Phishing: Examples and its prevention method

The webopedia define Phishing as the act of sending an e-mail to a user falsely

by claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the use information.

Phishing can be called a synonym to actual fishing. Scammer throws in bait by sending you an email, pretending to be a representative of the company. He wastrying to get sensitive information from you. If you eat the bait, the scammer will obtain your username and password, credit card information or whatever you have sent him.

There are a several examples of phishing that have been identified.

Firstly, we are going to look at the example of ‘eBay phishing.’ Nowadays, sophisticated and clever scams are arising with javascript. eBay allows javascript, which is a programming language to be implemented into the templates of auctions, giving scammers opportunities to scam right on ebay.com! You may get scammed even in the original ebay site itself . The scammer uses a fake feedback in order to make buyers believe he has a reputation at eBay. Look at this:

A fake feedback score of 120, fake paypal buyer protection button and power seller!

The true feedback:


Bellow is also one of the example from ebay:

This genuine looking email is a masquerade. As soon as you clicked on “respond”, you were directed to an exact clone of eBay and your personal information was stolen. These messages come in different styles and writings.

The second example is phishing emails and scam attacks. In this example you are informed of a payment made by you. Though the email is very nicely formatted and looks quite like a legitimate Paypal email, it does not included your name. Besides that, if you mouse point over the "Item Title" link, the URL points to an I.P. address but not to the Paypal web site, which is http://www.paypal.com/.

The Third example would be Citizens Bank.The phish site looks like a simple ligitimate survey, except the demand for a debit card number.The debit card information is demanded with the explanation that 'this is where we will credit your $5 reward'. However, the real bank would normally send you a special page, linked to your account as they already know who you are, and not demand this information via an unsecured session

Many users are suffering from phishing attacks. The attacks of the Phishing are increasing day by day on to the computers. Prevention is the best approach and you can prevent yourself in many ways.

Keep Your Email and Instant Message Addresses Private
The best way to keep yourself from being tempted to respond to a phishing scam is to prevent them from landing in your email box in the first place. You may find it useful to have a separate email address for financial institutions, one for trusted friends and family, and one for general or public use. Many email providers will allow you to redirect emails from each of these different addresses to one account to minimize the inconvenience of checking each account. Do everything possible to keep the address you use for financial transactions as private as possible.

Password Privacy

The individuals will be able to get the services an information by rendering a trusted institution. Sometimes you might have received an email from back about the confirmation of your password. In this case you should verify from the email sender who they are. It might be some virus which will get your personal data by automatic installation.

Immediately Report Suspected Phishing Contacts
If you do receive a message you suspect to be a phishing scam, call the customer service phone number right away to confirm whether you've received an actual message or not. In addition, almost every bank and credit card lender has a website where you can report suspicious emails and instant messages. Typically, they will ask you to fill out a simple form that will give them enough information to trace the origin of the perpetrator.

Education

It is important for the computer users to recognize the phishing and other attacks in the form of fraudulent emails and websites. If you are receiving these email then you should report other as well to prevent from these emails. You can contact the Anti Phishing Working Group who can guide and you and recommend some suggestions for your help.

It is a good thing to monitor credit changes along with taking measure to prevent phishing attacks. You can save yourself from severity of problems with quick response to credit card response.

As a conclusion, we should act as the role of 'phisherman' to protect ourselves from being the victim.

References:

1. http://onlinebusiness.about.com/od/onlinebusinessglossary/g/phishing.htm?rd=1
2. http://www.webopedia.com/TERM/P/phishing.html
3. http://www.bustathief.com/what-is-phishing-ebay-phishing-examples/Paypal
4. http://www.webdevelopersnotes.com/
5. http://www.antiphishing.org/
6. http://security-antivirus-software.suite101.com/article.cfm/how_to_protect_yourself_from_phishing_attacks

The Application of 3rd Party Certification Programme in Malaysia

VeriSign Inc. is the trusted provider of Internet infrastructure services for the networked world. It provide SSL ( the leading Secure Sockets Layer (SSL) Certificate Authority enabling secure e-commerce, communications, and interactions for Web sites, intranets, and extranets) identity and authentication, and domain name services that allow companies and consumers all over the world to engage in trusted communications and commerce.

VeriSign is part of the Standard and Poor’s 500 index and manages two of the world’s 13 Internet root servers, a.root-servers.net and j.root-servers.net, considered national IT assets by the U.S. Federal government. Besides that, VeriSign protects more than one million Web servers with digital certificates, protecting the majority of secure Web sites on the Internet, including 93% of the Fortune 500 sites. The VeriSign Secured® Seal is displayed by over 90,000 domains in 145 countries and viewed over 150 million times every day. There are over 2.3 million VeriSign Identity Protection Credentials have been issued to use for strong authentication.
Whereas, MSC Trustgate.com Sdn Bhd is a licensed Certification Authority (CA) operating within the Multimedia Super Corridor. MSC Trustgate was incorporated in 1999 to meet the growing need for secure open network communications and become the catalyst for the growth of e-commerce, both locally and across the ASEAN region. At present, MSC Trustgate has 12 million in paid up capital.

Trustgate is licensed under the Digital Signature Act 1997 (DSA), a Malaysia law that sets a global precedent for the mandate of a CA. As a CA, Trustgate’s core business is to provide digital certification services, including digital certificates, cryptographic products, and software development. Trustgate is working together with VeriSign Inc. in delivering the service of identity and authentication in Malaysia.

On 20th October 2008, VeriSign, Inc., announced that it has extended its existing reseller relationship with MSC Trustgate Sdn Bhd by entering into an additional agreement. Their services offer businesses strong authentication for protecting the online identities of their customers, business partners and employees. This is because identity theft is one of the fastest growing crimes in Malaysia, with personal information, such as credit card and NRIC numbers, netting criminals thousands of Ringgit in a very short time frame and his has become a reported concern by 78% of Malaysians.

One of the products that are offered by Trustgate is MyKad PKI (MyKey), where Malaysian government has put in place a smart National Identity Card (“MyKad”) for every citizen. MyKad with PKI capability allows its holder to conduct online transaction with government agencies and private sectors. MyKey is the MSC Trustgate.com Sdn. Bhd.'s Digital Certificate which is loaded into MyKad. It is governed by Malaysia Digital Signature Act 1997 and is accepted by the courts of law in Malaysia. It is class 2 certificate and has 1024-bit key length.

Besides that, Trustgate also offers MyTRUST for Mobile Signature. It can turns a SIM card into a Mobile Digital Identity for secure mobile banking and other financial services. Mobile digital signature provides non-repudiation on transactions under the Digital Signature Act, 1997. It runs on Wireless PKI platform and Mobile Operator infrastructure. PKI-enabled SIM cards are preloaded with MyTrust application and a digital certificate from a licensed Certification Authority. Users are able to digitally sign any transaction with ease and convenience via their mobile phone.

Other than that, there are also CryptoSuite. Everyday businesses are exchanging thousands of files and documents over the unsecured network.Some documents contain highly confidential information such as trade agreement, pricing information, business strategies, or even personal data. Sending unencrypted file is just like sending postcard, it can be easily read by anyone.

CyptoSuite from MSC Trustgate allows sender to secure their files and documents with a single-click of the mouse button. This utility uses digital certificate to encrypt the file so that only the intended recipient can only decrypt it using their private key. The encrypted file can be safely stored in any medium or send over the less-secured web-mail.

References:
http://www.verisign.com/ssl/ssl-information-center/index.html
http://www.msctrustgate.com/
http://littleangele-commerce.blogspot.com/2009/02/application-of-3rd-party-certification.html
http://ecommercesite.wordpress.com/2008/06/21/the-application-of-3rd-party-certification-programme-in-malaysia/

The Threat of Online Security : How Safe Is Our Data

Nowadays, online security has become an enormous concern to people surfing the Internet and to people who are conducting business on the world wide web. Online security threats have continue to increase in number and sophistication ways due to the many people online via dedicated broadband connections and some folks remain online 24 hours a day. In addition, they propagate faster and more difficult to detect. We have all heard reports of and been affected by online viruses spread through emails, online business scams, online identity theft, and online sexual abuses. So, online security really refers to many aspects of out new online world.

Types of Online Security Threats

Computer Viruses and Worms
Everybody has heard about computer viruses and worms that can infect our PC and wreak havoc on our operating system or files, but very few of us have completely escaped from these forms of online threats. New forms of these threats emerge every day. These viruses and worms are insidious little programs that can take control of our system or email service and cause great annoyance if not damage.

Computer virus is a kind of malicious software written intentionally to enter a computer without the user's permission or knowledge, with an ability to replicate itself and thus continuing to spread. Some viruses do little but replicate others can cause severe harm or adversely affect program and performance of the system. Most common types of viruses are Resident Viruses which will permanent dwells in the RAM memory, Boot Virus which will affects the boot sector of a floppy disk, Macro Virus which will infect files that are created using certain applications or programs that contain macros, Polymorphic Virus which will encrypt or encode themselves in a different way every time they infect a system, and so on.


Meanwhile, computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computer on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or devour files on a targeted computer.

Source:http://support.microsoft.com/kb/129972


Spyware
Spywares began to show up on the Internet round about 1995, when the term was used to talk about hardware used for spying on other computers.

Today, Spyware attacks are becoming the most common online security threat that faced by most internet users. A Spyware is a software that installs on our computer via the Internet without our knowledge or consent. What is worse, is that the software will often record our activity in the Internet, record our personal information, take over some or a lot of our bandwidth on the Internet that making our Internet connection slow, direct us automatically towards websites where we might find oursleves downloading even more viruses and spywares and also divert advertising related revenues to another third person.

Personal details like bank account and credit card details especially those who are a user of e-banking facilities can become extremely vulnerable. These personal details can be used for identity theft purpose as well.

There are many means for a spyware to get into our computer. Sometimes, these spywares are part of some softwares which are available for download on the Internet. This is called 'piggybacking'. The spyware comes bundled up with the software and when we install the software, the spyware install itself on the computer. Usually, spyware are part of shareware programs that are available on the Internet.

Source:http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci214518,00.html


Identity Theft
Identity theft is a serious crime affecting millions of people a year and accounting for the loss of billions of dollars every years as well. It occurs when someone uses our personal identifying information such as our name, social security number, or credit card information to pretend as us. The identity thief does this for his own personal gain at the expense of his victim.


An identity thief may use our information to:

• Open a new credit card, phone, or utilities account in our name and then run up the bills without paying by them.
• Open a bank account and write bad cheques in our name, apply for a loan in our name, or use our bank information to drain our account.
• File a fraudulent tax return or apply for government benefits in our name.

There are several ways that identity theft will happen towards the online users. For example, Phishing, this is when online user was contacted via email or phone by someone that asking them to "verify" specific information related to their credit card, pay pal or bank account. The other examples are that stealing mail, computer viruses, intercepting data from insecure networks or sites, data breaches at companies that have your information, and so on.

Source:http://en.wikipedia.org/wiki/Identity_theft


Computer Hacking
Computer hacking is basically an alteration of computer hardware and software in order to accomplish a goal which is outside of the creator's original purpose. Computer hacking is both art and science for the people who try to break into protected or unprotected networks.


Generally, hackers tend to steal personal information, change a corporation's financial data, break security codes to gain unauthorized network access, or conduct other destructive activities. Computer hacking invariably involves some degree of infringement on the privacy of others, breaching the network security, and thus causing damage to confidential files, web pages or software. In addition, it may also involve downloading or alteration of files through unauthorized access.

Basically, there are 3 types of hackers. A white hacker is the one who breaks security for non-malicious purpose. These purposes may range from testing the security system, to finding the major loopholes in the network. The second category includes the black hat hackers, who generally subvert computer security without authorization, with the help of viruses and various other hacking tools. These hackers use technology for vandalism, credit card fraud or identity theft. The third category includes grey hat hackers, whose domain of work lies mid-way between black hat and white hat hackers. They are ambiguous ethics and work on the borderline of legality.

Source:http://www.wisegeek.com/what-is-computer-hacking.htm


Gumblar
Gumblar is a complex new malware attack which is making way into certain websites and setting infection records. It carries a dangerous payload and attacks by injecting malicious JavaScript codes into certain components of the targeted websites. An online user can become a victim of the attack simply by visiting one of the infected pages.

Once the website becomes vulnerable, the malware makes changes in the user's access credentials and the site can then be accessed by the attacker even after the user has changed passwords. The malicious code is difficult to detect as its scripts are altered from site to site and even from page to page. So, it stop the administrators from automatically searching out and deleting the scripts.

Source:http://www.v3.co.uk/vnunet/news/2242317/gumblar-attack-explodes-web


Trojan Horse Virus
A Trojan Horse virus is a common yet difficult to remove computer threat. It works by hidding within a set of seemingly useful software programs. Once executed or installed in the system, this type of virus will start infecting other files in the computer.

A Trojan Horse virus is also capable of stealing important information from the user's computer. It will then send this information to Internet servers designated by the developer of the virus. The developer will then be able to gain a level of control over the computer through this Trojan virus.

A Trojan Horse virus can spread in a number of ways. The most common means of infection is through email attachments. Once the user open the attachment, the Trojan Horse virus immediately infects the system and performs the tasks. Another method is via chat software such as Yahoo Messenger and Skype. Moreover, it also can spread by sending copies of itself to the people in the address book of a user whose computer has already been infected by the virus.

Source:http://antivirus.about.com/b/2006/05/31/whats-a-trojan-horse-virus.htm


4 Cardinal Rules

"How safe is our data?", this must be the most common question that will pop up in all online users' mind. Based on the 6 types of online security threats that we have discussed above, here are 4 cardinal rules that we must follow in order to protect our data being safe from all these threats.

Rule 1 :
ALWAYS keep your anti-virus software up-to-date.

Rule 2 :
NEVER open an email attachment unless you know what it is, even if it is from someone that you know and trust.

Rule 3 :
NEVER give out personal information, credit information or password in chat rooms or in emails and do not provide credit card information online unless you can verify that the site is a secure site.

Rule 4 :
NEVER download executable files from untrusted sources. These files often contain damaging spyware or adware, and they can also contain other forms of malicious programs.

Source:http://www.massachusetts.edu/SecurityAwareness/12basicrules.html

How to safeguard our personal and financial data

Internet is a public, cooperative and self-sustaining facility that allowed people access to get information, online services such as financial transaction and etc. However, this becomes many people rely on Internet to do financial transaction such as online payment. So it required provide some private and personal information to do every transaction. Therefore, it tends to become more risky because we have revealed our information to others. And this information can be stolen by hacker.

So we should take some activities to safeguard our personal and financial data. There are some ways to protect our personal and financial data:


1. Do not reveal personal or private financial information in public. Do not used public computer such as library, Internet café and school computer lab to log on to check your bank balance and shared information with others. If have use public computer, make sure have to close the browser window. It will avoid someone to access your private or personal information.

2. Install a firewall. A firewall is a software program designed to allow good people in and keep bad people out. Nowadays, most new computers come with firewalls integrated into their operating systems. But, if you have an older computer or use dial up, you may need to buy a firewall separately and install it yourself.

3. Install and update antispyware and antivirus programs. There are many antispyware software such as Microsoft and numerous application vendors offer users regular updates to existing antispyware programs, so be on the lookout. As for antivirus protection, Symantec and Norton antivirus are popular choices.

4. Update your browser. On time updating your browser can help plug up security holes, so make it a habit.

5. Using strong password. Strong password can prevent someone to access your personal information and protect you to reveal private data.

6. Don't open mystery attachments. Attachments can contain viruses and links can lead unsuspecting users to dummy sites where they are asked to input financial information. So do not open an attachment or click on a link sent to you by an unknown party.

7. Look for "locks." How can you tell if your financial site is really secure before you log on? The Web address should start with "https," instead of "http," says Weston. Also, look for small lock icon in the lower-right corner of the browser window.

These several ways can prevent you to reveal information to others. So user must careful when using computer to do financial transaction and etc.

References:

1. http://ecommercesite.wordpress.com/2008/06/20/how-to-safeguard-our-personal-and-financial-data/
2. http://finance.yahoo.com/banking-budgeting/article/103893/Six-Ways-to-Safeguard-Your-Online-Assets
3. http://amazingcommerce.wordpress.com/2008/06/18/how-to-safeguard-our-personal-and-financial-data/