to updates to your other applications, if you are a PC user. Apple machines also have automatic checks for software and OS updates.

5. Run anti-virus software. Yes, even if you have an Apple computer! While A/V software can miss some viruses, it generally catches up pretty quickly and is your first line of defense.

6. Install the MyWOT plugin onto all of your browsers. My WOT blocks access to malicious sites.

7. If you are infected, and have anti-virus software that failed to detect the malware - wait if you can. As variations of the malware come out, so too do updates to anti-virus programs - see if you can update your a/v software, as it may be able to decrypt the stolen data.

8. If you have backups, or your data is stored on a cloud service, have an expert help wipe your machine completely clean, reinsstall your operating system and software, and then restore your data from a backup version prior to the infection.

9. If you are really stuck - as a last resort, pay the ransom. Paying the ramsom reportedly works in some cases. But try everything else first, because it may just tell the criminals that you're a live one, so they can come back for more.

While we don't encourage people to give money to criminals, if the data is irreplacable, you may have to give this a try if all else fails.Then start making backups. If you need to buy a backup disk, do so, now that you know what a good investment it is.

10. Don't respond to spam. Never click on it - delete it immediately

How to Prevent (and mitigate) Data Breaches

Cisco's Michael Sanchez published a great piece called 5 Steps for avoiding data breaches.

We tweeted, plussed, and re-posted this elsewhere, and at the encouragement of SURBL's Jeff Chan, here's a blog post about this practical advice. (Do read the article in its entirety)

Step 1: Document where your data is stored and how it is accessed.
Step 2: Identify the level of protection your data needs.
Step 3: Secure your company’s data.
Step 4: Create a disaster recovery plan.
Step 5: Know what to do if you experience a data breach.

Since we are talking about data breaches, it should be noted that Canada is now considering a bill, C-12, 'An Act to amend the Personal Information Protection and Electronic Documents Act' that provides for mandatory notification of breaches.

C-12 is the re-tabling of bill C-29, a bill that died on the order table last year; it is a companion to C-28, Canada's Anti-spam Law; it also has provisions to allow Canadian law enforcement to share data and evidence with agencies outside of Canada, and even among themselves, something that is currently illegal under PIPEDA.

CAUCE supported C-29, and of course supports the passage of C-12. Given the Conservative majority, it is expected that C-12 will pass this legislative session.

Facebook has stolen all the contents of mobile address books, including private telephone numbers

As you know, Facebook have a long, storied history, including several ongoing brushes with the Privacy Commissioner of Canada, and despite repeat warnings against abuse of end-user rights, they recently deployed facial recognition software with no notice given their 500,000,000 users.

Today, however was the straw that broke the camel's back. Unbeknowst to me, perhaps by way of their new 'Facebook messanger' [update: actually, by way of Facebook's iPhone app.] they have uploaded the address books of hundreds of millions of users' mobile phones.

I found the home, private, business and mobile telephone numbers of 700 friends, colleagues, co-workers, and associates (Facebook users or not) published on their site [update: on my account only - at least, for the moment, but nonetheless up on Facebook] - I never agreed to this, I never knew about this, and it was only by way of the Sophos blog post below that I discovered this.

To check to see if you have had the same unfortunate thing happened to you:

1. Log into Facebook
2. Click on Account (upper RH corner)
3. Click 'edit friends'
4. Click 'contacts' (LH side)

(There is the option to disable this feature. Turn OFF synching on your mobile phone, then go here)

update: CAUCE Director Matt Sergeant had this to say on his blog - he nails exactly what is wrong with this:

Addressing the latest Facebook privacy issue

(This is a non-work post, but Disclaimer: I work for Symantec and regularly talk publicly about security issues)

There’s been lots of talk today online about the latest Facebook privacy debacle whereby they have all your cell phone contacts listed on your “Contacts” page.

Facebook have been trying to quiet the storm, as people are posting to their status updates for people to disable this.

First, to combat some FUD: Facebook is not sharing this information from you with your friends. Your buddies aren’t going to be able to call up your Grandma.

But what Facebook have entirely ignored, and why this is again an issue, is the question of permission.

I have two phones. One is a work phone (BlackBerry), and one is my personal iPhone. The only phone the contacts I had listed on Facebook came from is my BlackBerry, which is good, because I have a lot of random old numbers in my iPhone (don’t ask!).

So what happened here? I believe that the latest BlackBerry Facebook app (which recently underwent a major upgrade) automatically set the preference to sync contacts with Facebook. Now it may very well have been in the multi-page user agreement that I accepted, but yes I admit, I don’t read those things. And those agreements don’t even appear on the iPhone version, because, and here’s the fundamental difference I guess: the iPhone version doesn’t transparently change your preferences.

Facebook needs to stop that. I don’t care if it’s useful, or if you’re not sharing it with anyone else. I don’t want you uploading my contacts to your servers without ASKING me first.

It’s that simple. And this is why there are laws against what they have done in various countries, and why this will probably result in yet another lawsuit against them.

Rant over.

CAUCE are stunned by this move, it is beyond the ken. We will be calling upon Facebook to remove this facility immediately (it should always bo opt-in by default, as should ALL end-user options) and failing that, filing complaints with the proper authorities.

See more: http://nakedsecurity.sophos.com/2011/08/11/has-facebook-got-your-mobile-number-now-your-friends-do-too

--
Neil Schwartzman
Executive Director
CAUCE : The Coalition Against Unsolicited Commercial Email

CRTC Publishes Regulations, another step towards CASL coming into Force

Happy Canada Day from the CRTC

As anticipated, the CRTC took a long-awaited step towards Canada's Anti-spam Law coming into force; regulations designed to help define the scope and impact of the law were published late afternoon, June 30. They are available in their full form here: http://www.crtc.gc.ca/eng/archive/2011/2011-400.htm

They are quite terse, coming in at less than 440 words. CAUCE will comment here in due course, but for your instant gratification, here they are:

The proposed regulations prescribe the form and certain information to be included in a CEM. They establish that a CEM must set out information that identifies the sender of the message and, if different, the person on whose behalf the message is sent, as well as, if applicable, the names of those persons’ businesses. The CEM is also to include information that would enable the recipient to readily contact such persons. Further, the proposed regulations prescribe that this information, as well as the unsubscribe mechanism, be set out clearly and prominently.

The proposed regulations also specify a particular form by which information relating to the sender of the message and the unsubscribe mechanism may be accessed, in circumstances where it is not practicable to include such information in a CEM, for instance, because of character limitations.

Section 6 of the Act prohibits the sending of a CEM unless there is express or implied consent from the recipient of that message. Section 7 of the Act prohibits, absent express consent, the alteration of transmission data in an electronic message which results in the message being delivered to a different destination. Section 8 of the Act prohibits the installation of a computer program unless express consent has been obtained. The Commission’s proposed regulations prescribe the form of a request for express consent for the purposes of subsections 10(1) and 10(3) of the Act. More specifically, the proposed regulations stipulate that any request for express consent must clearly identify the person seeking consent and, if different, the person on whose behalf consent is sought, and, if applicable, the names of those persons’ businesses. In addition, it is proposed that contact information be included for such persons, and further, that there be a requirement to include a statement which states that consent may be withdrawn using the contact information provided.

The focus of the final segment of the proposed regulations is the installation of computer programs in the course of a commercial activity, which, as noted above, is addressed in section 8 of the Act. The proposed provisions prescribe that additional information be provided when requesting express consent if a computer program that performs a function set out in subsection 10(5) of the Act is to be installed. In such circumstances, the proposed regulations prescribe the manner in which the computer program’s material elements must be brought to the attention of the person from whom consent is being sought, and further establish that the person seeking consent must obtain a written acknowledgement from the person from whom consent is sought that they understand and agree that the program performs the specified functions.

Best Buy and Air Miles notify Alberta, Canada Privacy Commissioner of Epsilon Data Breach

The Office of Information and Privacy Commissioner for the province of Alberta issued a decision [PDF] on May 16, regarding the Epsilon breach that affected the customer lists of 150 different companies, including Best Buy and Air Miles. Both companies operate in Canada.

The Personal Information Protection Act, which went into force May 01, 2010, compels companies to notify their customers in the event of a breach. Both companies did so.

Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.

Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.

CAUCE congratulates both Best Buy and Air Miles, as well as Information and Privacy Commissioner of Alberta, Frank Work on their actions in this regard.

As always, our advice to consumers remains the same: If you received a notices from any company regarding the Epsilon breach, we suggest you change your email address immediately.

Osama bin Laden is Still Alive!

Actually, no, he isn't.

End-users should be extremely careful clicking on any link, from both know and unknow sources (including this one) offering to show you gruesome pictures, proof of him being alive and so on. Spammers have followed their precitable pattern of launching massive campaigns capitalizing on bin Laden's death by email and on social networking sites like Facebook to get you to click through, and potentially infect your computer in the process.

Be careful, don't be fooled.

 

Continued Data Leaks: The Game is Rigged

Earlier this week, gigantic technology company Sony admitted that "an illegal and unauthorized person" had accessed their database of 77,000,000 PlayStation Network users, obtaining names, addresses, gaming profiles, and possibly credit card numbers.  Their response upon discovering the breach was decidedly old-school: they turned everything off while investigating.

If the ESP breaches we've been reporting are Godzilla, Gamera, and other residents of Monster Island, then the PlayStation breach is the larger and more powerful MechaGodzilla.  If the ESP breaches are planets in the solar system, the PlayStation breach is Jupiter — and the New York Yankees' mistaken exposure of 20,000 ticketholders is poor, downgraded Pluto.

As if size alone wasn't enough, the PlayStation breach may require an even more radical response from the victims whose information was stolen.  As The Globe and Mail explained yesterday afternoon, you should start by changing your password — especially if you've used that same password anywhere else.  But since Sony admits that credit card numbers might have been stolen too, you'll need to call your bank and get a new card with a new number — which some banks charge for.  You'll also need to change all the billing info associated with the old card number.  Oh, and if you don't want game-related spam and phishing attacks, you'll need to change your email address too.

Inconvenient? Annoying? Absolutely. Unfair? No question. But when the big companies to whom you've entrusted your information can't keep it secure, you're stuck having to find ways to stay safe on your own.

To be sure, the companies whose data was stolen (these, Sony, and more) are victims too — but they're all big enough to weather the storm.  How about you?

Emailvision France hit by the ESP Gang

There's not too much to say about this, except it is Thursday, so it must be Emailviion's turn in the barrel, they are leaking Adobe spam. No word yet as to whose list this is.

a spample can be found here

CAUCE President John Levine blogs about Emailvision's response to his alerting them to the breach.

 

Oh, Poo! Diapers.com & Optivo GmbH the latest victim of the ESP Adobe Gang

Diapers.com is the latest in a long series of ESP breaches by way of optivo.de. Optivo were alerted to this breach on April 14.

UPDATE: While Responsys is the current ESP of record for Diapers.com according to their website (and have been since 11/2009, according to company officials); this may indicate the tagged address was taken from Responsys, another ESP (some companies use more than one ESP), their previous ESP Silverpop, or from diapers.com directly.

Thanks to REDACTED for the report.

Delivered-To: REDACTED
Received: by 10.229.107.19 with SMTP id z19cs52292qco;
        Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Received: by 10.204.74.167 with SMTP id u39mr326019bkj.144.1302670065088;
        Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Return-Path: <return@demo.srv2.de>
Received: from mail17-54.srv2.de (mail17-54.srv2.de [193.169.180.54])
        by mx.google.com with ESMTP id c1si470386bky.10.2011.04.12.21.47.44;
        Tue, 12 Apr 2011 21:47:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of return@demo.srv2.de designates 193.169.180.54 as permitted sender) client-ip=193.169.180.54;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of return@demo.srv2.de designates 193.169.180.54 as permitted sender) smtp.mail=return@demo.srv2.de; dkim=pass header.i=Adobe@demo.srv2.de
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mailing; d=demo.srv2.de;
 h=Message-ID:Date:From:Reply-To:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; i=Adobe@demo.srv2.de;
 bh=Ob9u6TxtQqwyE0MTiwnn5kGewhc=;
 b=YXkzQAJ1/oHetfZxTPgwT35YL3se7xFVZitbg/bQwO5O4gqMSsU89Q3Wo5oJVSRy2P9mH0M+wm62
   2G75INYa+RsiLp9qQ2rtCUyXYQ24v7CEEs1ggg06Pj5giRymB1uS+ySNfuDTkh2eYifyKg7F9lx/
   dlKHvahHPVa5U6m6+wY=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mailing; d=demo.srv2.de;
 b=deGmdf/mVGx8f7o9EcPDZl4uaoxzLXPDR9jc2ILr9g9IgkAY1urF8dnGE9ydx7hrXiMckon1o7NI
   mJdGspev4TuPwWvY1jNldcUX93xrqYAcMGr4v4VM4rGGvXmxPFM7VTaJjnjMy9++N6n8BvC/zQuO
   BngpUpwys6rmeOEyu68=;
Received: by mail17-54.srv2.de id hkklf20farcr for <REDACTED>; Wed, 13 Apr 2011 06:47:43 +0200 (envelope-from <return@demo.srv2.de>)
Message-ID: <re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHI4W55-1UZ8D6Y-UUQ14MG@demo.srv2.de>
Date: Wed, 13 Apr 2011 06:47:43 +0200 (CEST)
From: Adobe Systerm Incorporated <Adobe@demo.srv2.de>
Reply-To: re-EHI4W55-1UZ8D6Y-13HAPU9@demo.srv2.de
To: REDACTED
Subject: =?ISO-8859-1?Q?Adobe_Acrobat_Reader_10x_:_all_?= =?ISO-8859-1?Q?new,_all_powerful_!_Upgrade_Now=3F?=
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-ulpe: re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHI4W55-1UZ8D6Y-UUQ14MG@demo.srv2.de

GETTING MORE DONE AT WORK NOW COMES IN A CONVENIENT BOX

See how Adobe Acrobat Reader is a step above anything you've experienced before, so you can be even more productive.

Upgrade Adobe Acrobat Reader

Just how much faster can you work with Adobe Acrobat PDF Reader
software? Fast enough to stay on top of last-minute changes, connect
with key decision makers, and share updates with co-workers.

You'll discover how easy it is to reuse content by exporting PDF files
to Microsoft Word or Excel formats. And how quickly you can automate
multi-step tasks with new, guided Actions. No wonder PC Magazine
says, "There's a lot to like in Acrobat X PDF Reader."

Download Now To Try Us Out

Copyright 2011 Adobe Systems Incorporated. All rights reserved.

Adobe Systems Incorporated
343 Preston Street
Ottawa, ON K1S 1N4
Canada  

*************

Delivered-To: REDACTED
Received: by 10.229.107.19 with SMTP id z19cs53998qco;
        Tue, 12 Apr 2011 22:29:46 -0700 (PDT)
Received: by 10.223.27.14 with SMTP id g14mr73129fac.129.1302672585540;
        Tue, 12 Apr 2011 22:29:45 -0700 (PDT)
Return-Path: <return@demo.srv2.de>
Received: from mail17-45.srv2.de
 
 (mail17-45.srv2.de
 
 [193.169.180.45])
        by mx.google.com with ESMTP id l25si86220fah.191.2011.04.12.22.29.45;
        Tue, 12 Apr 2011 22:29:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of return@demo.srv2.de designates 193.169.180.45 as permitted sender) client-ip=193.169.180.45;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of return@demo.srv2.de designates 193.169.180.45 as permitted sender) smtp.mail=return@demo.srv2.de; dkim=pass header.i=Skype@demo.srv2.de
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mailing; d=demo.srv2.de
 
;
 h=Message-ID:Date:From:Reply-To:To:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding; i=Skype@demo.srv2.de;
 bh=lF+2G6Rq1lrcc66z2TQZb33J6eQ=;
 b=GadElK40VNPm/e12VYpQLZai3O/5IRkfLTDOu6tYSuTaFGs27w76Azhu3SIgU5H4ixgP8O5BeN34
   9qn/8S1djO0khRgjeyISbKWddAOzOFYIsgBO6HIFgeqhfPBXlSd4030HF5WHTiIhuHEUr1aNhv9L
   UpL8c6x64PGnrvNU5Ow=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mailing; d=demo.srv2.de
 
;
 b=eEKJOR6eX0npHpBOmJPiHfkopOggjkq13StcWwuWK7LoNebJha4z8OXbFCKN2TxFKh/HaF5wlppd
   zyzYzoevuAgWJPNmpabtyOk6om7JJn1/moYlEERevNE2IA917NV2R9kDFEB7nfmcopy28XA5FSEr
   Bb1dZ6jQEr/hvgud7mQ=;
Received: by mail17-45.srv2.de
 
 id hkkqci0farc7 for <REDACTED>; Wed, 13 Apr 2011 07:29:44 +0200 (envelope-from <return@demo.srv2.de>)
Message-ID: <re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHPDGH2-1UZ8D7F-8KIZFU@demo.srv2.de>
Date: Wed, 13 Apr 2011 07:29:44 +0200 (CEST)
From: Skype Support <Skype@demo.srv2.de>
Reply-To: re-EHPDGH2-1UZ8D7F-BX918B1@demo.srv2.de
To: REDACTED
Subject: Download New VOIP Addons For More Skype Free Talks
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-ulpe: re-pOaX3BUQnds72BhAcj4J1wrgwTrlqCM5OetY-EHPDGH2-1UZ8D7F-8KIZFU@demo.srv2.de

SKYPE VoIP ADDONS UPDATES

This is to notify that new updates have been released for Skype
 
. Following are major new features:
 
- Talk more for free via Voice Over IP (VoIP).
- Lower cost when connecting to landlines (much cheaper than Calling Card).
- Record your conversation (better than telephone quality).
- Instant messaging& file-sharing, video calls.
- Now available on PSP !
 
To check and upgrade, go to Skype Updates Center
 
 
Skype has changed the way we think of telecommunications.
 
Thank you for choosing us.
 
With best regards,
 
Skype Support