Rick Demko

Don't Click the Link - A Phishing PSA

The internet is the biggest community on the planet. The online community can easily cross international boundaries. This means that people all around the world can participate in the same global meeting place.

While this is a good thing, there are also some major disadvantages with the size of the internet. The internet is huge and this means that it's impossible to effectively police everything. There are plenty of unsavory people on the internet who are out to profit from your ignorance.

Consider this post a PSA to pay a little more attention when surfing the internet, and to think before you Click on that Link.

There are lots of examples of cybercrime - perhaps one of the most prevalent is Phishing. But what is phishing and how can it affect your computer?

Phishing is simply where scammers try to trick you into giving them your personal details. These normally involve bank account or credit card numbers. The scams typically work by you receiving an email asking you to click a link to confirm some details.

You will however be directed to a fake bank website which has nothing to do with your bank. Building a website is very simple. This means that it's relatively easy for these scammers to build an exact replica of your banks website. Unlike your bank's website, however, it passes the information straight back to the scammer.

If you actually fall for one of these phishing scams then it could result in your identity being stolen. Identity theft is an ever increasing crime which you need to be wary of. Identity theft could end up costing you thousands of dollars which is why it's essential you learn how to protect yourself.

Look at this example of a Bank of America phishing scam, this message would normally be accompanied by a link for you to click, leading to a fake site:

Dear Bank of America customer, Security and confidentiality are at the heart of the Bank of America. Your details (and your money) is protected by a number of technologies, including Secure Sockets Layer (SSL) encryption. We would like to notify you that Bank of America carries out customer details confirmation procedure that is compulsory for all our customers. This procedure is attributed to a routine banking software update.

How To Avoid Phishing Scams

The internet can be very deceptive since it is possible to make websites appear valid when they are developed specifically for phishing scams.  Take a look at the URL in the address bar after clicking on links that you are required to login to.  If you aren't familiar with the web address, do not log in.  The BofA.com website example is one of the more common, simply because of the shear number of clients BofA has.

You need to learn how to be able to detect fake bank websites so that you can protect yourself from these phishing scams. This will help you to protect your identity and ensure that you retain control of your bank account.

If you receive any emails from your bank then you should ignore them. If your bank really needs to verify any of your details then they will typically write to you or ask you to book an appointment.

The scammers also don't know which bank accounts you hold. This means that they will be sending the same message to lots of people. If you receive any messages from banks that you don't hold an account with then you can be sure that this is certainly a scam.

If you're not sure whether an email is real then you can check it by phoning the bank. If it is genuine then they will be able to help you and tell you what to do. You should never click on any of the links in emails; these may be secretly redirecting you somewhere else.

Why Would they Care about Me?

I have heard from a number of clients, "Why me? What would a hacker want with me?".

The truth is a hacker very likely doesn't even know that you exist.  The intruder would rarely even know your name, who you are associated with, or what type of business it is that you're in.  Unless an internet intruder is specifically out to get You.

The most simplistic and technological method for a hacker to intrude a system is by running an automated search for known vulnerabilities in Microsoft products.  Hackers and Microsoft seam to have a little dance they do.  A hole is found by Microsoft, they announce the hole exists, the Hackers begin to find ways to exploit the hole.  This is in a perfect world too, if the Hackers are the first to find the hole it makes it much more difficult to create a patch for a problem if Microsoft isn't aware the problem exists yet.

Leaving these holes or points of entry for Hackers available is the easiest way for business owners to really be taken advantage of.  While Microsoft and Hackers do their little dance, the consumer is still left completely vulnerable.  Even after a patch is made, with out having an intelligent IT staff or at minimum a professional vendor checking patch management, these holes could remain open for an elongated time.

                                                      

I still get asked often, "Why would the Hackers care about my small business."  The Hackers do care about Microsoft and other big power house corporations but in reality their chances of breaching one of those companies isn't the best idea.  The 'big guys' have the resources to protect themselves with their tools, IT departments, and the funds to afford the protection.  Attacking a large company isn't just more difficult, it can also be much more dangerous and have much greater repercussions!  A Hacker that attacks a smaller company may very well never be detected and taking over several at a time would serve its purpose in line with penetrating a larger corporation.

"Last year, Microsoft IT said it was the target of more than 100,000 intrusion attempts per month. Currently, Microsoft filters out about 9 million spam and virus e-mails a day out of 10 million received. Yes, that means that roughly 90% of incoming e-mails are spam." - Martin Heller, December 8, 2006 (Computerworld)
      
Microsoft gets attacked often and as I mentioned before they have the resources to deal with those threats.  I recently read an article about the threats Microsoft receives daily and some of the precautions they use.  A threat for all businesses is having remote users and one of the most secure ways is through a hardware Virtual Private Network or VPN.  Microsoft does use a VPN but also something that is known as sandbagging.  Before a connected computer can access any resources on the corporate network, a program scans the computer for security.  An approved operating system must be installed, along with all critical security patches and several other security best practices.  If the scan finds a deficiency, it attempts to correct it.

"It will update antivirus signatures and force the installation of critical security patches. If the user rejects these updates, the scanner ends the connection. Once the scan has determined that the computer is clean and fully patched, the connection is allowed out of the sandbox and onto the corporate network." - Martin Heller

Do I believe a small business owner needs to sandbag?  I think that depends on their needs and what information they have.  My point is that without being aware that Yes Hackers do in fact very much care about small businesses!

Now lets keep you protected!