Surfer-advising software

It's hard to imagine busy Web surfers (especially young ones) bothering with the slight slow-down SiteAdvisor represents to the search-and-surf experience, but we may be looking at our surfing future. SiteAdvisor is a think-before-you-click software product that, when you've turned up a bunch of search results in Google or MSN Search, tells you whether it's safe to click on links to specific sites. It's a free (in beta-testing) add-on to the Firefox and Internet Explorer browsers that Washington Post security writer Brian Krebs has been testing. The reason why it may be our future is because it deals with the sad new reality of Web surfing: all the bad stuff that gets on our family PCs when we click on the rapidly proliferating malicious sites that send the stuff. Some of that clicking happens in emails and IMs; the rest, Brian reports, happens when people click on "unfamiliar links that turn up in Google, MSN or Yahoo search results." Here's where kids and teens come in. They love games, music, contests, and all the sites and technologies that deliver them and allow the uploading of them. They're also known to click, upload, download, and surf fast, freely, fearlessly. Unfortunately, that's a spyware and malicious hacker's dream user profile. For example, Brian searched for "lyrics" in Google ("song-lyrics sites are notorious for installing spyware and adware," and where spyware is, keylogger software that, e.g., captures passwords and credit card numbers is not far behind). You have to read his account to believe all the crud lyricsplanet.com downloaded on his PC (do not go to that site!). Whether or not your family downloads SiteAdvisor, a family discussion about alert surfing, IM-ing, and emailing might be a good idea. Nasty Web sites' numbers are growing, and their URLs and promises often look great to kids.

X-rated film-promotion game

An X-rated videogame promoting an R-rated movie, as the National Institute on Media & the Family's president David Walsh put it. It was a curious marketing strategy for "Running Scared," a film that did not get great reviews and with a "story line" highly populated by prostitutes, pimps, mobsters, bad cops, and pedophiles (the Chicago Trib's reviewer did have "a sneaking suspicion" that the film "could become a cult classic, and an even better hunch that it will top the box office this week. And who can blame moviegoers? It does, after all, have a lot of characters." Of the film's companion videogame's two versions, found at its Web site, the one rated "M" (for 17+) has sexually explicit content on Level 2 (which has a form of age verification with the required registration). The Minneapolis-based National Institute issued a parental alert, and WCCO-TV in Minnesota reported that the "racy interlude has apparently [since] been removed." The Institute does an annual "report card" on videogame violence. Here's another review of "Running Scared" in the Harrisburg Patriot-News.

The new PC security risk

Great. Just as we Net users were getting smart about phishing and viruses, online criminals have moved on, the New York Times reports. "In some countries, like Brazil, [phishing] has been eclipsed by an even more virulent form of electronic con — the use of keylogging programs that silently copy the keystrokes of computer users and send that information to the crooks." The little programs are much easier to exploit than the social engineering of phishing emails. Even kids are exploiting them. Brazilian police just arrested a ring of 55 people, 9 of them teenagers, for stealing $4.7 million from 200 different accounts at six banks. Tell your kids: We all need to avoid clicking on unfamiliar Web links in emails and IMs. And PC owners need continued vigilance about Microsoft security patches (or automate them), firewalls, and antivirus protection. These little keylogger programs (just like the kind in monitoring software parents use, hopefully openly, to check up on online kids) can also be embedded in files traded on file-sharing networks and, of course, in malicious Web sites – very often sites offering free games (sites kids like to frequent), a new study at the University of Washington found. Here's a report on the study at Yahoo News, and the New York Times's sidebar, "Protecting Yourself from Keylogging Thieves."

Mac users, Apple just issued its latest security patches, ZDNET reports. For context, see "Is Mac OS as safe as ever?" at CNET and "Straight talk on Mac security risks" at MacWorld.

Blogging's upside too: Study

Most of the coverage of a Northwestern University study of 68 randomly selected teen blogs zoomed in on what its authors said about blogging's risks. New Scientist magazine, however, led with the man-bites-dog part of the story: "Instead of steering them away from their computers, parents should recognise that teenagers sharpen important social skills online, say psychologists and anthropologists studying internet behaviour." One of the study's authors, David Huffaker, "thinks the blog format enhances [teens'] understanding of how to build a narrative," according to New Scientist. The Oregonian had a similar lead, reporting that these social scientists are saying to parents, "Just chill. The kids are doing just fine, thank you." The headline at Medindia.com, a healthcare portal in India, though, was more like US ones in recent months: "Teens need to exercise caution while using online blogs." Medindia cited some of the study's other findings, bearing out parental concerns: "The blogs, equal samples from male and female teens [average age about 15], were studied minutely, to reveal that nearly 70% opened up with their real names," 61% with contact information, some 30% linking to their personal home page, 44% giving IM contact details. About 50% had "stories about love affairs, infatuations, sexuality debates and homosexuality opinions"; "71% also discussed school topics, homework, grades and stuff along with music preferences." For more on blogging's broad user base (well beyond teens), please see this week's issue of my newsletter.

Teens & guns in the news

There were two sobering stories about teens and potential violence this week, from Colorado and Virginia. The Richmond Times-Dispatch reported that four boys – 16, 15, and two 13-year-olds – have been charged with plotting to blow up two high schools. All of the charges are felonies, which means detention until age 21 if the boys are convicted (the juvenile trial starts next month). "Police, who seized three computers, two shotguns and other unnamed items from the boys' homes, said the four plotted in Internet chat rooms." In Colorado, a 16-year-old student at Evergreen High School was arrested after posting in his MySpace profile photos of himself with guns, CBS News reported. He "was being held at a juvenile detention center facing three misdemeanor charges of juvenile possession of a handgun and will be in court on Monday." There were no threats in his profile, reportedly, but some parents kept their kids home from school after seeing the content and reporting it to the school, which reported it to the police. "One photo allegedly showed him lying on a floor surrounded by nine rifles with the caption, 'Angel o' death on wings o' lead'."

Beware 'IRS' attacks

Not really the IRS, of course – they're emails coming from phishers posing as the IRS, or PayPal, or your bank, or Wal-Mart, saying scary things like, "Your account's been compromised – click here or we'll have to close it." Or "click here to check on the status of your tax refund." These emails' numbers "skyrocketed in December," and IRS-related ones can only be expected to increase as we approach April 15, the Washington Post security blog reports. These messages are using "social engineering" to trick or scare people into clicking on links that take them to Web sites that automatically send software code to family computers – code like Trojan horse programs that give control of the computer to the phishers or keylogger software that captures personal information like passwords and bank account numbers. This kind of social engineering is aimed more at adults, obviously, but there's plenty employed on the instant-messaging services, trying to trick young IM-ers to check out a cool video clip or tune. Our kids probably know better than we do to be on the alert to messages like that, but a family discussion about social engineering might be interesting to all family members.

Mac: 'Serious' security flaw

Suddenly, Mac security is looking a whole lot more complicated. The worms, both discovered last week, are basically harmless, the second even called a "proof of concept" worm. But the security flaw, discovered this week, is being called a serious one by both the BBC and the Washington Post. Security experts say this is looking like a trend (Mac users, ask your nearest authorized dealer what protection they recommend). A German PhD student found the security breach in about 15 minutes after watching a discussion on German TV show Mac-TV in viewers called in to say it was "not possible for OS X users to infect their machines just by clicking on a link or visiting a Web page," the Post reports. Until Apple issues an update, the Post cites advice from the SANS Institute: "Safari users should consider disabling the option 'Open "safe" files after downloading' in the 'General' Preferences section in Safari." [For more on the worms, see my earlier post.]