Phishing

Phishing is a new Internet crime, that is flourishing day by day. To define Phishing lets say

“Phishing is a way to steal personnel data of Internet users such as credit card information, account information etc by make a malicious web site masquerade as a trust worthy entity.

“

According to antiphishing.org Phishing crime rose by 43% march this year as compared to last year

Phishing use social engineering skill to fool users. Most commonly by referring to malicious web site which is made to look like the authentic site of a bank or other financial institution. Differentiating the site from the original site require keen observation. However Phishing is not only done through email or IM even the original site may be wormed to refer the user to malicious pages as happened with myspace.com

Its important to know what Phishing is and how a user can avoid being phished and what steps can IT Security managers can take to deal with phishers, consider that more than $2 billion is lost my businesses annually on insurance covers relating to Phishing. Now even some banks are not providing insurance to claims due to Phishing. Their logic is that customer made the choice to enter the information in to the fake web site.

This article will deal with

1. How to spot phishing web sites

2. What to do after you've been phished

How can people protect themselves from becoming a victim of a phishing scam ?

By taking simple precautionary measures we can protect ourselves from phishers, and save ourselves

from on line fraud

1. Don’t click links within emails that ask for personal, financial, or account information. Go to main page of the organization instead.

2. Banks usually do not ask for information on the Internet they got nothing to do with your pin code, if still in doubt talk to the customer service of the bank, and instead of using the phone number in the email its better to look the number up.

3. A message being generally addressed instead of being specifically address to you is a sure way to tell, you are being phished.

4. Confirm the URL in the address bar if it spells right and is not a number, like IP adress. Normally phishers change a letter to redirect to their pages; like gogle.com instead of google.com.

5. Using book marks would be safer as it would lead you to the exact site, instead of entering every time, as a typo can lead you to a phishers site.

6. When replying to emails with sensitive, check the message headers. The ‘From:’ address and the ‘Return-path’ should be same, if they are different then the email address is spoofed.

7. Look at the expanded headers of the emails to trace the path of email, phishing emails use dubious mail servers, and anonymizing services.

8. Login sites of banks and other institutions dealing with private sensitive information use secure sites so in the address bar at the beginning of the address it should be HTTP not HTTPS; for secure HTTP.

9. Secure sites use a certificate and a certificate signing authority indicated by the padlock icon in the bottom bar of the explorer window, confirm its presence; it shows the site is validated by a certificate.

10. Most of the phishers are able to get a spoofed certificate now a days too, so click the padlock icon and confirm the company name of the certificate matches with the URL.

11. Most modern browsers check the certificate for expiry dates and validity instead of clicking through the certificate warning, pay attention to hem.

12. Use a phishing filter add ons for the browsers.

13. Phishing sites are usually like poor imitations of the originals, with spelling mistakes incorrect graphics etc, so be on the look out for the anomalies in the design.

14. Resist greed, like free money offers; if some thing is too good to be true then it must not be true.

15. If your friends account is compromised then the mail could come from his email address, confirm him by phone before giving out personnel information.

What action can people take if they discover that their private information has been stolen

Prevention is better than cure so the best policy is to avoid being phished, however if a negligence is already done, following measures could be taken to minimize the damage

1. Report to the organization whose site the phiser replicated, block your account.

2. Change your password immediately .

3. If you are unable to login use the hint service and change password and hint and contact the organization directly.

4. Check the transaction history, may be you are able to get insurance cover for fraudulent transactions

5. Several sites banking sites and Gmail offer log in and activity history keep, check the history frequently.

6. Report scam to your local law enforcement agency.

Electronic Frontier

First there was the telegraph, then came the switched telephone systems. Parallel to these telecommunication systems there were developments in the field of computing. They evolved from behemoths like ENIAC to the computers that were within the reach of normal consumers due to invention of transistors and IC.

A simple device knows as Modem http://tinyurl.com/mpsan merged the two, and foundations of information revolution were laid. The age of global village, connected people, connected world. But where this revolution has given us many things it has also taken one think very dear to us, in fact we have gladly sacrificed it for the pleasured we get in return that is PRIVACY

In the times of Web 1.0 email or our credit card details was the only things we had to worry about. After the first Internet bubble burst, a plethora of services were launched that stored our data of one kind or the other. From keeping our schedule, contacts, our favorite sites even to our backup data.

Next came the concept of cloud, Internet computing and on line application service providers. This means that from now on instead of installing applications we will go on line, and access applications ranging from productivity suites like Google docs to even payroll application. Result is that now even the data like our documents which were on our own computers are now in the cloud. Lets not forget social media too, sites offering to host our pictures videos so we can share with friends and then the amalgamation of these the community sites, which kept us friends too :)

but the big question is

“DO YOU TRUST THE CLOUD”

Have you ever thought the how these companies make money, ADS. Not just plan old ads, but the brand new shiny more money milking customized Ads.

What customized actually means? Take the example of Google, few years ago a startup launched by a couple of college students now one of the largest companies of IT and direct competitor to Microsoft and Apple, the companies much older then Google. The reason behind their explosive growth ADS, their ad sense http://tinyurl.com/olfo8 network integrated with their awesome crawler search engine ( give credit where due). At first they only customized ads according to your search terms, since then they have launched they email, video sharing, photo sharing, blogging and a host of other services. So what customized actually means

Google can look at your browsing history, cookies, favorites, email subject and bodies, the kind of videos and picture you host and you search for, the books you read, your search interest. All of this are for them the way to throw more ads at you. Oh my God, why so much information, some of it you may not want to share with your friends and family and you are sharing it with Google The thing is will Google be trusted enough to keep it safe from prying eyes, not to sell it, not to save it, and is there a possibility of this information to be used in the court of law.

Well now the reality crunch, they sell it, it may get hacked, they save it and on they may use it in the court of law. http://tinyurl.com/lu2y7w

Another recent example i found in the guise of facilitating you to keep you information is facebook.com. Though its a power full site, and really innovative but to use it fully you have to give it all your email address with user names and password, meaning that it will have access to all your correspondence and even your mobile number. They only thing that may not be on the cloud will be my DNA unless i submit it for profiling too :o

If i don't trust th cloud what could I do ???

It all depends upon how concerned you are,

• you could make you own mail server too, there are good free and cheap mail server.

• Install you own applications instead of relaying on clouds

• Make friends by physical networking not the virtual one, it would be more rewarding too

• use physical media to share you virtual media

• opt out of as much sign ins as you can

I may add more to it as i come along, and do add your comments