Under the phishing filters' radar

Criminals are reportedly using a new phishing technique that allows them to bypass the fraud warnings issued by modern browsers such as Firefox and Chrome. On its blog, security firm M86Security reports that the trick involves attaching an HTML document instead of sending a link. It remains unclear how many users have become victims so far.

Email recipients opening the HTML document in their browsers are, for example, presented with a bogus PayPal form with the usual request to enter their access data due to alleged security issues. As the form is being processed locally on the user's computer, the phishing filter doesn't issue a warning because it only filters external URLs. A click on the "Submit" button then transmits the entered data to a PHP script on a (hacked) server using a POST request. According to M86Security, the browser doesn't warn about this either.

While browsers should at least warn users when sending the data, M86Security stated two potential reasons why they won't: as users don't see the URL they access via POST requests, they can't report it, and consequently the URL is missing in the browser filter's blacklist. The company added that most users can't make anything of the HTML source code that is attached to the email.

Secondly, M86Security said that URLs which lead to a PHP script are very difficult to classify as phishing sites. It is reportedly hard to identify a phishing site without the accompanying HTML code which could, for instance, reveal whether a site pretends to be a banking site. This has apparently caused months-old phishing campaigns to remain undetected. The security firm didn't state whether its assessment only refers to the filter lists maintained for Chrome, Firefox and other browsers, or whether it also includes those of the AV vendors, who maintain separate lists for their own filter products.

[H-Online]

How to Make Sure Your Online Banking Is Safe

When was the last time you went to your bank and withdrew cash from an honest-to-goodness bank teller?

For many of us, it was probably years ago, as most people now prefer the ease and 24/7 availability of online banking and automated teller machines.

Today's bank robbers prefer them, too. They’ve gone high-tech, using ATM skimmers to get hard cash out of our accounts, and computer malware to raid accounts the electronic way.

New “banking Trojans” such as Tatanga are so well-concealed that they escape antivirus detection, and so sneaky that just a visit to any of thousands of compromised websites will infect your PC.

In fact, depending on computers for bank transactions has gotten so risky that getting to know our bank tellers is starting to sound good again.

This raises the question: Should we quit banking online altogether?




Ways to beef up your security

Of course not, said Josh Shaul, chief technology officer with New York-based Application Security Inc.
Shaul does all his banking online or at ATMs and never worries about the risk. He leaves that worry to the banks. For that reason, Shaul recommended that consumers, instead of panicking, learn how their banks approach security.

“I think larger banks tend to have more-sophisticated security systems than smaller banks can offer,” although smaller banks may be catching up or devising cost-effective security methods, he said.

Shaul said consumers shouldn’t hesitate to ask their bank about how they handle online banking security. What kind of authentication system do they use? How do they notify the customer who has forgotten a password? What are the security policies in place in case there is a breach?

“If you feel you don’t know enough about security to judge the bank’s security application, talk to a friend who does,” Shaul said.

Harry Sverdlove, CTO for Bit9, based in Waltham, Mass., is another security expert who has no problem with banking online.


The bank's job

But Sverdlove would like to see banks step up with another layer of security, especially as the most dangerous malware focuses on keylogging (recording keystrokes to steal passwords, PINs and bank numbers) or man-in-the-middle attacks (where it appears that an online transaction is happening as normal, but the malware hijacks and controls the information).

“One of the banking sites I deal with gives you a random generic [on-screen] keypad and you use the mouse to click in your PIN,” Sverdlove said. “Keyloggers won’t be able to read it because I use my mouse, not my keyboard.”

He’d also like to see banks use a card swipe or biometrics — something that has to be physically done by the consumer, separate from typing in login authentication.

That way, Sverdlove said, even if a criminal has the financial login information, he can’t do anything without the second layer of authentication.

For the most part, Sverdlove and Shaul agree that the platform used for online banking doesn’t make much difference.

Macs may be a little safer than Windows right now, simply because the vast majority of malware is still written for Windows machines. (Shaul says the increased use of iPads and iPhones will spur the creation of malware written for those platforms.)

The type of browser used makes little difference as well. Most of the banking malware is written to cross browser platforms.


Wise up about smartphones

What about using mobile devices for online banking? This is where Sverdlove and Shaul part ways, at least slightly.

Sverdlove said he doesn’t use his smartphone for banking.

“Banks will use SMS or text messages to authenticate things with you, and that information can be intercepted,” he said. “But the real reason I don’t use mobile banking is because how easy the device can be lost. Once the attacker has physical access to your device, a wealth of opportunities opens up.”

While Shaul agrees that the biggest risk in mobile-device banking is loss, he believes mobile devices are actually safer because the banking malware technology hasn’t caught up yet with banking apps.

But again, this can change as more people use banking apps and hackers refocus their efforts.
Online banking can be done safely if consumers follow some basic best practices:

• Keep up to date with patches. Shaul said malware will sneak in through the vulnerabilities in operating systems, browsers and software, so if your computer is alerting you of an update, install it immediately.
• Check your online account once a week to make sure everything looks okay.
• Use the “smell test.” Sverdlove said that if you log into your account but the interface is different or the look of the site has changed, contact your bank as soon as possible using the number printed on your ATM card.
• Ask your bank about its security practices.
• Do all of your banking from one computer. If you have a desktop, use that for banking. If you have to use a laptop, make sure banking information is not stored in a browser’s “cookies” before traveling with it.
• Never use an unfamiliar computer, such as a library computer or a friend’s laptop, to conduct banking.

Finally, maybe it isn’t always safest to visit the teller.

Christen Gentile, corporate PR specialist with Kaspersky Lab Americas, related an alarming story.

“I saw a case in the Netherlands where the bad guys had gone as far as renting office space for their scam,” Gentile told SecurityNewsDaily. “Victims were sent emails with information on the 'new office' complete with a special phone number. The office was completely branded as the targeted bank, complete with desk clerks and fake customers.”

[SecurityNewsDaily]

Top Five Online Scams

#1 Nigerian Scams:


While these types of scams are generally understood to be Nigerian in nature and origin, and are in fact named after the 419 Nigerian code that made them illegal, advanced-fee scams happen right here in the good old USA by Americans presenting to offer jobs or may ask help to transfer money.


#2 Romance Scams:

If you ever hear talk like this, run far and fast: “In me sweetheart you are going to find the most passionate, loving and romantic man you have ever met. There are very few promises in life but this is one of them! ROMANCE is the key to my happiness and to my heart and soul!”


#3 Classified Ad Scams:

This story caught my eye: “An online scam targeting pet-lovers is circulating the web, and it could cost you more than a new pet. An ad posted to a local online classified website by a man who claimed he was living in Florida. He was willing to give the Labrador Retriever puppy named Dely away for the cost of shipping, which was $220.”


#4 Phishing:

Phishing continues to become more sophisticated, more effective, and more prevalent. In one example, criminal hackers waited until Pennsylvania school administrators were on vacation, then used simple money transfers to liquidate over $440,000 out of the districts accounts.


#5 Spear Phishing:

Spear phishing occurs when the scammers concentrate on a localized target, usually an individual with control over a company’s checkbook.

This insidious type of phishing occurs when a recipient clicks a link, either in the body of an email or on the spoofed website linked in the email, and a download begins.

Don’t be taken. Keep your head up and recognize when someone’s trying to take advantage of you.


Robert Siciliano personal and home security specialist to Home Security Source discussing home security and identity theft on TBS Movie and a Makeover.


[InfoSecIsland]

Apple issues mammoth security update for Safari browser

Apple has released Safari 5.0.4 - the latest version of Apple's browser software for Windows and Mac users - patching an eye-watering 62 security vulnerabilities in the process.

The vulnerabilities, described in an Apple knowledgebase article, were disclosed at the same time as a host of security holes in the iOS software used by the iPhone, iPad and iPod touch were also revealed by the company.

What this means is, just like their iPhone/iPod touch/iPad-owning cousins, people who run Safari on their Mac or Windows computers would be wise to check out the latest available security updates as soon as possible.

Apple doesn't like to assign severity levels to the security vulnerabilities found in its products, but the bugs in Safari look pretty critical to me. 57 of the 62 bugs can be exploited just by a user visiting a maliciously-crafted website.

If that's not a reason to install a security update to your Safari browser, I'm not sure what is.
You can download Safari 5.0.4 from Apple's website for Mac OS X 10.5 (Leopard), Mac OS X 10.6 (Snow Leopard), Windows XP, Windows Vista and Windows 7.

SophosLabs see tens of thousands of legitimately websites that have been infected by malware every single day, so it's really important to keep your browser up-to-date with the latest security patches.

[NakedSecurity]

Five Apple Security Myths — and the Disturbing Truths

"I just got a Mac,” think many first-time Apple customers. “I'll never have to worry about a virus again."
So it would seem to many longtime PC users, plagued by virus, e-mail and phishing attacks that require constant vigilance and the installation of often pricey security software. They rarely, if ever, hear their Mac-using friends complaining about the same problems.

But even though it’s true that Macintosh computers, iPhones, iPods and iPads (the latter three of which run Apple’s iOS mobile operating system) are subject to far fewer attacks than their Windows (or Android) counterparts, Apple products are definitely not immune to security flaws.

In fact, as Apple’s market shares increase, so do the chances of malware being written specifically for the company’s devices.

Virgin territory


Apple software is actually ripe for attack. At the 2010 “Pwn2Own” hacking contest, held every March at the CanSecWest security conference in Vancouver, Apple’s Mac OS X, the Safari Web browser and an iPhone 3GS were all exploited with surprising ease, falling quicker than their Windows-based competitors.

The overconfidence many Apple users feel about their gadgets may come from the company itself, said Alex Horan, director of product management at Boston-based Core Security.

“On its website, Apple states that: ‘Mac OS X doesn’t get PC viruses. And its built-in defenses help keep you safe from other malware without the hassle of constant alerts and sweeps,” Horan said.
But it’s a false comparison.

“Traditionally the only reason we haven’t seen a lot of news about viruses and worms targeting Mac systems is because we haven’t seen as many Mac systems in use,” Horan explained.

“The reality today remains that if I want to write some code that will attempt to control the maximum number of systems, then I need to have that code target the most common systems out there [Windows]. But as the number of Mac system grows, so will the attention of the attackers.”

Horan’s colleague at Core Security, Vice President of Security Awareness and Government Affairs Tom Kellermann, added a warning.

“Over the past few years, we’ve seen multiple exploits that have proven that this perception around Apple security is truly misguided,” Kellerman said. “Those people who believe that they are fundamentally more secure simply because they use Apple products will likely someday learn to regret it.”
Five hard lessons


With that in mind, here are five Apple security myths — and the brutal truth behind each:

Myth: I don't need antivirus and spam protection because I work on a Mac.

Truth: The Mac OS X operating system is targeted less frequently by malware only because it’s not as widespread as Windows. It’s no more secure than any other operating system, said Sorin Mustaca, data security expert at Germany-based Avira.

As for phishing attacks, said Mustaca, “the biggest problem in this case is not the computer itself, but rather it's the user.”

Myth: I can't be infected by any malicious software because I get my applications exclusively from the iTunes App Store.

Truth: “We've seen a couple of times already that the App Store is not such a secure fortress as one might have hoped,” said Mustaca. “It is extremely difficult to check every single application that is inserted there.”

Myth: Mac OS X is inherently more secure than Windows.

Truth: Apple’s brand-new products are being hacked almost immediately upon arrival. For example, “jailbreaking” your iPhone is as easy as browsing to a specific website.
“For a while, it was easier to write exploits for Mac OS X systems than it was for Windows, but now they're relatively equal,” said Core Security technical specialist Dan Crowley. “Bugs seem to be just as easy — if not easier — to find in Mac OS versus Windows.”

Myth: Apple's Safari browser is more secure than Microsoft's Internet Explorer.

Truth: Safari had more than twice the number of reported vulnerabilities in 2009 (94) than did Internet Explorer (41), according to Symantec's Global Internet Security Threat Report.

Myth: iPad users are not susceptible to the same sorts of attacks that Windows users experience.

Truth: According to Anup Ghosh, founder and chief scientist of Fairfax, Va.-based Invincea, Apple released the iOS 3.2.2 software update for the iPad specifically to fix a critical vulnerability in Adobe Reader that can be exploited by malicious PDF files.

So what can you do to make your Apple device more secure? First of all, never open an e-mail attachment you’re not expecting, even if it’s from someone you know.

Always check the URL — the long string of characters that begins with “http” — in your browser address window when surfing the Web, even on an iPhone or iPod Touch. Be very careful about using free Wi-Fi hotspots in coffeeshops, libraries or airports — it’s safer to just use your cellular carrier’s data service.

There isn’t any third-party security software for iOS devices as of yet, but a few Mac OS X applications are available, such as Sophos Anti-Virus for Mac Home Edition (free), BitDefender Antivirus 2011 for Mac (starting at $40 per year), Intego Virus Barrier X6 ($50 per year, two users) and various Norton products (starting at $50 per year).

[SecurityNewsDaily]

New net rules set to make cookies crumble

How websites track visitors and tailor ads to their behaviour is about to undergo a big shake-up.

From 25 May, European laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies".

These files are widely used to help users navigate faster around sites they visit regularly.

Businesses are being urged to sort out how they get consent so they can keep on using cookies.
Track changes


The changes are demanded by the European e-Privacy directive which comes into force in the UK in late May.

The section of the directive dealing with cookies was drawn up in an attempt to protect privacy and, in particular, limit how much use could be made of behavioural advertising.

This form of marketing involves people being tracked across websites, with their behaviour used to create a profile that dictates the type of adverts they see.

As part of its work to comply with the directive, the IAB - an industry body that represents web ad firms - created a site that explains how behavioural advertising works and lets people opt out of it.

The directive demands that users be fully informed about the information being stored in cookies and told why they see particular adverts.

Specifically excluded by the directive are cookies that log what people have put in online shopping baskets.

However, the directive is likely to have an impact on the more general use of cookies that remember login details and enable people to speed up their use of sites they visit regularly.

It could mean that after 25 May, users see many more pop-up windows and dialogue boxes asking them to let sites gather data.

Data delay


The exact steps that businesses have to go through to comply with the law and gain consent from customers and users are being drawn up by the Department for Culture, Media and Sport (DCMS).
A spokesman for the DCMS said that work on the regulations was "ongoing" but would not be complete by 25 May.

In a statement, Ed Vaizey, minister for Culture, Communications and the Creative Industries, said he recognised that the delay would "cause uncertainty for businesses and consumers".

 

"Therefore we do not expect the Information Commissioner's Office (ICO) to take enforcement action in the short term against businesses and organisations as they work out how to address their use of cookies," he added.

Information Commissioner Christopher Graham said: "I cannot bark at the industry at the moment because I have not got the regulations."

However, Mr Graham stressed that the government's confession that the regulations will be delayed should not be a spur to inaction.

"My message is that this is not your 'get out of jail free' card," he said.

The response to complaints about firms that flout the directive will be viewed in light of what they have done to prepare for it, continued Mr Graham.

Businesses should be considering how they will communicate with customers to get consent and look at the technical steps that might make that process easier, he explained.

Early work by the ICO suggests that gathering consent by changing settings on browsers may not be sophisticated enough for the demands of the directive.

"They have to think seriously about this," said Mr Graham. "It's going to happen and it's the law."

[BBC]

Free Internet Security Tools

Criminals have gotten pretty good at making fake Web sites (for PayPal, eBay, Facebook, etc.) look like the real thing. But what they can’t fake quite as easily is the location of the Web server that’s hosting their fradulent site. You might be looking at a perfect replica of, say, Bank of America, but if the site is hosted in Uzbekistan, it’s a good bet you shouldn’t input your password. Read “Seven HInts to Stay Safe Online” for details on this sort of scam, and some ways to protect yourself.

Flagfox for Firefox makes the necessary detective work simple: it determines the Web server’s physical location and pastes the corresponding country’s flag at the end of the address bar. Clever!

If you’re wondering how it works, Flagfox bases its flag choice on the actual location of the server you’re connected to, rather than just the nationality of the domain name–which may be different.

After installing the plug-in and restarting Firefox, just head to any site and you’ll see the flag at the right end of the address bar. If you click the flag, you’ll get a new tab containing detailed geographic information about the site.

If you right-click the flag, Flagfox pops up a list of other handy tools, including Whois, SiteAdvisor, Web of Trust, and URL-shortener bit.ly. Head to the settings (via Tools, Add-ons) for the plug-in and you’ll find a dozen or so other options you can add to the list.

This is a great little addition to Firefox, one that combines convenience with added security. What’s not to like?

Keep Your PC Insulated from Internet Threats with Free BufferZone Pro

Most security tools leap into action only after they’ve detected a threat–and sometimes that’s too late (especially if the threat is one that’s new and unknown).

The only way to really stay safe while you’re online is to work inside a virtual environment–a kind of protected bubble (aka “sandbox”) that operates on your PC but isn’t directly tied to it. Trustware’s BufferZone Pro creates exactly that kind of protected bubble, thus offering a unique (and theoretically impenetrable) level of protection.

BufferZone Pro originally sold for $40, but Trustware has decided to offer the software free to home users.

The software’s virtual environment isolates security threats and prevents them from ever touching your PC. With it you can safely download, install, and run any application without worrying about Trojan horses, worms, keyloggers, spyware, Adware, phishing attempts, or other computer-clogging malware.

This newly free Pro version includes support for USB devices (flash drives, etc.), P2P file sharing, all instant-messaging programs, and personal files (which get stored in a confidential folder). And unlike many security tools, BufferZone Pro isn’t subscription-based, meaning you won’t get hit with a $40 bill a year from now. It’s free, period.

[ComputerWorld] via [hackinthebox]

New types of cookies raise online privacy concerns

The advertising industry has led the drive for new, persistent and powerful cookies, with privacy-invasive features for marketing practices and profiling.

The EU cyber security Agency ENISA advocates that both the user browser and the origin server must assist informed consent, and that users should be able to easily manage their cookies.

A new ENISA paper identifies and analyzes cookies in terms of security vulnerabilities and the relevant privacy concerns.

The new type of cookies support user-identification in a persistent manner and do not have enough transparency of how they are being used. Therefore, their security and privacy implications are not easily quantifiable. To mitigate the privacy implications, the Agency recommends, among other things, that:

• Informed consent should guide the design of systems using cookies, the use of cookies and the data stored in cookies should be transparent for users.
• Users should be able to easily manage cookies: in particular new cookie types. As such, all cookies should have user-friendly removal mechanisms which are easy to understand and use by any user.
• Storage of cookies outside browser control should be limited or prohibited.
• Users should be provided with another service channel if they do not accept cookies.

The Executive Director of ENISA, Prof. Udo Helmbrecht underlines: "Much work is needed to make these next-generation cookies as transparent and user-controlled as regular HTTP cookies, to safeguard the privacy and security aspects of consumers and business alike." 

[net-security]

Five best browser security extensions

You share and access some of your most sensitive data through your web browser, so it doesn't hurt to add a little extra security to your browsing session. Here's a look at five of the best, most popular security extensions out there.

AdBlock Plus (Firefox/Chrome)
AdBlock, as its name would imply, blocks certain scripts serving advertisements on a website. But instead of more general script-blocking, like NoScript (below), ABP focuses on blocking just advertisements. As we've mentioned before, you can tweak ABP for added security benefit by using a "malicious ad" blocklist. You can, of course, whitelist sites you want to support (ahem), but ABP also provides the more obvious aesthetic benefit of a web less cluttered with ads.

---

HTTPS Everywhere (Firefox)

HTTPS Everywhere from the Electronic Freedom Foundation will help you to secure the connection between your browser and the servers it is connecting to. It helps to encrypt your connection when possible, even when the default setting on the web site does not offer the added security. A good example is Twitter. The username and password input boxes are encrypted, but after that all text coming to or from the server is sent in the clear. (Very recently, Facebook added an option to always turn on HTTPS. Here's how to do that.) HTTPS Everywhere even helps to protect against hacking tools such as Firesheep.

---

LastPass (All Platforms)

LastPass secures another vector that hackers can use to try to gain access to your personal information - your password. When you use the LastPass browser plugin, it stores your password, encrypted, for you and also allows you to easily generate a complicated and hard-to-crack password that is unique to a site. LastPass has plugins available for every browser under the sun. If you're just getting started with LastPass, here's our introduction to LastPass, our intermediate guide, and a guide to auditing and updating your passwords with LastPass.

---

NoScript (Firefox)

NoScript is a Firefox-only plugin that does one thing and does one thing well—it blocks scripts such as JavaScript, Flash, Quicktime, and more from loading in your browser window. (Chrome users may want to check out the similar Chrome extension, NotScripts.) The reason it works so well for security purposes is that malicious web sites can use these scripts as attack vectors in order to cause a browser crash and to gain access to your computer. By blocking these scripts you can make yourself significantly safer on the web.
Keep in mind that for most of us, blocking all scripts would result in a fairly broken internet, given that many websites, such as Google, Gmail, Twitter, Lifehacker and others rely on JavaScript to load their pages. NoScript allows you to block 3rd-party scripts or even just from unsafe domains. You can manage these settings in detail, giving you the maximum security with minimum inconvenience.

---

Web of Trust (All Browsers)

Web of Trust is another plugin that does something different than the above. Instead of halting any attack vectors, it lets you know when the website you are visiting is trustworthy or not. That way if you happen across a website that you think is trustworthy and even looks it, you get a warning that you should not submit your personal information to the site.
They rely on user-ratings to rate their site and in my experience it has been very accurate and useful.

---

Supplemental Reading
We recently highlighted a few easy steps for securing your online life, some of which employ a few extensions here. For an even more secure browsing experience, here's how to encrypt your entire browsing session.

[Lifehacker]

What "Do Not Track" Is and Why It’s Important

What's so bad about ad tracking on the web, a.k.a. behavioral targeting? Nothing, if you don't mind being a living stereotype. No, seriously—that's what much of the fuss over "Do Not Track" browser options and opt-out options is about. Ad companies watch what you do online, and they make bold assumptions about you. How you feel about that is up to you.

What is Tracking (a.k.a. Behavioral Targeting)?

You might go months and months without ever noticing it, but surf around online and look closely at the edges of your web pages once in a while. Unless you've tweaked the settings on your browser, you're allowing not just the sites you visit, but the ads they display, to learn a bit more about you.

Full size

How does it work in practice? Let's take Google's ad network as an example. Yesterday, I searched Google because I couldn't remember how many tablespoons of coffee to put into my use-your-own-coffee Keurig K-Cup.

Full size

Later that day, doing research for this post, I noticed a peculiarly specific ad in an odd context. Do most Wired readers need Keurig refills? Maybe, but, wow, what a coincidence!

During an afternoon lull, I did some daydreaming about, well, the hardware specs on the ultra-light ThinkPad 410s versus a MacBook Air. Hey, it's my own version of a fantasy league.

Full size

Later on, when I'm really, really off the beaten path, I'm looking for a specific clip from a RoboCop film when, lo and behold, there's special pricing on the ThinkPad line, right beneath the guy who ended RoboCop's humanity!

This is the most obvious level of cookie-based browser tracking: you searched for terms on Google, and Google, which also runs advertising on its Reader and YouTube services, gently nudged you toward those same terms, or related things, on ads you saw later on. A sub-level of that tracking, one that's generally more innocuous, occurs within web sites that use web analytics—which is to say, all of them. Sites track you as you arrive from specific links or searches, move through their pages, click on things, request images, and the site owners and content editors can learn from how traffic flows through their pages, as people stop on certain pages for certain lengths, and so on.

How Do Sites and Advertisers Track Me?

On the most basic level, it's very simple: your browser accepts a cookie from a site, generally as a means of storing your login status, site preferences, or the like. If your browser also accepts third-party cookies, those are used to customize the ads you see, and log some of your activity.
As we've previously set out in the truth about browser cookies, these third-party cookies—not from the site you visit, but from an ad supplier they partner with—don't actually know anything about you, the user, in terms of your identity, where you live (to the street address level, at least), or other unique identifiers. What they do know is about you, generally, as a web user. Within their wide-reaching networks, sellers of advertising can build up a profile of your habits, and use their best guesses to figure out what you might be interested in buying.
AOL, in seeking to explain ad tracking in a fairly simple, innocuous way, conceived of a penguin-guided illustration (or perhaps video) that may have never seen the light of day. But the leaked shot list and sketches do provide a nicely simple explanation:

Why Should I Care if Some Computer Knows What I'm Looking For?

All that seems fairly straightforward: you searched for ThinkPads, so maybe you'd be interested in seeing ThinkPad deals. Over a long enough timeline, though, lots of those searches, clicks, and ad impressions add up to build a profile. You search for ThinkPads, you're into DIY Keurigs, you search out RoboCop clips on YouTube. If an advertising network wants to convince a video game maker, or maybe an Android phone retailer, that their ads are hitting the right marks, all that pseudo-confidential data makes one (okay, me) a pretty likely target.
Finally, there's the deep, deep well of information social-oriented sites and apps like Facebook have about not only what you search for and click online, but what you "Like," which of your friends you interact with most, your common interests, your professions, coupon deals you've clicked on, and much, much more. Facebook and sites like it sit right between relatively innocuous on-site analytics and behavior-trailing networks. More on that in a bit.
The more alarming aspect of what's sometimes referred to as behavioral targeting isn't a certain kind of tracking, or any particular browser aspect, but simply the unanswered questions about the data that's being grabbed by ad firms:

• How long should networks hold onto your unique ID, set in your cookie, as you browse the web?
• How much data should they be able to glean from you?
• Are there certain kinds of searches and page visits that shouldn't be tracked or monitored?
• What rights do ad networks have to sell or store your data?

Who Are the Firms Tracking Me?

Short answer: every web-based advertising network that wants to make money.

Better answer: Check out the firm-by-firm specifics for yourself:
The online ad industry has made efforts to make itself more transparent. Most of the major networks go out of their way to explain their data retention and behavioral policies, if you've got the time and inclination to look around. And at sites like the Network Advertising Initiative and this multi-organizational opt-out site, you can selectively click to opt out of being tracked by AOL, Google, Fox, or most of the other ad networks.
But the next time you wipe out your browser cache, or run some other kind of cleaning operation, you're back in the ad-tracking game.

Where and How Can I Get Away from Ad Tracking?

Every browser these days offers a private/"Incognito" mode, and that's the safest way to play it, at least for short stretches of browsing you want to keep (generally) un-linked to your other habits. But for the general browsing populace, that's not a real option. This is where Firefox 4, Internet Explorer 9, a Chrome extension, and a bit of potential (U.S.) legislation come into play.
In the nightly builds of Firefox 4, an option is provided in your Privacy settings to "Tell web sites I do not want to be tracked." A similar function has appeared in Internet Explorer 9's release candidate. There's nothing built into Chrome, though that browser moves quickly; in the meantime, a very handy extension from Google itself allows you to make your opt-out ad-tracking choices stick, whether or not you've wiped your cache. (Image via WebMonkey).
All these options are, however, voluntary on the part of the advertising networks, or at least very tiresome to manage for the individual. On a broad level, major industry players may adhere to principles, but the Federal Trade Commission has suggested that firmer, more universal rules are needed to govern data collection on the web. One such bill, from Rep. Jackie Speier (D-California), looks like a promising initiative, but as Wired points out, it's hard to write a bill that covers behavior by the analytics firm almost every site uses, the sticky-but-generally-anonymous ad tracking of networks, and the deep data mine that Facebook possesses but rarely moves on, and, generally, only inside its own network. And none of the rules in Speier's bill would apply to ad firms that haven't stepped forward to make note of their privacy policies.

---

As the How-To Geek pointed out, ad tracking isn't, in itself, necessarily a bad thing. The alternative is dumb ads aimed at the widest possible audience—think of "(Your City) Woman Earns $78/Hour Working From Home!" But for now, most of us are stuck between a rock and a hard place: regularly monitoring our cookies, opt-outs, and other micro-data, or living a casual life online and hoping that firms are only loosely associating the things we do, and forgetting about them in relatively short order.

[Lifehacker]