Order of the Bath

Today is Safer Internet Day 2010 and [one of] the slogan[s] being promoted is “Zip it, Block it, Flag it”; I suppose the principle is ok but this is not the language that kids understand however we are stuck with it. What it means, and I had to look it up, is Zip it—Keep stuff private, Block it—Block nasty people, Flag it—Tell someone if anything bothers you. There is more detail, but that is the gist of it; make it too complex and they won’t remember at all. Seeing as this program was announced back in December by the Prime Minister, it is not exactly prominent!

Anyway, I would like to add another one, not for the kids, except perhaps the older ones, but for the parents—Log it.

Most instant messaging (IM) and chat systems have a mechanism that allows a permanent (private) log to be made of all conversations. Switch it on. That way, if there is any doubt or worry then it can be reviewed and, when it is all in one place, trends and tendencies can be spotted more easily. Of course, for young children it is only a reminder because you are always there with them when they are on line **AREN’T YOU**. Older ones are entitled to a bit of privacy so if there are any concerns then you can discuss it with them and review the log together. Without the log there is no evidence that you can see (there are server chat logs which the police can use if an offence is suspected). But, beware, some chat systems also have public logs available where conversations can be seen by anybody. This is not usually a good idea.

Footnote: these are really rotten web sites, they don’t work properly with all web browsers, some make sounds which you can’t turn off and one feature only works with IE 8, a browser only used by 15% of users. The real web site is ceop.gov.uk but there are bogus ones at ceop.org.uk and ceop.co.uk designed to mislead you.

When I was a child, one of the things I loved to receive at Christmas and birthdays were gift cards. In those days it was book tokens and it meant that I could get something that I wanted rather than chosen by a rarely seen aunt who had forgotten how old I was. Later on it became record tokens but after a while these became a problem because few shops would take them where we lived. However, I think book tokens are still going strong.

In latter years everyone got into it and there was a big growth in store tokens. Everyone from the big department stores to smaller specialist chains had their own gift tokens; even some individual shops did it.

Recently there has been a move away from the denominated slip of paper with banknote like swirls, embossing, holograms and markers to a plastic card that looks like a store discount/loyalty/charge card. With this have come some security problems which are causing many people grief. The victims can be the shop or the customer and the perpetrators can be the staff, the public or third parties. I will concentrate on the problems for the customer because they have no control over the system.

The cards themselves are low security. They have a number which is duplicated by a bar code and sometimes by a magnetic stripe. Some cards also have a PIN which is initially concealed by a scratch-off covering. When the card is purchased it is “loaded” with money but this does not get recorded on the card itself but onto a central computer system. When goods are purchased with the card then the cost is deducted and any balance remains in credit. In order to provide the customer with documentary evidence a receipt is issued every time a card transaction takes place which shows how much is left on the card and this can also be checked at any time, either in a branch of the shop, by telephone or online.

How can you be conned? There are a number of holes in the system from old fashioned deception though to weaknesses in the system.

• One way is that the card you are given when you buy one is not the card that was loaded with the deposit, it has been switched by the cashier. As this is likely to be a gift this is not discovered until little Johnny tries to buy his new trainers or whatever and then often not followed up because the parents don’t want to trouble the old guy that gave it because perhaps he did something wrong.
• A similar switch can be pulled when spending a card with the cashier returning a different card with less on it or claiming the one presented has less on it than it does.
• The other one I have heard of is even more blatant. When you buy the card, you are not given it, just a gift wallet containing the till receipt. When questioned, the cashiers have said that that is the token, there is nothing else. This was observed a few times when they were new and could have been partly down to poor staff training but in many cases they were not reported because it was thought that “aunt Millie had lost it before giving it to little Johnny.”

The cure for all of these is to observe closely everything that happens. When you get the card initially make sure the number on the card matches the one on the receipt and write that number on the inside of the gift wallet. Then when each transaction takes place, make sure the new receipt matches the same number and the card number is still the same. Also demand to have the empty card back, it is yours. If there is a significant amount of money on it then separately check the value using the phone/online system or another cashier.

There is one final scam which is enabled by the poor system design and there is not much that the customer can do about it.

• The cashier selling the card has already noted the number and/or copied the card—if it is a bar code then a photocopy will do. They then spend the money on it before the legitimate owner. This is quite common around Christmas because they know that the card is unlikely to be redeemed until the January sales. It is very hard to prove that you haven’t spent it yourself because the shop has records that you have.

The flaw in the system here is that there is no interaction with the real card like there is with a Chip-and-Pin credit card. For online transactions they use the scratch-off PIN to verify that you actually have the card but in the shop there is no similar verification if you are on the inside—i.e. staff.

These observations were made on one brand (the M&S store card) but I am not picking on that one in particular because they all have similar problems. Perhaps there are some with real security but I haven’t seen one. These are being treated like real money, they are already as vulnerable as cash because there is no recovery if they are lost, yet the value can be spirited away from you without you even knowing.

This is one for the boys—not. We have discovered that it is mostly the girls who are caught up by the Farmville type scams but this time it is the boys using Facebook that have to look out. There is a very sophisticated worm about (a worm is like a virus but crawls through web sites rather than directly between PCs). If you see someone’s profile picture has become a rather curvaceous girl in a Bikini then *don’t* click on it. If you do, then three things will happen. First you will be taken to a web site which contains rather a lot of porn. Secondly, that web site will download a lot of nasty stuff to your computer such as programs that steal account details. Thirdly, your profile will be changed to include this picture so as to attract other mugs victims. I said sophisticated at the start because it uses a lot of different techniques to trap you, from the initial social engineering making you think with the wrong part of your body through to clickjacking which is a page layout technique where you think you are clicking on something innocent (ha!) but actually saying yes to something important hidden underneath. As Roger Thompson says in a parody of Trooper Truth, “Keep safe, folks.”

If you are not aware of it, Farmville is one of the many addictive games that are available in Facebook. It is not the only culprit in these deceptive marketing techniques but among the best known. What you also need to know is that the lure is the internal currency used in the game. There is a thriving market in this to rival some minor real world currencies. For those that refuse to part with actual cash to buy the stuff then they try these sub-games.

At the end it says “Farm Cash awarded after the submission of a valid mobile number and PIN confirmation.” What they don’t say anywhere obvious is that sending this PIN number back to them as “confirmation” subscribes you to a mobile service which will cost you $9.99 US per month (there may be different versions in the UK). This is only one variation that makes Farmville and its associates part of a multi-million dollar business and as a side effect, the advertising boots the profits of Facebook. They don’t have the muscle to stop it but, when there is this benefit, why should they bother.

Thanks to SunBelt for the lead and TechCrunch for the detail.

I just had a “Help desk” call from a friend who relayed a phone call he had received earlier this morning. The caller knew his name and address (and obviously his phone number) and then went on to say that his PC was running slow and was having problems and they could fix it for him. To demonstrate they asked him to open Start==>Run and type “eventvwr” which would open a window, then click on “System” and he would see a lot of yellow triangle warnings and red cross errors which showed that there were problems. They then said that they could fix it remotely but the conversation never got far enough to say how as he became too suspicious.

On further questioning, during which he was passed between three different people, he discovered that the company was called SupportOnClick in India at www.supportonclick.com and could be reached at a UK number in Bradford 01274 900834. This looks like a legitimate web site for a PC support company which works in America, Britain, Australia and NZ and I suspect that the next stage of the call would be a connection via Remote Desktop and they would do something innocuous and then try to sell you a contract for three years.

I don’t suspect that this was a criminal scam, either obtaining personal bank details or infecting your PC with malware but the methods are certainly deceptive—the mechanism they used to “demonstrate” that there were problems will always show some errors. It is useful for diagnosing problems but not worrying of itself. I suspect that they are just working down an electoral roll or some other mailing list; the majority of people they call will have a PC these days. Doing a web search I find that some people are not so lenient and, as they seem to use other deceptions like passing themselves off as from Microsoft or your ISP then perhaps it is more sinister and they are trying to sell bogus AntiVirus software after all.