Arriving at the Frankfurt airport late in the evening. The flight was almost on schedule so I have some 30 minutes left before the final leg to Helsinki. A nice opportunity to check my mail and the latest headlines. What a blessing with free WiFi on the airports! And Frankfurt is no exception; the “open network available” -indicator is on when I grab the phone. And there we have the welcome-screen that pops up in the browser. But wait a minute, this one looks different. “Please fill in your mobile phone number and select your country. We will send you an SMS with details about how to log into the wireless network.”
Stop! You should always stop and think when an unknown website asks for your mobile phone number (well, actually when asked for any kind of personal information). Knowing your number is the key prerequisite for someone who want to scam you with premium rate text messages. Ask yourself the following questions when you encounter a page like this:
Most people already know that one should be careful when entering mail addresses at fishy websites. Your junk mail folder may start to fill up much faster than before. But what about your mobile phone number? It’s easy to forget that the mobile number is a key to a billing system. It can be a lot more harmful if it gets in the wrong hands. You may get an unpleasant surprise in the next phone bill.
How does the scam work? Someone puts up a web page where you can sign up for anything that sounds interesting. A lottery is a typical example. Your phone number is required as part of your personal information. And you are of course keen to get it right as you want to make sure they can reach you if you win. There’s also the usual checkbox indicating that you accept the terms, but who cares about those legal details?
Well, you should care. Somewhere deep down in the terms there is a paragraph where you agree to receive informational text messages, or whatever they are called, for a price that can be several Euros each. Yes, that’s right. The billing system of our mobile phones supports messages that are paid by the recipient. This scheme is not even illegal as you have agreed to receive them. And needless to say, the sender is impossible to reach if you change your mind and want to terminate the agreement.
You should leave out your phone number or steer clear of the site if you have any doubts about it. If the organization isn’t trusted, but you still feel that you really have to participate, get familiar with the legal terms. Yes, I really mean reading them!
Another variant of the scam is to send you an unexpected text message that invites you to a quiz, a lottery or something else. Responding to the message means in practice that you sign up to the scam.
So what about Frankfurt? Well, the page asking for my phone number was pretty nicely designed. It looked legit. But there was a legal document that users must accept. So I decided to not use the network. It’s much nicer to spend the remaining 20 minutes before departure reading a good book about sailing in the Mediterranean than reading legal terms.
PS. I’m of course not claiming that the Frankfurt network login is a scam. The point is that I can’t know for sure, and I don’t have to take the risk as the benefit I could have gained was very small.
Photo by whiteafrican @ Flickr
On Tuesday Apple announced its latest iPhone models and a new piece of wearable technology some have been anxiously waiting for -- Apple Watch. TechRadar describes the latest innovation from Cupertino as "An iOS 8-friendly watch that plays nice with your iPhone." And if it works like your iPhone, you can expect that it will free of all mobile malware threats, unless you decide to "jailbreak" it. The latest F-Secure Labs Threat Report clears up one big misconception about iOS malware: It does exist, barely. In the first half of 2014, 295 new families and variants or mobile malware were discovered – 294 on Android and one on iOS. iPhone users can face phishing scams and Wi-Fi hijacking, which is why we created our Freedome VPN, but the threat of getting a bad app on your iOS device is almost non-existent. "Unlike Android, malware on iOS have so far only been effective against jailbroken devices, making the jailbreak tools created by various hacker outfits (and which usually work by exploiting undocumented bugs in the platform) of interest to security researchers," the report explains. The iOS threat that was found earlier this year, Unflod Baby Panda, was designed to listen to outgoing SSL connections in order to steal the device’s Apple ID and password details. Apple ID and passwords have been in the news recently as they may have played a role in a series of hacks of celebrity iCloud accounts that led to the posting of dozens of private photos. Our Mikko Hypponen explained in our latest Threat Report Webinar that many users have been using these accounts for years, mostly to purchase items in the iTunes store, without realizing how much data they were actually protecting. But Unflod Baby Panda is very unlikely to have played any role in the celebrity hacks, as "jailbreaking" a device is still very rare. Few users know about the hack that gives up the protection of the "closed garden" approach of the iOS app store, which has been incredibly successful in keeping malware off the platform, especially compared to the more open Android landscape. The official Play store has seen some infiltration by bad apps, adware and spamware -- as has the iOS app store to a far lesser degree -- but the majority of Android threats come from third-party marketplaces, which is why F-Secure Labs recommends you avoid them. The vast majority of iPhone owners have never had to worry about malware -- and if the Apple Watch employs the some tight restrictions on apps, the device will likely be free of security concerns. However, having a watch with the power of a smartphone attached to your body nearly twenty-four hours a day promises to introduce privacy questions few have ever considered.
Our Freedome VPN service hit a new milestone this summer. We added our newest location in Paris, France and now have 11 nodes in 10 different countries: Canada (Toronto) Finland (Espo) France (Paris) Germany (Sachsen) Italy (Milan) Netherlands (Amsterdam) Spain (Madrid) Sweden (Stockholm) United Kingdom (London) United States (East Coast) United States (West Coast) That means regardless where you are in world, you can pick any of these locations to mask your whereabouts and use any of the services you love. Freedome also acts a VPN to encrypt your data so a free Wi-Fi network is safe for private transactions along, and it includes anti-virus, anti-tracking, and anti-phishing. It's been localized into 10 different locations and will soon be available for iOS devices. If you travel -- our just want your phone to think you're traveling -- this is the kind of protection you need. Get it now from the Google Play or iTunes store. Cheers, Sandra, [Image by jvieras via Flickr]
This May, the GameOver ZeuS botnet made history by becoming one of the largest botnets ever seized by law enforcement. Unfortunately, it's back at work. BankInfo Security's Mathew J. Schwartz explains: Nearly three months after the FBI, Europol and Britain's National Crime Agency launched"Operation Tovar" to successfully disrupt the botnet used to spread Gameover ZeuS, the malware is making a global comeback. Gameover ZeuS is a Trojan designed to steal banking and other personal credentials from infected PCs. At the time of the May law enforcement takedown, the FBI estimated that between 500,000 and 1 million PCs worldwide - one-quarter of them in the United States - were infected by the malware, which the bureau says was used to steal more than $100 million. Our Security Advisor Sean Sullivan notes that "there isn't a 'flood' of new GoZ variants". F-Secure Labs has looked at the recent threats and one of our experts has a theory about their origin. Our analyst most familiar w/ GameOver ZeuS just took a look at the latest GOZ samples. His verdict: it's very clearly the work of Slavik. — Sean Sullivan (@5ean5ullivan) August 27, 2014 Find out the latest about GoZ from Sean and Mikko Hypponen on 5 September in Threat Report Webinar live from Helsinki at 10:00 AM EST. What should you do? Our Online Scanner detects both new and old GameOver Zeus variants. Check your PC for free now. Cheers, Jason [Image by delunula dot com]