gHacks technology news » phishing

Facebook Phishing Scam In The Wild

Martin — Sun, 08 Nov 2009 17:52:28 +0000

Offering a popular website or web service is not always a blessing. This especially becomes apparent when you have to deal with security related issues like phishing attacks. Facebook is without doubt one of the most popular sites on the Internet these days and it therefor comes unsurprisingly that the service is regularly attacked.

Trend Micro are reporting about yet another Facebook phishing attack that is currently in the wild. The attack begins – like most phishing attacks – by mass mailing potential Facebook users informing them that they need to update their Facebook login credentials. A link is offered in that email and if they follow that link they land on a website that looks like Facebook. What’s interesting here is that the email address field of the Facebook login form is already filled out so that the Facebook user only needs to enter the Facebook password to complete the process.

A click on the login button will open a new page that contains a link to an update tool which installs a trojan on the user’s system.

It attempts to access a Web site to download a file which contains information where the Trojan can download an updated copy of itself, and where to send its stolen data. This configuration file also contains a list of targeted bank-related Web sites from which it steals information. Note that the contents of the file, hence the list of Web sites to monitor, may change any time.

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user’s account information, which may then lead to the unauthorized use of the stolen data.

The blog post contains security tips on how to distinguish legit from phishing emails. Users who are interested in those can visit the blog post but the most important lesson once again is to avoid clicking on links that are send via email.

Tags: facebook, facebook login, facebook login page, facebook phishing, facebook security, phishing

SafeOnline Protects PCs Even If They Are Infected

Martin — Tue, 03 Nov 2009 21:42:51 +0000

I have been working for one of the biggest financial organizations in Germany. One of our jobs was to deal with customers who had fallen pray to phishing and other malicious attacks. The attacks in the beginning were not sophisticated at all including emails with errors, no personal information and even some from other organizations that the customer had never dealt with before. The phishing emails started to get more professional and it became harder to educate customers about the dangers.

SafeOnline is a security program developed by Prevx that is available as a standalone software or as part of Prevx 3.0. This program, according to its developers, is able to protect PCs against many forms of phishing and pharming even if they are infected.

How is it done?

The core protection lies in the ability to block keyloggers, screen scrapers, man-in-the-browser attacks, session hijackers, clipboard grabbers, and a number of other threats commonly installed by trojans like SilentBanker, Bancos, Zeus, Torpig, and Curtwail onto thousands of PCs daily. Rather than focusing on being able to identify the threats themselves, SafeOnline works to isolate the browser from the rest of the system even if unknown threats exist that try to steal data from the user. System level malware generally attempts to read data from the browser but Prevx introduces a layer in-between the browser and the rest of the operating system, tricking the threats into thinking that they have successfully read and transmitted the user’s credentials outside of the system when they have not. Unlike other solutions, Prevx SafeOnline works with the user’s existing browser, without requiring the use of a specialized browser so there is no need for the user to change their browsing habits – protection is applied seamlessly and silently in the background.

This sounds like a reverse sandbox where the contents in the sandbox are protected from the rest of the computer system. According to Prevx it offers protection against

* Man-In-The-Browser
* Phishing attacks
* Keyloggers
* Screen Grabbers
* Cookie Stealers
* Info Stealing Trojans such as ZEUS, MBR, Goldun, and Silent Banker

Prevx has contacted several banks in the UK offering their product for free to the bank’s customers. Six banks so far have shown interest in the product. These banks had special requirements according to PC World that included that the product would work with other security software and would not force the banks to change their websites. The security product was able to meet all of these requirements.

Verdict: The main question here is if it is really safe. Will it really defeat all keyloggers and phishing attacks? What if the security software fails do to so? What if users feel overconfident using the software? It might work as an extra layer of defense on a PC system but it might take a while before the company can build enough trust in their product. Thanks Dante for the tip.

Tags: banking, phishing, prevx, safeonline, security-software

Twitter Account Suspended? Be Careful What You Post

Martin — Mon, 12 Oct 2009 15:49:01 +0000

You might have already read about it in the news elsewhere: The Twitter account of security researcher Mikko H. Hyppönen of F-Secure got suspended without warning two days ago. Mikko tried to contact Twitter support and tried everything in his power to understand why his Twitter account was suspended in first place. He received a short message by a Twitter representative after two days that mentioned why his account was suspended and that it was unsuspended.

Here is how Mikko describes what happended in his blog: He posted a warning about a new MySpace phishing website two month ago as a tweet using his Twitter account. This message contained an unclickable url of the phishing website to warn users and spread the word.

Twitter, after two months, figured that the url was a phishing url and made the decision to suspend the account. It is not clear if this was an automatic or manual suspension. The Twitter account of Mikko was restored after two days and the following explanations was given:

I’ve unsuspended your acct.
You were suspended for using the malware URL rnyspeceDOTcom in DMs.
Be careful!
We scan evrythng for malware.

To make matters worse all of his followers and people that he followed were not restored. Both counts showed 0.

The whole incident raises several questions:

Why was the Twitter account banned after two months and not immediately?
Why did no one notify the Twitter user about the suspension
Why did it take two days to restore the account
Why can’t the followers and followed be restored

Twitter’s reaction fell short and put the blame on the Twitter user rather on an ineffective way of handling the incident. Until things change Twitter users should be very careful what they post in Twitter.

Tags: f-secure, phishing, twitter, twitter account

Phishing Protection Tips

Martin — Wed, 07 Oct 2009 08:57:42 +0000

It is time to update the phishing protection article that we published some time ago (see Phishing explained) with the recent news that thousands of Hotmail users (and apparently Gmail users as well) fell pray to yet another phishing scam. What is phishing? Phishing, which stands for password fishing, is a popular technique to get collect data from users without their knowledge. This data is usually sensitive in nature, like credit card information or usernames and passwords. The attackers need to get a user on a specifically prepared website first which often is looks exactly like the real website the user wants to visit.

Think of this example: A user receives an email from PayPal or his bank which states that the account was comprised and that action needs to be taken right now. A link is provided and most users will click on that link to get to the website fast. The website looks like the real PayPal or bank website which adds to the trust the user has in the process. The website asks for authorization and most users will enter their data without hesitation. The data that is entered will be collected by the attackers and used in criminal activity.

What is phishing:

Phishing always requires a user to visit a specifically prepared website (most of the time through a link that is added in emails or messaging)
The fake website looks a lot like the real website (there are ways to detect fake websites)
The goal of the attackers is to get the user to enter the data that they are after into a web form.

Phishing protection:

The most powerful weapon against phishing is common sense and the following rules that every user should oblige to.

If you are not a customer of the site delete the email immediatly. Don´t click on the link or reply.
If you are a customer and you are not sure if the email is legit do one of the following:
Contact the institute by phone or contact at the official website ( do not use the email link of course) and ask if the mail is official.
Instead of using the link provided open the website by typing in the official link there. The site should have news about the email on their starting page. (most of the time). If not, use 2a to verify the email.

Thankfully though there are quite a few tools out there to aid and protect the user against phishing attacks.

Most web browsers these days come with phishing protection enabled. The lists that they use are usually updated several times a day. It has to be noted though that they only detect phishing websites that are already in the list.
Several email clients, like Mozilla Thunderbird, but also online email services, like Gmail or Yahoo Mail, make use of phishing protection as well.
Internet security programs do come with phishing protection as well.
Password managers can be an excellent aid. If you have saved the login for a website in the password manager you usually can login automatically (Last Pass for example supports that option). The password manager will only work on the real website and not the phishing website.

The most powerful protection again is the user’s common sense. Here are a few pointers on how to detect if a website is real or a phishing site:

Check the url in the address bar. Is it pointing to the right website? Make sure you look close for chars that look similar, e.g. o and 0.
Is it a https website? Is the certificate valid?
Does the website look different? Open another web browser tab to enter the url manually just to be on the same side (if you have opened an external link)

Firefox users can check if the phishing protection of their web browser is working. Do you have additional phishing protection tips?

Tags: phishing, phishing protection, phishing scams

Test The Phishing Protection In Firefox

Martin — Tue, 06 Oct 2009 12:48:34 +0000

There are basically two options to protect computer systems (and their users) from phishing attacks. The first are protections in programs like email clients or instant messengers that are commonly used to spread phishing links while the second method blocks the web browser from opening those links (when they have already been clicked on). The phishing protection – they call it web forgery protection – in the Firefox web browser belongs to the second protection option against phishing attacks.

Firefox will display a warning whenever the user tries to open a website that is a reported phishing website. Updated phishing and malware lists are automatically downloaded every 30 minutes if the web forgery protection is enabled in the web browser.

The following screen is then displayed if a website is opened that is on that list of phishing and malware websites.

The user still has the option to ignore the warning and proceed with the site loading but it is generally recommended to stop at this point and close the tab. There is however one nagging questions that some Firefox users have. How can they be sure that the phishing protection is working in the web browser?

Mozilla has created a specifically prepared website that will trigger the phishing protection. Users who open the It’s a trap website at Mozilla.com will see the web forgery warning if the phishing protection is enabled and working in the web browser. Everyone else will simply see the test website.

Firefox users who do not see the warning page should go into the Tools > Options > Security in the Firefox options and ensure that the entries Block reported attack sites and Block reported web forgeries are checked.

The phishing test website will not work with other browsers even if they offer phishing protection as well.

Tags: firefox, firefox phishing, firefox security, firefox web forgery, phishing, web forgery

Hotmail Phishing Attack: Time To Change Passwords

Martin — Mon, 05 Oct 2009 19:26:30 +0000

Microsoft has recently confirmed that thousands of Windows Live Hotmail customer’s credentials were exposed on a third party website. According to Neowin the account information were posted by an anonymous user at the pastebin website. The list that was posted contained over 10.000 account details of accounts starting with the letters A and B which suggests that additional lists might be in the hands of the attackers. Initial investigations suggest that only accounts used to access Windows Live Hotmail were affected (which includes email accounts ending with hotmail.com, msn.com or live.com.

Microsoft determined that the attack was not a breach of internal Microsoft data and believes that the account data was gained by a phishing attack. Phishing attacks are common ways these days to lure users into entering their account data on websites that look like the real deal but are not.

Hotmail users are encouraged to immediately change their account password to protect the account from unauthorized access. It is furthermore recommended to change the account password on other websites if the same password was used for accounts there as well.

A good tool that can help users create and use secure passwords is the Last Pass extension which is available for Firefox,Internet Explorer and Google Chrome.

Tags: hotmail, hotmail phishing, last pass, msn, phishing, windows live

Help the fight against phishing with Phishtank

Joe — Sun, 23 Aug 2009 22:13:48 +0000

For anti-phishing tools to work, phishing sites must be identified to analyse and to warn people about.

Sites like Web of Trust allow users to share information about phishing sites, but scores of similar tools exist and as it would be counter-productive for each to maintain their own database of phishing sites.

PhishTank centralises phishing reports and allows developers to use their data free-of-charge in their own applications, with manual or automatic download enabled (although the latter requires a free API key).

PhishTank offers a service a lot of web users will use without even realising it. Whilst certain tools might submit their data to PhishTank too, you can help your fellow web users and fight phishers through submitting data directly to PhishTank.

With a free registered account, reports can be submitted through a web interface or through email. It is extremely easy to send the next phishing attempt that manages to get through your spam filters to PhishTank. Providing you have that email address registered with them, all you have to do it forward it to phish (at) phishtank.com .

Whilst it might not directly benefit you to do so, you are helping users who might help you too. If nothing else, you are keeping your credit card interest rate down marginally, as your bank has to pay less out to compensate phishing victims!

Tags: anti-phishing, antiphishing, phishing, phishtank, Security, social-phishing, web of trust

Another Report Finds Internet Explorer 8 To Be The Most Secure Web Browser

Martin — Fri, 14 Aug 2009 15:59:23 +0000

A web browsing security test that pitted Internet Explorer 8 against Firefox 3, Opera 10, Safari 4 and Google Chrome 4 came to the conclusion that Internet Explorer 8 is the most secure web browser, at least in the area that were tested by security research company NSS Labs. The report, which is available at the company’s website for download was sponsored by Microsoft’s online security engineering team and later send to marketing after the results have been published.

The test analyzed the web browser’s phishing protection. Both Internet Explorer 8 and Firefox 3 (that is Firefox 3.0.11 and not Firefox 3.5) managed to score an average block rate of 83% and 80% during the 14 days of testing. Opera 10 managed to block 54%, Google Chrome 26% and Safari a whopping 2%.

The average phishing URL catch rate for browsers over the entire 14 day test period ranged from 2% for Safari 4 to 83% for Windows Internet Explorer 8. Internet Explorer 8 and Firefox 3 were the most consistent in the high level of protection they offered. Statistically, Internet Explorer 8 and Firefox 3 had a two-way tie for first, given the margin of error of 3.96%. Opera 10 beta came in third due to inconsistent protection during the test. Chrome 2 was consistent, albeit at a much lower rate of protection, and Safari offered minimal overall protection.

The test analyzed the average response time to phishing attacks. Internet Explorer 8 finished first with an average response time of about 5 hours closely followed by Firefox and Google Chrome. It took Opera about double the time and Safari more than 10 times to protect against emerging phishing attacks.

Many users will criticize the test because it has been sponsored by Microsoft. This alone should not be reason to dismiss the findings as inaccurate. There have however been accusations of manipulated reports by NSS Labs in the past which are for example mentioned in a blog post at the Opera website. Some of the points of criticism like mixing beta and final versions or limiting test urls to a very low number are also valid points in the new report.

Even critics have to admit on the other hand that Microsoft has made progress with Internet Explorer 8. The web browser might still not be as fast as the others but it is definitely a solid web browser which could be the most secure web browser when it comes to protecting users from phishing attacks. It has to be noted that the test is only considering the automated protection.

Tags: firefox, google chrome, internet explorer 8, internet-explorer, opera, phishing, phishing protection, safari

Truemark Email Identification

Martin — Wed, 11 Mar 2009 19:35:33 +0000

Inexperienced users and even some experienced users have troubles identifying fake emails from legit ones. It is sometimes hard to tell if the email that just arrived in your mail inbox came from a legit company like eBay, Amazon or Citibank or if it is just another phishing attempt. There are some basic guidelines that help identify phishing emails. They are not that hard to learn, read our anti-phishing tips for pointers. Many inexperienced computer users think that it’s complicated, they prefer an easier way of telling if an email is legit or not.

Enter Truemark by Iconix. Truemark uses authentication techniques to identify more than 1500 different company email addresses including the three companies in the example above. It is backed by some of the most popular shopping and financial websites on the Internet which makes it attractive for many users. Even better is the fact that the software is free to use and compatible to several popular email providers like Gmail, Hotmail, Yahoo! Mail or Aol Webmail but also Microsoft Outlook 2003 and 2007.

Another advantage of Truemark is that is it working in both Internet Explorer and Mozilla Firefox which should cover more almost 90% of the web browser market. The installation of the software will install a Browser Helper Object in Internet Explorer and an add-on in Firefox.

Truemark will automatically scan the emails in the mail inbox if the user opens a supported email client or web email client. It will display a verification icon next to the email to notify the user that the email is legit.

Moving the mouse over the icon will show an overlay with additional information about the sender and if the sender passed both identification and authentication.

Tags: aol, Email, email certificates, email security, gmail, hotmail, iconix, microsoft outlook, outlook, phishing, Security, truemark, yahoo

Add Hostname To Firefox Titlebar

Martin — Wed, 10 Dec 2008 20:12:19 +0000

The hostname is basically the root url of a website, for Ghacks it would be www.ghacks.net. Adding that information to the titlebar has two apparent benefits. Number one is related to phishing. Antiphishing measures have been implemented in many web browsers and security software programs which could lead to the assumption that “yet another” way of helping with the identification of phishing sites might be overkill.

Experienced users on the other hand know that no software or script will reach an accuracy of 100%. There will always be false positives and negatives meaning regular websites that are identified as phishing websites (although they are not) and phishing websites that are not identified as such. The latter is obviously more devastating for the user.

Adding the hostname to the titlebar gives the user the opportunity to quickly check if he is on the right website. This in addition to other indicators can aid the user tremendously. More tips can be found at our Phishing Explained article.

There is however another benefit for users who work with password managers like KeePass who make use of the title for identification purposes.

Hostname in Title Bar (via Technix Update) is an experimental Firefox add-on which means that you have to sign in to the Mozilla website before you are allowed to download and install it.

Tags: anti-phishing, antiphishing, firefox, firefox phishing, firefox-add on, firefox-extension, phishing, phishing protection

Web of Trust: collaborative online security

Joe — Tue, 02 Dec 2008 19:30:58 +0000

Most systems which warn of unsafe websites, like ~~OpenDNS~~ and Google, work in mysterious, non-transparent ways and websites are often deemed as unsafe for reasons other than safety. Web of Trust is a Firefox extension which rates the safety of websites based on ratings received by other users of the plug-in.

Users rate websites on their ‘Trustworthiness’, ‘Vendor reliability’, ‘Privacy’ and ‘Child Safety’. Information about websites is also gathered from Compete, comments by users and through links from reliable sources (such as Digg, Lifehacker, Open Directory Project and Wikipedia).

Web of Trust sits alongside your navigation buttons, ensuring it has your attention, and should a website be cause for concern the button will change colour. Information is also integrated in webmail and search results, to ensure you won’t stumble across an unsafe website.

It currently has information regarding of about 21,000,000 websites based on feedback from the extension’s users. It can also be used as parental control, blocking children from websites not suitable for kids.

The website has flaws. It relies on a user spotting a phishing site before someone falls prey to it and naturally, intelligent scammers could trick it through rating their own site. Then again, I imagine this would rarely happen and even when it does, one would expect it to be quickly rectified.

Tags: anti-phising, firefox, firefox-extension, firefox-extensions, online safety, parental control, phishing, safety, Security, web of trust, wot

New Phishing Emails Emerge

Martin — Fri, 01 Aug 2008 18:36:05 +0000

The usual phishing email is still claiming that “action” is required because of something that just happened. This can be a fake eBay purchase, PayPal or bank account transactions. While these methods are still highly successful it becomes widely known by the general Internet user that they should not click on emails that contain such topics.

A new phishing email (via Trend Micro)that recently emerged claimed that the user’s Bank of America account was accessed by an international IP from an unregistered computer and that their “Foreign IP Spy” detected that breach.

It is asking the user to verify and register his current computer by logging in to the Bank of America website. That link leads to a new window which opens a phishing website that is using a fake address bar. Most users who clicked on that link will surely enter their login information.

This approach is basically appealing to the user to secure his account. That’s tricky and many users will probably fall for this because they believe that thiefs would not ask them to secure their accounts. What they obviously miss is the fact that the added security feature is fake and not existing.

Websites with that fake address bar can be easily identified by right-clicking on that website and selecting properties from the context menu if Internet Explorer is the browser of choice. Firefox users click on Page Info in that right-click menu while Opera users press Alt + Enter or right-click and selected Edit Site Preferences.

The best protection against phishing is to not open any links in emails. Always open the website directly in the browser. If you are insecure call the company and ask if they have send that email to you.

Tags: bank of america, firefox phishing, opera phishing, phishing, prevent phishing, trend micro

PayPal to Block Unsafe Browsers

Martin — Sat, 19 Apr 2008 11:46:51 +0000

If you run an old version of a browser you will more likely be subject of an attack, that’s a fact I think that we can all agree on. The latest browser versions are not as vulnerable as old versions, especially if you take into consideration that known vulnerabilities are much easier to exploit than finding new ones. So, if you do not run the latest version of your favorite browser you are a security risk.

That’s what PayPal (thanks Lee for the email) mentioned in a Whitepaper and I have to agree with it. There is virtually no reason why someone would still use Internet Explorer 3 or 4 to surf the Internet for example. Those browsers probably have so many known security holes and lack so many security features that it’s highly likely that the browser will get successfully attacked eventually.

This still does not take care of the user who is working with the computer which is in my opinion the greatest security risk of them all. I always like to say that if you do not understand basic security concepts, for instance the ability to differentiate between http and https websites, then you should not be doing security related stuff on the Internet including banking but also eBay, Amazon or PayPal.

The battle against Phishing is something that companies cannot win alone. Companies cannot do anything about a user who cannot differentiate between fake and original websites. Systems like Extended Validation SSL Certificates which highlight the address bar in green will surely help those users in the long run.

What should not happen though is the exclusion of a browser simply because it is being used by a smaller community. Say Safari for Mac. When I worked at one of the biggest German financial corporations I always had to tell Mac users that their browser was not officially supported. Security is not an excuse to lock out some users with more “exotic” browsers.

Tags: browser, paypal, phishing, Security

How Stolen Credit Cards are sold

Martin — Wed, 26 Mar 2008 18:58:04 +0000

Have you ever wondered how criminals who hacked, phished or stole Credit Card information sell them later on ? I mean, where would you go and sell the stuff and where would a buyer look to find it ? One possible way is to create a blogspot blog and sell it from there. Sounds to easy to be true ? Read on to find out..

Dante send me this interesting article from Techworld that describes the mechanism behind selling Credit Cards. They are sold in so called dumps which seems to be packs of one hundred numbers starting from $10 per 100 for regular Visa and Mastercard Credit Cards up to $150 for European Gold and Platinum cards.

Techworld calls it a Credit Card Supermarket which does not seem to fit the website at all in my opinion. It looks pretty spammy, probably to keep regular visitors from exploring the website. I think it is interesting to note that there is no obvious way to contact the sellers other than to reply with a comment on your own which would make a seller pretty vulnerable to investigations unless they take extra precautions.

Tags: american express, cc, credit cards, fraud, mastercard, phishing, sellcvv2, visa

Free McAfee VirusScan Plus 2008

Martin — Mon, 17 Mar 2008 11:30:56 +0000

McAfee VirusScan Plus 2008 retails for $39.99 for a one year license normally but you can get it for free for a limited time. It runs on computers with Windows 2000 or newer Microsoft operating systems including Windows Vista and protects your system from various threats such as spyware, viruses, trojans and phishing.

I personally do not install software like this especially if it has Norton / Symantec or McAfee written on it. Still this might be useful for some and it is free after all. Here are the steps that you need to do: (Thanks to Raymond for finding another great offer)

Visit the Natwest website and click on the huge banner at the bottom saying Free PC Security, Protect your PC for 12 months with McAfee VirusScan Plus. This will lead you to a McAfee website that has a Register Now button. Click on that button and fill out the registration form.

McAfree VirusScan Plus 2008 Features

Safe Search, Safe Surf. McAfee® SiteAdvisor™ adds ratings to websites to help you avoid online dangers.
Home License Subscription Service. Automatically delivers the latest software features and threat updates and lets you easily manage security subscriptions for all your PCs.
Stops Viruses. Blocks and removes viruses and even stops them before they even get to your PC.
Stops Hackers. Protects and conceals your computer from hackers.
Blocks Spyware. Blocks spyware before it installs on your computer and removes existing spyware.
Improves PC Health. Cleans clutter off your computer so it stays healthy and secure.

It requires your name, email and a password. You might want to uncheck the options below the form so that you do not subscribe to those newsletters. Click on the I Agree button to proceed and in the next window on the Go To My Account button.

This should load the account window and you should see the McAfee VirusScan Plus 2008 subscription in a table on that page. A download / install button is available in the same row, click that button to download the file DMSetup.exe and execute it when the download is finished.

You should be automatically logged into your account, if not the option is given in the tool. Just click on the Download button to download the real product which takes a while. Once the download is completed you click on Install to install the product.

The Register Now link is not working all the time. My first test through up an error message. Just try it again and it should work afte all.

Tags: antivirus, mcafee, offers, phishing, software, trojans, virus, Windows

New Phishing Mail Tactics

Martin — Sun, 17 Feb 2008 19:20:30 +0000

I guess every user with an email address has already received at least one email from a bank, financial website or other website asking him to download a security patch to avoid account termination or a ban. Those mails are so common nowadays that they seem to lack the desired affect and that less and less users are falling for those phishing emails that point to the download of a Trojan of course and not a security update.

The new kind of phishing emails is actually using the knowledge of those first gen phishing emails by warning users about those emails which will lead to a fake website. Since this is a relatively new scheme many users will probably fall for it believing the message that is send to them.

Who would believe that a message that is warning the user about phishing emails is actually a phishing email ? The best way to defend against this kind of attacks ? Never open links in mails, always visit the website directly.

Tags: Email, phishing, phishing email, Security

How to defeat Phishing

Martin — Sat, 05 Jan 2008 23:16:15 +0000

Kurt mentioned in Daniel’s PayPal phishing article how he dealt with phishing and that got me thinking about the easiest way to defeat phishing for certain accounts. The answer is virtual mail accounts. I always thought about virtual mail accounts as a way to stop spam and find out which website or service sells your email but it can also be used to defeat phishing.

Virtual mail accounts can be created in many online mail accounts including Gmail and Yahoo Mail. If you wanted to create such a virtual mail account in Gmail you would simply change the email address at the site where you are registered at to youraddress+added@gmail.com. To give you an example, you could use the email ghacks+paypalcom@gmail.com as your main email in PayPal.

You would then set a filter in Gmail to filter all messages send to this email. Now, whenever an email from PayPal arrives that was not send to this virtual email address you can be sure that it is a phishing email. To be effective you need to hide this email from everyone, even the people who send or receive money. This is done by using a second email for this purpose that is not your default email in PayPal.

This system works fine if the service accepts email addresses with plus signs. Most websites need only one virtual email address, your bank for instance, eBay and every other website where the email is not visible to contacts.

Tags: ebay, Email, gmail, paypal, phishing, yahoo

Ingenious PayPal mimicing spam

Daniel Pataki — Sat, 05 Jan 2008 06:34:07 +0000

About 2 days ago, I received a quite clever spam email in my Gmail account. It’s still pretty new, so I do take a look when I occasionally get spam to filter out any mistakes (none so far). I noticed a letter with the sender “PayPal”. I clicked on it and it says:

This email confirms that you have sent an eBay payment of $47.85 USD to hineswhittier@yahoo.com for an eBay item using PayPal.

If you look at the email, it does look like a PayPal email at first glance. There are differences, but who can really recall an invoice at first glance? I have to say, that despite my “mental training” to be really cautious, I almost clicked on the link. My first thought was, maybe someone hacked my account. I don’t have a load of money on there, but I do have over $48, so if they did hack it, it would make sense to only send that small amount. If you read a bit further, here’s what you see, and this is what arose my suspicion.

Note: If you haven’t authorized this charge ,click the link below to dispute transaction and get full refund (Encrypted Link )
*SSL connection: PayPal automatically encrypts your confidential information in transit from your computer to ours using the Secure Sockets Layer protocol (SSL) with an encryption key length of 128-bits (the highest level commercially available)

First of all, yeah right, I click dispute, and I get all my money back, how nice of PayPal, not even to look into it. Second of all, I don’t think 128 bit SSL is the highest available. Third of all, and this was right before I almost clicked, the link contained inside (I have removed it now) goes to a very non-PayPal page. I mean it goes to some Japanese, even spam-sounding website. By the way, 3 of the five links in the email went to the same page. I just stopped there and then and forgot about it. Upon an even closer inspection though you can see the comma error in the first line, and also the faulty bracket spacing after “Encrypted Link”.

Whenever you receive something that seems like spam, always remember to check these things, they can tell you it is spam, or at least keep you from clicking away wildly. Click on the pic if you want to see the email, it’s in gif format, so no need to worry about links and things.

Update: I have forwarded the email to spoof [at@] paypal [dot.] com, if you receive anything like this, please help them out too.

Tags: Email, paypal, phishing, Security

Free Phishing Protection with Delphish

Martin — Sun, 06 May 2007 18:37:17 +0000

Many Internet users do not realize how dangerous Phishing can be. They receive a email which claims to be from their bank and they blindly trust everything that is written in that mail and will click on any links that are displayed in that mail to “update” their security software or passwords. They are usually redirected to sites that password fish their passwords and use them to make online transactions. I’m always astonished by the amount of users that want to do online banking for instance on the Internet but lack basic security knowledge.

Installing a software that protects the computer against most forms of phishing would be one way to deal with the lack of knowledge. Delphish is a free anti-phishing extension for Microsoft Outlook and Mozilla Thunderbird. It adds a new toolbar to the email client with several new options. The most important button in that toolbar is the Check for Phishing button which analyzes the mail in two steps. The first step is a comparison to an online database that contains known phishing emails. If that check is positive the result will be shown and the mail will be moved into the phishing folder.

If the first comparison is negative Delphish will analyze the contents of the mail to determine factors that are normally used in phishing emails. A whitepaper that is available on the Delphish website details that process but should be left for the interested that have a technological and mathematical background. Some of the factors that play a role in determine if the mail is a phishing email are: Geolocation, link analysis, context analysis and reputation analysis.

Even with the extension installed common sense should be used as well. You can use Delphish as a first layer of defense against phishing but should make sure that you are able to analyze the mails by yourself as well.

Tags: anti-phishing, delphish, microsoft outlook, phishing, phishing extension, thunderbird

Introduction to new phishing techniques

Martin — Fri, 16 Feb 2007 07:59:54 +0000

Many users are still unaware of the dangers that phishing could mean for their life’s. They might now that hackers try to lure unsuspecting users to fake websites hoping that their victims would try to supply login information, credit card details or social security numbers while trying to use the service. Those users already have difficulties identifying those first generation phishing websites that undoubtedly look and feel more professional with every passing day.

Anti-Phishing toolbars and implementations in the major browsers are useful but can, as you will see, give the user a false sense of security. This can be attributed to the fact that databases that contain the information are not updated in real time. Someone has to report a phishing website before it will be added to the database, it would be more than difficulty to create a automatic solution for this problem.

A second difficulty are new techniques used by hackers that are not detected by ant-phishing toolbars and implementations.

Flash Phishing

Anti-Phishing toolbars do check the page content for signs of phishing but do not analyze flash objects at all. Hackers know this and tend to use this to their advantage by using flash to emulate the original website. Users tend to believe that the site is “clean” because their anti-phishing toolbar did not react to it.

It is however relatively easy to find out if the current website is fake.

You need to take a look at the url in the address bar. If it is not the original address leave it immediately.
Check if it is using https instead of http. If it is using http leave the site immediately.
If it is using https check the certificate.
If the site is only using flash leave it.
Never follow links in emails (unless you know the person)
Never follow links in chats (unless you know the person)

You should immediately contact the supposed owner of the website and ask for advice.

Social Phishing

Phishers use other means of getting sensitive data from users. We all know that we should contact the company if we have doubts about a website. What if you would receive a mail from your bank asking you to call them back because there was a security breach ? Would you call them back ?

What if the number was redirecting you to someone in China speaking fluent English ? Would you give him the information he would be asking for to verify´that you are the customer ? Sir, we need to make sure that you are indeed our customer. Could you please supply your credit card information so that I can verify your identity ?

This is not a huge market yet but it will grow over time.

Tags: flash-phishing, hacker, Hacking, phishing, social-phishing

gHacks technology news » phishing

Facebook Phishing Scam In The Wild

Related posts

SafeOnline Protects PCs Even If They Are Infected

Related posts

Twitter Account Suspended? Be Careful What You Post

Related posts

Phishing Protection Tips

Related posts

Test The Phishing Protection In Firefox

Related posts

Hotmail Phishing Attack: Time To Change Passwords

Related posts

Help the fight against phishing with Phishtank

Related posts

Another Report Finds Internet Explorer 8 To Be The Most Secure Web Browser

Related posts

Truemark Email Identification

Related posts

Add Hostname To Firefox Titlebar

Related posts

Web of Trust: collaborative online security

Related posts

New Phishing Emails Emerge

Related posts

PayPal to Block Unsafe Browsers

Related posts

How Stolen Credit Cards are sold

Related posts

Free McAfee VirusScan Plus 2008

Related posts

New Phishing Mail Tactics

Related posts

How to defeat Phishing

Related posts

Ingenious PayPal mimicing spam

Related posts

Free Phishing Protection with Delphish

Related posts

Introduction to new phishing techniques

Related posts