If you have XP and plan to upgrade to Vista and use PCC you need to do the following:
*Uninstall PCC on XP
*Install Vista
*Re-Install PCC from www.earthlink.net/software/pcc

Going forward PCC will no longer support Windows 2000. What this means is that if you're running PCC on Windows 2000, we will continue to provide you the latest spyware and virus definitions but you will no longer receive program updates The reason for this is that Microsoft no longer supports 2000 therefore it is very hard for us to do so as well.

The "lawyer" then emailed me and said the following, "To proceed further on this matter, you are required to send us a scanned copy of your International Passport or Driver’s license, your full address + telephone & fax number with the probate fees as listed below:

(i) Affidavit: $820
(ii) Application / registration: $200
(iii) Fund Release authorization Bond: $1850
(iv) Judiciary Approval Order: $2700
(v) Stamp duty: $500
(vi) VAT $283.5

Total: $6,353.5 (USD).

These fees are non deductible as they are the official government rate for the afforementioned documents. For the expedition of the process, you are advised to send the money to this law firm through Western Union or moneygram via the name and address below:

Name: Mohammed Lamin
Address / City: Abidjan
Country: Cote d'Ivoire (Ivory-Coast)"

I played along and told the lawyer I'd be happy to send the money but I'd need proof that the money was in the account and the bank was real. He sent View image" and View image which actually looked pretty authentic. He also sent me a link to a bank site (which I won't link to) that looked very very real but it was in French. My EarthLink ScamBlocker client went nuts and told me the site was fake, but I already knew that.

I then decided to tell Frederic that I was very apprehensive about sending a large amount of money to someone who I didn't know. I proposed that we split that 6 thousand dollar fee and that way we'd both have some "skin in the game". Frederic liked this idea and told me to wire my half immediately.

Of course there was no way I was going to send my money to him so I asked that Frederic send the money to me and I'd send the money to the lawyer. Frederic thought this idea was ridiculous and told me that god was not looking favorably on me. I explained that since we were supposed to split the money that I needed to proof that he was just as vested in this endeavor as I was. My last communication from Frederic said that he was very angry in my decision to not go any further and that he would simply ask someone else for help in getting the money.

I can see why many people fall for this scam despite all the Internet safety information out there. Greed is a trait inherently strong in a lot of us and the opportunity to make a quick buck will make people go against conventional wisdom. This scam has been around for years yet it is still going strong because people just think that money will magically fall in their lap. The best thing to do when you get an email offering you money for almost nothing is simply to delete it and think about a more productive way to get rich quick!

Part 2:
As I mentioned in my previous post I was contacted by one the thousands the people across the Internet who send out email spam claiming you can become rich. The following was my first contact with Frederic who claimed to work for the offical bank of the Ivory Coast:

"My name is Mr. Frederic Nelson, a Banker with one of the leading banks here in Abidjan, Cote d'Ivoire (West Africa). I am the personal accounts manager to Mr. Morrison Kaplan, who used to be a contractor with an oil servicing company based here in Cote d’Ivoire.

All I require is your honest cooperation to enable us seeing this deal through. I guarantee that this will be executed under all legitimate arrangement that will protect you from any breach of the law. If you can handle this with me, reach me by sending the following informations:"

I decided to play along and send him some information that was fake but realistic enough that he wouldn't know any better. Frederic immediately emailed me back telling me how happy he was that we could work together and become rich. He then said, "I have successfully legalized the account files and other related documents in your name as the legal beneficiary of the account. Now you have the legal right to claim the money.
All you have to do is to simply copy the text of application below and send it to the bank at the e-mail given on it.

Ben Kaplan"

Part 1-

So I assume most have you have received at some point, an email proclaiming that you've either been chosen to receive a large cash inheritance or you're an heir to a vast fortune of money from another country. At first glance you might think this is a miracle and this must be your lucky day. Then hopefully your senses kick in and you realize this is one of the thousands of email scams going around the Internet; most likely originating in Nigeria or the Ivory Coast.

The email asks you to give provide some very basic information which is then used to "bait" you in to thinking you may actually be able to get some money from some random person half around the world. Over the course of the past month I've been corresponding and pretending to be interested in receiving this fortune with a man in the Ivory Coast. Over the next couple of blog entries I'll detail what I've done and what I've been told. The detail and manipulation tactics that these would be criminals try to employ are very impressive and I can see why your average Joe might fall for these ploys that are too good to be true.

This past week I was at a Anti-Spyware Coalition (ASC) conference in Boston. The ASC is an organization made up of the world's most prominent anti-spyware providers as well as key public interest groups committed to combating the rise of unwanted spyware clogging computers and endangering Internet communications.

This group meets every so often to discuss the latest spyware threats, current issues surrounding spyware, and the newest technologies designed to defeat spyware. At this particular meeting we listened to Cindy Southworth from the The National Network to End Domestic Violence (NNEDV) speak to us regarding the rise of spyware and its ability to aid perpetrators of domestic violence who use these technologies to further their abusive and controlling behavior.

I never thought about this specific aspect of the danger of Spyware before, but let me tell you it is very very real. Cindy brought in a guest who we'll call "Betty" for the sake of confidentiality and her continued safety. Betty was a victim of domestic violence perpetrated by her former husband (we'll call him Chuck) and father of her children. To make a long story short: Betty's relationship with Chuck started off wonderfully but over the years the abuse started verbally and then moved into the physical realm. It got to the point where Betty was afraid for her life b/c her husband said if she left he would kill the children.

Betty tried to contact her friends via email but Chuck would always seem to know what she was doing while online. He knew what sites she went to (even when she cleared her history), what she typed, and who she corresponded with. All of these activities infuriated Chuck and led to several physical abuse incidents. Little did Betty know that Chuck had installed monitoring software that allowed only him to track ALL of what Betty did online. Betty had no clue she was being watched online b/c this special software hides itself from its victims.

The really scary part is that this software is accessible to anyone. Typing in "Software to spy on Spouse" yields over 600k Google hits. Betty ended up getting out of this terrible relationship but to this day has to be very careful about what she does online. She no longer has a permanent email address, she does not shop or pay bills online, and she is very cautious about what personal information she gives out to anyone. Chuck has no idea where she is but if Betty wasn't careful, little bits of personal information could add up to big pieces which would lead to her location etc.....

As a professional who focuses more on the identity theft angle of spyware this was a wake up call to an area I had not thought about. For more information about domestic violence and the Internet please visit the NNEDV.

Before we go too far I thought I’d go into a little detail about how you and I are protected from viruses and spyware using traditional signature/definition based methods. Over the past 20 years everyone has received a daily spyware and/or virus definition update that helps to protect users against the known malware on the Internet. Despite heroic attempts to fight the war against computer security threats, the bad guys are winning, especially as hackers learn ways to exploit the wait time between when threats are detected, and when they are fixed. As Yankee Group puts it, the old “signature-based malware systems are crumbling under the force of the sheer numbers marshaled by the enemy. ” Worse, “detection rates for the new malware variants are less than 70%, and anti-virus labs are between 30 and 60 days behind for run of the mill malware.” This is why 99% of consumer computers today have anti virus installed and yet 60% still get infected annually. And in the last year alone, nearly 10 million Americans became victims of identity theft, a crime that cost them approximately $5 billion total. It is the fastest growing crime in the United States, and it takes identity theft victims approximately 12 months to realize that they have been victimized.

Ok, back to the topic at hand.

Put simply a zero day threat is a piece of malicious code that is so new that there is no definition or signature for removal. A zero day attack is when that code is put onto the Internet to create havoc and more than likely try to steal personal consumer information. So the next question is how do we protect ourselves from these types of threats? For true zero day protection, a security solution needs to be able to discover malicious behaviors of files that may get onto your computer, without needing any signatures databases. Does a product like this exist? Absolutely!

I don't want this to turn into a huge sales pitch for my product (Protection Control Center with Attack Shield) but I’ll simply say that Attack Shield is the only purely behavioral based malware detection product on the market. By combining Attack Shield with traditional Proteciton Control Center (PCC), you achieve an unprecedented level of security. While PCC detects known attacks, Attack Shield prevents the unknown, zero day attacks that the anti virus/ anti spyware signatures on your system may not be able to find. With this combination, the vulnerability gap that once existed is now closed and your security level is raised.

We also provide a stand alone version of Attack Shield called Primary Response Safe Connect. This stand alone version is specifically designed to work with other security solutions such as Norton Internet Security and McAfee Protection Suites. By adding this additional layer of protection to your existing security, you enhance the protection provided by your AntiVirus with the ability to provide instant and constant protection against malware that your antivirus software cannot find. The combination of the two products provides you with stronger protection against newer, stealthier threats designed to avoid your antivirus software.

EarthLink has partnered with the leading zero-day protection security company (Sana Security) to bring you both Attack Shield and Primary Response Safe Connect. We believe in the product so strongly that we recommend it to everyone regardless of what other security products you may use.

If you want to try Protection Control Center with Attack Shield free for 30 days, click here.

If you have another security solution and want to add an extra layer of zero day protection, click here for a free 15 day trial.

You won’t be disappointed!

1^Yankee Group report entitled AntiVirus is Dead; Love Live AntiMalware, dated Dec. 18, 2006

Thanks!

Fact: Potentially malicious software code (called Jikto) that could be used to turn a Web browser into a Hacker’s tool has been posted to the Internet, after it was downloaded by a quick-thinking individual at the Shmoocon Hacker conference last month.

After reading this, it got me thinking about who else (if anyone) besides the hackers should be held responsible for malicious code making its way onto the Internet? Some background on this: Security researchers do a lot of sharing of information and technology in order to combat Internet security threats. Sometimes this involves the sharing of actual malware samples through specialized channels from one lab to the next. I’m not a malware researcher so I don’t know exactly how it works. But I do know the industry is extremely small and that there are a great deal of interpersonal relationships that exist between researchers. So it is entirely possible that a researcher at company A talks with company B about samples etc. All of this sharing leads to better protection for all of us which in the end is what we all want.

However, this is not what happened at the Shmoocon confernece last month. A so called “Security Consultant” posted the URL to the this malicious code and posted it to Digg.com for a very short period of time. My sources within the security industry call this a very very big “no-no!”. Digg is a user powered content portal where anyone can come to get all types of information, news, videos etc. Why on earth would you publish a link to code that has the potential to make it easier for hackers to gain control of your computer? There is no good reason and despite the individual claiming that he “posted the code because he thought it would be useful to other security professionals looking for ways to illustrate just how dangerous a scripting attack can be”, I don’t buy it!

So a couple of nights ago I was watching Dateline NBC about the significant increase in identity theft and/or fraud in the past year. For as long as I can remember the public has been blanketed with scary stories of consumers whose lives were ruined because someone took over their financial identity. You’d think that consumers would listen to the warnings and take the appropriate actions to protect themselves. Well I don’t think it is working. According to the United States Secret Service, “It happens once every 4 seconds, thousands of times a day, millions of times a year": That’s how many times experts estimate there’s a phony charge made with a stolen credit card number.

That number is staggering to me given the fact that we all know we need to be extremely careful with our personal informaiton. So instead of simply ripping up credit card applications or shredding them, we need to be cross cutting them with a professional shredder. I’ve seen demonstrations where ex-cons will piece back together torn or single shredded applications back together and send them in; only to have the credit card company send them a brand new credit card within 1-2 weeks.

Dateline wanted to find out a couple of things during their investigation. 1)How much does your personal information sell for on the black market? Let me tell you I was shocked. At any given time there are hundreds or possibly thousands of people selling consumer information (which ultimately leads to financial fraud) for as little as 5 bucks. Yes, you heard me right! Thieves can enter a online chat room and buy a stolen credit card for the same price as a Starbucks coffee. 2)Once your credit card information is stolen how long does it take for a thief to use it and max it out? Again I was astonished...Less than 12 seconds after purchase on the Internet the card was used illegally. And in less than 10 minutes it was maxed out!

If you haven’t already begun to use PCC, I urge you to download it at (http://www.earthlink.net/software/pcc/) and get top notch protection. Our basic version of PCC gives you powerful Anti-Virus, Anti-Spyware, Anti-Phishing, and Firewall tools that keep you safe from threats on the Internet. All of these excellent security components are integrated into one easy to use security suite that helps to take the guess work out of Internet security. EarthLink knows you don’t want to play IT manager!

You can also upgrade to PCC with Attack Shield for either $24 a year or $2.95/month if you get Internet access from EarthLink (and $36/year or $3.95/month otherwise). What is Attack Shield you ask? Attack Shield is a revolutionary technology that protects you from unknown viruses and spyware, commonly referred to as Zero-Day threats. Zero-Day threats are pieces of malicious code so new that your standard virus and spyware defintion files don’t yet recognize them, and so can’t remove them from your computer. Attack Shield doesn’t rely on scanning or definitions but instead studies the behaviors of activity on your computer and can differentiate between good and bad. Basically EarthLink's Attack Shield gives you an added layer of essential, real-time protection that counteracts typical lag-times between security software updates. Its constant behavioral monitoring means your computer doesn’t have to wait for a list of new viruses to know something on your computer is bad for you. EarthLink is proud to be the first ISP to offer this advanced level of protection that not even the big security companies can offer. I gave a preview of this with screen shots on the Earthling Blog back in November that might interest you.