Posted by stuart.gilbertson

A new scam which sees fraudsters calling your home landline and taking control of your home PC is surfacing in Edinburgh.

The conmen, who are thought to be calling hundreds of Edinburgh based PC users, are claiming to work for Microsoft and are warning the PC users that they have an infected computer. They then convince the unsuspecting user to click on a web link directing them to malware which allows the caller access to the remote PC.  This allows them to copy bank details, passwords, and other sensitive data off the computer.

A spokeswoman for Lothian and Borders Police said: “Our advice to avoid falling victim to fraud would be to never engage with someone who cold calls out of the blue and give them access to your computer. If you have concerns about your computer security, ask a known and trusted expert to assist.”

The Edinburgh Evening News Reports: http://edinburghnews.scotsman.com/news/Conmen-take-control-of-home.6488963.jp

Virgin Media, the UK’s third-largest Internet Service Provider will match lists of compromised IP addresses collected by the Shadowserver Foundation against its customer lists so that they are able to issue a letter of warning about their security.

Subscribers to Virgin Media whose computers are part of a botnet can expect the warning letter telling them to tighten up their security immediately. Those with infected machines will be asked to download free security software to remove the malware and protect their computers and connection.

Virgin Media said it expects to send out hundreds of these letter per week initially, and has plans to expand their campaign based on customer feedback. Virgin Media will also take the opportunity to try and sell its Digital Home Support service offering remote PC maintenance over the phone.

The Information Commissioner’s Office (ICO) remains highly concerned that data breaches involving people’s personal information are continuing to occur in NHS organisations.

Today NHS Stoke-on-Trent and Basingstoke and North Hampshire NHS Foundation Trust are the latest NHS bodies found to have breached the Data Protection Act (DPA). Both NHS organisations’ chief executives have signed formal Undertakings outlining that they will process personal information in line with the DPA.

Mick Gorrill, Head of Enforcement at the ICO, said: “Everyone makes mistakes, but regrettably there are far too many within the NHS…”

The NHS organisations have agreed to implement a number of security measures to protect personal information more effectively. All staff will be made aware of the organisations’ policies for the retention and use of personal data and will receive training on how to follow those policies.

NHS Stoke-on-Trent will also apply physical security measures in respect of paper medical records, particularly when they are in transit. The ICO can issue a monetary penalty for serious breaches of the Data Protection Act.

If your business handles personal or confidential information that should really be encrypted in transit, give Consider IT a call now on 0131 510 0110

The Information Commissioner’s Office (ICO) has found Lampeter Medical Practice to be in breach of the Data Protection Act, after an unencrypted memory stick containing the personal details of 8,000 patients was reported lost to the privacy watchdog.

In March 2010, a member of staff downloaded a database containing patient details in contravention of practice policy. The staff member downloaded the information on to an unencrypted and non password protected computer memory stick which was then posted by recorded delivery to the Health Boards Business Service Centre. The memory stick did not arrive at its intended destination and is now accepted to be lost.

Sally-anne Poole, Enforcement Group Manager, said: “It is unnecessarily risky to download 8,000 personal details on to a memory stick. It is imperative that staff are made fully aware of an organisation’s policy for securing personal data and any portable device containing personal information should always be encrypted to prevent it being accessed in the event of loss or theft…”

If your business is at risk of this happening, give us a call and let’s get your data sorted!

West Berkshire Council is taking remedial action after the Information Commissioner’s Office (ICO) found it in breach of the Data Protection Act (DPA) following the loss of a USB stick containing the sensitive personal information of children and young people.

The details, said to be of ‘a handful’ of children, would be available to anyone finding the memory stick, which was unencrypted and not password protected.

The ICO found that unencrypted devices, in operation before the council introduced encrypted memory sticks in 2006, were still being used by members of staff. Further enquiries revealed staff had not received appropriate training in data protection issues and monitoring of compliance with the council’s policies was found to be inadequate. This is the second data security incident reported by West Berkshire Council within six months.

Nick Carter, Chief Executive of West Berkshire Council, has now signed a formal Undertaking to ensure that portable and mobile devices used to store and transmit personal data are encrypted.

Sally-anne Poole, Enforcement Group Manager at the ICO, said: “It is essential that organisations ensure the correct safeguards are in place when storing and transferring personal information, especially when it concerns sensitive information relating to children. A lack of awareness and training in data protection requirements can lead to personal information falling into the wrong hands. I am aware that staff have been provided with encrypted USB sticks since 2006 but older devices were not recalled…”

A German court has fined a man for failing to secure his home wireless internet access point which was used to download music without the copyright holder’s permission.

Wireless networks are common in most homes nowadays, providing wireless connection to the Internet through the home owner’s connection. Leaving this network without security can be like leaving your front door unlocked.

Anybody in the vacinity can access your Internet connection, the files folders and shared devices, and can download illegal material at their convenience. This could be avoided if the Cricket Wireless APN or similar options were configured.
The owner of the network was able to prove that he was on holiday at the time, but Germany’s federal high court of justice said that the owner had to bear some responsibility for the actions of a third party using their system.

“Private users are obligated to check whether their wireless connection is adequately secured to the danger of unauthorized third parties abusing it to commit copyright violation,” the court said, according to news agency Associated Press (AP).

“It is vital that all owners of a wireless network make sure it is secure. Failing to do this can have catastrophic consequences on the owner of the network” Stuart Gilbertson, Managing Director of Consider IT went on to say “When you fail to secure your network, you give all users the ability to access your Internet connection, your data, and probably your files. With the right equipment and know-how, they can watch what you’re doing on the Internet with ease”.

A number of clients and us included have recently received an email pertaining to be from iTunes congratulating the recipients for winning a $50.00 Gift Certificate.

Please be warned: THIS IS A VIRUS!

The email body contains the following:

Hello!
You have received an iTunes Gift Certificate in the amount of $50.00 You can find your certificate code in attachment below.
Then you need to open iTunes. Once you verify your account, $50.00 will be credited to your account, so you can start buying music, games, video right away.

iTunes Store.

The email contains an attachment ZIP file which contains the executable iTunes_certificate_247.exe file. When run, the executable modifies your registry and creates files in specific directories. So please don’t do it.

At time of writing, AVG did not recognise the .exe file as a vulnerability.

Consumers and IT support personnel around the country found themselves in a nightmare situation this afternoon; at best, their Windows XP-based machines simply couldn’t connect to a network, but more often than not were stuck in an endless loop of reboots.

The update, labeled 5958, causes McAfee to misidentify svchost.exe (an essential Windows system file) as a piece of malware and delete it. The official statement from McAfee indicates that the flaw only effects Windows XP machines with SP3, and results in “moderate to significant performance issues.” Of course, reports from around the Web indicate this affects systems that are only up to SP2. And calling an endless cycle of reboots a “performance issue” is a bit of an understatement.
There are unconfirmed reports that the flaw has taken out banks of systems at Intel and Dish Network, and the New York Times is reporting that dozens of PCs at the Illinois State University in Normal were taken out as well.

McAfee has released a “fix” for the problem that really only suppresses the issue and doesn’t directly address the false-positive issue. The fix also requires that a technician individually visit and repair any affected system, meaning that it may be a long night for support staff at companies and institutions who turn to McAfee for their virus protection.