~welcome to e-commerce world~

Post by Ching Wen, 7 July 09 @ 5:50 pm

From the Legal post in E-Commerze blog, there is an interesting topic which captured my attention. The title is “identity theft: cases on stolen laptops, hacking and lost CD”. The blogger shares seven cases on stolen laptops and hacking systems which are mostly in the United States from the month of August 2006 to May 2007. There are four cases involving laptops stolen from cars and house break-ins, 2 other cases from hacking the systems server and one involving the lost of CD.

Stolen laptops have been a great issue for UTAR students when they experience break-ins in at their Sg.Long rented apartments and housing areas. The information stored inside the laptop will be violated as the laptop is stolen and any personal and confidential data kept can be used to carry out fraud or blackmail.

For example, recently, one of the Hong Kong actors’s lost his laptop and all his private information had been disclosed to the public, which had cause a lot of controversy and inconvenience towards him. The poor guy was even blackmailed for money as exchange for his valuable information. To avoid this scenario from happening, the public should always ensure that their laptops are password-oriented, recommended alpha-numeric type. Furthermore, they should ensure that the information or data kept in their laptops are encrypted. One of the main reasons for laptop theft is due to the user’s lack of awareness as they leave their laptops in their car booths and unattended while they perform other tasks.

Another legal consideration is due to system hacking. This is a popular strategy used to access private data of an organization. For example, when a hacker hacks the organization’s system, it will cause their server to break down for several hours. This will cause the organization to be unable to continue their operation as normal and the business of the organization can only continue when the server has recovered from the hacking. In order to prevent a system hacking action, an organization has to ensure their server is password-protected and is regularly updated.

Theft of CDs is an important issue in the business environment, just as it is in the universities. Information placed on a CD can contribute to plagiarism of others work. In one of the cases mentioned by the writer of the blog, information on a CD can consists of the names, social security number, and member identification, which can provide outsiders with the ability to use the information stored on the CD. This will cause identity theft and abuse.
If the government implements legal laws on system hacking, theft of laptops and lost of CDs, we believe the percentage of the crime can and will be reduced.

Post by Jaeme, 7 July 09 @ 5:50 pm

• E learners can easily access to the learning programme at anytime through internet access. E learners are not required to physically attend the classes and they can learn when they are at home or work. Reading materials are online which enables e learners to download it for their own reading.

2. More reflection and higher retention

• E learning encourages students to practice and improve their learning performance. Besides that, students can focus on what they need to learn and they can do this in a variety of learning styles, as retention is frequently better than in a traditional classroom.

3. Time and cost savings.

• Due to the fact that all learning materials are available over the internet, there are fewer materials to print. Therefore, this results in a paperless environment. Reading materials can be shared and reused in a more efficient way. Students can download reading materials from internet and it only requires a few minutes to download.

4. Enhanced learning.

• More practice and features developed in e Learning, e learning offer learners more exciting ways to engage with the course. Besides that, e learning provides lecturers a flexible ways to deliver the knowledge to their students and results in a greater interaction and collaboration.

5. Greater Collaboration.

• E learning provides opportunities for the groups to work together. It creates shared electronic conversations that can be thoughtful and more permanent than voice conversations.

Although e learning brings benefit to people, but there are still some disadvantages in e learning.

1. Misuse and abuse of technology.

• Since rules and codes are all in digital forms, students may break the rules and cheat their way to success. Students in Malaysian universities have the tendency to break the intranet security set by the university and even try to modify their results or to get preview of the final examination questions.

2. Lack of human interaction.

• Since learning is done through the internet, students do not need to attend the classes nor meet their lecturers. Therefore, some students may not able to understand certain information if there are no lecturers to explain to them. Due to this problem, e learning will not be effective if students are unable to understand the online notes given to them.

3. Lack of motivation and effort among students.

• One of the biggest problems of e-learning is that it makes students lazy and ineffective. Because of e-learning provides educational task that can be done either by the tutor or some sophisticated software, students can do this simple task by just downloading the notes.

References:

http://www.campus.manchester.ac.uk/elearning/uomelearning/ebenefits/

http://www.charm.au.edu/SCPaper/UniversityLevel%20eLearning%20in%20ASEAN.pdf

E government has improved how the government operates internally as well as how it delivers services to the Malaysian citizen. It seeks to improve convenience, accessibility and quality of interactions with citizens and businesses. Besides that, it also improves information flows and process within the government to help improve the speed and quality of policy development, coordination and enforcement.

E government’s vision is to focus on effectively and efficiently delivering services from the government to Malaysian citizens. This enables the government to be more responsible towards the citizens.

There are 7 e government projects implementation:

1. Generic Office Environment (GOE).

• A powerful document and office management solution that allows users to effectively and efficiently manage their office environment. It provides efficient preparation and storage of documents, fast search and retrieval of documents, effective of information, and secure and traceable access to the documents.

2. Electronic Procurement Project

• It is a system that allows suppliers to sell goods and services to the Government through the Internet. Suppliers on the World Wide Web can advertise their goods; show their pricing, process orders and deliveries. It creates a more skillful and knowledgeable workforce and equips the workforce with the new technology at minimum cost.

• It is an integrated technology system that enables HRMIS for the Malaysian Public Service. This will allow the Public Service to successfully deal with the Challenges of the K-Economy.


• It provides effective staffing and right-sizing of civil service, improving paperless HRM capabilities, an open and flexible system and better communication.

• It is a type of service where agencies such as Tenaga Nasional Bhd and Telekom Malaysia Bhd conducting transactions through various convenient channels such as internet.

5. Electronic Labor Exchange (ELX).

• It enables employers and job seekers to communicate in the same platform. It helps to provide an effective center of labor market information and references. Besides that, it improves mobilization of the nation’s human resource and ensures that manpower is fully utilized.

6. E Syariah.

• A management system that integrates the process related to management for Syariah Courts cases. It helps to improve the quality service of Syariah Courts in coordinating and supervising related agencies under its jurisdiction. It also improves the productivity and efficiency of the management of the Syariah Courts throughout the country.

7. Project Monitoring System.

• It is an online system that monitors the entire lifecycle of national programs. It supports and monitors the entire lifecycle of Malaysia’s 5 years of development program. It provides a platform for exchanging ideas and demonstrating best practice models in project implementation and effective decision making based on the forecast project information.

However, there are some difficulties faced while implementing e government. These difficulties are:-

1. Legislative and regulatory barriers.

• To make e government services to be successful and widely accepted, it has to be as good as the traditional paper process and has to have a good security system.

2. Budgetary framework.

• Government needs to know the potential benefits of adopting e government services and treat Information Communication Technology (ICT) expenses as a future investment which will benefit the nation.

3. Lag behind technological change.

• Government faced the challenge of the uncertainty of technological change and negative impact while developing e government. It is difficult to anticipate future impact because technology is changing very fast.

4. Digital divide impedes the benefits of government.

• E government will not be effective if the online access is not being improved. If people are unable to access to the e government services, they will lose the e government’s benefits. Besides that, not many people have the IT knowledge; therefore there might be some of them which are unable to obtain the services online provided by e government.
  

E government implementation was successful due to the good citizen’s adoption strategies provided by e government.

E government is convenient because the services provided are made through the internet. People need not go to a particular store and wait in a line for an hour and spend time to get things done. The services are provided online so you can save time and get the services done through the internet during working hours. Your tasks can be done anytime and anywhere you want.

Besides that, e government provides better customer services which allows agencies to focus on things that you usually need help in routine transaction. The agency provides services such as translating English to those people who can’t speak well and explains to them the complex policies. Besides that, they even provide assistance for disabled people.

Furthermore, E government allows citizen to access to the information 24 hours. New and improved search functions provided by government allow users to search for information that is relevant to what you want to know.

Lastly, the e government service is efficient as online transactions are faster than face to face transactions. Since the services are done online, the paper processing is automated, reducing time and risk of clerical errors.

References:

http://www.das.state.or.us/DAS/EISPD/EGOV/benefits.shtml

http://www.intanbk.intan.my/psimr/articles/Article1%20-%20Full.pdf

Post by Jackie, 7 July 09 @ 5:49pm

Blogs is a short form for weblogs. A blog is a site on the internet where a writer can present his thoughts about a particular topic. Visitors to a blog can post their comments and views of what they feel towards the writer’s blog. The blogging trend is not limited to individuals alone. In fact, many organizations are starting to create their own blogs. This is known as corporate blogging. Corporate blogging is where executives, stakeholders, vendors, and employees post their thoughts and opinions on certain subjects.

There are two main types of corporate blogs which are internal blogs and external blogs.

• An internal blog is accessed through the organization’s intranet and can be viewed only by the employees of that organization. This allows for employee participation by presenting their discussions of issues and also provides direct communication between upper and lower layers of an organization. It gives the employees in the organization a sense of belonging.

2. External Blogs.

• An external blog is accessible to the public to share their views and opinions. Organizations usually use external blogs to introduce new products and services offered by their company. Furthermore, it gives an opportunity the public to give critic on the organization if they are not satisfied with the products and services offered. However, certain corporate blogs do not allow any comments to be made on the posts.

Corporate blogging entered into the mainstream in May 2005, when the front cover of Business Week boldly stated that 'Blogs will change your business'. Meaning that, traditional marketing techniques no longer appropriate for today’s markets and skeptical customers. This is because blogs can help corporate communication’s strategy achieve company’s overall objective by clearly communicating the organization’s message. Furthermore, some organizations have created blogs for external marketing and Public relations.

Corporate blogging is a new effective marketing communication tool because it is most helpful when people are in located in two different locations or have different schedules and need to discuss on urgent matters. Beside that, as compared to the traditional form of marketing, blogs offer a more honest and open communication channel. This is great when organizations want to evaluate customer’s feedback on products and services. It is also a good communication tool due to the fact that Howard Dean, an American politician, was the first to person to use weblog to run for his presidential campaign. In addition, corporate blogging is less costly as compared to thousands of dollars spent on television and radio commercial, and newspaper and magazine advertising. Weblogs are also effective as the messages posted up will not be wrongly interpreted and is assured that there is no misunderstanding among readers.

References:

http://twoday.net/static/maximus/files/seminarpaper.pdf

http://kathleenkenney.com/images/sample_writing/pr_writing/StrategicBlogsInCorpCom.pdf

http://www.nirf.org/_upl/effective_corporate_blogging1.pdf

Post by Jackie, 3 July 09 @ 10:08 pm

• This card represents talk time that users acquire in advance. For instance, if you purchase a prepaid phone card for RM 10, you can use up to RM10 of talk time depending on the call rates per minute to the destination that you make. People like to use prepaid phone cards because they don’t have to carry coins or notes around, and furthermore, calls can be made from payphones, mobile phones, and landlines. The cards are mostly used for overseas calls as the rate per-minute is cheaper as compared to other telecommunications provider. Besides that, prepaid phone cards can purchase from any grocery stores, phone shops, and even newsstands.

2. Prepaid Debit Card.

• This card is very frequently used all over the world because; it can be used to make international payments without the fuss of waiting for neither bank’s approval for clearance and only a minimal fees is charged for bank transfers. All one needs to do is to ensure the card is loaded with cash and transactions can be carried out. Alternatively, if there is insufficient cash on the card, the users need to reload their cards with money from their bank accounts. The purchase amount will then be directly deducted from amount loaded onto the card. This card is most practical for e commerce transactions.

3. Prepaid Smart Card.

• It uses Mifare contactless technology, which is an internationally recognized standard for contactless smartcard. In Malaysia, the Touch ‘n Go card uses this technology for payments made on highways, public transports, selected parking and theme parks. Each time a user touches their card on the electronic reader, the precise fee imposed will be deducted automatically. As you can see from the picture below, as of this moment, Touch ‘n Go cards can even be used at fast food outlets.

4. Prepaid Gift Card

• Instead of giving someone gift vouchers as a present, why not give them a prepaid gift card instead? MasterCard offers customers an easier gift solution as this gift card can be used at millions of stores located worldwide and the person receiving the card can spend a maximum of the amount that is on the card.

References:

http://www.mastercard.com/uk/personal/en/findacard/prepaidcard/prepaid_gift.html
http://www.mastercard.com/uk/personal/en/findacard/prepaidcard/about_prepaid.html
http://www.therichcom.com/phoneCardsguide.asp
http://www.touchngo.com.my/WhatTNG_card_TNG_1a.html
http://blog.saimatkong.com/index.php/2008/04/13/you-can-use-touch-%e2%80%99n-go-card-to-buy-burgers-by-next-saturday/

Post by Jackie, 3 July 09 @ 10:07 pm

Electronic currency is a digital symbol of physical money. It allows consumers to pay for goods or services by sending a number from one computer to another. It is done by transferring funds electronically, from one party to another, where it is cleared and protected by a strong encryption. This benefits the users as it offers more safety and less risk to them.

Furthermore, as E-commerce is evolving to be used widely, electronic currency is making it simpler for consumers to spend online. Usually, a user can purchase electronic currency by connecting to the Internet and certifying ownership of their account. This is followed by the user withdrawing the required amount and the bank issues a unique random number in an electronic coin format. The electronic coin has a serial number whereby the bank signs with their private key. The user will then store the electronic coins on their hard drive.

A unique type of electronic currency is E-Gold. E-Gold is an electronic currency issued by e-gold Ltd., a Nevis corporation. It is done by integrating an account system that allows the consumers to use gold as money. When one consumer carries out the e-gold payment, only the rights over it changes to the other party. The gold however, is still kept in the treasury vault.

1. Mondex.

• Electronic currency can be transferred by a system called Mondex. Mondex is a type of smart card that keeps 5 different types of currencies and transmits cash on the internet. A consumer can make a purchase from any online vendors that accept Mondex by inserting their Mondex card into the card reader and validating with the vendor’s Mondex device, the value of the transaction will be transferred onto the vendor’s card.
  

2. Mark Twain.

• Another type of electronic currency system is Mark Twain. Firstly, a consumer must open a World Currency Access (WCA) account. The WCA is a money market deposit account that bears interest and is accessible to customers free of the electronic currency program. To use electronic currency from their WCA account, a consumer must make transfer of funds by telephone, facsimile, mail or e-mail, from the WCA account to an individual "electronic currency mint" non-interest-bearing account. Following this, the electronic currency amount is downloaded from the electronic currency mint to the consumer’s computer via the internet. The funds are then transferred again to a pooled account at Mark Twain’s. Vendors who are paid by electronic currency can then cash in the amount received.
  

Electronic currency provides some of the benefits as follow:

1. Confidentiality

• Electronic currency is known to be anonymous. For instance, when a consumer sends electronic currencies to a vendor, the vendor will have no idea who the consumer is. This is a completely different feature as compared to credit cards. Furthermore, using electronic currencies can protect the confidentiality of the consumer as banks are also unable to obtain consumer’s personal information.
  

2. Security.

• Electronic currency is protected by encryption of RSA cryptography which makes it difficult to crack the code. Cryptograph is created by using digital signature. Digital signatures require an electronic private key on the sender’s part and a public key on the recipient’s part. Thus, even though people have doubts about internet safety, consumers carrying out electronic currency transactions are probably more secured while carrying out transactions online as compared to conventional way of doing business.
  

There are still some of the disadvantages of electronic currency:

1. Fraud.

• When a consumer misplaces their private key and funds are withdrawn by an unknown party, the bank will not know about it. The consumer will then be liable for any transaction carried out. Furthermore, if the security code is hacked and message interrupted, the unknown party can commit fraud on the intended recipient of the message.

2. Peer-to-peer double spending.

• This only occurs when consumer decides not to have the bank as an intermediary. This is because if the consumer includes the bank as an intermediary, the bank will check for double spending on behalf of the consumer and stop it immediately. However, if the consumer chooses a peer-to-peer transaction, nothing can be done if there is double spending on a transaction.

Post by Jaeme, 3 July 09 @ 10:07 pm

According to the statistics of credit card debts in Malaysia, the number of Malaysians declaring bankruptcy due to credit card debts has been increasing. However, as of May 2009, the number of people declaring bankruptcy has reduced.

There are a few causes of credit card debts:

1. Less income, more expenses.

• Most of the people have lesser income as compared to the expenses they incur. When their income is unable to cover their expenses, they will conduct payments using their credit cards. At this time, they do not think about the ability of paying back the installments of the debts.
  
  

2. Saving little or none at all

• You should save at least 4 months of living expenses in case of a rainy day. For instance, if you lose your job in June, you will have enough money to maintain your current lifestyle up until September. After these 4 months, you may be able to find a new employment. Therefore, having enough savings for a rainy day is always a worthwhile investment.

3. Poor money management.

• Many families accumulate lots of debts. This is due to them not having a monthly spending plan and keeping their monthly bills properly which makes them unaware of the amount of bills they have to settle. Hundreds of ringgit is charged each month on items which they don’t actually need, at the same time, incurring higher interest.

4. Big medical expenses.

• Unfortunately, medical expenses are quite high, especially on serious diseases. Almost all the hospitals receive credit card payment. When you need treatment and you do not have enough money, you will usually use your credit card to pay, although you may not be able to repay the expenses.

References:

http://www.3debtconsolidation.com/top10-causes.html

How to prevent your credit card debts?

1. Spending plan.

• Spending plan can help you to deal in controlling your monthly expenses. For instance, by having the spending plan, you expenses will not exceed your income.

2. Adjust your shopping habits to reduce credit card debt.

• Some people have a habit of shopping and usually they will spent too much of money that they can’t afford to pay. To reduce credit card debts, consumers need to adjust their shopping habits to may help to reduce your debt.

3. Pay card with higher interest rate first.

• A higher interest rate will always cost more money in the long run. To prevent this situation from happening, paying off the credit card debt with the highest interest rates may save a lot of money.

4. Debt consolidation.

• If you consider to switching your debt from one credit card to another, check the fine print before you start transferring the balance. Usually credit card companies try to sweeten the deal by advertising a zero or a very low interest payment on the balance transfers for a certain period. But then, after the time period is up, the amount of debt left is charged a much higher interest rate. This would only benefit credit card customers who can pay the amount of the debt in full at this low rate, otherwise they will run the risk of incurring higher interest rate on the debt.
  

References:

http://consumereducation.suite101.com/article.cfm/credit_card_debt_solutions#ixzz0K6vny9ST&D

http://consumereducation.suite101.com/article.cfm/credit_card_debt_solutions

http://www.rebuild.org/news-article/top-four-techniques-to-get-credit-card-debt-under-control/

Post by Ching Wen, 3 July 2009 @ 10:06 pm

With the current technological advancement, payment methods for mobile phone bills are becoming more convenient than it has ever been. One of the most convenient ways of payment is using mobile payment.

Mobile payment system can be done via mobile phones. It is where money is transferred from one party to another, by means of an intermediary or directly, without an intermediary. Mobile payment system is also introduced in ticketing, peer to peer fund transfers purchases on the internet and purchase of goods.

There are certain potentials in using mobile payment system. Mobile payment system makes consumers to potentially increase their desire in the purchasing of goods. Furthermore, it makes consumers feel at ease as they can buy the goods at the moment they have the desire to do so. For corporate purposes, it can enhance customer service by introducing new products or services via offering more convenient payment method for purchase. Besides that, it brings a positive effect to the company image; as the companies can save cost compared to traditional payment method. Mobile payment systems have become universally and widely accepted to customer, merchants and companies. Payment through mobile is also handy as consumers do not need to search for ATM machines to withdraw money for making payments. Mobile payment system is much more secured compared to cash or credit card.

There are several examples of mobile payments available in Malaysia:

1. MobileExec

• It provides commercial grade short message service (SMS) to people and business that want fast and reliable messaging services.
  

2. Mobile Money

• A PIN-based Mobile Payment solution for the limitation and bottlenecks created by cash, check and credit card. It allows registered user pay for goods and service at anytime, anywhere by using mobile phone with a 6-digit security PIN via SMS.
  

3. Paybox.

• “Paybox” was set up as a holistic mobile banking system which allows customers to access their accounts at any banks.

There are four types of mobile payment can be used by user, which are stated as follow:-

1. SMS based transactions, which is based on sending SMS for payments. This is the easiest but less secured method. It is less secured because any hacker can read the SMS details. It is also unreliable as the services varies, relying on SMS server traffic.

2. Direct mobile billing method which usually charges a fee for the payment made. However, this method is more secured than SMS, which is attributed by two-way authentication.

3. Mobile web payment using web pages or additional software on user’s mobile to make payment. It is done by wireless access protocol (WAP) to make payments, which is also more secured and works better as compared with the other type of payment methods.

4. Near field communication is a smart card installed in a user’s mobile phone whereby the mobile phone can be used for payments in shopping malls.

Relatively, advantages in mobile payment could affect the consumers’ adoption of mobile payment. By comparing the traditional payment methods with mobile payment methods, consumers are able to make purchases anywhere and anytime.Consumers do not need to wait hours in queue for counter payments; they can merely use their mobile phones to conduct payments which can save time. Furthermore, consumers feel comfortable and convenient carrying out mobile payments due to its low-value transaction costs. Low-value transactions are payments for movie tickets, transportation and so on.

Cost saving is one of the strategies that consumers adopt by using mobile payment system. In making transfer of funds or payments, consumers need to pay transaction cost first. By providing low transaction cost, the consumers tend to adopt mobile payment system.

Furthermore, another type of adoption strategy is by educating the consumers about mobile payment system. By widely spreading and advertising about the mobile payment strategies, consumers will feel more confident and comfortable while using mobile payment systems. This is because some consumers do not have knowledge about mobile payment system and some of them do not even know what mobile payment system is. Therefore, the government or any other related parties should advertise and provide seminars on how to use mobile payment systems. Besides that, the government should promote the relative advantages of using mobile payment, so that consumers will feel more confident while using it.

Although mobile payment brings a lot of benefits to consumers, there are certainly security risk involved while conducting mobile payments. Mobile payment system should include essential features that protect confidential information of the users. Service providers should enhance their security system and carry out updates regularly. These will increase consumer’s adoption of using mobile payment.

Moreover, the service provides should design the websites so that the WebPages fit nicely into the mobile screens.This can create a more user friendly system where consumers do not get confused nor frustrated while using mobile payments.

Lastly, lower selling price of mobile phones can encourage consumers to use mobile payment systems. Consumers are able to perform mobile payments by purchasing a mobile phone for less that RM200, which has General Packet Radio Service(GPRS) enabling them to connect to the internet and to perform mobile payments.

References:

http://project.hkkk.fi/helsinkimobility/papers/Mobile%20Applications_2_3.pdf

http://is2.lse.ac.uk/asp/aspecis/20020144.pdf

http://www.watblog.com/2009/06/03/mobile-payments-to-touch-190-million-worldwide-by-2012-a-detailed-look-at-types-of-mobile-payments/

Post by Jaeme, 26 June 09 @ 9:26pm

In order to ensure that our personal and financial data are being safeguarded appropriately, we need to take certain precautions while conducting online transactions. There are certain safety measures that one can choose from depending on the confidentiality of information exchanged and the level of security required by each individual or organization. Below are 7 types of precautions to ensure protection while conducting business online.

1. Antivirus and anti-spyware software.

• Antivirus is software designed to protect your computer against malicious software. Malicious software includes viruses, Trojan Horse, worm and other codes which can steal any unsecured information from your computer. In order to make an antivirus software an effective defense, users are required to scan through their computer regularly and keep the antivirus software up-to-date to recognize the version of malicious software. Therefore, with the right antivirus software, it can provide protection for computers to fight against viruses that can cause damage to computers and more importantly, to ensure that any personal and financial data will not be stolen.
  
• Anti-spyware is a program designed to detect and prevent unwanted spyware installation and remove those program that have been installed. Adware and Spyware are dangerous programs that will enable website developers to access users personal and financial data from their computers. Spyware can be activated while downloading certain files from the internet. This software should be included on the internet as a security measure and should be able to update automatically.

2. Firewall software.

• A firewall is simple program or hardware device that filters the information coming through the Internet into ones private network or system. Firewalls are used to prevent unauthorized internet users from accessing to a private network, especially an intranet. All messages entering or leaving the intranet will pass through the firewall which will examine each message and lock those messages that do not fulfill specified security criteria.
  
  
  

3. Message encryption.

• A popular technique for protecting messages in transit is called public-key infrastructure (PKI) cryptography. PKI is a scheme for securing e-payments by using public key encryption and various technical components. PKI confers integrity (the data haven't been manipulated), authenticity (the identity of the sender is known), nonrepudiation (the data can't be disowned) and privacy on the data. Any one attempting to corrupt or damage the contents will cause the initial binary digits sent by the computer to be messed up and when the receiver receives the message in normal text, it will also be a clutter when the recipient views it. Therefore, the recipient will know the message will have already been corrupted.

4. Browsers encryption.

• The actual way for encrypting the Web-based information interchange is by using the Secure Sockets Layer (SSL). It can be used to encrypt email messages using a symmetrical one-time electronic key. This key functions when the server and browser connection is opened. When the connection ends, the encryption expires with it.

5. Digital signature.

• An identifying code that can be used to authenticate the identity of the sender of a document. It is equal to a personal signature and cannot be easily repudiated or imitated. There is a simpler PKI process using the same algorithms referred to above as `sign' a message whereby the private key of an individual can be used to `hash' the message. This can then be verified against the sender's public key. This ensures the data's authenticity and origin without conferring privacy, and is called a `digital signature'.

6. Password.

• You should choose a password that is difficult for someone to crack. A strong password should consist of a combination of letters, symbols, and numbers in order to secure your personal and financial data. Furthermore, you should not use passwords such as license number plate, IC number, birthdates or phone numbers as passwords and always make sure you change your password occasionally.

References:

http://www.howstuffworks.com/firewall.htm

http://www.jmir.org/2002/2/e12/HTML

How to determine a phishing e mail?

1. Generic Greeting.

• Phishing e mails usually are sent in a large batch. Phishers usually will use such generic greeting such as “Dear customers”. The phishers do not to type all the customers’ name out and sent one-by-one. This is because it takes a lot of time, and they wish to get as much information as they can in a short period. If you receive such an e mail that does not contain your name, please do not click on the link and always be on the alert of such schemes.

2. Spelling errors.

• Phishing e mails usually will contain some spelling error. Once you see any errors in the e mail, it is clearly a phishing e mail.
  
  

3. Requests for personal information.

• The reason why phishers send phishing e mails to users is to track their personal information. If you receive such an e mail that requires you to provide personal information, usually it is an attempt to be a phishing email.
  

4. Sense of urgency.

• Phishing e mails usually will contain “If you do not update your personal information by clicking the above link, your account will be suspended or terminated”. They want you to provide information right away. Therefore, you will be afraid that if you do not act fast, something will happen to your account. The faster you provide information to them, the faster they can move on to the next victim.

5. Fictitious Link.

• Usually phishing emails will have a link for you to go to the website. However, the link that appears in that e- mail may not be the link that constitutes to the real organization. Roll your mouse over the link and see whether it matches the link that appears in the e mail; do not click on the link if there are any discrepancies. Websites that is safe to enter personal information will begin with “https” (s stands for secure); do not proceed if the link does not contain “s”.
  
  
  

How to determine a phishing website?

1. Poor resolution.

• Since phishers created the phishing website urgently, the website will be in a poor quality and will have a short lifespan. Be aware if the resolution of the logo and text strikes you as poor.

2. Fictitious URL.

• Although the link contains the name that you recognize, it may not necessarily the real link to the real organization. Read URLs from right to left – the real domain is at the end of the URL. Websites that are not safe to enter personal information will NOT begin with “https”. Be aware of such URL’s that begin with an IP address such as: http://12.34.56.78/firstgenericbank/account-update/ -- it is likely to be phishers.
  

References:

http://www.phishtank.com/what_is_phishing.php

http://www.phishinginfo.org/how.html

Examples of Phishing:












Process of phishing:

1. Planning.

• Phishers will determine which business to target and then determine how to get the customers’ e mail address of that business. They usually use the same mass-mailing and address collection as a technique.

2. Setup.

• The phishers will create a method of delivering the messages and collecting the data once they have determined which business to spoof and who their victims are. The phisher usually do this by sending e-mails which has the link to the fake web page.

3. Attack.

• Phishers will send false messages that would look like it is from a recognized source.

4. Collection.

• Phishers will then collect the information from the victims when they click on a link and perform any updates as stated in the link which they were brought to.

5. Identity theft and fraud.

• Phishers will then use the information they have gathered from the victims to make illegal purchases or commit fraud.

Ways to Prevention Phishing.

1. Awareness and Education.

• The main reason criminals can conduct phishing is because of the internet users’ lack of education and awareness of the existence of financial crimes targeted on them.
• Besides that, internet users may not know what are the internet policies and procedures when it comes to the confidentiality of consumers account information and maintenance issues. The company can distribute the general information on phishing in the company email or company’s website.
• Furthermore, companies also can remind the customers about their corporate policy and procedures when contacting customers regarding their account information. Both customers and employees need to have an understanding on how phishing works, understand how to determine whether an online transaction is secure and if it is authentic.

2. Targeting Hosting site.

• This method may be useful for those who seek to shut down the phishing site. The phishing e mails are used with the same method of mass- mailing infrastructure such as spam, affecting institutions and even law enforcement systems are made aware of a site hosting, resulting in the site to shut down.
• Companies that are affected have to implement ways to allow customers to submit the phishing e mails that they have received. These e mails, along with the web access logs for monitoring any suspicious activities, can help to indicate the existence of new phishing site. According to Anti-Phishing Working Group’s trends reports, it showed an approximate decrease of 10% in the average time online for a phishing site between the months of October 2004 and April 2005.

3. Web browser toolbar.

• A web browser toolbar has the ability to identify if a customer is viewing a possible phishing site. This toolbar functions by referring to a database of known FQDNs and IP address that have been reported as hosting phishing sites. It requires the phishing site to be observed and reported to the database.
• Certain toolbars offer a detection of potential phishing site by checking for certain heuristics that usually indicate that the site is not a legitimate commercial site. Example: the server IP address belongs to a network associated with a broadband service provider in a different country, other than the user.

4. Strong Authentication and Authorization.

• Two-factor authentication is a mechanism requiring two or more authenticators, usually consisting of something you know (such as a password or PIN) and something you have (such as a credit card or hardware token). For online transactions to be carried out safely, two-factor authentication is being implemented by providing the customer with a hardware token for generating a continually changing component for their authentication credentials. The goal is to protect the users if their authentication credentials have been captured by an attacker via electronic surveillance. The timeliness of the ever-changing component limits the attacker’s ability to use the credentials in the future.
• Another countermeasure being implemented by certain banks is the use of transaction numbers (TANs) for authorizing individual transactions. Customers will be sent a list of TANs with their monthly statement, and they are required to enter the next unused TAN when authorizing a transaction online. In addition, banks use another way whereby users receive a request for their TAN via an out-of-band mechanism, such as an SMS message on their cell phone.

5. Virus, Spyware, and Spam Prevention.

• With the marked increase in phishing malware, products that detect, prevent and execute the installation of malicious codes are an essential part for an environment of secured home computing and online buying and selling. These products must enable and, in the case of anti-virus and anti-spyware products, they must have up-to-date signatures. A large portion of recent malware attempts were done before a detection signature was able to detect and neutralize the malware. Furthermore, the attempts was to disable anti-virus and anti spyware software.
• Spam prevention has also contributed to the fight against phishing. Phishing emails use the same distribution mechanism as spam and they usually have several of the same characteristics. Email filtering based on content blacklisting, Bayesian filtering, blocking mail from known spamming/phishing relays, anti-forgery solutions such as Sender Policy Framework (SPF) and Sender ID, and other heuristics specifications towards phishing can help prevent a great number of phishing emails from reaching potential victims in the first place. However, spammers are continually evolving their tricks for bypassing filters [Schmidt] and the phishers can leverage this.

References:

http://computer.howstuffworks.com/phishing.htm

http://www.us-cert.gov/reading_room/phishing_trends0511.pdf

http://www.phishtank.com/what_is_phishing.php

http://www.phishinginfo.org/how.html