My Digitized Thoughts - Ramen Mukherjee ...

hey guys i know there are lots of websites out there who are warning people to how to get yourself cleaned after you get infected but i found no website / blog claiming that HOW TO NOT GET ATTACKED IN FIRST HAND, HOW TO PROTECT YOURSELF FROM ALL THESE KIND OF ATTACKS, as prevention is better than cure and these kinds of attacks are increasing day by day so i thought that it would be high time to share my expertise with you all. AND how i really saved myself.

IF YOU LIKE MY POST AND IT HELPS YOU THEN PLEASE SHARE, LIKE, +1, AND COMMENT, IF YOU SHARE THIS IN YOUR BLOG / WEBSITE THEN PLEASE GIVE CREDITS TO ME AND OTHER AUTHORS. THIS IS AN AUTHENTIC CONTENT PLEASE RESPECT IT.

Remember the earlier Facebook scam related to Marika Fruscio showing breasts on TV? Well, looks like the scam had made its comeback again. The new scan titled – “[VIDEO] Yeahh!! It happens on Live Television!” which has the message – “Lol Checkout this video its a very embarrassing moment for her” is reportedly spreading like wildfire on the social networking giant.

The scam has the same thumbnail that was used for the Marika Fruscio Facebook scam. The scam message comes with link that directs you to a bogus web page. The web page displays a message stating that the “divx-plugin missing” and asks you to install the plugin in order to watch the video.

Not matter what, DO NOT install the plugin, or do not download anything from that site. When you click on the “Install Plugin” button, a malware will be downloaded and automatically installed on your computer. This malware is designed to gather all your personal and sensitive information, which then sends it to the scammer.

Please be aware that this malware can be a huge threat to your system. If in case you have accidently installed the plugin, then I recommended you to scan your computer using you anti-virus software. I also suggest you to remove the scam from your news feed by clicking on the “X” mark on the top-right corner of the post. Alternatively you can report the scam to the Facebook Security team.

Please note that scams like this use multiple domain and different web pages. You may see variations in the landing pages, but they are all the same.

Here are the different versions of the scam that have been reported earlier –

• Marika Fruscio Spam Spreading on Facebook
• Marika Fruscio Scam Spreading Again on Facebook
• Italian Model Shows Her Tits on T.V Video Scam

As a precautionary measure, always check which applications you use and remove unwanted or suspicious ones. If you aren’t sure how to do it, you can always check our guide on removing apps from Facebook. In addition to that, don’t forget to check out our article about Avoiding Facebook Lifejacking and Clickjacking scams.

A new Facebook spam video

A new facebook virus is spreading under the title “98 Percent Of People Can’t Watch This Video For More Than 15 Seconds”. The Image shown is not a video but a thumbnail of the website. The play button at the bottom left gives it the appearance of facebook video icon. Visiting the site can harm your account as you give permission to third parties to access your account and post comments and send messages as you. A similar spam message had become viral last year under the title “99% of people can’t watch this video more than 25 seconds”. There was a spam message becoming viral with Osama bin Ladens dead pics.

How the facebook spam virus works

Clicking the link you will be redirected to a page which would look exactly like facebook page with facebook favicon but if you look into the address bar it will not be facebook.com URL. The embedded video player would look exactly like facebook video player. Here you will be asked for a quick security check. Facebook should never ask you for any security check for just watching a video.

After doing that, it will ask you to do a set of three steps
1. Select you address bar
2. Press J on your keyboard
3. Pres (CTRL +V) and press ENTER
Doing these three steps, you actually open your account to third parties. It will bypass all firewall protection of your system and your session may be hijacked. Then this video will be shared with your friends through wall posting or inbox messaging.

What to do if you receive spam messages

• Firstly, if you see such messages or shared wall posts don’t open the URL. Instead immediately click the “Report/Mark as spam” button by the side of the post.
• Even if you opened the webpage do not share it at all. You will be spamming your friends too if you do so. Instead tell them about such a facebook spam message and wall post.
• If you have already clicked the share button, then you have to immediately log out from facebook and other websites you might be logged in. Then clear all browser cookies, cache and temporary files using CCleaner. The restart your system and change you facebook password.

Another New Facebook spam virus

Facebook is breing filled with more and more spam viruses everyday. A new virus has come up on facebook under the title “Girl killed herself after her dad posted a secret of her on here fb wall.!!!” This works almost similar to the Facebook spam, Yeahh!! It happens on Live Television!

What does the Girl killed herself virus do after you click

If you click on the link it will take you to another webpage where a video is embedded. When you click the play button it will either redirect to a survey page or ask you for permission to access facebook content. When doing this you are actually granting permission to a facebook app to access your facebook private content and post or comment as you. This means that you let the app to post on wall or send messages of similar virus links to your friends.

What to do after you click

• If you see such links do not click them. Instead open the drop-down on the right and click “Report story or spam”.
• If you have clicked on the link, immediately change your passoword. Then logout from all the websites you are currenlty logged in. Change all the passowords and then use CCleaner to clear all your browser cache and temporary files.
• If you have clicked on the play button, deactivate all the apps you have authorised by
  Account>Privacy Settings>Edit settings (Apps and Websites). Here you can see the list of apps you authorised. If you find any spammy apps remove them.

What to do if you are affected ?

Go to your profile and click the x mark beside the spammy post to either remove the post or report as spam.

You may also want to check the apps you are using:

• Click Account (top right) of your Facebook and go to Privacy Settings
• Scroll down below and click on ‘Edit Your Settings’ under Apps and Websites.

• Under Apps You Use, click Remove unwanted or spammy apps or the Edit settings button.

• Find and click on the malicious app. Note: The application may vary so make sure to check unfamiliar and new applications.
• Click on ‘Edit Settings’ and ‘remove app’. You may also want to get rid of other applications you don’t want to have access to your facebook account data. and MOST IMPORTANTLY change your password.

Now The IMPORTANT Part, how not to get affected at all by these Malwares at all?

to read please go to the next page

Credits -

http://techie-buzz.com/scams/yeahh-it-happens-on-live-television.html

http://scameo.com/2011/07/11/girl-showed-her-assets-on-live-television-facebook-scam/

http://www.techreign.com/2011/11/facebook-spam-98-percent-of-people-cant-watch-this-video-for-more-than-15-seconds/

http://www.techreign.com/2011/12/facebook-spam-girl-killed-herself-after-her-dad-posted-a-secret-of-her-on-here-fb-wall/

http://www.techreign.com/2011/12/facebook-spam-yeahh-it-happens-on-live-television/

http://www.ghacks.net/2009/10/15/top-5-security-plugins-for-firefox-chrome-and-internet-explorer/

I will try to update the lists all the time, please share your views and thoughts to make this list better and secure for all.

Thank You for your patience.

© Ramen Mukherjee

The first important thing is to control yourself, most problems occurred for loosing the self control while online. For other things I first suggest using Firefox, why? Because no matter how much google brags about their browser, it has several flawed loopholes and exploits which in turn actually helps to spread these kinds of malwares. Don’t you are surprised that none of them are attacking google+ or Orkut ?? Strange isn’t it? Anyways without getting intro controversies I must say that protection you can get by following a 3 LAYER architecture.

• 1. First Layer is Social Network / Website Security. in this case it is Facebook.
• 2. Second Layer is Browser Security
• 3. Third Layer is Computer Security.

But the problem is that often we forget to protect the middle one, which is I am trying to focus here.

The First Layer (Social / Web Layer)–

1. Hide all your personal albums. Share your photos with only selective group of members. Don’t make them public. Disable photo tagging.

2. Make your private album such as profile picture strictly private to yourself. Remember we are focusing on security here.

3. Don’t reveal too much of yourselves on internet, don’t reveal all of your information which however can be used to actually GUESS your account informations. Remember always that you cant trust online anyone, no one is your friend, so don’t share anything personal over the net, it may happen that your most trusted friend’s profile got compromised and that hacker knew all of your secrets to hack into YOUR profile.

4. Don’t ever show your login email id in your profile to public. Make it a strict private. Remember that a hacker needs two things, one your login email id and another is password, which in most case are easy to guess, because people tend to use passwords related to their life, and revealing to much of their lives in public would increase the risk to get guessed easily.

5. In your settings, enable login notifications both in email and text, activate your mobile number but strictly make it private.

6. Delete all unused apps, actually what happens is that once you permit any app to access your details, later that app can get compromised and by your permission that corrupted app can leak you’re a/c info. So don’t use any app, if you do then delete it after using it.

7. Don’t blindly click on any link, photos, videos AYTHING Even the clicking on the last portion of any long post’s “see more” can be manipulated to forward you to a phising site. For that use a linkchecker, like AVG linkscanner, bitdefender trafficlight, WOT etc …which can check the link.

8. Always keep a strong watch on when you login and how many times you login, and if you can then from which ip you are logging into. THIS IS VERY IMPORTANT because you may get wrong login timing in facebook’s notifications, wrong locations also due to their different location of servers, but the IP address is always accurate.

9. Change your password often and securely, use a random password, use password maker for that.

10. Enable secure browsing so that your channel to Facebook can become encrypted so less eavesdropping can be occurred.

11. Don’t ever use any proxy services to logininto Facebook, it will make frequent lokups in Facebook and later Facebook will realize that you are a glob trotter and then they will loosen the security so that you can login smoothly.

12. Don’t use OPERA TURBO while logging onto Facebook, because opera turbo is also a proxy based service which compresses the website to save bandwidth, but in order to do so your info get bypassed by another server and if that server gets compromised your data can get leaked, also OPERA TURBO tends to save data for reuse it. DON’T DO IT EVER.

13. Always LOGOUT and clean your cookies. It will be good if you enable automatic cookie cleaning at the exit time of the browser. BUT before logout you MUST delete the device from Facebook > setting > devices. So that if somehow anyone got the session cookie he/she can never use that to login into Facebook again.

14. Use a password manager (ex: last pass) which uses encryption and never enter password with physical keyboard, if you need to, then use virtual on screen keyboard which is in windows, linux, mac os x.

15. Use MOBILE PIN feature of Facebook if you are using Facebook from mobile and using Facebook sms service.

16. Always keep your mobile phone locked so that no one can use your mobile to access Facebook. Don’t let anyone to access their profile from your phone, don’t access your profile from anywhere, if you do keep in mind to clear the cache, cookie, history, and password, remember again to LOGOUT PROPERLY.

These are very common steps, but these steps can ONLY make your profile safe from Facebook attacks. To actually not get infected physically (machine wise) you need the later two tiers of security

The Second Layer (Browser Layer) –

1. Always use a secure browser. For me I ONLY trust Firefox on any platform, IE9 is also great but it seems that it stopped supporting flash, another thing is that IE9 is fast secure but not reliable due to its past records and it can be easily manipulated. Apple Safari is great BUT ONLY in Macintosh, not in windows, OPERA is good but it seems that majority of websites are not supported in it. Again OPERA is not FAST ENOUGH unless you use OPERA TURBO, which is again FATAL for social networks specially Facebook (as I explained above). Lastly Google Chrome, well this is the most used (thus abused) browser, the problem is that you cant tune chrome for becoming perfect, its DNS PREFETCHING is the problem why these attacks are getting spread day by day. Again google’s sync is the problem where even if you delete any app from your pc it gets back in the next sync, or if you use chrome in another pc.

2. In firefox there are lots of addons which are trusted from decades and very much secured, I am not telling you to blindly trust them, just keep on updating them and firefox. These are –

• No Script – The one add-on that many security experts do not want to live without. No Script can block script execution on websites. It does so on all websites by default with the option to enable specific scripts temporarily or permanently. The add-on can prevent script based attacks (most of them are) if used correctly.
• Last Pass – The password manager for Firefox. It can generate and remember secure passwords, fill out forms and even auto login the user into websites. The three important security related features are secure password generation, password storing and auto login. Secure passwords have the weakness that they are hard to remember. It is simply easier to remember 123456 than f&z_cU!;re4xZ especially if you consider that unique passwords should be used one every website. With Last Pass users get unlimited secure passwords with the need to only remember the master password. The auto login feature can be very effective against phishing attacks as it won’t work on phishing websites that use a different url than the original.
• No Redirect – A versatile add-on that handles several things at once. It will reveal the destination url of short url services and prevent that Internet providers and other companies use DNS hijacks to show their (search pages). This does happen for instance with many major ISPs if the user mistypes a domain extension.
• Link Extend and Web of Trust – Link Extend and Web of Trust provide a similar functionality. They provide website ratings to inform the user about potentially dangerous websites. Both display ratings in major search engines but also in a toolbar for the active page.
• CS Lite – Cookie permissions on a per-site basis. Allows the user to block or allow cookies permanently or temporarily.
• Backup: Febe Firefox Backup. It is always a good idea to create regular backups to be prepared when data gets corrupted or deleted. Febe is a Firefox add-on that can backup all profile data of the web browser including bookmarks, settings, extensions and passwords.
• Flash Block – This is the closest to the No Script Firefox add-on. Flash Block will only block Flash content but not other script related objects.
• McAfee Site Advisor bookmarklet
• Adsweep, Adblock and Adblock+ – Two options to disable most advertisement that is displayed on websites. These add-ons are more about the annoying objects on websites and less about security. They can however be helpful in situations were rogue ads are displayed that spread malware.
• Web of Trust or Trend Protect – Both display ratings for the active websites and websites that are listed in the major search engines (Google Search, Yahoo Search, MSN). They can be used as an indicator if a site’s potentially dangerous to visit.
• Perspectives - Securely bypasses Firefox HTTPS security errors by verifying certificates using a collection of Network Notaries.
• Bitdefender Quickscan – it is a online virus scanner inside Firefox so that you can scan while you surf.
• Facebook Phishing Protector – saves from XSS and several Scripting attacks
• HTTPS Finder & HTTPS Everywhere – enhances your web browsing experience while securing the channel using encryption and validation so that you can know that the website is validated and the channel is secure. This provides another way to see the info if the links.
• Bitdefender Trafficlight – it is an addon to Firefox which enables user to surf securely, it checks the links visited, it is also intergraded into Facebook so it saves from unusual activities and hacking also.
• WorldIP – it enables you to quickly check YOUR IP so that later you can verify that IP when you get login notifications from FACEBOOK.
• Ecleaner – now many times we come across faulty apps, but even after uninstalling them from firefox some of their remains, this addon removes them all.

These are few useful addons which I personally tested, I am sure there are more. Just look at the subjects of security which are written in all above points, and you can use any other addon which YOU trust for that. Alternatively you can use private browsing modes to login into social networks or email account.

The Third Layer (Computer Security) –

1. This layer is pretty simple to understand as it needs nothing special which you don’t know.

2. Use a good antivirus. I use AVG FREE and its damn awesome, all settings turned to max, linkscanner active, infact this is the first application which prevented the malware from the Facebook SCAM to get loaded into my computer, archive scanner running always, memory and USB drives gets scanned all time, protection to the c drive and windows directory gets priority, its active security system is awesome.

3. Use a good firewall, I use windows 7’s default firewall which is very secure, but I use some tricks and tuned it to maximum, cant share these settings publicly for my security. Don’t get access right to all programs. Specially FAKE P2P softwares like kazaa, frostwire, etc .. However Torrents are secure. But clients like bitcomet is not. Use utorrent or bittorrent. They are the best. vuze’s java based plugins are not safe also it takes huge memory so don’t use that either. The problem is that the best client of torrents don’t work in windows which is transmission. Close all ports don’t open unnecessary ports, while using XP, please don’t increase the prescribed limit of HALF-OPEN ports. This will be fatal. This will help to spread the virus faster.

4. Make UAC in windows7 to MAX, this will help you not to get infected accidentally by any malware.

5. But for today’s environment where 0 days attacks are getting increased you should also use something more, that’s CLOUD PROTECTION, while I found IMMUNET FREE working superbly in windows x86 architecture, PANDA CLOUD FREE is working awesome in windows x64 architecture. Cloud / online protections are lightweight, don’t need any update, always ready to work, and you only need to be online to get the protection.

6. Use free garbage cleaner like IObit Advance Systemcare or better use CCleaner, this is a tiny free tool which provides all the functionalities. Use this to sweep all registry data, histories and most importantly cookies.

7. Use free proxy like TOR-VIDALIA bundle, systems to securely surf the web and email BUT DON’T USE IT FOR FACEBOOK; this will help to hide your security online. Never show your official private email ID in Facebook, Facebook has its email id, use that instead, but however if you need to show your private email in Facebook then you MUST use proxy to send mails as without protection anyone can see your IP in mail header.

8. If you are stuck with windows it is high time that you invest in ORIGINAL windows because with frequent updates windows, defender, IE, NETWORK DRIVERS, firewall & UAC rules will get updated, so that you can stay protected online.

9. always use an offline mail software to send and receive mails, what happens online IMAP access that the contents of mail gets loaded automatically then they are checked, so the changes of getting affected by steganographed viruses, so while using POP and SMTP the mail gets checked 2 times, one at the provider, second at your own computer, so you can be more secure. Also don’t download attachments from all mails that could have a virus.

10. Always encrypt the mails before sending, windows live mail writer can do that automatically BUT ONLY if you are using hotmail (windows live mail), but you can use PGP, TRUECRYPT also to encrypt the mails.

11. Enable bitlocker in windows 7 for c drive and windows so that no virus can harm. Also this will make sure that no malware can corrupt the firewall and antivirus.

I will try to update the lists all the time, please share your views and thoughts to make this list better and secure for all.

Thank You for your patience.

© Ramen Mukherjee

Credits –

1. http://www.ghacks.net/2009/10/15/top-5-security-plugins-for-firefox-chrome-and-internet-explorer/

2. Mozilla Firefox addon repository

yesterday i was invited for the Young India Fellowship, a fully scholarship based 1 year integrated course, today i submitted their online form, but in order to do so i had to ask something from me, and here are the results of their questions -

What matters the most to you and why?

The thing which really matters to me is SUCCESS. For me it is not any materialistic achievement like to have a big car or big house, it is not any mental pleasure like having a loving wife or to have nice kinds, it is not again any degree like MBA, PhD, it does not means to me any position like VP, CEO, MD of any fortune 500 company, not the life situation of state where I don’t have to worry about money ever, SUCCESS to me is where I accomplish the task perfectly which I wanted to do, and have done it the same way I wanted to do, simple or complex, highest paid or lowest, and I also get to know something new. SUCCESS is not what you buy, it is to be EARNED. Facing Challenges makes me able to learn something new, no knowledge goes unfruitful and by applying those knowledge I do my work passionately. To leave a mark a person needs to be successful on their own terms not others. I believe in this. So it does not matter anything if you don’t get SUCCESS in life and SUCCESS does not have any names or degree.

What has been your biggest achievement so far and why do you consider it to be so

My biggest achievement so far is able to design and maintain a personal blog-website of myself, http://www.myfullydigitallife.co.cc with all free Technologies available. None of my friends even lolling around with their BCA syllabus where I gone far ahead by ACTUALLY creating something practical out of my knowledge. I have also made a Web Browser “WebTrotter”, a Compression Software “Kompression”, a Chat Server “HushTalk”, I played around many scripting, maybe they sound more technically geeky than making a small website, but still for me this is my biggest achievements compared to others of my same calibre. I have also faced many hard challenges while troubleshooting computer systems in my freelancing job where I used to repair computers for extra pocket money, they are hard because at my age I am solving the problems which other high paid engineers failed to do. I have done a s/w course from government organization at class 7 where the minimum requirement for this course is secondary examination pass. But why still making that website was so valuable for me? Because that made me MENTALLY SATISFIED, it brought me a taste of SUCCESS and also global recognition, which I wanted to have from the very beginning.

What do you hope to accomplish from the Young India Fellowship?

As I studied more about the program of Young India fellowship, I realized that this program can help me to shape myself as I do. As the biggest challenge with the Indian Private Education is the cost of the good education. But as of YIF, I can get a scholarship. The curriculum is very dynamic, no wonder it would be hectic but by the process I hope it will also teach us the very basics of management, management of everything, be it time or yourself. The essence of management will make me able to sharpen not only my skills but myself. By the knowledge gathered from this express course combined the skills of my graduation, I am sure that I can get SUCCESS in the way of my career goal, as I aspire to become a software professional and for that learning the basics of team game is a very prime objective as developing quality software is not a one man show. But this course will definitely broaden my outlook also and nevertheless I get to meet new people and can experience something new. It will be a chance of a lifetime when I will get an experience of lifetime.

Do share with us any other details that you think might add to your candidature for a Young India Fellowship.

As I belong to a very poor family, my father is retired, my father is not fully able to provide me with costly education, YES I know that government institutions can provide me low cost education but surely I don’t posses such level of calibre to get into one with my trend, also being a general caste boy I cant get any scholarship from anywhere, I tried many. We don’t have any such assets to keep mortgage and get a study loan. so I hope doing this 1 year course at YIF, can make me able too find me a good place where in place of spending family savings I can actually provide them something, my family sacrificed a lot for me and I think this might be the change of giving them a small piece of joy. But in the end I will not pledge to take pity on my financial condition because despite of everything my values never permit to ask for so. If you find me eligible, then give me a chance, this is all I want you to request.