Consumer Reports on 'State of the Net' 95
netbuzz writes "A " State of the Net" survey to be released today by Consumer Reports contends that Americans lost $7 billion over the past two years to malware and myriad online scams. Not surprisingly, a significant portion of this financial pain appears to have been avoidable, as the survey reveals a widespread continuing negligence toward the use of home firewalls and virus protection. As for underage children using MySpace and the like? There, too, the risks in many case look to be self-inflicted, as 13 percent of children fail to meet the 14-year-old age minimum on MySpace, and, as the organization notes: "Those were just the ones the parents knew about."
In other news... (Score:4, Insightful)
Re: (Score:3, Interesting)
I guess I'm lazy.
I just tried logging into my Hotmail account and I got this page saying "Hotmail is now Windows Live Hotmail" with a completely new domain name and everything. I don't know if this is legit or a phishing expedition and I didn't get any email in the last couple of days saying this will happen. You know what I'm going to do? I'm going to wait a couple of days and if I don't see any news of phishing of Hotmail accounts, maybe I'll go through the
Re: (Score:2)
Re: (Score:2)
If you go to the domain directly, it is not phishing, by definition. The web site may have been compromised, but that's not phishing. Moreover, if someone was to crack the website, they would almost definitely NOT do something obvious that would be noticed within seconds, like announcing a big change and redirecting everyone who logs in.
If you had clicked on a link to get to Hotmail, you might have a legitimate concern, but it wouldn'
What about DNS cache poisoning? (Score:1)
www.hotmail.com == 80.190.185.109 (warez.biz)
instead of
165.193.120.166 (the real thing)
Re: (Score:2)
You really think the average person wants or needs to know the difference between Virus/Trojan/Phishing Scam? Do you really see this as being the problem? You are the sort of guy who runs around the office refusing to help people because they don't ask the right question.
Re: (Score:2)
Re: (Score:2)
viruses, malware, et cetera (Score:5, Insightful)
Re:viruses, malware, et cetera (Score:5, Funny)
Mods - Into attack mode
Re: (Score:2, Insightful)
Have mandatory 'securing your computer' classes at the high school and college levels. In these classes one would learn about viruses, various malware, spam, social engineering, etc. as well as ways to combat/prevent them from infecting your machine. At least it'll improve awareness (let's not dodge the bullet here, at least 90% of high school students - from my experiences in the past 4 years going to a high school which hands out Inspirion 600m laptops
Re:viruses, malware, et cetera (Score:4, Insightful)
Anyway, you get to fund this class.
Re: (Score:2)
Schools used to have "computer literacy" classes. They're largely redundant now, since the kids are usually more computer literate than anyone who could teach them.
They weren't terribly useful then either. I had a computer literacy class in 7th grade [86-87]. The only thing we were really taught was how to load games [and programs] from the floppy drive on a Commodore 64. I didn't have a C64 at home, so I don't even remember how to do that.
The rest of the semester was spent playing the collection of games which the teacher had and whatever the students brought in. Oh we did learn that the teacher had been teaching at that school since it had opened in the 60's. I hav
Re: (Score:2)
Re:viruses, malware, et cetera (Score:5, Informative)
The vast majority kids are not "computer literate" in any functional sense of the word. Honestly, this makes them much like the vast majority of adults, so it's no real surprise. When children (14-18) enter my class, they understand the mere basics of certain programs - thy understand how to instant message, but not necessarily how to uninstall an IM program. They know that some web-based proxy sites can't get around the myspace filter, but they don't understand what's going on or why it would be easier to type in a proxy server address for their browser. They don't understand the first thing about basic file management, or why naming files with descriptive names is a good idea, or why their Powerpoint presentation that's laden with images and sound won't fit on a floppy disk. And they really, really don't understand that a spreadsheet has uses beyond making tables of stuff, that the word "memory" can have different meanings, why their computer is "running slow", or that the concept of mail merge even exists.
In short, they are exactly like most non-techies that you probably interact with on a daily basis. To say that the people teaching the classes don't know anymore is pretty absurd; I'll grant that there are bad teachers, but it honestly isn't that hard to know more than the average person. In my experience, the people who teach these courses (at least the ones I've met) seem intelligent and experienced enough that they certainly have plenty to teach. They may not be "running apache under Gentoo on their toaster" geeks, but they're educated and intelligent, and (most importantly) they know their material.
At my school, the 10% who are geeks or gunning for extra GPA take our Computer Science AP course. The rest end up in my course or one of the similar ones. I assure you: most kids are not computer literate, and I truly believe they do benefit from some useful computer education.
Comment removed (Score:5, Insightful)
Re: (Score:2)
I wouldn't hold any teacher of an Applications-focused class in contempt for not recognizing a SQL query - it has no bounds on their job whatsoever. Nor would I find it "wrong" if a student in the class could explain recursion and the teacher couldn't. Most courses that function as Computer Literacy or similar have as their focus 1) teach about the basics of computer hardware a
Re: (Score:2)
Whoops! Use the preview!
Re: (Score:1)
Luckily we have the simple basics of math, science, language, history, music, etc... so that the intelligent have a way out, but the main problems people have appear to be either stayin
Re: (Score:2)
On the plus side, I'm never hurting for disks for BIOS flashes; at the end of any year, I will have a stack of 20 or so floppies that the
Re: (Score:1)
It doesn't even have to be a full semester long class. Just a week or two worth of teaching during whatever mandatory "intro to computer" level course. If it's boring for those that think they know all that, well all the better to pad their grade in that class during this section's test.
Re: (Score:1)
Re: (Score:2)
Re:viruses, malware, et cetera (Score:5, Insightful)
That will work just as well as:
Mandatory driving classes
Mandatory civics classes
Mandatory typing classes
At a population level, people are Just Plain Stupid (TM, patent pending). It's the bell curve - the short bus tends to get pretty crowded.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
3 problems with that: (Score:2)
1) that would mean that people would have to take responsibility for their actions with a computer and that "i am not a computer person" would no longer be a defense. people don't take responsibility for their actions. ever. more so when computers are involved.
2) what about all of those "geeksquad" types and the screwdriver monkeys at the local PC shop? they are shysters that take people's money to fix a problem caused by other shysters. what are they going to do? go back to work at mcdonald's?
3)
Re:viruses, malware, et cetera (Score:5, Insightful)
Malware will be no less prevalent if Linux takes over the home market from Windows because the average home user still doesn't understand computer security (and has no desire to try). The vast majority of malware today is not installed through IE security holes and drive-by-downloads like they were in Windows 9x days. They're all trojans. No matter how tight the security on Linux, you can never stop a user from downloading and installing a malicious trojan for a "FREE SCR33NS4VER!1!!!".
Re: (Score:2, Insightful)
Ah, yes, but if you
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Damage to what, the OS, the network, or the user?
Damage to the OS is easy to fix, just reinstall.
Damage to the network only requires the ability to start outgoing connections. No root access needed.
Damage to the user can also be done without root access.
W^X (Score:1)
Ah, yes, but if you prevent the home user from running as root.. it becomes significantly more difficult to get the trojan installed in areas where
it could do real damage.. for now...
It helps there if the account for daily use has no sudo or admin privileges.
The next step would be keep things in order by applying the Write XOR Execute principle to disk partitions: put the user home directories on their own partition, mounted noexec, put everything else on another mount it read-only. /var can be symlinked to a directory in /home.
Knowing the partition sizes is the only tricky part.
Security-oriented systems are even applying the Write XOR Execute principle to memory [openbsd.org]
Re: (Score:2)
Security is a state of mind, not a software package.
That is true. However, a few MS-isms make it MUCH harder. In the old days, we used to tell users to avoid any attachment with .exe or .scr on the end. They 'got' that and most did as instructed. Then MS decided those nasty ol' extensions were confusing so they hid them. NOW how do I explain it?
The frankly broken security model screws plenty up as well. Not to mention the Rube Goldbergesque way the thing is put together so that it's fairly easy to hi
Re: (Score:2)
Re: (Score:2)
Windows security works just fin
Re: (Score:2)
Re: (Score:2)
Re:viruses, malware, et cetera (Score:5, Insightful)
One problem is education. A bigger problem is that users don't see this as being "their problem". The ISP should be protecting them. The banks should be protecting them. The gov't should be protecting them. They don't feel they need to bear any of the responsibility of what is going on. I remember one old neighbour who's computer was riddled with viruses, and their ISP cut them off. They proceeded to blast the ISP for cutting the service and not not protecting them in the first place.
Until people becoming willing to take responsibility, the education won't happen. Until the education happens, these problems cannot be prevented.
Re: (Score:2)
That's precisely the problem. If it were secure, there would be very little extra that could be done.
Re: (Score:2)
Let me guess: that would be either NAT or a firewall which blocks all incoming connections. So your solution to security problems is to break two way communication on the internet? I suppose your solution to someone being harrassed by telephone would be to put in a box which blocks incoming calls.
Yaar! Let's turn the inner-net into WebTV(tm).
Re: (Score:1)
Um... Yeah? You have a home computer. Unless you are running a server or doing something that REQUIRES incoming connections, then damn straight you block them all. Are you saying that you would PREFER to have random people on the internet poking at your machine?
Re: (Score:2)
I was talking about running a "server." The bans by home ISPs on "servers", floating IP addresses and such reduced what is "allowed" on the internet.
NAT and firewalls which block everything except web traffic will make it worse and doesn't really increase security. If they are not secure, you shouldn't be running daemons which are connected to internet bound ports anyway. If you are running a test web server bind it to localhost, not *.
Yeah, MS software often binds to ports and there is no easy way to t
Re: (Score:1)
Re: (Score:2)
web surfing -- exactly my point. The internet is supposed to work with much more than just your WebTV rig. Doing anything more these days isn't allowed on ISPs serving home users, which is exactly what I was complaining about.
Re: (Score:2)
Re: (Score:1, Interesting)
If linux had marketshare, there would be more pople looking to exploit it.
Re: (Score:2)
Re: (Score:1)
No. You'd still have lots and lots of stupid people online doing stupid t
Re: (Score:1)
Re: (Score:2)
How does this compare (Score:3, Insightful)
Re: (Score:1)
thankfully with vista out (Score:2, Funny)
"Computer viruses have prompted 1.8 million households to junk their PCs over the past two years, while spyware has claimed another 850,000 machines in just the past six months."
Oh.. But Think of the Children!! (Score:1, Flamebait)
Either that or more "family friendly" legislation to protect us from ourselves. (Which never works)
Or maybe some combination of the two.
Re: (Score:2)
No wonder... (Score:4, Interesting)
Re: (Score:1)
If that's the case then maybe some parents shouldn't be allowed to purchase a computer . . .
I wonder if they day will ever come where you have to have a license to purchase a computer? Not a software license, but an actual certificate that documents your having some knowledge about what it is you're buying and the proper way to secure it.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
That would probably be even better . . .
Network Users or Network Providers (Score:1)
I'm pretty sure I know the response (Score:5, Insightful)
Sure, it won't solve a thing. But hell, we did something. We didn't do anything that changed anything, but nobody can complain that we don't do anything.
Instead, it could maybe be a good idea to educate people that they should use some AV kits, firewall kits and most important some brains when clicking up and down the 'net. Yeah, I know, I know, everyone wants to replace good ol' common sense (why is it called "common" sense is beyond me, but hey, you know, maybe in the old times when those idioms were created, it was actually common) with technology, we want to bubblewrap our kids instead of preparing them for life, but hey, it simply and plainly does not work. It never did and never will.
Education and information is the key weapon against trojans. Sure, that requires you to learn how to protect yourself and how to defend yourself against malware. You don't want to? Ok, then I don't want you in my net. Get outta here 'til you learned how to operate safely in an environment where your clueless, careless actions cause harm to other people!
How that harms me? Well, considering that there are DDoS sheeps worth a few hundred gigabit/sec, one could see (if one knows how BGP works) how this could be a minor inconvenience to the internet as a whole. So far, "critical mass" is not yet obtained, and they are not in a centralized hand. But I shudder at the thought that it might be. Imagine someone actually having the ability to bring the net to its knees with sheeps firing intercontinentally simultanously. We're heading there. Think he could do the Dr. Evil prank of asking for (pinky-at-mouth) a million bucks and he'll be paid?
All made possible by clueless people who don't give a jack about security, ignorantly participating in DDoS attacks every day.
And what's best about it, they're not even liable for it. I wonder, maybe one should set up a protest through the 'net, and whoever wants to participate and protest against some oil company that fills our seas with crud or clothing companies that employ kids at sweatshops, simply lets himself be infected by a trojan which then DOSes those companies' internet access lines. Hey, don't worry, you're not liable for it. You're just a poor victim yourself, infected by that nefarious trojan.
Re: (Score:1)
Wow. Here, have some lemonade. We tried that, remember? We tried to educate the clueless during the 'September that never ended' period, and we failed. F
Re: (Score:2)
The problem is exactly that this is NOT happening. If ISPs were required to cut the slack, I'd agree with yo
Maybe there's a connection? (Score:1, Troll)
Do your patriotic duty: Install Apache [apache.org].
I second... (Score:1)
I always tell people what they did wrong and what to look-out for while they are surfing the series of tubes. But I almost always, with few exceptions, have repeat customers over the exact crap on a different da
report accuracy (Score:1)
RIAA figures, Consumer Reports figures, all calculated in Taiwan.
...and if that would include europeans (Score:2, Funny)
$400,000,000 (yearly) more (Score:3, Insightful)
I am speaking of a kind of private internet "tax" that amounts to roughly $400,000,000 every year.
The internet now has a regulatory apparatus, called ICANN, that requires that domain name buyers pay about $400,000,000 in excessive domain name fees every year. This is a result of ICANN imposing a roughly $7 "registry fee" on every domain name sale every year even though the actual cost of providing that service is only a few cents.
It may not be phishing, but the ICANN tax certainly pays off for Verisign and the very few other lucky DNS registrars. In fact it is better than phishing because smart consumers can avoid being caught, but with the ICANN tax the buyers of domain names have no choice but to pay.
What To Do. (Score:5, Informative)
Part of this may sound like preaching to the choir, but bear with me. There is a tendency to want the government to do something about every problem, and the hassle of online scumbaggery is no exception. Individuals (and their guardians) need to take responsibility for their own protection, and not expect either the government to protect them (which it cannot) or for faceless strangers to be kind to them, which a tiny but significant portion will not.
Each of these steps solves roughly half of the remaining problems not solved by the previous ones.
So what do you do if your kids download some game, P2P app, or other crapware-laden piece of stupidity? Take away the computer. What if you have several kids, and you don't know who did it? Enlist their aid and hold them all accountable. Tell them that if any of them downloads crapware and the guilty party won't come forward, they all do their homework at the library (for a week or month or whatever).
Re: (Score:2)
Collective punishment like this is a war crime and disallowed by the Geneva convention. It's no good for prisoners of war and it's no good for your kids.
Re: (Score:2)
What a bunch of baloney. While it may be that collective punishment is barred by the Geneva Conventions, it is most certainly allowed in other venues which don't include prisoners of war or protected non-combatants.
Also, there are lots of things that the GCs disallow, such as corporal punishment, that are left to the judgment of parents. I would add that a kid old enough to use a computer unsupervised is past the age of spanking. There are things allowed by the GCs that I would never do, such as
Re: (Score:1)
I guess this is a question of degrees... While I believe collective punishment of children is, and should be, allowable (heck, they use it in schools and youth groups all the time in my experience), your suggestion that non imprisonment of your kids should not be allowable could be interpreted as saying it should be illegal to ground your kids. While I recognise there are those parents who wouldn't ground their kids
Re: (Score:1)
Re: (Score:1)
Be a teacher! (Score:2, Insightful)
I'm telling you, though, that it's not that simple. The scammers are savvy...sometimes even more savvy than us!
The best defense is education. Here at the office I've been offering some lunchtime classes on basic computer stuff - how they work, how scammers work, how computers get in
"Lost" 7 billion (Score:5, Insightful)
During a year of not working i "lost" 50K.
By downloading my albums from itunes rather than buying locally, my local record shop "loses" perhaps $100 a year.
Of course all of these are not even paper loses, as they do not represent money that is any way real. They barely qualify as opportunity costs.
I really don't understand why these numbers are represented as losses. If a firm pays $.25 for each advertisement, do they lose that money for customers who do not buy anything, or do they just alginate the entire thing as a loss, or do they say it costs, say $2 to acquire a customer. When a computer is down, is this a loss, or cost of doing business with that computer. Presumable if the computer started generating actual losses, the firm would no longer use it. In fact machines are brought in because not using machines costs more money, and represent real losses. Of course, once the machines are in the savings are often not as great as one calculated, which some might consider a loss.
Of course even if this is a loss, it hardly seems significant. It is like $20 per person. The recent price increase at Starbucks likely has a greater impact.
Re: (Score:1)
7 billion? (Score:1)
13% (Score:2)
18/14*100... 77% of children don't meet the MySpace age 14 requirement? No?
Blame the parents (Score:2)
For example, my 8 year old daughter does have her computer in her room. It's an old machine I fix
Re: (Score:2)
I had the same exact problem with my step-daughter in her teen years -- probably worse than your situation. Because she was getting into trouble, her access was extremely limited and she did NOT have a computer in her room. Because of how serious the situation was, I went so far as t
Mad Magazine (Score:4, Insightful)
These are fictional examples, but typical of the attacks on the establishment that Consumer's Reports dished out in every issue. Not even a lowly coffee pot was safe from their critical reviews.
Just one step away from being a Mad Magazine of Products. Great fun to read.
They justified their reports by selecting one as a "best buy", but sometimes, none were acceptable, adding to the funny-factor. All these serious manufacturers making products that turned out to be downright dangerous, or totally useless for the intended purpose.
Now, on to the 'Net. Did Consumer's Reports draw any correlation between an OS like Windows, installed on a hard drive where Trojans can be placed, and the financial losses that they have reported? Sure, any OS can be used by the unsuspecting to fall for a trap on a web site. Back when comic books had advertisements in the back, one could "send off" for a "movie projector", at a very low price, only to get a cardboard one, that you placed over a table lamp. Excuse given for not sending the one in the advertisement, "Shortage of Metal, caused by the Korean War."
Only now, Mac, Windows, Linux users can "send off" for rip offs like that via web sites, and the financial loss is not the fault of the OS.
However, the "ability" of an OS to accept and retain Trojans, viruses, etc. that have as their purpose the stealing of passwords, credit card numbers, account numbers, etc. stored on a hard drive is the point that should be made when blaming an OS. In that case, the user is not choosing to "order something from a web site", and get ripped off when the product never shows up, or is not accurately represented. The computer is just turned on, and is attacked by not having an up-to-date virus scanner, or is attacked by a drive-by when visiting a link.
Surely most of the loss reported by Consumers Reports is from Windows Computers, even if no Trojan or virus was present in the particular loss, the OS was just the one most computer owners were using when the rip-off purchase was made from a web site. That kind of loss is not really the fault of Windows. One could say that since Windows comes preinstalled, requiring no technical knowledge at all to get on the 'Net, then too many average people are able to use a computer to go on the internet, find web sites that can rip them off. They are simply exposed to more opportunities to buy items than they would if they just looked in magazines, or drove to stores.
In a magazine, if it is a well-known magazine, advertisements may tend to be more from trustworthy companies. On the 'Net, all web sites stand alone, unless linked from a trustworthy site.
Consumer's Reports may not be drawing all of these conclusions, and may just be blaming the losses on the 'Net, rather than on the consumer, and the OS.
I didn't RTFA, but I doubt that the Consumer's Reports that I have known all these years would put the blame on the computer users themselves, rather than on the established 'Net, OS providers, and computer manufacturers. CR tends to say, "This product is faulty, you should not buy it", rather than "This is a good product in the right hands, most of you are not using it right, and are going to get ripped off"
Rapidweather