Of Viruses and Acid Rain

I am one of the lucky Nigerians who don’t need to drive long distances to get to work. One effect of this is that I don’t spend much time listening to my car radio. However, one radio show I do get to hear and really enjoy listening to is the Daily Guide on Star 101 FM from 7.15 am and 7.30 am. I seriously love Moyo and Mofe Oyatogun’s take on the news. This isn’t because their reports are necessarily of scintillating intellectual content or breathtaking in vision. Instead, I like their news show because they bring texture to what is traditionally dry and monotonous. Their back and forth makes the news fun to listen to.

On two occasions however, they quite annoyed me. Late last year, December I believe it was, Mofe reported on a computer virus that was making the rounds. This virus was supposedly the most dangerous virus ever known. Microsoft and CNN were apparently both reporting it as the virus to end all viruses. For those familiar with such things, it was clearly a tried and tired hoax. And it was being reported as fact over a radio show that is listened to by thousands if not hundreds of thousands of uninformed listeners. This particular hoax has been recycled repeatedly since the last century. I wrote about it earlier in my blog post on hoaxes and talked about how to validate and verify those kinds of reports.

Act two. A couple of weeks ago, the Acid Rain hoax filled the airwaves. Apparently a text message had gone around Lagos that a rain of acid was coming and people should take cover. Again my second favourite (Dan Foster’s my first) radio personalities reported it as news. Let’s give them credit this time. They brought some skepticism to the story and followed up with a bit of journalistic fact-finding to “to see if these things were true”. Still, the results they came back with did much less that clear up the issue or expose it as the hoax it clearly was.

Both these incidents worry me because of several things. First, as I said wrong information was reported as news. The journalist apparently received the information about the virus in an email message. As a good citizen who wanted to make sure people she knew didn’t get their computers infected, she decided to let as many people as she knew know about it. For most of us that would have meant forwarding the email to as many people as we could and asking them to do the same (creating the flood of messages that was the hoaxer’s intent). My Daily Guide folks, being radio journalists, just happened to be in a position to share this hoax with all her teeming radio fans.

Most people in Nigeria don’t know computers. Beyond the basic uses they put their PCs to, they really know just enough to get into trouble. So those of us who speak to the public in any form or fashion (radio or blogs) need to be as sure as we can that we are not spreading misinformation. Because someone will believe us. The public sound of our voice gives us the fallacy of legitimacy. Consequently we have a greater duty to ensure veracity. I kind of hold myself responsible for not calling into the station or sending them an email debunking the first story. As a blogger and computer professional, I should have done what I could to get the word out over the same medium the hoax was spread.

The second incident is the more chilling one. This isn’t really a computer issue and the domain knowledge needed to debunk the hoax is different. Still secondary school encyclopedia reading was all the information I needed to be sure it was a hoax. The initial word went out over SMS before being picked up by the news media. Nigeria is a cell phone nation. The increase in our tele-density over the past decade has been off the charts. Many technology and developmental thinkers have recognised that the cell phone, for most of our population, is the equivalent of the computer and the internet. The great thing about cell-phones is that they are so cheap that most people independent of income or education can afford one. What makes them great also makes them a huge problem. If you want to reach most Nigerians as individuals you sent mass SMS. Those messages resonate more and somehow seem more authentic to many than a news broadcast. Possibly because text messages carry a sense of personal communications with them.

A similar, and worse incident, was the text about a large influx of northerners into Lagos with nefarious intent. I didn’t get that text either, but I did get the text debunking it. I must commend the security services and whoever they partnered with in getting the word out. Still, how do we know the first wasn’t true and the second wasn’t a lie to deceive us? You see the problem? We are now in age where mass communication can be done anonymously with near impunity that can have all sorts of impact on our populace.

Which is why I am concerned about what our radio and TV broadcasters present. They are in the unique position of being able to instantly spread the word to counteract false information or become the unwittingly agents of a wildfire of misinformation. They need to know and use the tools available to get the right information into people’s hands when someone else is doing their best, whether maliciously or misguidedly, to rain acidic information on us all.

Dej.

Photo courtesy of Eremi at flickr.com

The Great Firewall of Africa.

 

The Great Wall of China is an awesome piece of world history and architecture created in the so-called Middle Kingdom between the 5^th and 16^th centuries BC. This wall stretches for over 8,000 km and was built to protect the nation then from invasion. The “Great Firewall of China“, is a euphemism for the technology the Chinese government has put in place to control what websites (mostly from outside China) their citizens can see. This prevents people in China for accessing what their governments consider to be unacceptable content. They are locked away from the rest of the digital global village seeing only of filtered view of the world. The major international internet services such as Google and Yahoo have also been a part of the Great Firewall by filtering their content as required by the Chinese government.

There is another great firewall. Unlike the Chinese one, this is not imposed by any government and it is not to keep anything from getting in. Rather, it keeps much of a continent locked out. It is not acknowledged, identified or much commented about. However, it is similarly bad for the people encircled by it. It is an insult to their right to access internet resources across the world. I refer to the Great Firewall of Africa.

A couple of years ago, after I got my first debit card, I tried to purchase something online from HP.com. The order failed. Apparently HP doesn’t accept credit or debit cards that are not issued by US banks. Good enough. That is their choice. However, I recently discovered that if you do have a US issued card, and you try to make a purchase from an IP address that is outside the US, (even if the delivery address is in the US), the order will not be successful - and they won’t let you know why. It took a conversation with their support people to discover this. Now this may not be only Africa or Nigeria specific, but anecdotal evidence suggests that other online service providers do explicitly block out Nigeria and other African nations. I work with several Americans and several of them have testified that they cannot access their bank accounts and other personal web services from within Nigeria. The only way they can do their transactions is from the office because their internet connection is routed through the UK and the US.

Services like PayPal provide financial services that make it simple, safe and efficient to move funds and perform transactions on the internet. You can tie a PayPal account to a bank account and efficiently conduct commerce, funds transfers and other services with ease. PayPal is famously not available to Nigerians, - not by IP address, but by any form of indication that you are resident in Nigeria. Their services are simply not available in way that they can be consumed by Nigerians in Nigeria - and they are not the only one. Google Checkout is a system for masking your credit card information and placing orders online. Well Google will happily register my Nigerian issued debit card in their system, but will not let me make Nigeria a shipping destination.

Wikipedia has this to say about the phenomenon called IP banning: “IP banning is also used to limit the syndication of content to a specific region. To achieve this IP-addresses are mapped to the countries they have been assigned to. This has been used to devastating effect most recently to target Nigerian IPs due to the perception that all business emanating from the country is fraudulent. Thus making it extremely difficult for legitimate businesses based in the country to interact with their counterparts in the rest of the world. To make purchases abroad, Nigerians rely on proxy companies to mediate transactions”. While IP blocking or banning is the most blatant form of discrimination, I find what HP is doing more insulting. At least with the banning, I don’t waste time on your website at all. At HP you spend time, do all the ordering, then your payment is rejected.

The reason Wikipedia gives is also the main reason many sites do what they do to us in Nigeria. From one perspective, it’s understandable in the light of the 419 problem. On the other hand, as I asked someone today, if they block access from Nigeria to prevent fraud, what do they do to prevent fraud from inside their own countries where the incidence of fraud is far greater? According to the Internet Fraud, Scam and Crime Statistics - 2009, the following stats about fraud perpetrators hold true:

· 77.4% were male and

· 50% resided in one of the following states: California, New York, Florida, Texas, District of Columbia, and Washington.

· The majority of reported perpetrators (66.1%) were from the United States; however, a significant number of perpetrators where also located in the United Kingdom, Nigeria, Canada, China, and South Africa.

The person I was speaking with had the perspective that all of us suffer from the activities of the fraudsters. Not just in the risk of being defrauded, but from our freedoms being curtailed in order to protect themselves.

Examples abound of this tacit discrimination against us and it’s not just about websites. technologies like the iPhone and the Blackberry limit what applications you can download and install, they determine what music you can buy or stream for free. All based on where you live. The XO, a special notebook designed for the poor children of the world can only be purchased by governments, or by US residents once a year. So as individual Africans we cannot contribute this innovative computing technology to our own communities because One Laptop Per Child did not take our abilities into account.

There is a fundamental disdain being demonstrated for Africans and Nigerians. It may be subtler, but no different from the mentality that thinks we live in trees and don’t wear clothes. It is the same insult that dumps toxic chemicals on our shores. It is the limited mindset that focuses on giving aid to Africa rather than engaging the African entrepreneur in a way that is a real win for all parties. It is a missed economic opportunity, and it is their loss.

As it is, all I have spoken about is ecommerce examples. Who knows what sites there are that hide useful knowledge and information simply because of conceptions (no doubt some are true) about Africans and Nigerians. Information that could be a precious resource to us all.

What should we do about it?

First of all, I think we should scream as loudly as possible. Rather than the Minister of Information complaining about jokes in a Sony advert, the ministers of trade around the continent should be putting pressure on our trading partners across the oceans to make companies remove these unjustified blockades. Nigeria, let’s use our oil as our leverage.

Secondly, we should develop our own home-grown solutions. We are a continent of very smart people. We know our peoples’ needs and interests. We know the terrain better than anyone from outside. We can create products and services for our internet that will rock the world. Let’s do an India on them and make them clamour for our technology expertise. Let’s make them come to us.

Dej.

Image Courtesy of jonhardm at Flickr.com

SMS Spam: Stopping The Flood Before It Happens

Is it just me, or is there an increasing amount of unsolicited SMS messages hitting my phone? First were all the Access Bank messages. Then there are the Dana Air messages I have received over the past few days. It hasn’t become a really irritating issue yet, but email spam wasn’t either in the early days. Now it makes up 80% of all email traffic worldwide.

Email spam is evil for many reasons. Many times it offers illegal or questionable items or activities. Other times, spam could actually be a phishing attack, a trick that ends up with your computer infected with viruses, your financial information compromised or any number of evil things. At the very least, email spam takes up so much of your mailbox and it distracts you and wastes your time. It forces businesses to spend so much on tools that block spam from your email. Expensive email storage is taken up by these messages if the spam blockers are not efficient enough.

email spam has forced legitimate businesses who want to connect with customers or potential customers to jump through so many hoops to get email messages to people. So businesses have to get people’s permissions upfront before they can send them email messages (“opting in” is the preferred term), they need to provide a means for people who have already opted in to opt out. Many countries have laws against spam.

Before email spam, there was what I could call “voice spam”. Telemarketers are often the scourge of US households. Telemarketers call your home to try to convince you to buy stuff. Many times they are making legitimate offers. Other times they are tricksters. Once, while visiting the US three or four years ago the home I stayed in was deluged constantly with phone calls from telemarketers. Not an hour passed without the phone ringing with someone making another offer. The US has systems in place called “No Call” lists in various states and cities. You register to get on “No Call” lists and telemarketers are not allowed to call you. There are legal penalties if the telemarketers call numbers on the list.

Now I said all that to say this: as businesses begin to increasingly use SMS to advertise their products and events, these SMS messages could begin to take on the qualities of spam. As a matter of fact, unlike email spam, which is a problem for ISPs, telecoms service providers actually profit from the flood of messages (they bill the senders). So there is actually a disincentive for them to be part of any attempt to control SMS adverts. However, before it becomes a problem, regulatory bodies (Madam Dora and NCC) and telecoms companies need to set up rules and systems that give users control over whether or not they can be sent advertising text messages, or filter out what messages they can receive. Businesses to which we give our phone information should be explicit in how they intend to use that information before we give it to them. We probably need our own equivalent of no call lists.

Of course, I may just be raising a false alarm. SMS spam may never become a real issue here in Nigeria. More likely though, its only going to be delayed en route to hitting us. The cost of messages may keep this prohibitive for most businesses. On the other hand, the internet has provided mechanisms for making so many expensive things (both good and bad) cheaper to accomplish. Indeed some may not share my viewpoint and see these messages as a source of valuable information and products. Either way you see it, the ability to control your personal communications and decide what reaches you or not, can only be a good thing.

What do you think?

Dej. 

Photo courtesy of G-rated Birdman on Flickr.

---

I just installed Snap.com’s widget. It gives a live preview of the page that links point to. Let me know how you like it.

Phishing for Trouble

I think it started with the airlines. It may actually have begun with the late lamented www.shopforless.com, but I think it was the airlines. Whoever may have been the first to offer online payment on websites in Nigeria, they were faced with a society that was sceptical about providing financial information online.

Carded

When the banks started offering MasterCard services, they were initially adopted by people with international exposure who had been chomping at the bit for a payment mechanism to use online or on trips abroad. These people could not open accounts in the US or Europe and get credit or debit cards and so were eager to take advantage of these new services. Slowly this led to increasing awareness and confidence in the populace that payment systems could be locally supported here in Nigeria. By the time InterSwitch and eTransact cards became part of the national idiom they met a significant part of the populace who were not only willing to shop online but demanded web-based services.

I think the airlines helped the most. The convenience of booking, making payments, rescheduling flights without having to go to the airport or the bank or calling up a travel agent cannot be quantified. My wife lived through this particular evolution and was an ardent evangelist of this at a time when even vastly more technologically-oriented people were not even aware that these online fulfilment systems were even available.

Phishing Means You’re Bait

Aside from the ecommerce sites, the banks have rolled out a range of services on the internet. These include passive services like checking transaction histories, and active services such as funds transfers, cheque confirmation or revocation as well as utility payment systems. InterSwitch itself has a site where you can pay several different bills from service providers such DSTV and Zain on your PC or your internet enabled mobile phone. With all this and a host of ecommerce products and services now available Nigeria, like most of the world, is swinging through the lush forests of ecommerce.

Unfortunately, here there be tygers.

Internet criminals are now plaguing Nigerians and our own home-grown ecommerce and online payment systems like they do international products and services. There are a variety of criminal mechanisms designed to fleece people of their money, one in particular bears discussion. It is known as phishing. The word is a corruption of the English word “fishing”. Perhaps the concept of a fisherman dangling his bait in the water waiting patiently for a victim to swim by is the basis for this usage. Using Wikipedia’s definitions:

“In the field of computer security, phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT Administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by e-mail or instant messaging,^[1] and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Even when using server authentication, it may require tremendous skill to detect that the website is fake.”

More Than Meets the Eye

Earlier this year (or was it late last year) a phishing scam email was going around in which people were told that InterSwitch was upgrading its systems and needed owners of InterSwitch cards to go to a website (a link was provided) and enter their card number, expiration date and PIN. Anyone who did this would have ended up giving their card details to criminals who would have used the information to rapidly make purchases for goods and services online to the limit of what the person had in their account. A screenshot of the scam message is included below as an example.

Image courtesy of Spam Email Graveyard

The example is typical of the scam. It purports to come from a well known organisation. It puts you under time pressure, makes you afraid that if you don’t take action, you may lose access to something important and it provides you with a link to go to. While simple, this is also powerfully effective. In particular, note the link in the image. It is actually a perfectly legitimate InterSwitch link. However if you were to click on it, the code behind the text would take you to a completely different page. In this case you would have ended up at the link below.

Some links in other spam messages may not be this well done and may be variation of the legitimate address. So for example “interswitch-ng.com” could trick some people.

Because of phishing scams too many Nigerian sites have some kind of warning as a pop-up or other kind of fraud alert message on their web pages. InterSwitch has one. As do Guaranty Trust Bank, MTN and no doubt everyone else worth their salt. Often ugly and distracting from the overall web experience, but like the metal bars on our windows and the spikes on our fences, they are unfortunately necessary. Despite these efforts many are still taken in by this and other “social engineering” scams.

Phishing scams are not always internet based and many play on the baser human instincts. For instance a popular warning in the Nigerian media from the phone companies is around scams that send you a text message telling you that you have phone something from the provider and you need to send a recharge card PIN to the number provided to claim the prize.

Breaking the Line

So how do you avoid becoming a victim of a phishing scam?

The very first thing is to NEVER EVER click on a link in an email message you receive that has some of the characteristics I have described. Instead open a browser and type in the LEGITIMATE address your are familiar with for the service. So if I received such a message claiming to be from GTBank for instance, I would go my browser and type in www.gtbplc.com rather than clicking on any link. If the email was truly from that site, there would be some information on the website, usually on the home page, if it is general message to its user populace. It will be within your account pages if it is a specific message to you.

Secondly, use a modern web browser. The latest versions of Microsoft Internet Explorer (version 7 and above), Mozilla Firefox (2.0 and higher), Google Chrome (all versions) and Opera all have in-built tools that provide some level of protection against phishing attacks. The internet security versions of some popular antivirus tools such Norton Internet Security also add their own phishing protection to the common browsers.

Using a spam filter (a tool that removes unsolicited email messages from your mailbox) also provides some level of protection. The public services – Hotmail, Gmail, Yahoo! Mail and their like – have inbuilt spam filters and most organisations that host their own email have invested in them. However spam filters and phishing protection tools are not 100 per cent reliable.

Continuous vigilance is needed in order to avoid becoming a victim of such scams. Treat the internet with the enjoyment and the same wariness as the Balogun market. Revel in the rich variety of goods, sites and sounds, but keep your eyes peeled and your pocketbook tightly clasped to your side.

Dej.

---

My sympathies go to the families of the victims of Air France Flight 447. May they find comfort in God as they face this.

This is not a Hoax

List the horrors out there on the internet. Let me guess what makes your list. Viruses. Spam. Spyware. Credit card fraud. Porn. Old pictures of you from when you were in secondary school. One thing that I bet will not make your list is internet hoaxes. Hoaxes are not dramatic. They don’t keep your computer from working. They don’t take money from out of your pocket. So why care about hoaxes? There are several reasons you should.

A hoax, according to Wikipedia is “a deliberate attempt to dupe, deceive or trick an audience into believing, or accepting, that something is real, when the hoaxster (sic) knows it is not; or that something is true, when it is false.” The most familiar types of hoaxes are April Fool’s Jokes.

Hoaxes have been around for far longer than the internet, but like for so many other things the internet has accelerated the ability to spread hoaxes. In that lies their potential for great damage. One of the most common types of hoaxes out there are virus hoaxes. For example:

PLEASE READ THE MESSAGE BELOW !!!!!!!!!!!!!
Some miscreant is sending email under the title "Good Times" nationwide, if you get anything like this, DON'T DOWN LOAD THE FILE!
It has a virus that rewrites your hard drive, obliterating anything it. Please be careful and forward this mail to anyone you care about. The FCC released a warning last Wednesday concerning a matter of major importance to any regular user of the Internet. Apparently a new computer virus has been engineered by a user of AMERICA ON LINE that is unparalleled in its destructive capability. Other more well-known viruses such as "Stoned", "Airwolf" and "Michaelangelo" pale in comparison to the prospects of this newest creation by a warped mentality. What makes this virus so terrifying, said the FCC, is the fact that no program needs to be exchanged for a new computer to be infected. It can be spread through the existing email systems of the Internet.
Once a Computer is infected, one of several things can happen. If the computer contains a hard drive, that will most likely be destroyed. If the program is not stopped, the computer's processor will be placed in an nth-complexity infinite binary loop - which can severely damage the processor if left running that way too long. Unfortunately, most novice computer users will not realize what is happening until it is far too late. Luckily, there is one sure means of detecting what is now known as the "Good Times" virus. It always travels to new computers the same way in a text email message with the subject line reading "Good Times". Avoiding infection is easy once the file has been received simply by NOT READING IT! The act of loading the file into the mail server's ASCII buffer causes the "Good Times" mainline program to initialize and execute.
The program is highly intelligent - it will send copies of itself to everyone whose email address is contained in a receive-mail file or a sent-mail file, if it can find one. It will then proceed to trash the computer it is running on.
The bottom line is: - if you receive a file with the subject line "Good Times", delete it immediately! Do not read it" Rest assured that whoever's name was on the "From" line was surely struck by the virus. Warn your friends and local system users of this newest threat to the Internet! It could save them a lot of time and money.
Could you pass this along to your global mailing list as well?
-----------------
********IMPORTANT*******
PLEASE SEND TO PEOPLE YOU CARE ABOUT OR JUST PEOPLE ONLINE

Now this may seem like a harmless, though annoying joke, but it has the potential to cause quite a bit of trouble. Many hoaxes ask you to take some kind of action or the other. For instance, delete a file from your computer or stop using a particular product or adopt a particular perspective on something. Then it also usually asks you to forward the email to everyone you know. this is where the internet effect comes into play. Say you forward to 100 people and those 100 people forward to another 100 and so on and so forth. In a matter of seconds, that email could be in a 100 million mailboxes. If we assume 10KB for each copy, That’s 1TB (1,000 GB) of storage space consumed with false information that is spread, not by some insidious mechanism like a virus, spam or a trojan, but by gullible people hitting the forward button. That is bad enough but it can get worse. Now supposing you, and 10 percent of the other recipients (10 million people) actually act on the suggestion of the hoax. This could potentially result in 10 million support calls to a service provider because they deleted an important, or 10 million people who go to see a doctor because of imagined symptoms, or a business that loses millions of dollars in lost business because of a hoax about cockroaches in their factories. Now look at it from a different perspective, supposing, again 10 percent of the hundred million people read the email and spend 1 minute on it. That is 10 million minutes. Which is nearly 170,000 man-hours. If we assume a totally arbitrary five dollars per hour that is $850,000 lost.

You get the idea.

What should you do with hoaxes? Ignore them. Don’t forward them. Don’t hit “reply to all” asking that no more should be sent to you. Kill it dead. Of course, it is not always clear that it is a hoax. However hoaxes usually have the following characteristics.

• Hoaxes toss up well known names in the industry they address in order to give an air of authenticity. So a virus hoax may invoke Microsoft, Symantec (makers of Norton Antivirus) and CNN (to get the media angle). A hoax about a disease may invoke the Centers for Disease Control (CDC). A financial hoax may invoke the name of a bank.
• Hoaxes ask that you forward to as many people as you know. They have usually already been sent to a lot of people, so you will often see a lot of email addresses already in the email.
• They usually claim catastrophic effects. A virus that will bring down the internet. A plot to ban all preachers from American television. A company who will donate 1 dollar for every email forwarded to the live-saving operation of a little child.
• Some technical, professional or scientific sounding information. Most people believe that people who sling around technical terms are speaking the truth – the worship of the expert.

There are websites out there that keep track of hoaxes: www.snopes.com, www.museumofhoaxes.com, and one of the better ones, www.hoax-slayer.com. Your favourite antivirus software will also have information about current hoaxes on their website. The cartoon is courtesy of www.paultempleton.co.uk.

Hoaxes can cause as much damage as the better known internet horrors out there. Unfortunately, there is no technical tool to keep them away. You just need to have a healthy dose of scepticism and go easy on the forward button.

Dej.

---