At The Launch Pad we are continually educating our clients about the increasing number of online security threats and how to protect their businesses. Human error accounts for over 50% of the of the root cause of security breaches according to a new study from CompTIA Information Technology. While many people will rightly guess this is primarily caused by end user’s failure to follow company security policies and procedures, there are many other seemingly innocent ways users can stumble upon malware or scareware as they surf the web.
Recently we re-posted an article discussing Google’s warning about ad injector malware that inserts legitimate looking extra ads onto websites that make the pages difficult to navigate. Some even deliver ads explaining that a virus infection has been detected on your computer, hoping you won’t put two and two together to figure out that it’s the popup window itself that’s trying to hold your computer for ransom.
Another little known tactic for installing scareware or malware is typosquatting. Dozens of misspelled domain names that spoof major brands are leading unsuspecting PC users to a questionable tune-up application called SpeedUpKit. Knowing that people are unlikely to search for the application directly, SpeedUpKit is banking on users misspelling common domain names to lead them to the product. The application claims to clean up registry entries and junk files but in reality it finds hundreds of ficticious issues on any PC it scans hoping to scare the user into buying security products they don’t actually need. Microsoft, Adobe, Google, Wikipedia and the New York Daily News are among the companies that have been targeted by SpeedUpKit for typosquatting. If you try accessing the website legacy.com but accidentally type legady.com, you will likely end up on a SpeedUpKit promotion page.
SpeedUpKit is certainly not the only perpertrator of typosquatting. Many companies, including Verizon and Lego have garnered reputations for aggressively chasing down typosquatted names. Lego, for example, has spent roughly $500,000 USD pursuing 309 cases of typosquatting. From 2006 to 2008, a typosquatted variant of Google called ‘Goggle.com’ existed. Visiting the website would cause the domain to automatically download various computer viruses and other malicious software.
The best defense against any of these online security threats is to be immediately suspicious. Users have a responsibility to partner with their company’s IT provider in being vigilant and adhering to online security policies and procedures. When in doubt, don’t click and never fall for unsolicited tech support offers. If you think you may have experienced a breach or become infected with malware, contact your IT provider immediately for assistance in remediating the issue. And finally, share your experience with family, friends and associates so they can become better educated about the dangers that lurk online.
For more information on solutions for running your businesses’ technology more efficiently, visit our website or contact Megan Meisner at mmeisner@launchpadonline.com or 813 448-7100 x210.