Internet security fears for 2005

ONLINE scams proliferated in 2004 and computer experts warn that next year will see no let up in phishing and other internet frauds. There is still no magic solution to internet fraud ? computer users simply have to educate themselves about the potential risks and act accordingly.

But security analysts say that once people are aware of the dangers, it will be more difficult for fraudsters to make a living. Even so, heightened online security has forced the criminals to become more ingenious and look for weaknesses.

The top internet threats last year included computer worms which leave behind tools that spread spam. Scammers also sent so-called 'phishing' emails to trick bank account holders into revealing passwords. And rogue programs known as 'spyware' hijacked web browsers and crippled computers.

Experts admit that as technology gets better, so too do the scams. Gregg Mastoras, a security analyst at security systems provider Sophos, says users are the weak point and they are being exploited: 'The bottom line is, there is no silver bullet technology. I just don't think users are educated enough when they are on machines and what they are doing with them.'

Dozens of products and services were developed to attack 'phishing' - email pretending to be from High Street banks, building societies and online retailers, including eBay. But fraudsters are upping the ante. Virus writers have found new ways to infiltrate computers and networks, bypassing protection inspired by their earlier methods of attack.

For example, with more network administrators blocking attachments to stop viruses from spreading via email, hackers managed in June to convert popular web sites into virus transmitters by taking advantage of known flaws with Microsoft products.

They have also used viruses like 'Mydoom' to deposit programs that let them take over infected PCs - and then use them to relay spam or launch attacks on websites like Microsoft's. Some 90% of viruses in 2004 carried a 'backdoor' mechanism, compared with fewer than half in 2003, said Alfred Huger of Symantec, an online security software company.

Law enforcement agencies and service providers are only beginning to establish guidelines for jointly chasing suspects who can move with stealth in a medium that knows no borders.

Security experts rank phishing and spyware as the greatest threats for 2005, given how clever their developers have become in the past year. Phishing scams can quickly drain entire bank accounts of unsuspecting users.

Anyone who is worried about online security needs to take basic precautions.

1. Protect your passwords and online usernames. Do not disclose them to anyone, especially someone who claims to work for a bank or financial institution with which you hold accounts.

2. Never respond to unsolicited email that purports to come from your bank or building society. They do not need to 'check' your details, they already have them. If you think the email could be legitimate, phone your bank to be sure.

3. Don't access your bank details from a shared computer or from an internet caf?. Technically, the banks are not liable for losses if your details are compromised by use of a shared computer.

4. Don't give your credit card numbers or personal data to anyone you don't trust or don't know. A fraudster can apply for credit in your name using just your basic name, address and other information such as your birth date or even your mother's maiden name.

5. Never download software or other files from an unknown source and be wary of unsolicited 'security updates' and other emails asking you to click on links to download information.

6. Before submitting financial information through a website, look for the 'lock' icon on the browser's status bar. It means your information is secure during transmission.

So far phishing has cost UK banks more than £4.5m, but their patience with people falling victim to the fraud is wearing thin. The Association of Payment Clearing Services said banks will no longer guarantee victims will be reimbursed losses, but instead will look at each incident on a 'case by case' basis.

Banks are not legally liable for the fraud if the customer has broken its online banking terms and conditions, which typically include failing to protect security details and not ensuring your computer has the necessary firewalls in place.

An Apacs spokeswoman said: 'Given the amount of work the banks of done to publicise phishing, it is coming to a point where a bank may refuse to recompense a customer. It is likely to be if you have been duped twice, which shows negligence. If you have been a victim once the bank will be sympathetic, but twice shows a lack of care.'