Archive | January, 2017

Seriously Beware of Collectibles with Causes / Works of Life

30 Jan

Somebody claiming to be Cameron Arballo from Works of Life called both my wife’s and sister’s places of employment and left threatening messages saying that he knows where she/we/I live, amongst other creepy things.

I’ve never said anything about Mr Arballo. I’d only heard of him in comments other people left in response to the 2+ year old blog post about my less than smooth experience with Works of Life / Collectibles with Causes. There you’ll find other peoples’ tales and accusations, not mine. My story summarizes sketchy communication problems and delays I dealt with. Nothing more.

I guess the moral of the story is, if you don’t have a great experience with one of Cameron’s many charities, don’t say anything about it or he (or somebody claiming to be him) will threaten your family.

EDIT:
If you’ve had bad dealings with him or his charity, this guy is looking for evidence and would appreciate your help.

Ken Marrero
Investigator
Division of Charitable Solicitations, Fantasy Sports, and Gaming
Office of Tennessee Secretary of State Tre Hargett
312 Rosa L. Parks Avenue, 8th Floor
Nashville, TN 37243
Office 615-253-4575 Fax 615-253-5173

CheapoDrugs.com Database Hacked?

29 Jan
cheapodrugs-blog

Not all companies care about privacy

Update: 7/1/2017
If you use CheapoDrugs.com, stop. If you put any faith in the CIPA, stop. Neither of these organizations take cybersecurity seriously. I don’t consider them good stewards of your or my personal information. Neither organization will address evidence of a breach. …The CIPA at least gave me lip service for a while, before blowing me off.

Is CIPA legit? If CIPA doesn’t hold its members accountable, it’s worthless and you should ignore its recommendations and “certifications”.  Check out the Wikipedia entry for more evidence. Malarkey.

Original post follows

For almost 20 years, because I’m a big nerd, I’ve been using unique email addresses for every single website. e.g. the email address I give VictoriasSecret.com is different than the one I use to sign in to Fredericks.com.

When I start getting spam at an email address, I can quickly turn off that one address.

Problem solved. No more spam.

For those of you thinking, “That multi-address thing sounds like an ongoing hassle!” All addresses come into a single inbox. It’s easy. …It wasn’t necessarily easy to setup, but that was forever ago. Who even remembers that? 😉

Canary in an internet coal mine

Anyhow, if I start getting spam to an address, and its content is unrelated to the site/business where I used the address, something is amiss. If it’s a biz/site I don’t care about, I just kill that address. However, when it’s a biz I care about, I let them know. I’m a canary in a coal mine. But much larger, and figuratively in email databases instead of literally in a coal mine. I also lack feathers.

Most of the time these businesses are thankful when I have an opportunity to act as an email canary. They listen. I tell them, “I don’t know how it happened, but somebody got into your database. I don’t know what they didn’t get, (credit cards? social security number?) but I can tell you that they for sure have your email list.”

How did somebody get our database?

There are three likely routes:

  • One of your employees or contractors grabbed it and sold it or is using it themselves.
  • Somebody hacked into your system and stole it.
  • A computer/laptop with your db and/or email list got infected with malware, which then sent the list to its devious hacker makers.

There are other options, but those three methods account for the vast majority of email leak incidents.

Why oh why is he blogging about this?

Cheapodrugs.com. I used ’em. …And while I still sometimes use Canadian pharmacies for my sweet, sweet drugs, I haven’t used Cheapo Drugs in a few years.

How strange then, that a little over a week ago I started receiving emails to the address I only gave to Cheapo Drugs. Within these emails I’m encouraged to use a coupon code to save on drugs at safemedspills by clicking on a tinyurl.com link. Nope. Not. Clicking. That.

What’s worse, the email contained evidence that the spammers also have access to other Cheapo Drugs’ clients’ information. (Full name, address, etc.)

I emailed Cheapo Drugs and let them know what had happened and shared with them the three possibilities (see above). In their reply, Cheapo Drugs confirmed that, shocker, they had not sent me the spam emails. The only other substance in their missive was, “We guarantee our patients that we do not sell their information to any phishing websites.” …I never said that you sold your address list. Idiots.

I went back and forth with Cheapo Drugs customer support a few more times trying to help them understand, but was met with a stonewall of non-customer-service. I even called and talked to somebody. I’ll spare you the frustrating details and summarize: Cheapo Drugs does not take proof of a database leak seriously. What to do?

Reporting a pharmacy to CIPA

I contacted CIPA, the Canadian International Pharmacy Association. Let’s see if CIPA takes this more seriously than Cheapo Drugs. …It would be hard not to. I’ll report back.

Sidenote: Now that Gmail’s spam filtering is so on fleek, I’ve considered using my gmail address more, in lieu of the system above. However, doing so isn’t as secure as using a different address for every site. Especially if you use the same password for multiple websites. Natch, I use unique passwords for each site, too. hashtag: nerd.

Swine Flu Tracker

Swine Flu News and Information

Grown Up Book Reports

Book reviews with a healthy dollop of snark

Ethan McCarty

Digital strategy | Social business | People-centric biznology

%d bloggers like this: