Welcome to the March issue of the Examiner! This month we take a look at the future workers of America, give you tips on selecting a quality investigator, and update you on some of the high-tech methods criminals are using to obtain personal information.

As always, please feel free to send comments and/or suggestions to us!

Computer Users Beware: Keylogging is on the Rise [more...]
Crime Briefs [more...]

Employers have a vested interest in the health and productivity of their employees. Most employers are paying increasing attention to substance abuse in their workplaces due to the variety of potentially hazardous consequences that may result from substance abusing-employees, such as an increased turnover and absenteeism, insurance costs, likelihood of accidents, and decreased profit, to name a few.

According to the U.S. Drug Enforcement Agency (DEA), the international illicit drug trade is a $300 billion a year industry. What's more, the DEA estimates that 60% of all illicit drugs in the world are consumed in the U.S. Of those illegal drugs consumed here, 75% or more are consumed by people with jobs, resulting in an estimated domestic economic impact of over $150 billion annually.

The good news to employers? The University of Michigan's 2005 study, Monitoring the Future, revealed that substance abuse among youth has declined by nearly 20% since 2001. Especially encouraging was the sharp decline of use of methamphetamines and steroids among youths.

"This is promising data to our economy and to those of us who will be employing these youths in our workforce in the coming years," said Todd N. Krost, Business Development Coordinator for Credential Check Corporation. "Of concern, however, is the increase of abuse of prescription drugs, namely Oxycontin, which itself saw a 26% increase in abuse. The overall decline of abuse has been attributed to a variety of factors including: DEA enforcement, declining substance availability, and targeted drug awareness campaigns."

Source: Monitoring the Future, University of Michigan, 2005.

top

Every organization will eventually find itself in the situation where it needs to conduct an investigation related to an internal matter. It is often appropriate to select a third party investigator due to an array of legal issues and responsibilities. Typically, when an organization decides that an external investigation is required, time is of the essence and liability and cost are on the rise while the situation goes unresolved. But how does an organization go about choosing an investigator?

A workplace investigation is a delicate undertaking fraught with liability and pitfalls. The wrong investigator can make the cure worse than the disease. The investigator and their team should have a combination of experience, education, and continuing professional development sufficient for the level of sophistication of the investigation.

"Selecting the right investigator up front will save corporations' time and money and ensure that the expected results are delivered," said Timothy D. Whiting, Director of Operations for Credential Check. "Investigators that will meet with you to understand what your expected deliverable is can save time and frustration."

Furthermore, we recommend that any organization consider these factors in selecting an investigator:

There are more factors that contribute to the selection process. Next month, we will continue discussing how to choose the right investigator.

Adapted from Investigations in the Workplace by Eugene Ferraro, Auerbach Publications, 2006.

top

Technology is often a double-edged sword, and eBay, the San Jose based online auction giant, is no exception. While we are free to buy and sell all kinds of goods on the convenient, global, virtual marketplace, fraudsters are taking the fun out of eBay for several hundred buyers a day. EBay fraudsters most successful scam is to advertise a genuine item (an iPod or Rolex for example), then deliver a counterfeit item to the unsuspecting auction winner. Even if the auction winner is aware of the scam, they have limited recourse as far as getting their money back or reporting the scam.

EBay estimates that one one-hundredth of one percent of all goods sold in its auctions involve some type of fraud, but when one considers that there are over 6 million new listings per day, it becomes apparent that there are hundreds of thousands of victims per year.

EBay has not been negligent in addressing the issue, as it has over one thousand employees dedicated to detecting fraud, and it has developed measures to shut down auctions in progress if they are suspicious. In the meantime, consumers should be wary of red flags, such as individuals who post an inordinate number of auctions, negative or lack of feedback on an auctioneer, the lack of a return policy or the insistence on completing the transaction offline.

top

If you have yet to become familiar with the software title SnagIt, this is one product that you need to get to know, not only for its applications, but the potential security risk involved with it. SnagIt (current version is 8.0) is a screen capture program that allows the user to take a screen shot of any application in progress and to save the file as most any type of image file, including as a .PDF. A user can even add text, arrows, or effects to the "snagged" image prior to saving it in the desired format. SnagIt comes in very handy for getting graphics into presentations, emails, blogs, or instant messages.

Such a powerful tool comes inherent with its own security considerations. A criminal would see a different set of uses for SnagIt that aren't in the user manual. How many people do you know who use their digitized written signature as part of their email signature block? Using SnagIt, one could capture such a signature and place the image of it at the end of a critical document. Just as the possibilities for the noble user are practically limitless, so too are the uses for the criminal.

top

Quote of the Month: "Work and acquire, and thou hast chained the wheel of Chance."

-Ralph Waldo Emerson (1803 - 1882)

Do you use a computer to conduct your banking, pay bills or access other sensitive personal data? Like most in the United States and throughout the world, you probably answered yes to this question, which may put you at greater risk of becoming a victim of an innovative form of cyber crime known as keylogging. This form of electronic con involves the silent copying of keystrokes of unwary computer users via a "backdoor" in a PC, all in an effort to gather personal data. Cyber thieves who monitor their victims' keystrokes typically take interest in and begin recording information only when the victim enters a site of interest to them. Examples include sites which require user names and passwords to access personal data, such as on-line banking websites or online credit card accounts. Even snapshots of a victim's screen can be recorded by these thieves. Once the desired information is accessed, the cyber thieves are able to make unauthorized transactions on the users personal accounts and in nearly all cases, the user has no idea their personal information has been compromised. In two recent cases in Brazil and Russia, cyber thieves successfully accessed personal bank accounts via keylogging software and stole close to 6 million dollars overall.

More often than not, keylogging programs are hidden within other software applications, hence making this form of cyber crime all the more surreptitious. There are a multitude of ways that key logging programs can be installed on your computer, from spyware web downloads, files that are shared through Instant Messenger, files hidden within peer-to-peer applications or downloads, attachments, and email. Because keylogging programs are typically hidden in software before infecting the machine, they are classified as malicious types of programs known as "Trojan horses." Once a computer has been infected with a Trojan horse, the user may notice the following symptoms, which are indicative of infection: increase in pop up messages, computer instability, dramatically slow network performance, the presence of new tool bars in the web browser, and other such difficulties that were not present prior to infection.

Although there is some debate on which specific types of anti-virus software provides the best protection against surreptitious keylogging programs, it is agreed upon that computer users can take some basic precautions against keylogging. Some precautionary steps include: always keep your computer's operating system up-to-date with security patches, install and run anti-virus and spyware removal software regularly, and perform a full system scan weekly with anti-virus and spyware removal software.

top

Cases of unusual ATM skimming have been reported at two locations of Washington Mutual savings bank. The culprits hid a tiny video camera near the bank's ATMs. Customers' personal data were captured by the camera. Skimming devices were also installed where the card is dipped. Fraudsters then encode info on new blank cards and use the purloined PIN to withdraw victims' money from other banks. Three men spotted on CCTV are suspects, but have not been apprehended.

Banks have a duty to make sure that their ATMs are standardized. Outsiders should not have an opportunity to hide a camera near keypads. Service and cleaning staffs should be warned of the risks. Bank security should offer rewards to any staff personnel who find such a wireless device.

Credit card security is at risk if card holders provide the three or four digit security code contained on most cards. It's not enough for fraudsters to have the full number and the expiration date. To cut fraud credit processing offices sometimes demand this additional info. They also might ask for the zip code of the address to which the card statement is mailed. This is easy to deduce. The card code isn't.

Advise employees never to provide this number to an inquirer unless they have initiated the purchase request. With fear of phishing growing daily, card holders need to be more alert. Instead of responding directly to "opportunities" received on their email, they should type the desired, a confirmed URL into the browser to assure it's the correct site, not a phony one.

Reprinted with permission by "2006 Security Newsletter," January 15, 2006. Robert D. McCrie, CPP, editor.

top

Melissa Data of California has developed a resource tool for looking up crime statistics in cities and states across the country. The Crime Statistics Lookup allows for the viewing of statistical information related to crimes that impact a city's crime index rating. For example, one might be surprised to learn that Palm Springs, CA has a much higher (worse) crime index rating (835) than Los Angeles (435), despite having only 4 murders committed in 2004 compared to LA's 518 in 2004 (the most recent year of Uniform Crime Statistics from the FBI), and despite roughly 3.5 cars being stolen every hour in LA. Melissa Data also offers several other Lookups, such as latitude/longitude locators, zip code registries, labor statistics, and campaign contributions - just to name a few.

top

top