CNC - Phishing (Lesson)

Phishing

Why is Phishing Dangerous?

The cybercriminal may download viruses or ransomware; steal information such as identity theft and data theft, or enter into a system moving from computer to network.

Phish are targeted and deceptive emails sent to you to steal information or money or access information.  The intent is malicious.

Ways to Identify

• Sender details – give some details on spoof emails
• Consider the context – why does the sender need this info, is the issues really as urgent as the sender states, is it too good to be true, shipping is a big one.  Legitimate companies will never ask for personal information
• Consider the content – is there an attachment? is there a link? Were you expecting this?

Did you know that malicious emails can reach your smartphone or tablet?  Malicious emails are more common on a smartphone or tablet.  One reason is the small form makes it harder to view the details of the email. Malware is invisible on most mobile devices.  Malware may steal data, record a phone conversation, manipulate your text messages, or capture your location.  These type of devices have very little security and we use them without thinking. 

Some ways to help you make sure you do not fall for these attacks.

• Take time to look and really read before you do anything.
• Verify the sender
• If it can wait, read it later so you have time to verify.

If there is a link in your email asking for a password change or to enter a conference, carefully tap and press the link until a menu pops up.  This is different on different devices.  Here you can see the URL.  IF the URL is unknown, do not proceed.   Here are some tips

• Look for inconsistencies in email address, links, domain names and downloads
• Look at the purpose. Ask yourself why the sender is making the request.
• Check the tones, vague greetings, urgency, or threats. Remember attackers’ pry on emotions.  They want you to do act without thinking.

Data Entry Phishing

Data Entry Phishing can come in the form of an email, which tricks you into revealing personal information.  The email contains a link and when you go to the link, the fraudulent site looks legitimate and asks you personal information. The purpose is to steal personal identifiable information, account logins, and other confidential information then log you into the correct site enabling the criminal to have access to your data.  These type emails usually contain no attachments therefor are not flagged by your virus protection.

Phishing Websites

These are websites that ask for information.  Have you ever been the winner of an xbox or $1000 because you were that lucky winner.  What happens when you click on the box to accept?  The site begins to ask you question about your personal identifiable information.  Have you ever thought who was getting this information?

How to Verify a Site's Safety

• Keep your browser updated
• Look for Browser warnings that warn you of unsecure sites. Any security certificate issues should be a warning
• Website encryption is important. (https, the description of “secure” or a padlock symbol)
• Suspicious URLs – here are some examples
  • Shortened URLs condense longer URLs to shorter URLs to hide where they are really going
  • Number based links – legitimate companies prefer to use words
  • Similar web addresses – this can be by changing letters within the URL or the domain extensions. For example, the real employee safety website is www.osha.gov but there is a www.osha.net that sells training.
  • Adding hyphens
• Website Appearance – look for blurry, odd design or variation, implied urgency, etc.

Basically, if a website is asking you for information, ask yourself

• Is this normally what I have to do when I enter this website
• Am I having to log in multiple times?
• Does it really need this personal information?
• Get someone else to look to help you decide.

If you do enter information and then realize it may not be correct, contact the person or group or monitor that particular activity.  For example:  if you enter banking information and realize you may have been in a malicious site, contact your bank and then monitor that bank account.

Spam

Spam is unsolicited email trying to see you a product or service.  It is usually harmless just bothersome. It is usually advertising for products that we do not want or just junk mail.  Just like you get mail that is sent to everyone is your snail mail box, you can get those same type advertisements.  The key is, you need to know is the email trying to trick you into giving information.  Other than being annoying, spam alone does not pose a threat to your computer BUT when you click a link or download something from that spam email, then the trouble can begin.  Remember a download could have a potential virus and opening the link lets the spammer know this is an active email address, can possibly download potential cookies, and the information you enter goes to the spammer.

Ransomware

Ransomware is a type of malicious software or malware in which cybercriminal tries to get money in the form of ransom payments.  If your computer becomes infected with malware, your files are encrypted meaning you cannot open your files.  The attacker holds victims’ data hostage until the infected company pays to have the data unlocked.  To get the files open, you need an encrypt key which is owned by the cybercriminal.  To get your files unlocked, you would need to pay the cybercriminal.  Your files are useless until the encryption key is sent.  Once a ransomware download has been initiated, virus protection software does not help.  Ransomware can be activated through phishing email attachments, websites, and text messages to name a few.

Once infected, you will be notified by a text document or graphic on the desktop or on a web page.  Ransomware can infect your USB storage device, personal fitness tracker, external hard drive, etc.  Basically, if the item  can connect to the internet, there is a potential for ransomware.  The most common ransomware infection methods are email, attachments, viruses, spam, pirated software, free software, advertisements on the web, popup windows, browser plug-ins, videos, etc

Cybercriminals can tailor popups on computers to send threatening messages, called scareware.  Occasionally, ransomware can come from legitimate businesses meaning the business has been taken over by cyber criminals.

Some examples of a virus are: files do not open, errors appear telling you the file is corrupt, cannot be found, or has the wrong extension, payment countdown window, files on your desktop you did not create to name a few.

Summary

Here are some things to help protect your digital devices

1. When browsing the web, always look at the address bar of the site you’re on to see if it’s protected. If the URL address bar saysHTTPS and shows a lock, that means any information you send is going on a secure line to the website you’re visiting. This means it’s very likely OK to send private information or passwords. (Of course, you never know; somebody could’ve hacked the computers on the other end, in which case all bets are off.)  If there’s no lock and the web address says HTTP without an S, that means all of your data is open and unsecured. Normally this is okay if you are just looking but if you are checking email, entering information, social networking, shopping, banking, or doing anything that requires security, always check for the lock.  Without the lock, your data can be intercepted.

6. always make sure you’re on the legitimate version of a website by checking the URL. Sometimes a web site mightlooklike what you want, but it’s a fake. Remember to check the domain name carefully
7. Only Download From Trustworthy Sources. Whether you click on links in emails or you’re just browsing the web or looking for games, you should take extra care when a web site asks you to download anything. This may lead you to install unwanted apps called viruses, or to add 3rd party browser extensions that snoop on your browsing habits. If you accidentally download something like this from the Internet, don’t install it. Instead, only download software from verified, trustworthy sources.
8. Install Security Updates - Operating systems, browsers, etc are continuously updating security issues sometimes called patches. All digital devices are subject to security vulnerabilities. You must allow these updates to happen to help in the protection
9. Never email Private data even if there’s a lock on your browser, not all the information you send and receive is private. Whenever you send email on the internet, unless you’re sending it to somebody on the same email domain as you, your email is out in the open, available for anybody in the world to access. In fact, almost ALL the emails you send can be seen by a third party. Why? Email is sent behind the scenes using a protocol called SMTP which is out in the open and has no security or privacy protection.  The reason is there is no common protocol on how to secure email.  Just to note, this is the same for texting in most cases.
10. Another protection is your password. Use strong passwords and multiple passwords.  Strong passwords would include numbers, upper and lower case letters, and symbols.  Also the longer the password, the better. It takes longer to figure out a 16 character password than a 4 character password.  Also, use multiple passwords.  If one password does get breached, at least the cybercriminal will not be able to access everything.
11. A newer one is the Enable Two-Factor Authentication. This provides an extra layer of security. The two-factor authentication can work in two ways.  One is when you log into your account, a text is sent to your phone asking if it is you trying to login.  If you say yes, your password works.  If you say no, the process is halted and you are made aware someone is trying to use your credentials. Another ways is when you enter your account, a code is sent to another device, either a text, a phone call or some other notification. A code is generated and that code has to be entered in a timely fashion and then access is granted.
12. Last, never use someone else’s device and plug into your system.

Let's Review: Cyber Security - Terms to Know

Watch the video below to review some important key terms related to Cybersecurity.

IMAGES SOURCED FROM SUBSCRIPTION AND EDITED  BY GAVS. SURF THE INTERNET SECURELY SOURCED FROM WISC-ONLINE Links to an external site.  AND USED ACCORDING TO TERMS OF USE.