Latest on Technology, Systems, and Security

Posts Tagged ‘ phishing ’

As you’ve probably seen in the news over the last week or so, tens of thousands of e-mail accounts have been compromised and had their log-in details posted online. Furthermore, the problem was not down to security weaknesses in Google Mail, Hotmail/Live Mail or Yahoo Mail. The problem was users giving out their information to anyone who asked.

You’re a web user. You do your shopping and banking online, always involving your confidential financial information. Perhaps you even pay the utility bills and taxes through online services. Chances are there is an awful lot of your information circulating on the internet.

So, if someone e-mailed you, claiming to be your bank, and asked for your bank account or credit card details, would you hand them over? Picture it this way – if the same person came up to you on the street and said that they were a representative of your bank, would you give the information to them, then and there? Probably not, if you had any sense!

While people may be more savvy about this threat, they seem not to be so sharp when it comes to ‘less important’ matters such as e-mail or social networking accounts. It seems tens of thousands of people have been more than happy to provide their usernames and passwords to anyone who asks, or to put those details into questionable forms on the web. When their data gets accessed, stolen or tampered with, they all of a sudden blame the services rather than themselves. This wouldn’t be so bad if every service didn’t say something like “Never give your information to anyone, ever – we will never ask for it” when you signed up!

What you have here is a deadly combination – stupid users and high tech con artists. Users are stupid in the way that they are wary in certain areas of the internet, but not in others – while they wouldn’t give a stranger their credit card details, they will give them their e-mail account details (which more often than not contains enough confidential information to sign up for a new credit card in your name!). Meanwhile, con artists are using ever more high tech methods to get people’s information – and succeeding.

Remember this golden rule: trust no-one. If someone is asking you about your information, chances are they aren’t supposed to have access to it. So, lesson to be learned? Don’t be a stupid user – get smart.

 
Thursday, October 1st, 2009

The US government has continued with its cyber-security initiative this year, with the main focus being what they term “cyber hygiene”. They want people to think more about the information they divulge over the internet and to be more wary of messages they receive via e-mail and social networking.

With the numbers of phishing attacks rising, organisers are keen to convince users that they should be suspicious of all messages from banks and other organisations, to ensure their personal data is not compromised. Of course, all banks and financial institutions already tell their customers to never divulge account information and that their staff will never ask for it, but it seems some people are still falling for some of the oldest online scams.

419 attacks, involving using someone’s identity to ask friends and acquaintances for money, are also on the rise. These attacks usually take place over social networks like Twitter and Facebook, but can also happen over instant messaging networks.

Security experts are also warning people to be ever-cautious of the information they divulge in the public domain, seeing as determined criminals can gather enough personal information over a wide spread of mediums to build up a convincing fake message with which to scam friends and relatives.

Let’s hope this initiative works out well and gives people enough information about how to avoid being scammed over the internet.