Scams
Alert: BlackHat SEO attack targeting Google Nexus One (Updated) (From Panda Labs Blog)
Jan 17th
From the Panda Labs Blog (BlackHat SEO attack targeting Google Nexus One (Updated) (http://pandalabs NULL.pandasecurity NULL.com/blackhat-seo-attack-targeting-google-nexus-one/))
A few days ago Google presented their brand new phone, called Nexus One:
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/google NULL.jpg)
And some days later we find out that if a user searchs for “buy Nexus One” he will obtain around 4,000 malicious links:
When clicking on any of these links, you will see some of the typical fake antivirus sites:
It will try to infect your computer with a rogueware called LivePcCare. Be careful while searching, and use at least some free web filtering tools (http://www NULL.mywot NULL.com/). (Like Web of Trust)
Update: 5 out of the 6 first results are malicious, including the 1st and the 2nd one.
Update 2: Now the same crew is using the Haiti earthquake

Alert: Criminals using Haiti Tragedy for new online scams
Jan 16th
Unfortunately, the bad guys seem to try and use anything that is current in an effort to take advantage of the situation and unsuspecting people, many of which may have their guard down because of the circumstances. The tragedy in Haiti is the latest way for the bad guys to attack.
The FBI released the following warning this week after the earthquake (LINK: http://www.fbi.gov/cyberinvest/escams.htm (http://www NULL.fbi NULL.gov/cyberinvest/escams NULL.htm))
HAITIAN EARTHQUAKE RELIEF FRAUD ALERT
01/13/10—The FBI today reminds Internet users who receive appeals to donate money in the aftermath of Tuesday’s earthquake in Haiti to apply a critical eye and do their due diligence before responding to those requests. Past tragedies and natural disasters have prompted individuals with criminal intent to solicit contributions purportedly for a charitable organization and/or a good cause.
Therefore, before making a donation of any kind, consumers should adhere to certain guidelines, to include the following:
- Do not respond to any unsolicited (spam) incoming e-mails, including clicking links contained within those messages.
- Be skeptical of individuals representing themselves as surviving victims or officials asking for donations via e-mail or social networking sites.
- Verify the legitimacy of nonprofit organizations by utilizing various Internet-based resources that may assist in confirming the group’s existence and its nonprofit status rather than following a purported link to the site.
- Be cautious of e-mails that claim to show pictures of the disaster areas in attached files because the files may contain viruses. Only open attachments from known senders.
- Make contributions directly to known organizations rather than relying on others to make the donation on your behalf to ensure contributions are received and used for intended purposes.
- Do not give your personal or financial information to anyone who solicits contributions: Providing such information may compromise your identity and make you vulnerable to identity theft.
MSNBC has released a list of charitable organizations that are active in Haiti, to help you know that your donation is going to the right place. The list can be found at http://www.msnbc.msn.com/id/34835478 (http://www NULL.msnbc NULL.msn NULL.com/id/34835478)
——————– o ——————–
In addition to the the financial scams, there are now also web scams which will cause your pc to get infected with Rogueware (Things like fake anti-virus messages), while visiting sites that appear to be legit Haiti Support or Information sites.
In the latest attempt to use a news making event, into a way to spread Rogueware, those running what are called SEO (SEO = Search Engine Optimization) are targeting keywords related to the earthquake in Haiti. Running searches on terms such as ‘Haiti’, ‘RT (re-Tweet)’, ‘Wyclef Jean’ and his charity, ‘Port-au-Prince’, Haiti donations, just to name a few are bringing up sites on major search engines pointing users to what they believe to be legitimate news and images related to the tragedy. When in fact, these sites, because the criminals were able to manipulate results of the search engines, are showing fake sites mixed in with real sites.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/haiti_20fraud_201_thumb NULL.jpg)
(Picture from http://sunbeltblog.blogspot.com/2010/01/dangerous-web-search-haiti-earthquake.html (http://sunbeltblog NULL.blogspot NULL.com/2010/01/dangerous-web-search-haiti-earthquake NULL.html))
If you encounter one of these fake site, 1st thing that you should NOT DO is click on any pop up or link that says you need to install something to see the site. 1st thing you SHOULD DO is attempt to close your browser by selecting either the X on the top right or by selecting CNTR-ALT-DEL on your keyboard, going into Task Manager, highlighting your browser, and selecting END TASK (Never attempt to use any of the actual “Close” or “exit” buttons that will appear with the pop up as most of the time the “yes” and “no” button will both do the same thing which is install the Rogue program on your machine).
In addition, as soon as you reopen your browser (after closing it for the pop up), you want to make sure that you go in and clear your Temporary Internet Files and your Internet Cookies (In Internet Explorer its Tools –> Internet Options –> then under browsing history –> delete and then delete all. In Firefox its Tools –> options –> privacy –> clear your recent history / clear your recent cookies). That is in addition to making sure that your Anti-Virus software is up to date, that your Updates for your operating system (Windows, MAC, Linux) are up to date.
(Soapbox**) I continue to point out the need to update, and yet I still regularly get called out to clear infected machines, that are missing updates (Had a Windows PC last week on XP service pack 1 and Norton AV 2004 with updates from September 2005). Not that I don’t want to work, and get paid, but if you really want to make sure you don’t suffer thru the down time and expense of waiting for a tech like myself, UPDATE UPDATE UPDATE. Will updates protect you 100%, no, unfortunately in the age of the internet, new and more innovative ways to beat a system come up 100’s of times every day, seven days a week. However, keep in mind, when you leave your house, you lock your door. Why? Will locking your door, protect your house from being robbed? You hope so, and 99% of the time it will. So updating your system is like locking your door, if you don’t lock your door you will eventually get robed. (End Soapbox)
**Lastly – To the people of Haiti and those readers of TGM with family and friends in Haiti. You have our thoughts, during this difficult time.**
Scam Alert: You CANT make money from home with GOOGLE (It’s a scam). It’s that simple
Dec 31st
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/dinamite NULL.jpg) Today’s post concerning the “Make money from home with Google” pop-ups that seem to be more and more common while people are surfing online recently has 2 reasons behind it. (1) I have been asked by numerous people if its legit (its a SCAM and lets just say way more people than I ever would imaged have asked) and (2) I am running into this ad pop-up daily now, while I’m online and accessing major sites.
Here is a screenshot I took of one of these ad pop-ups that I got while accessing a Major National Newspaper site. You probably have seen this or something similar to this if you spend much of any time online. Let me say it one more time, before going on with this post “THIS IS A SCAM”.
(http://houstontribune NULL.net/business/work_from_home/)
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/scam1B NULL.jpg)
Not only do you get the ad telling you that Google will pay you to work from home, but when you try and close it you get the following pop ups.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/scam2 NULL.jpg)
“Skeptical…..” Any ad that requires it to tell me that I shouldn’t be skeptical and that my financial security will only cost me $1 should be an instant alarm for everyone to not just walk away but run away as quickly as possible. (IMPORTANT NOTE: AT THIS POINT USE THE X ON THE TOP RIGHT, DO NOT USE THE OK BUTTON TO CLOSE IT)
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/scam3 NULL.jpg)
“Are you sure” is the next window you will get, really people, if being told are you sure, then told are your really sure, about anything should be an alarm. (NOTE: AGAIN USE THE X ON THE TOP RIGHT, DONT CLICK EITHER OK OR CANCEL)
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/scam4B NULL.jpg)
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/news8fakesite NULL.jpg)
Oh and for good measure now you will get another pop-up ad that looks like a legit news site (I appears that it will say either from the “Houston Tribune News” or from “News8News”). The sites are very real looking as they use parts from actual websites (Note the Electronic Cigarette story that comes from News8, but that news 8 is actually WFAA which is an ABC TV station not the fake news8news that has nothing to do with any legit website.)
Part of the problem with these sites are that they are now finding ways to appear long side legit sites, and on top of that they refer to actual stories (like the WFAA story) or claim to be “As seen as” and use major legit news sites (There is a very legit . Additionally, the problem is that they use very similar names to actual sites, so that the average user gets confused.
ABC News did a story about this issue recently (A few Quotes from the ABC story)
“But the affiliations suggested by the site were questionable at best: It said that customers would earn cash "working from home with Google," even though Google says it does not endorse such work-from-home sites.
It also claimed that it had been featured by television news organizations, including ABC News and CNN.
Both organizations say they haven’t endorsed the site. The site’s only real connection to legitimate news organizations, experts say, seems to be through paid advertisements placed on those organizations’ Web sites.”
The complete ABC news story about this can be found at (LINK) http://abcnews.go.com/Business/work-home-google-scam/story?id=8438110&page=1 (http://abcnews NULL.go NULL.com/Business/work-home-google-scam/story?id=8438110&page=1)
So just remember a couple of Internet Golden Rules
– Even if its on the internet, it doesn’t mean that its true
– Even if it looks like the Tweet, Facebook link, Email, IM, or any other form of online communications looks like it came from someone you know, its possible that it wasn’t sent by them. Always be very careful when clicking on links.
– No job/job search or anything concerning “financial security” should cost you money to get. As soon as anyone says “Pay me X amount, and I’ll tell you how to be make money or be debt free”.
An additional resource to see if something is a scam is (LINK) snoops.com (http://snoops NULL.com). Snoops has more info on this fake work at home scam as well. (LINK: http://www.snopes.com/fraud/employment/google.asp (http://www NULL.snopes NULL.com/fraud/employment/google NULL.asp))
Software: Free add-on for Internet Explorer or Firefox can help prevent you from visiting a fake site that could infect your pc.
Nov 30th
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/11/weboftrust NULL.jpg) There is an add-on for Internet Explorer, Opera and Firefox that may help keep you from visiting a fake site that could infect your pc with malware or worse. The program called “Web of Trust” (From http://www.mywot.com/ (http://www NULL.mywot NULL.com/)), monitors trends (using their own information as well as information from other security providers) from the bad guys who set up these types of sites and either puts a marker or presents you with a message when a link that you are opening is considered to be either a known “phishing” site (a fake site meant to still your information) or a site that is high risk and could be a “phishing” site. The add-on does not actually block the sites, which means that you as the user still needs to use common sense while surfing the internet, as you could click on the message and tell it to continue to the site in question.
The add-on which is easy to install, will show the following type of notice on searches (Green as safe sites, Red as sites that would be recommended you avoid)
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/11/image21 NULL.png) 
In addition when visiting sites that could put you at risk you will see the following message
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/11/image22 NULL.png)
As already noted above, this is only an alert, this add-on with all of the browsers will still allow you to “Click here to continue to the page anyways”. That means that this program does not replace common sense, it is a tool to help you better chose but ultimately its still up to the user to use their own common sense.
Since I like giving real world examples to explain, here is how I explain Web of Trust. Consider WOT like your house or car alarm. When you leave your house, you set your alarm, but because you set the alarm doesn’t mean you don’t lock your doors (At least I hope it doesn’t). Consider your common sense as the looking of your door, if you don’t do it, your still at risk.
Internet Explorer Add-On (LINK: http://www.mywot.com/en/download/ie (http://www NULL.mywot NULL.com/en/download/ie))
Firefox Add-On (LINK: http://www.mywot.com/en/download/ff (http://www NULL.mywot NULL.com/en/download/ff))
Opera Add-On (LINK: http://files.myopera.com/PH%60/UserJs/wot.js (http://files NULL.myopera NULL.com/PH%60/UserJs/wot NULL.js))
Alert: Doing a search for DoorBuster sales could get you infected
Nov 30th
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/11/computervirus1 NULL.jpg) It seems that the bad guys are at it again, and this time they are using the holiday shopping season to try and trick people into infecting their pc’s. Panda Labs released a post on their Panda Labs site (LINK:http://pandalabs.pandasecurity.com/archive/Black_2800_hat_2900_-Friday.aspx (http://pandalabs NULL.pandasecurity NULL.com/archive/Black_2800_hat_2900_-Friday NULL.aspx)) concerning the fact that if you go online and run a search that many of the links showing on search engines have been compromised and the results actually lead to fake sites that are just there to infect your pc.
From the Panda Labs post here is an example they show with results that will do nothing but infect your pc.
Google Search:
(http://www NULL.flickr NULL.com/photos/lithium-/4120742406/sizes/o/)
If you happen to access one of these fake sites you will get infected with an old favorite, the fake antivirus notices that wont go away until you give the bad guys your credit card information (One of the many others names you may have heard of this is AntiVirus2009 LINK:http://techgeekandmore.com/2009/10/19/rogueware-with-new-ranson-technology/ (http://techgeekandmore NULL.com/2009/10/19/rogueware-with-new-ranson-technology/)), since they will claim your infected until you but their product. At the moment you do, in a miracle your pc is clean, but a good chance that so would your bank account or credit card since you would have handed the bad guys your information.
In case if you do click on a bad link, you will see the screen just like it shows in the example below (or a slight variation). What you will need to do is follow the information from the recent post “What to do if you get a virus or malware” (LINK: http://techgeekandmore.com/2009/11/23/how-to-what-to-do-if-you-get-a-virus-or-malware-via-a-pop-up-message/ (http://techgeekandmore NULL.com/2009/11/23/how-to-what-to-do-if-you-get-a-virus-or-malware-via-a-pop-up-message/)) to attempt to clean your pc.
Fake Antivirus Page:
(http://www NULL.flickr NULL.com/photos/lithium-/4120742422/sizes/o/)
As always take precautions and use common sense when going to links including those that come up on search engine sites (Like Google, Bing, Yahoo). If your trying to get to the site of a major site, but the link showing says pleaseclickme.cm/SoIcanmesswithyou (This is just an example), then you may really want to think about it before clicking on the link.
**Images for this post are from the Panda Labs Post. Presented for the benefit of TGM readers.
(http://www