Social Engineering

I received an email today, from a well-intentioned friend that I knew instantly was a hoax that they had forwarded.

We’ve all had them at some point in time “Send this to Bill Gates and 20 friends, he’ll send you a million dollars” for example, they may seem harmless and the opinion is often, well I’ll forward it in case… This kind of ‘too good to be true’ scenario is just that.

But why would anyone bother going to the trouble of starting this kind of chain mail?

Think about the bandwidth that gets wasted, let alone the time for people to click delete or the extra split-second to retrieve your email.

But more importantly, you are enabling thousands of personal emails (often including valuable information like a person’s workplace and telephone number) to potentially get into the hands of internet fraudsters.

Graham Cluley, senior technology consultant from Sophos warned last year: ‘I would advise users intent on sharing these chain emails to check the website of the company apparently making the offer to determine its authenticity, before deciding to click the ‘forward’ button.’

Simple logical advice.

But this is just chain emails and for most of you (I hope) preaching to the converted… what this lead me onto was to consider some of the “harmless” apps that are available on sites like facebook.

Remember the school yard “What is your pornstar name?” lets imagine there is a Facebook app that shows you my “pornstar name” and asks you for yours… not sure what yours is? Well, its your mothers maiden name and your first pet…

…hold on a minute…

…what would be two key security questions you might need to retrieve a lost password? How many profiles include an email address on facebook – combine the two by “allowing this application to access data about you” and an innocent app suddenly has very real and valuable information.

Social Engineering is about exploiting your very human desire to share, in clever ways to extract information about you and those around you.

The most successful viruses of recent times, have been the most simple – sending an infected zip file with a title that entices you to open it. No amount of clever protection can save you from yourself!

Read More

Naymz

I’ve had a few clients/contacts asking about Naymz recently, so I thought I’d start of the site reviews with some thoughts on Naymz.

At first glance, it’s another social network aimed at business users, mainly US focused and with a rating system within your network.

On sign up, as well as the usual invite your friends/contatcs through email address books, it also allows you to give them your LinkedIn or Plaxo details to invite your contacts – interesting – all the usual stuff is there, describe yourself, upgrade to premium to add these extra bits (ie linking to a personal domain).

Usage wise it all looks n feels, ok, nothing groundbreaking – the amount and positioning of Ads on the site is perhaps a bit excessive (too large and in the middle of the page – making some bit feel cluttered).

They’re slightly different to the usual networking sites though in that their main up-sell is “reputational repair” – confused?

If you search for your name on google and you don’t like the results, they’ll do their best to “repair” that reputation for you, to quote from their own site:

“I had a securities violation that was over 20 years old that kept coming to the top of Google for my name. Naymz was able to put a flood of positive information on the web about me that pushed down my old mistake.”

Michael P. – Financial Advisor

Now there are 2 things here that worry me:

1) They’ve set up their site in contrast to Google’s own guidance on best practice.  The content of the website is not designed for a human visitor, it includes an A-Z type link chunk on each page as a way of trying to bolster its rankings for each name, click on one of those and you get an even uglier chunk of names, again purely for the Google spider. This probably works well, but note that Google could take a dim view on this and blacklist the site.

2) They will “flood” the Internet with positive information about you – there’s something that is almost (and for want of a better word) unethical about this. Surely knowing that a Financial Advisor had a Securities Violation in their history is something I should find? If he had other information on there to balance the search then this wouldn’t be such an issue.  Flooding the world with my information, isn’t something I’d want a company to do.

Perhaps I’m missing a trick here, maybe there is more to Naymz than being just A.N.Other social networking site with an up-sell to “reputational repair” for people who don’t have much online presence… what do you think?

Please add your comment below.

Read More

Facebook and working from home- can they co-exist?

The way I have structured my business means that I can work from anywhere and at any time, so long as I have a web connection.  Everything from my CRM (via Highrise) to project management (Basecamp), even my accounts package, is all online.  I log into my VOIP, my 0845 number is active and I’m ready for business.  Right now I mostly work from home, and when I started my business I began to track my time.  I tend to spend a lot of spare time on the web anyway, and work and social tend to get mixed together.  It’s really easy to get chatting to someone, or check Facebook now and again, or get on a load of random forums.  I started to find it quite a struggle not to get distracted, and simply demarcating the time didn’t work for me.  All that ended up happening was that I’d be in this work/social blend all day and all evening.

The key for me in the end was simple- I loaded up another browser (Flock, lovely for social networking addicts), and transfered everything personal onto that, all my bookmarks, my email, my social networking logins, all my RSS feeds (so many blogs so little time).  I then crafted my orignial browser into a work powerhouse- I sorted out all my bookmarks, loaded up work-related RSS feeds and spent some time just getting the browser to feel like I was “at work”.  And equally, my Flock browser has no end of stupid add-ons, fun stuff and time wasting opportunities.  The simple act of doing this, and loading up the work browser during work time, and the social browser during out of work time has seen my productivity rocket.  In fact I would go so far as to say that I spend less time on social networking than I did when I was employed by someone else.  It’s gone a long way to separate work and play and has made me far less stressed in the process.  It’s worked so well that i’ve done the same on my laptop, and have even used Foxmarks to synch my bookmarks for both browsers across each machine.  Now, wherever I am, if I feel the need to chill out, I close work and open play.  It’s clear to my mind that this is non-worktime, so I’m so much more inclined after a few minutes so log out, close Flock and load up work.

Simple but effective!

Read More

Reviewing Social Networks?

I had a discussion today, along the lines of “which social network is right for me?”…

An interesting question, in this instance myspace was probably the offering is music/arts related… it led me to think further… I’ve tried LOTS of social networks and I get asked this quite often – maybe its something I should do on here?

Would you be interested in “reviews” (for want of a better word!) of social networking sites?

Answers on a comment below.

Read More