Your Federal Reserve Bank account has been accessed! Again!

Phishing is an ever-growing problem. Even if you realize the website to which you are directed is not the one from your bank, you are still vulnerable to a number of things. Check out my previous post for the serious side of things.

For some of us, it is one of growing amusement as well. I have a list of email addresses from various companies I forward phishing email to. ("Your Citi account has been violated!" yeah right.) Since I never get just one, I put the report-phishing email addresses in my addressbook. I've got one for the head of security at a credit union. The second time I sent him something, he sent back a thank you, as he hadn't seen that one or the website they were operating from. The last time I sent him something, I said any time he wanted me to stop, just let me know. Haven't heard a thing. I hope some yah-hoo doesn't decide that I'm this great world traveler, based on the "accounts" I have all over. According to the email I get, I have accounts in Alaska, Alabama, Kansas, Indiana, Texas and Tennessee. Oh, and two different accounts in Hawaii.

Man, do I travel a lot, or what?

And with Citi, BofA, Chase, Amazon.com (my credit card with Amazon had been accessed - does Amazon have a credit card?), an assortment of credit unions, the National Credit Union Association (they don't have accounts - I'm waiting for the one about my account with the Federal Reserve Bank), Visa (visa doesn't have individual accounts either), and a host of others.

I choose to be amused. And fight back. To report phishing or spam, these email addresses are useful:

reportphishing@antiphishing.org

spam@uce.gov

Your Federal Reserve Bank account has been accessed!

Phishing is an ever-growing problem. Even if you realize the website to which you are directed is not the one from your bank, you are still vulnerable to a number of things.

• The most common vulnerability, of course, is entering your username and password. The phisher now has that, and can access your account(s) at will.
• You can, and often do, get cookies containing malicious code from these phishing websites. Since most sites require you to be able to have cookies enabled to be able to use the site, most people accept most cookies. Most are harmless marketing tools. Those few that aren't, however, can contain software called "key loggers," that logs all keystrokes you make and then forwards them to the phisher. This means every time you type in your username and password, the phisher gets it. For every account you access. Personally, I delete my cookies once a day, and more often if I've gone to a web store to buy something. If I get popups, I very definitely delete my cookies. Most are harmless, but I can't tell which are which. And don't want to take the time to learn.
• And since Microsoft makes its software so very helpful, Internet Explorer will easily accept what is called a "browser helper object," to help make your browsing experience friendly and helpful. Your Yahoo or Google browser bar is a browser helper object, one you chose to add. And Yahoo and Google want to continue to have your business, so they aren't going to do anything to ruin their reputations. Going to the wrong website and clicking on the wrong thing will get you malicious, possibly invisible BHOs. Your virus software often does not catch these. Try searching for "spyware removal" software, which can get rid of most of these. I spent two weeks and several phone calls working with spyware removal companies, to find one such. The hackers had changed its name and changed where it was saved on the system. I found it, finally, and reported it.

I have a list of email addresses from various companies I forward phishing email to. ("Your Citi account has been violated!" yeah right.) The two you will find most useful are:

reportphishing@antiphishing.org

spam@uce.gov

Just so you know, the Federal Reserve Bank doesn't have individual accounts.

Should ISPs be accountable for overall Internet security?

How?

Let's start with a basic understanding of what you're looking at. Right now, it's my blog. It has graphics, text, formatting, and all these pieces sit on the blogspot.com server. When you got here, your browser software asked the blogspot.com server for those pieces. Blogspot said sure, no problem, and started to send them.

Due to the way the internet was originally designed (and unless you want to spends billions and billions of dollars moving everybody to a new system, you're stuck with it), things are broken up into smaller byte-sized pieces, wrappped with identifiers called headers, and tossed out into the maelstrom. I don't have a clue how many packets my blog gets broken into, but let's use the number thirty(30) as a working number. Blogspot.com, point A, sends the first five packets out to point B. Point B suddenly gets buried in stuff from somewhere else, so blogspot.com sends the next five packets to point C. Point C is doing ok, so blogspot sends the remaining twenty packets to point C, too. So now we've got five going one way and twenty-five going another. Point B has a good connection down the line, so it sends the five packets on to point D, which in turn connects to points E, F and G. G is your home ISP, and they hand those five packets to your browser. Meanwhile, point C hands off five packets to point H, which says everything is fine so point C hands off five more. But wait! Point H suddenly gets a bunch of stuff from somewhere else, and point C now must hand off the remaining fifteen packets to point I. Point H is so overwhelmed, it can only hand off the ten packets two at a time to point J, who in turn hands them to K, L, O, Q and Beta. Somewhere in there, they finally make it to G, your ISP, and then to your browser. Meanwhile, the fifteen currenly at point I get handed off as a group to point M, which again due to traffic, breaks them up into five packet pieces and hands them off respectively to N, P and S. N's got a direct connection to G. P has to send its packets thru R, then Y and then to G. S has to send one packet each to T, U, V, Z and alpha. Alpha needs to hand off to X before it can get to G, but the rest can hand them all to point G, which gives them to your browser. Your browser now can put them all together and you get my blog.

Everything gets sent that way.

The $64,000 question is this: How can your ISP (point G) check every single packet for the hundreds, thousands, tens of thousands of users, without slowing down your I-want-it-now web surfing experience, correctly identify that piece as a virus and not as the next version of Norton anti-virus download or the picture of my cat, without having all the pieces, when all the pieces don't come together, in the same order, or even at all? If you can answer that question successfully, I guarantee that you will be richer than Bill Gates in less than two years.

In the mean time, get virus checking software on your computer. Your ISP can check your email because all the pieces have come together on the email server, but everything else is yours. Your computer is the only place all the bits and pieces come together to make a blog, a shopping website or that ugly monster virus.