Phishing and Internet Scams

Definitions and recent statistics Why is it dangerous? Phishing techniques and identifiers Examples of phishing and scam s Possible losses Prevention techniques

Important Scam Definitions Phishing- An online scam in which the perpetrator sends out a large number of legitimate looking e- mails that appear to come from respected companies (such as banks, credit card companies, etc.) with the intent of "fishing" for personal and financial information from the recipient. These s are falsely claiming to be the respected company who needs the user's information to update their files, when in fact, it is an attempt to scam the user into surrendering private information that will later be used for identity theft. (Netlingo)

Important Scam Definitions Spear Phishing- an spoofing fraud attempt that targets a specific organization, seeking unauthorized access to confidential data. Spear phishing is a specific attack against a certain company or organization. (whatis) Spoofing- the forgery of an header so that the message appears to have originated from someone or somewhere other than the actual source. (whatis)

PhishTank.com’s Month Overview

Why is phishing so dangerous? s and websites can be convincing or hard to distinguish from the real company Uses pictures and websites from existing companies Can sometimes link to the real website to seem even more realistic address seems legitimate

Common Phishing Tactics and Identifiers Reply s are requested to be sent to a different address Reason for the information request Account information is outdated Account has been selected for varification Limited time threats Threats of discontinued service or deactivated accounts Security Statement Assure the victim that the company can be trusted with the requested information Use of the TRUSTe symbol to fake legitimacy (even though this symbol is supposed to be displayed to show security) Information Collection Link to a site that requires information be submitted Request for an reply with information included

Common Phishing Tactics and Identifiers Fake links or hidden destinations Links that take you to a different destination than stated in the Using the IP address of the website, which can be modified even farther by representing it in a different format (hex,oct) Symbol and Hexadecimal Commands When used in http or https, all text before becomes can be concealed even further by using %40, which is it’s hexadecimal representation Putting a null (%00) in front of will sometimes hide the real destination, giving only the user info tag

Fake Link Examples Actual link address Stated link addres

Fake Link Examples onMouseOver modification ypal.com/cgi-bin/webscr?cmd=_login-run Typed Address onMouseOver Address Actual Address

Phishing Examples

Possible Losses/Criminal Targets Personal Social Security Number Credit Card Numbers Bank Accounts Private Information Businesses Credibility Money Customer Information Employee Information Private Documents

Prevention Techniques, Methods, and Advancements Businesses should have policies on what information should never be given out Ex: passwords, usernames, important files Most businesses will never ask you to give out your private information in an Contact the company by phone if unsure about an Do not give personal information out in an Programs and communities are being developed to fight against phishing

Overview Important definitions and statistics Why phishing is so dangerous What makes up a phishing attack Examples Losses and preventions