Jessica Simpson: Making Money Without

Social Networks

According to Cisco, criminals are targeting social network users more aggressively. In particular, criminals are spending more time and effort trying to steal users' social networking credentials, since that makes it possible to exploit the trust of all that users' friends.

Although the exploitation of trust is crucial, Cisco predicts a decline in simple phishing and social networking scams. The company expects instead a rise exploits similar to the Zeus trojan, which steals banking credentials and propagates on social networks, mobile devices and more.

Social Engineering

Cisco warns of the "seven deadly weaknesses" exploited by social engineers:

Sex Appeal

Greed

Vanity

Trust

Sloth

Compassion

Urgency

Even the most savvy users can fall prey to social engineering. For example, Thomas Ryan of Provide Security created fake identity called "Robin Sage." Ryan was able to get hundreds of government officials and security professionals to friend this imaginary person on social networking sites and, as a result, share personal information with Ryan.

According to the report:

Clickthrough rates for most malware or spam incidents consistently hover at around 3 percent, according to data from Cisco ScanSafe. While 3 percent may not seem high, imagine the impact of repeated waves of spam to which 3 percent of workers consistently respond to and click on. Even this small percentage is the equivalent of having a gaping hole in the network firewall that cannot be closed. Instead of trying to change human behavior, security researchers are exploring the possibility of changing the way we use software to reduce risks.

Java: The New Number One Target

Java and PDF are both frequently exploited, but according to Cisco Java exploits rose last year and PDF exploits fell. Java surpassed PDF as the most commonly exploited technology.

Cybercrime in the Post-PC Era

According to the report, Windows has been so prevalent and so easy to exploit that there was no need for criminals to try to exploit other systems. However, the proliferation of other devices and OSes along with improved security in Windows 7 has changed that.

However, this move is happening slowly. A report from Forrester on security in the post-PC era notes that mobile device OSes are inherently more secure than desktop OSes due to sandboxing. This means that even jailbroken iPhones and rooted Android phones will be harder to compromise than older Windows PCs. However, social engineers can prey on anyone, regardless of the device they are using.

The Cloud: Friend or Foe?

The report cites the cloud as having both benefits and drawbacks for security. The drawback is that data can be intercepted while traveling between a server and the devices that access it. The advantage is that having data stored off-device makes it hard to extract sensitive information from lost or stolen devices.

Money Mules

The report has an interesting section on "money mules." Once a criminal has stolen a victim's bank account information, they need a way to get the money into their own accounts without getting caught. Money mules are people who transfer money from a victim's bank account to a criminal. One way to do this is to transfer money into the mule's account, then have the mule wire it via Western Union to the criminals overseas. The recipient of the wire from Western Union might not have to provide bank account information to receive the money, making them more difficult to trace.

Some mules are low-level criminals who participate for the money. Others are duped by work at home job ads. Students and people with large debts are often targets.

However, there's a shortage of mules. "Currently, the ratio of stolen account credentials to available mule capacity could be as high as 10,000 to 1," says the report.

Winners of the Cybercrime Showcase

Cisco highlights two winners in this year's "Cybercrime Showcase" - a "good" winner and an "evil" winner.

The Good winner is Thorsten Holz of the security firm LastLine. Holz identified the top 30 servers that the botnet Pushdo/Cutwail used for sending spam. Holz got ISPs to shutdown those servers and, as a result, the rate of spam decreased from 350 billion messages per day to 300 billion per day.

The Evil winner is Stuxnet, which we've covered frequently.

What, No Malvertising?

Surprisingly, there is no discussion of malvertising in the report. You can read our post "What You Need to Know About Malvertising" for more about this threat.

This occurred on a panel at a meeting of the Mortgage Bankers Association, where Platt appeared with Georgetown Law Professor Adam Levitin, who has been critical of MERS. I corresponded with Levitin, and this was an accurate rendering of Platt’s remarks.

“My response was that’s nonsense,” Levitin wrote in an email. “No one, absolutely no one, is arguing that a valid security agreement should not be enforced. Instead, the issue is whether we should enforce invalid security interests or let parties that do not hold a security interest enforce someone else’s. I hardly think that denying parties that right will result in a change in the cost of credit. It might result in them changing law firms, however, to ones that didn’t screw up their securitization deals.”

MERS, an electronic database created and funded by the banks to avoid land recording fees at county offices, has been criticized on multiple fronts. First of all, they don’t track the information inputted in the database, leading to inaccuracies between what appears in MERS and what appears on the note. Second, they stand in as the mortgagee and sell Vice Presidencies in their company when servicers attempt to foreclose, at the same time saying they have no financial interest in the loan. Third, banks using MERS failed to convey mortgages and notes properly, instead using this unregulated private system, and have broken chain of title in many circumstances, voiding their right to foreclose or even collect payments from a borrower.

Platt clearly wants to threaten the political system here. He’s saying that mortgage interest rates will skyrocket and constituents will become angered if the banks aren’t allowed to do what they want. That aims at a political settlement that stops the courts from making findings of the banks’ wrongdoing under the law. “If we want to have a well functioning credit system, we need to enforce security interests when they are done in compliance with the law, and not enforce them when they fail to comply,” Levitin wrote. “This is fundamental commercial law—you screw up on dotting the I’s and crossing the T’s in a security interest and you’re SOL. Everyone knows the rules of the game going in and there’s no reason to bailout sophisticated parties who failed to comply with the law.”

The notion that MERS saves the banks so much money that they can offer loans at multiple percentage points less than what they’d have to without it is extremely puzzling. “I don’t know of anyone who has argued that MERS lowered interest rates,” Levitin wrote. He estimated that the banks saved “maybe $50 per loan” using MERS, which certainly makes it worthwhile from their perspective, given the millions of loans on the system, but which makes the claim of massive savings to interest rates just foolish. “Of course, even if MERS lowers interest rates, we have to ask at what cost, and a screwed up title system is a pretty high cost for saving a few bps (basis points),” Levitin concluded.

Looking at this chart of mortgage rates from before and after MERS came into existence in 1995, you can see no evidentiary basis for the claim that MERS lowered interest rates; the mortgage lending rate basically tracks the prime interest rate.

At the root, this is a scare tactic. The banks don’t want to change their systems, and they certainly don’t want them found illegal. So they trot out corporate lawyers to make baseless charges that will be taken in Washington as conventional wisdom. And the politicians will scramble to make sure the inaccurate consequences never take place.

bench craft company reviews bench craft company reviews

Monday, January 24, 2011

Making Money Without