Leaked files from state-sponsored hackers reveal which protection their trojans can’t get past

Your typical anti-malware provider has their products tested in a lab to bolster credibility. But with recent leaks on massive surveillance companies, there’s new data available to help measure how good popular anti-malware products are at detecting unwanted threats.

What do surveillance companies have to do with anti-malware?

There is a lot of controversy that surrounds big surveillance firms, and for good reasons. These companies help their clients (often times government agencies) spy on people and on other organizations or countries.

While many claim that this is for the safety of their people, big governments often have to hire these firms that specialize in making malware, breaching the privacy of unassuming individuals. How these firms develop their malware deeply involves anti-malware programs – they must test leading anti-malware software so that they can develop undetectable trojans that successfully infect systems.

Normally, this kind of internal information is kept incredibly private. These firms have highly sensitive data concerning their products and their customers that could really compromise international intelligence agencies.

But some high-profile leaks in the last twelve months are not only political, they’re practical. Below we’ll discuss two surveillance hacks that reveal which anti-malware providers are actually most effective in keeping unwanted programs off your computer.

Hacking Team’s trojan detected by 5 out of 34 antivirus vendors

Hacking Team is a Milan-based company that provides surveillance technology to clients from all over the world, including governmental agencies in countries such as Russia and the United States.

In early July, an unknown hacker released a torrent of 400 GB of company data. This included internal communications and code, as well as records of anti-malware testing. This screenshot of one of their internal documents shows a number of anti-malware suppliers and how Hacking Team’s trojan, Galileo, fared against their products in performance tests.

Emsisoft Anti-Malware blacklisted by Hacking Team – Source: Hacking Team

Green means the malware bypassed the antivirus and was able to infect the system. Yellow means it was able to infect the system and was operational, but during the process some unspecific pop-ups may have appeared (like a generic firewall alert). Red means that a malware detection was triggered. A few vendors were ‘blacklisted’ by Hacking Team’s trojan. That means, the malware doesn’t even bother to start any action when it notices that a specific protection software is running. That way it remains hidden, but also can’t do any spying. As you can see in the full table, only 5 out of 34 vendors were able to detect the Hacking Team malware.

FinFisher’s malware agent FinSpy able to bypass 31 out of 35 vendors

FinFisher is a German-based firm responsible for programs that enable governments to surveil citizens. This type of surveillance, called “lawful interception malware” is very controversial, as it’s questionable if these programs actually help protect people at all.

In September 2014 Wikileaks took a stand against FinFisher and accused the surveillance firm of selling their products and services to oppressive regimes. This leak involved the company’s malware as well as internal documents. Among the information leaked was a table of anti-malware softwares, which reveals what programs their malware agent FinSpy was able to dupe and which ones it wasn’t. FinFisher tested different programs with different versions of the trojan, and recorded how the different anti-malware programs responded to each threat. The following table gives an overview of the results. In the “Full Trojan” column (Install Admin) you can see which vendors warned or blocked the full trojan.

FinSpy wasn’t able to dupe Emsisoft – Click to see the full list

The green “pass” means that the antivirus didn’t detect any threat. The yellow “warn” means that the antivirus detected the trojan as suspicious and alerted the user about it. The red “fail” means that the trojan was detected as malicious. As you can see, the majority of vendors were not able to detect FinSpy at all (green). Only 4 out of 35 vendors reliably detected the threat as suspicious (yellow) or malicious (red) and therefore blocked it completely.

Consider your privacy needs when choosing software

In studying the tables above, it’s important to remember that products that failed to detect these trojans may be just as likely to fail to detect others. It’s also possible that these products are run by companies that work with state-sponsored firms rather than against them. What are your privacy needs? Are you concerned with protecting yourself against government surveillance?

Choosing a program that keeps you safe from all types malware may seem impossible, but the tables above give you an unbiased look at what really works against surveillance trojans:

1. Vendors that detect Hacking Team’s trojan

Emsisoft was able to block the Hacking Team trojan and was given the great honor of being blacklisted as a result! Sophos and CMC AV were the other programs that Hacking Team blacklisted. Comodo and Rising also did a great job by detecting and blocking Hacking Team’s trojans in most cases. A few other vendors showed “not-so-worrysome” popups for Hacking Team, while all other vendors were not able to detect the trojan at all.

2. Vendors that detect Finfisher’s malware

Emsisoft Anti-Malware, Comodo Internet Security, Outpost Security Suite Pro and Trusport Total Security are the only vendors that were able to detect Finspy’s full trojan in all cases.

As shown above, Emsisoft performed very consistent since both Hacking Team and Finfisher’s malware had issues getting past (if at all). Whatever program you choose, know that your privacy is important — don’t put it in the wrong hands.

Have a great, malware-free day!

Related Posts:

• A Statement from Emsisoft on WikiLeaks and the FinFisher…


• When a surveillance state hacking firm gets hacked


• WikiLeaks exposed how much governments spend on FinFisher…


• Découvrez quels logiciels de protection ont résisté aux…


• Multinational SIM cards manufacturer Gemalto hacked by NSA…

Leaked files from state-sponsored hackers reveal which protection their trojans can’t get past

Update now! Get the latest Windows Security patch

Just a few hours back Microsoft released their latest Windows Security Update.

There was a super-critical bug discovered in the Hacking Team files. It opens a doorway that allows to get full access to your PC. The exploit utilizes a vulnerability in OpenType fonts. The pathways may be opening an infected email attachment or just visiting a website.

Microsoft Corp. took pains to get this out-of-band patch up as soon as possible, now your computer protection depends on how fast you can run this update.

All the versions currently supported plus most probably the up-and-coming Windows 10 will need this patch and the sooner you apply it the better. Despite not specifically mentioned, it is very likely that this bug also affects the no longer supported Windows XP. As no more security updates will be furnished, this turns XP users into sitting ducks exposed to a critical risk. At the moment we are not aware of any antivirus or anti-exploit software that would be able to stop exploits from using the leak.

Related Posts:

• Patch Tuesday: It Doesn’t Apply to Windows XP


• IE Zero Day Update: Microsoft Issues Emergency Patch, Even…


• Widespread Windows Zero Day affecting Microsoft Office Files


• Reminder: Microsoft Ends Support for Windows XP April 8th,…


• Zero Day Alert: Unpatched Vulnerability in Internet Explorer

Update now! Get the latest Windows Security patch

An in-depth look at the Emsisoft scanner technology

Our team of developers here at Emsisoft works hard to deliver major improvements in the realm of scan speed and optimization. You may know how to use our scanners thanks to our video tutorials, but do you know how our scanner technology works? Let’s lift up the hood to learn about the underlying technology that drives all Emsisoft’s products. 

1. Two scan engines are better than one


2. Available scan methods


3. Advanced scanner features


4. Productivity features


5. Cleaning infections

1. Two scan engines are better than one

Part of what gives our scanner its advanced detection power is its dual engine. We are committed to providing the best possible scanner technology, that’s why we built our software to be flexible enough to swap out third party engines as required.

You may remember that we switched our engine from Ikarus to Bitdefender in 2012. A powerful match between our technological developments and a keen eye on the future of cutting edge antivirus developments keeps us ahead of the curve.

Advanced signature-based detection

The engine we have built complements the second Bitdefender engine, and are combined seamlessly to maximize efficiency.

One of the ways we detect unwanted programs is through signature-based detection. What this means is that we search programs for their unique signatures, which are like fingerprints, and scan your computer for these threats.

Here at Emsisoft, most of our lab time is spent creating detection signatures for PUPs (potentially unwanted programs) and on custom malware removal code for specific infections. We ran some numbers earlier this year and discovered that more than 74% of the total detected PUPs are detected by our in-house built scan engine component.

Maximizing performance with a dual engine scanner

Having two engines means we are better equipped to provide new signatures for threats as quickly as possible — so quickly, that often times both vendors have signatures made for the same threat within the hour!

Two engines are more efficient than one

If you’re concerned about increased memory usage, never fear. We have these duplicate signatures cleaned out at regular intervals to keep memory usage low. 90% of the signatures created by Emsisoft’s engine are duplicates and are not used in malware detection.

And you don’t have to worry about time lost either: the files on your hard disk are only read once and then scanned by both engines. This ensures that there is no significant scan time loss, even though we use two engines. It’s no coincidence that our dual engine scanner works faster than many big brands with just one engine available!

So how does information translate to your own practical use?

Simple: all detections with an (A) postfix are from our own engine and those with (B) are from Bitdefender.

In a nutshell: We believe two engines are better than one, and we use our own technology to detect threats to your computer that might otherwise be missed. But we won’t compromise efficiency in this process — Emsisoft works to keep your memory clean and uncluttered, and to detect threats at optimal speeds. To see some numbers about the real power of the second scan engine in our products, please see this article from earlier this year.

2. Available scan methods

Here is a quick rundown of the available scan methods on Emsisoft Emergency Kit, as well as Emsisoft Anti-malware and Emsisoft Internet Security:

Three different scan types

Quick Scan

Quick scan quickly gives you an overview of any active infections on your computer. It does so by scanning through all running programs and their modules. Quick scan also completes something called a “trace scan.” Traces are known file and registry- paths of malware infection. In simpler terms, it’s an antivirus scan that looks for a trace left behind by malware in order to locate it.

Additionally, quick scan checks installed drivers for active rootkits. A rootkit is a type of malicious software that hides certain files or registry keys from normal methods of detection so that it continues to have access to your computer. We’ll discuss rootkits and how they work further when we review the custom scan features.

We recommend a quick scan for automated/scheduled scans after boot or on user logons. It generally takes about thirty seconds to complete, so you don’t have to worry about it interrupting your day!

Malware Scan

The malware scan is similar to the quick scan, but it scans files in all folders that are known to host active malware infections. Our scanner identifies about a hundred common areas where malware likes to strike. One advantage here is that malware is really predictable in where it chooses to install — but don’t think the Emsisoft team is complacent! Our analysis team is constantly moving forward to detect new common areas, and they’re able to update software within minutes to keep your Emsisoft applications up-to-date.

We recommend a malware scan as the default scan when you suspect an active infection on your system. The malware scan does not detect inactive malware files, but luckily inactive files are non-active threats. These files can simply be deleted with a stroke of a key, like the Word document for a meeting long past or an unflattering vacation photo.

Custom Scan

Since the default mode of custom scan is set to perform a complete, full scan, use this option if you want to do a very thorough malware search and scan all files on all drives of your computer. The custom scan takes a significant amount of time to complete, and it isn’t recommended for frequent or daily use. It’s the kind of scan you should run a few times a year to be absolutely sure nothing is hiding around on your computer.

3. Advanced scanner features

One of the great features of a custom scan is that you can control your scanning settings. If you look at the custom scan settings dialog you’ll see all of your options. Some of them are enabled by default and others aren’t. Knowledge is the key to knowing what you need and what you don’t, but we have the best options selected for the everyday user. We’ll detail the options below so that you can familiarize yourself with what may or may not be appropriate for your scanning needs.

Advanced scanner features

Rootkit scan

A normal file scan uses Windows APIs (Application Program Interface) to read files. Think of an API as the foundation for building software applications, that is built of routines and protocols.

Unfortunately, though using a Windows APIs may be optimal for speed and performance in certain regards, these APIs may be manipulated by rootkits.

What are rootkits?

Rootkits are like soldiers in camouflage. They blend into systems through a number of different means, and a very common way to do this is by modifying lists and tables that tell a system where to find code (this is called “hooking”).

When antivirus software accesses this list of available files, the rootkit has manipulated the list to skip a file — a malware file. Once a file is made invisible like this, it’s difficult for your malware scanner to find.

To find hidden rootkits, our scanner uses its own NTFS file system parser code when looking for rootkits. This code doesn’t rely on the common Windows APIs, which gives us an advantage over stealthy rootkits.

If the rootkit has camouflage, the Emsisoft scanner has super vision!

Cleaning rootkits

Cleaning rootkits properly is very tricky. Sometimes rootkits can even hide within certain regions of your computer’s hard disk, like the boot sector. Simply deleting these malicious files often results in an unbootable computer.

Our specialists help many victims of careless cleaning attempts by other anti-malware products, so we know firsthand how important it is to use a trustworthy source.

Rootkits generally require manual cleaning. Our scanner will tell you to consult our malware removal experts to clean rootkits. They will analyze and identify the type of rootkit affecting your system, and provide you with detailed, step by step instructions to remove it without risking the stability of your computer system.

You might wonder why all of the scans don’t rely on our own scanner: this is because reading directly from the file system (direct disk access) is generally very challenging and typically much slower than using windows APIs. If it were different, rest assured, we would use our own NTFS file system parser code for all scans.

Traces Scan

A trace scan (a scan that looks for traces that malware left behind) may be one of three types:

-File traces: These are known paths of executable files on the hard disk that are used exclusively by malware. These are essentially traces that exists alone in the hard drive, independent of any other program’s folders.

Example: C:\windows\explore.exe (may be mixed with exploreR.exe).

-Folder traces: These are similar to file traces, but exist inside the folder of other common applications, like a Google Chrome setting folder.

Example: c:\program files (x86)\PUP Folder\.

-Registry traces: These are entries in the system registry database that indicate a malware infection. A registry trace points to an infection inside the actual settings of the computer. These are the most dangerous traces, and the related virus may significantly slow down the speed of your computer.

Example: HKLM\Software\Windows\CurrentVersion\Run.

It’s important to note that if a malware trace is detected, it doesn’t necessarily mean that there is an active infection. It may well be leftovers from a previous, incomplete cleaning attempt. Trace infections tell you to be aware and to investigate.

Generally when there is an active infection, traces are typically found next to file findings. You can clean them at any time.

PUPs detection

For legal reasons, we can’t call all unwanted programs “malware” in our user interfaces. The term PUP was invented by the antivirus industry several years back, which stands for Potentially Unwanted Program. Generally, PUPs exist to get their creators some extra cash by displaying ads, changing your default search engine provider, or by collecting private data to sell to advertisers.

Potentially Unwanted Programs (PUPs) detection

PUP detection must be enabled on first installation of our software. In Emsisoft Anti-Malware and Emsisoft Internet Security it can be enabled in the File Guard settings dialog afterwards.

Scan in compressed archives

Compressed archives are files that contain a number of other files and shrink their size. Some common examples are ZIP, RAR, or 7Z, but there are hundreds of other less known compressed archives. Even a program like EXE may actually be a self-extracting archive, meaning it contains other files (generally this is for more efficient data transferring).

A malware file that is wrapped inside an archive file can’t directly start from within a compressed archive, as it needs to be unpacked first. Because of this, archives aren’t typically considered dangerous on their own. As a result, many scanners exclude archives from scanning or limit archive scanning to file sizes of about 200 MB.

Unpacking archives is incredibly time consuming and takes up a lot of system resources. You may disable the archive scan feature if you already understand what’s happening within your own archives and know there isn’t a possibility of infection.

Scan in NTFS alternate data streams

In 1993, with the introduction of NTFS (New Technology File System) as the default file system of Windows NT (predecessor of 2000, XP, 7, 8, etc.), a new feature called Alternate Data Streams was introduced. Files were now able to store meta data in hidden layers.

Unfortunately, these streams can also be used to store other types of harmful data, like complete malware programs — and all within a 0 bye text file.

Fast forward to today, and a harmless looking file extension may contain dangerous code which can be started automatically via autorun registry keys.

When the NTFS Alternate Data Streams scan option is enabled, the scanner searches all data layers for hidden threats.

Using the file extension filter

With the file extension filter you can limit the number of scanned files based on their file type. Many file types cannot be used to host dangerous code, so many people might initially think it’s a waste of time to scan certain files.

For example, all executable Windows files start with the byte sequence “MZ” which tells the operating system that the file can be run by the computer. Checking these byte sequences (or “magic bytes”) is a reliable method, and almost as fast as simply checking the file extension itself.

But it’s important to note: there’s an important reason that this feature is actually disabled in the default settings. This is because the scanner doesn’t just look at the type of file extension by name, but looks for specific file type markers inside of the file. File extensions can be easily changed to fool a scanner, but the content can’t.

Direct disk access mode

As mentioned above, the scanner is able to search files that are hidden by active rootkits by utilizing our own NTFS file system parser instead of Windows APIs. The direct disk access mode allows the Emsisoft scanner to bypass security checks and to go directly to a file location to find protected malware.

The downside of this method is how immensely time consuming it can be. Therefore it should only be used for specific folders that may contain rootkits. There is not much to gain by using this feature to scan your whole disk, that’s why this option is disabled by default. Rootkit scan always uses the direct disk access mode feature, so rest assured that it’s automatically set to be utilized when necessary.

Performance settings

When viewing the scan area of the software, you’ll see a small “Performance settings” option below the 3 main scan methods. If you click on it, it opens a little popup with advanced features for tuning the scanner speed:

Performance settings

– Processors

By default, all available processors of your CPU are used for scanning. Note that quad-core CPUs are usually displayed as 8 virtual processors. You may want to disable one or two of them if you are planning a long duration scan and need to run some heavy resource consuming program at the same time.

– Number of threads

Threads can be visualized like execution tasks that run in parallel. Imagine threads like roads that information takes to get to the core.

If the scanner were to be single-threaded (one thread limit) a file would be read from disk, then scanned, and then the next file would be read and scanned, and so on. Using multi-threading technology, each virtual processor can scan a file at the same time without interrupting the others.

By default, the number of threads is the number of available processors + 1. The reason for that is that one thread with low CPU requirements is used for reading the data from the hard disk (as parallel reading typically isn’t an option), and then the files are distributed across all processors for simultaneous scanning. This is the heaviest part for a CPU.

– Scan thread priority

By default, Windows defines which programs get which percentage of the overall available hardware resources (CPU time). But you may define a higher or lower priority for the Emsisoft scanner. Use a higher than standard value to make sure that scans are finished in the shortest time (even if other programs are running). Use a lower than standard value if your work relies on other programs that require higher priority. This is best if you don’t care how long the scan takes, as long as it doesn’t interfere with your work.

– Use advanced caching

Caching means that files that are proven to be safe are not scanned over and over again. For example, if a file has been on your computer for a very long time and has already scanned many times without any findings, it is very unlikely to be malicious. A smart logic estimates how likely it is that a file is safe and then skips it for further scanning.

4. Productivity features

Context menu scan in Explorer (Not available in Emsisoft Emergency Kit)

The web is teeming with trojans and spamware, just waiting to get inside of your system. But a context menu scan can act as a great preventative method to contracting viruses in the first place.

Emsisoft Anti-Malware and Emsisoft Internet Security come with a useful Windows Explorer integration that can save you a lot of time if you’re performing frequent scans. Just right-click on any file or folder in Explorer and select the option “Scan with Emsisoft” in the context menu to start your custom scan.

Emsisoft Commandline Scanner

Commandline Scanner

A commandline scanner is best for professionals who don’t need a graphical user interface to perform their scans. If you’re unsure of what this means, don’t worry! This isn’t a program that you’ll need.

The Emsisoft Commandline Scanner is a complete commandline interface that includes all features of the Windows-based scanner. It’s primarily used for automated scans, initiated by other programs or scripts which require a return value for further processing. Learn more about the available parameters of the command line scanner here.

5. Cleaning infections

Detecting an active threat is just one part of the journey to a clean computer. Cleaning is actually a more difficult process than finding PUPs, because malware works hard to avoid extraction. Here are a couple of cleaning prevention mechanisms that malware uses to lodge itself in your computer:

– Lock the file

Some malware is able to lock a file. If a file is locked, it can’t be deleted. Locks can be achieved by ensuring a program is always running.

– Watchguards

This is an infection method in which malware comes in a pair of two programs. If you kill one program, the other will notice and re-start immediately. If you kill the second, the first one restarts, and so on.

– Hiding

As mentioned above, Rootkits manipulate system APIs to remain hidden. If a file can’t be seen it can’t be removed, now can it?

Autorun as system component

Some threats load themselves into programs that your operating system autoruns (automatically runs) when you start your computer. If you try to kill them, you’ll get the dreaded blue screen, and everything will stall. If you remove the autorun entry, the malware recovers instantly.

How Emsisoft cleans infections

To cope with these malware tricks, we have developed our own sophisticated cleaning engine. It cleans about 100 locations in the registry and file system that can be abused to automatically load malware on system startup.

If a file is locked, our cleaning engine schedules the removal of the malware in question for the next system boot up through a method that disables malware from blocking removal once again. Additionally, our engine restores default values of a number of autorun locations that would render the system unusable when you just delete the malware entries. During removal, a quarantine copy of each threat is saved for later analysis or restoration (unless you select the “delete” option instead of “quarantine”).

So what does it mean when a file is in “quarantine”? It means that a file is wrapped in an encrypted, secure container file where it cannot do harm to other files and applications on your system. We always recommend using the quarantine feature, because there is a small chance that the file that was detected is harmless (a false positive), or that the file might be necessary for further investigation or forensics. You may delete quarantine files after a couple of weeks if it turns out that the file is in fact harmless.

Scanning and cleaning files on network shares

While it is possible to scan files on network shares that are located on other machines, we don’t recommend that at all. It might save you a bit of time to walk over to it, or remote connect to a target machine, but please be aware that scanning remote files has some serious limitations by design:

• Memory, rootkit and trace scans are not possible, as they require operating system APIs that can only be accessed locally. You’re limited to scanning files via standard file reading procedures, which means no direct disk access mode is available either.


• Cleaning is not possible at all, because removing a detected active malware file without removing its accompanying autorun entries would most likely crash the computer and leave it in an unbootable state.

Always scan and clean locally. If you want to avoid installation of our software for doing that, go for the Emsisoft Emerngency Kit scanner which is fully portable and doesn’t require any installation.

Whether you’re an antivirus expert or a casual internet browser, we hope this information will help you understand exactly how Emsisoft’s top of the line technology is working to protect your computer from malware.

Have a great, malware-free day!

Related Posts:

• Emsisoft’s dual-engine scanner Behind the scenes


• How to find and clean malware infections with Emsisoft…


• How to scan and clean a computer with Emsisoft Emergency Kit


• New: Emsisoft Emergency Kit 10 – The fastest portable…


• Buzz word: “cloud anti-virus” – what is it…

An in-depth look at the Emsisoft scanner technology

When a surveillance state hacking firm gets hacked

This past Sunday, a Milan-based surveillance company by the name of Hacking Team got a taste of its own medicine. A 400 GB torrent file of internal documents, communications, and code was uploaded to the internet by an unknown hacktivist.

We don’t recommend relying on Hacking Team.

An embarrassment to surveillance states everywhere

Hacking Team is a surveillance firm used by government agencies around the world, including (but not limited to) organizations from Russia, Ethiopia, Saudi Arabia, Mexico, Hungary, Spain, and the United States. With all the information that has been released on its scores of clients, Hacking Team is urging its customers to stop using its software, and has yet to regain control over its email system.

If the hack itself isn’t enough to inspire doubt in big surveillance states, some of the compromised information might: leaked client passwords include such embarrassments as, HTPassw0rd, Pas$w0rd, and Passw0rd.

A security engineer’s worst nightmare

Hacking Team’s security engineer, Christian Pozzi, had his password store exposed, which revealed even more simple and straight-forward passwords to the company’s social media, financial, and network accounts. The word “kittens” was Pozzi’s personal administrative password.

If there were ever a reason to question government agencies and their surveillance aptitude, it’s this entertaining security fiasco.

The biggest and most influential governments of the world have hired a company that fails to enforce the basic principles of password creation. More importantly, this is a company that governments choose to entrust with highly sensitive information.

Naturally, Pozzi is claiming the leaked file has malware and has threatened unidentified hackers with incarceration and legal action. His twitter was subsequently hacked and has since been deleted, but you can see an archive of the social media account here.

Into the dark abyss

One of the most interesting aspects of this incident is that it allows an in-depth view into how companies like Hacking Team operate. And the view most definitely isn’t pretty… Hacking Team, just like many government agencies, have been secretly collecting exploits within software products in order to compromise systems. Without requiring any user interaction at all.

It comes as no surprise that these vulnerabilities have been adapted by various popular exploit kits within hours of the leak and are now used by cyber criminals to target millions of unprotected users. Also, routines were found within the Hacking Team command and control panel, that seem to allow anyone to place discriminating evidence like child pornography or bomb construction manuals on a compromised system:

How Hacking Team operates definitely isn’t pretty.

This fuels many state malware opponent’s concerns, that malware that is used by government agencies for surveillance and evidence collection can easily be used to place the very same discriminating evidence. Therefor, any evidence collected through such means is not trustworthy by default.

The beginning of the end for Hacking Team

The damage is done. Hacking Team is facing an uphill battle from here on out.

Regardless of what the Hacking Team does from here on out, the damage has been done—not only has a good amount of internal and customer information been compromised (clients as big as The Army of South Korea and The Federal Bureau of Investigation of the United States), but it may be facing serious legal trouble: Hacking Team claimed to have never done business with Sudan, and yet the released information shows otherwise. This potential partnership could be in conflict with the UN’s arms embargo on Sudan, which includes a prohibition on “technical assistance.”

While this story is still developing, it might interest you to learn more about Hacking Team on the Reporters Without Borders Enemies of the Internet index. You can also view a curated slideshow of the hacked material here, curtesy of CSO Online.

How does it affect me?

The Internet, and therefor hackers as well as government agencies, can only surveil, store and analyze what they are fed via different sources. It is out of the question, that using malware to get access to any kind of private communication or company secrets is faul play. Usually, it is just a matter of time until government supported malware projects tend to be discovered and shared with the public just as well.

The use of strong passwords, encrypted communication and trustworthy security software is your first level of defense. It should go hand in hand with updating your operating system, cleaning out your mail account (e.g. move old mails to a local backup instead of storing all of it permanently online) and changing your passwords on a regular basis.

Whatever you choose to share with the world by using Internet technology, remains for the most part, up to you. With that in mind, you are the warden of your own privacy.

Have a great, surveillance-free day!

Related Posts:

• The Hacking Team, RCS, Qatif Today, and Lawful Interception…


• WikiLeaks exposed how much governments spend on FinFisher…


• The NSA is just one malware writer out of thousands


• A Statement from Emsisoft on WikiLeaks and the FinFisher…


• Multinational SIM cards manufacturer Gemalto hacked by NSA…

When a surveillance state hacking firm gets hacked

Top 10 senior citizen scams that affect the whole family

Scams are plentiful on the current internet landscape, and people of all ages find it overwhelming to dodge these digital bullets. Users over the age of 50 have an especially difficult time keeping their identities and bank accounts safe, as they may find that all of the practical sense they have developed over the years to spot scams in real life just don’t translate on the internet.

Statistics back this up: according to researchers, individuals over 65 are 34% more likely to have lost money in a scam than people in their forties.

Popular internet scams affect the whole family

Scammers know how vulnerable older generations can be on the web, and they take advantage of unsuspecting victims everyday. This can cause stress not just for seniors, but also for their entire family unit. Younger generations may also be fearful of how vulnerable their parents or grandparents are to internet fraud.

This dilemma is often caused by a lack of communication: older generations may not want to share potential issues or ask certain questions out of embarrassment. Similarly, their children, grandchildren, nieces and nephews may not want to insult them by asking if they need help spotting scams.

Just like you’d ask your friendly neighbor about a good gardening tip, don’t hesitate to ask your friends and family for help.

But indulging this sense of propriety can be dangerous. Financial information and personal assets may be put at risk, and the victim’s whole family can suffer from these loses. Additionally, if an older family member isn’t practicing the right safety online, they may accidentally compromise the identities of their loved ones.

One simple misstep increases the likelihood that victims will be put on “sucker lists” that are sold on the black market and will be targets for future scams.

 

Internet fraud that targets seniors

The following list describes the most common scams that target seniors in the contemporary digital landscape, and how to avoid them.

1. Social Security Scam

Tens of thousands of seniors in the US have fallen victim to this new social security scam. Scammers create legitimate online accounts with the social security website and redirect payments to their own personal accounts. With over 59 million Americans receiving social security benefits in 2014, this scam targets many individuals’ primary source of income.

Never share your social security details with anyone, ever.

 

2. Funeral Invitation

As we reach more mature phases of life, we anticipate more loved ones and acquaintances passing away. Internet con artists take advantage of this sad fact of life and send out fake funeral invitations to lure in older individuals. When the victim sees the email, they click a link or open an attachment to learn the name of their deceased friend/acquaintance. Then malware attacks their computer and steals sensitive information that can be sold to cyber criminals or used immediately to steal money.

It is cruel, but scammers don’t care about your feelings. Be careful when opening any attachments. (stock: pixabay.com)

 

3. Work at Home Scams

Everyone is looking to make an extra buck here and there, and seniors are no exception. Often older members of a household may want to contribute more to family finances, but this noble mission can end poorly for those who respond to fake advertisements. If it seems too good to be true, requires specialized training, or asks for “training” money, it is most likely run by a scammer looking to get access to an unsuspecting victim’s bank account (or even some free labor).

Working from home is very attractive not only to seniors, but also stay-at-home moms and individuals with limited mobility and resources.

 

4. Lottery/sweepstakes Scams

Since older internet users may be less experienced than their younger counterparts, they may easily fall for a sweepstakes scam, often in the form on an email informing them they have won some kind of prize (usually money). The email will ask for funds to release the prize money or sensitive personal information to allegedly pay taxes or bank fees.

If it sounds too good to be true, it probably is.

 

5. Fake Online Pharmacies

Seniors have more ailments, and as result, potentially high medical bills depending on the country they reside in. Other times they struggle with mobility and transportation. Either of these issues makes using an online pharmacy a tempting option. However this need makes the elderly  vulnerable to fraudulent online vendors. This can be confusing for many people, not just seniors, because legitimate online pharmacies do actually exist. But according to the NABP (National Association of Boards of Pharmacy) 96% of online pharmacies operate outside of existing legal structures, and “fuel prescription drug abuse and misuse.”

There is a thin line between cheap and fraudulent. (stock: pixabay.com)

 

6. Sweetheart Scam

Many older individuals suffer from loneliness. In England alone, over 61% of all people over the age of 75 live alone. It’s natural for older internet users to turn to dating sites and social media to alleviate this loneliness. Unfortunately, this also increases their risk of falling for a “sweetheart” scam. These cyber criminals lure in their victims with a prospect of love, usually through many back and forth messages. These fake “sweethearts” ultimately exploit the victim’s pocketbook, asking for funds to come and visit or to buy basic necessities. People have reported being scammed up to hundreds of thousands of dollars.

Love makes us happy, but it can also make us blind when it comes to fraud. (stock: pixabay.com)

 

7. Grandparent Scam

This is an old trick that preceded the internet: an alleged “grandchild” calls from a noisy location, telling the grandparent in question that they are in trouble and need money immediately. Nowadays, this can also come in email form. Criminals even going so far as to accurately assume the identity of the victim’s grandchild or family member and claim the matter is incredibly urgent. Desperate to help their beloved, this stops internet users from thinking twice about sending money.

Don’t let scammers tug at your heartstrings. Always call your loved ones before sending them money. (stock: pixabay.com)

 

8. Investment Scams

The only person getting rich is a successful scammer.

While investments made online have become increasingly popular, so has scamming people with get-rich-quick and Ponzi schemes. These can take the form of professional looking ads, websites, and videos that detail how other individuals have made their fortune this way. Other times it will come in the form of an email from a trusted source, like a family member or friend. Unbeknownst to them, their email account has been have hacked and a scam artist is utilizing it to lure unsuspecting victims into paying large sums of money they will never see again.

 

9. Fake Check Scam

There are lots of trusted platforms that enable you to securely send and receive money for your goods. (stock: pixabay.com)

The internet can be a great place to sell that old couch or elliptical machine, but you should be wary of the offers you receive. When an unsuspecting victim puts something up for sale on the internet, they may be impatient to rid themselves of the listed item and make some quick cash. Unfortunately this is when scammers strike, offering the lister a cashier’s check that’s often made out for more than the agreed upon price. The victim will pay the scammer the difference only to find out later that the check is a fraud. Seniors are more likely to fall for this scam because they trust older forms of payments like checks over secure forms of internet-based payments.

 

10. Charity Scams

Looking into the eyes of a poor child makes it hard to say no or think straight… (stock: pixabay.com)

Charity scams are old news in the realm of telemarketing, but are their increasing presence online is a cause for concern. Seniors should be wary of any emails that ask them to contribute to a charity, even if the associated website and materials appear legitimate and well designed. Most federal governments have lists of registered charities, and the representative in question should be able to provide a registration number or ID that can be cross-referenced with the appropriate national registry.

Protecting yourself from Internet scams

Reading about all these scams may have you thinking that you should just turn off your computer for good! But protecting you and your loved ones from over hundreds of internet scams is just a matter of taking a number of simple precautions:

• Set up financial accounts online with a trusted family member


• Create complicated, un-memorizable passwords for all of your accounts


• Install trustworthy anti-malware


• Always learn the whereabouts of your family when you suspect their identity has been stolen


• Be wary of “officials” contacting you stating they are from a financial institution or the government


• Never open an attachment from an unidentified source


• Be suspicious of emails, ads, and websites that offer you money in exchange for personal information or an upfront payment


• Learn what precautions to take when dating online

Scams can bring lots of stress to your entire family, but they don’t have too. A combination of adopting the habits listed above and communicating regularly about your safety concerns can significantly reduce your exposure to internet fraud.

Just remember, a healthy dose of suspicion goes a long way. Not everyone is trying to take advantage of your trust online, but few things are worth the risk.

Have a great, scam-free day!

Related Posts:

• WhatsApp scam falsely promises early access to voice calling


• How to recognize the difference between a safe email and a…


• The SEPA Switch and Internet Fraud


• Curiosity arousing Facebook scams lead to nothing but…


• How to avoid losing your hard earned money to online…

Top 10 senior citizen scams that affect the whole family

AV Lab: If you highly value your privacy, choose Emsisoft!

The newest version of Emsisoft Internet Security, version 10, has only been around for a bit but the first great review is already here!

“Emsisoft performed exceedingly well in phishing tests, blocking 17 of the 20 phishing sites the author threw at it. This is exceptionally impressive as none of the sites were older than 24 hours.”, AVlab concludes. The journalists noted that this was one of the best results they had seen: “It is one of the best results, and shows how truly immense the number of malicious sites that Emsisoft products can block is.”

AV Lab confirms that the new product is very light and doesn’t slowdown your system: “In conclusion, I can say that performance of Emsisoft Internet Security 10 belongs in the category of the lightest, most efficient security applications on the market. Running on a virtual machine, the program experienced no stability problems and the protection and verification system works briskly, efficiently and does not slowdown the system.”

The review also points out that Emsisoft Internet Security is not only the best choice for standard HDD users but SSD as well.

„[…] So regardless of whether you are still using a traditional hard disk drive (HDD) or a solid-state drive (SSD), Emsisoft Internet Security 10 will be a very good choice […].”

The full review, in Polish, is available at the official AVLAB.PL website.

Related Posts:

• VB100 Award: Emsisoft ranks 2nd out of 27 in PC slowdown…


• AvLab Performance Test 2014


• AvLab Performance Test 2014


• AV Lab: “If you need solid protection…Emsisoft Internet…


• AVLab Performance Test 2014

AV Lab: If you highly value your privacy, choose Emsisoft!