Malicious website .......... reaches you ....... through your network ........and you click it! ......but thanks to FireFox!!!!!!!!

First email (real one): One good friend of mine sent me a mail advert recently about USID challenge 2009. Below is the snippet of same......I registered by sending the email to email ID shown in red box........





Second email (Fake one): Then I get another mail about the same event but this one looks more fancy.......this one also comes from a good friend. Something which made me read this mail was, I didn't get registration reply when registering through the address on the first email. You can see the screenshot of the same advert below ( I am using the screenshot as I don't want to spread the attack myself :P but one can see the url of malicious website in the redbox in bottom left ....thanks to Mozilla Firefox 3.5)



I am really impressed by the ingenuity of the spammer/attacker as here the mail didn't came to me as a random email but from someone trusted. So the attack searched for me ..... :)

They knew that the event is recent .....so they were mixing familiar names with malicious links (some of the URL's point to trusted portals like Forum Nokia). Since the event info comes through network ....it reaches to a person who has a high chance of clicking on it. So, the chances of the attack being successful are even higher.

Lessons to be learned:

1. Have upgraded browser and working one (like Firefox) , which can tell you that the website you are trying to open is malicious.
2. Even though mail comes from a trusted source ....... first hover over the link before clicking on it ......if it is something malicious...I am clicking on! (like the one in above image is just an IP )
3. Inform your network about it ...so that they stop spreading attack........but inform them in a smart way (by not spreading it again) ........ :)

Future of social media and how it effects India

Out of many value propositions which I could/(or could not) think for social media, one which has just struck me is "Reputation and Trust management".

In the ideal world of high Internet penetration, where every body is on some sort of social networking site. We will have every body connected to somebody (with some exceptions). The creation and identification of trust from reputation would be much easy, especially in the places where it is not that easy now!

Like we already can see role of recommendations on LinkedIn for getting a job. Recommendations do exist in real world but hard or costly to have. In online networks they exist in black and white, easy to access and persists for ever!

Some of the things we (Govt.) ought to do in physical world, where people intend to do some fraud for greedy reasons, like what is mentioned here in an article of Times of India. These problems could be solved effectively with use of online social networks and crowdsourcing.

I am taking some basic assumptions about India here:

1. Coming from India, I know that we have a society where most of the people know about people around them, which is very different from west! So, it is very easy for people to vouch for others (their near and dear ones).

2. Too many people, lot of contribution possible. Success rate for crowdsourcing the effort!

Now one of the problem posed in the article is that govt. want to issue id cards and then they are issued to people who do not even exist and execution fails.

So, what I propose is a wikipedia kind of solution where people can create people database. Let's call it peoplepedia.

Allowed functions for peoplepedia.

1. Creating a node, which is essentially a living person (say in India ) which can be later dead and the status change can happen accordingly.

• Node will contains the name.
  
• The gender.
  
• System will issue a unique id to every node.
  
• Anybody can create/ delete a node.
  
• The system will have a CAPTCHA like solution to prevent non-computers to make fake nodes.
  

2. Linking to another node, if one thinks they know each other.

• People can also indicate the relationship when linking. Like relative, friend, NGO, third party etc.
  

3. Bootstraping this database from existing social networks like Facebook and Orkut. (as chances of having real living users on those networks are high)

4. To users people have a graphical interface to search people based on their unique id, name or social graph neighbors.

5. Optional could be users adding more details to a node which could be private data like passport number etc but then which might need a login/password protection. Although this is not the real value of this database.

6. Since it is a people driven project and people identify the people they know in real life , which gives the trust in the numbers. Also, more people linking to a person will add to the reputation of a person and database can have an indicator based on who links to the node and how many links to the node. Let's call this indicator lively index, which would mean, the chances that person is real and exists/existed in this world ! However, the loss of privacy will happen in form of identifying somebodies social network but since we do not have any other details about that person (apart from name and sex) the privacy loss is minimum.

The cost of the project must not be high but the value it can provide with a small percentage of population actively involved would be high.

It would be a dynamic snapshot of number of real people in the country and also giving the break up (like men and women)

This platform can then be used for vouching for people, for distributing cards / other goods. Although it would not be highly reliable but could boost the confidence of identifying the real person.

I welcome readers of this post to improve the concept as it is in very initial stage and I have the feeling that it can be improved a lot!