Phishing

Recently, phishers have been creating public documents and forms via cloud computing resources to harvest email addresses and associated passwords. Cloud computing allows people to access, create, and save personal files remotely without downloading software or purchasing licensing rights, as with a word processor.

Internet security firms uncovered a recent bout of spam email messages warning the recipients that they have exceeded their email account’s storage space. They are then instructed to follow a link to confirm their account’s validity by entering their email address and password into a Google Doc. Failure to comply will allegedly result in the closing of their email account–an age-old tactic built in to phishing ploys.

The Google Docs that harvest the personal information were created via cloud computing resources, for free. The advantage is an immediate air of legitimacy. Unsuspecting victims see a real Google Doc, with valid links to information about the program and cloud computing resources right on the page. The phishing ploy is located at the recognizable address spreadsheets.google.docs. Even somewhat savvy users can be fooled, as these cloud pages are displayed at an https:// address, which is for many web users a signal that the page is safe and secure.

Those who enter their email address and password into the provided fields on the Google Doc form and press submit send this information directly to the phishers.

Common sense should still win out if you receive one of these emails leading to a phisher’s cloud page. The emails contain most of the hallmarks of spam. They have typos, misspellings, and grammatical errors. The emails are impersonally addressed to “User,” “Account Holder,” or other vague terms. Likewise, they include impersonal signatures such as “System Administrator” and “System Administrator Center.” Links contained in the body of the email go to a different domain than the email was sent from.

Keep in mind that no email service providers will request that you enter your password anywhere other than the sign-in page to your account. Also, they won’t make random threats to close your account for exceeding a storage limit or other ridiculous reason.

It’s now important that the same skepticism you apply to email messages be employed when visiting web pages hosted on cloud computing servers, too. Certainly this is only the beginning of a new online security concern. Spammers, phishers, and other cybercriminals will undoubtedly continually find new and creative ways to defraud careless and unsuspecting web users via cloud computing resources.

Be the first to comment

Spear Phishing in Workplace Email Accounts

by Christopher on June 19, 2011

Spear phishing, or targeted phishing, typically conjures up attempts by spammers to get user names and passwords that provide access to money, credit card numbers, or financial information. However, spammers who directly target employees in a company are often looking for more indirect benefits.

If not financial information, what might a Spear Phishing spammer be seeking? Sometimes, it’s deeper access into company files. Sensitive information obtained can be offered for sale to competitors. A list of your customers or clients can be compiled, complete with contact information, buying habits, and other private data. Company email accounts may be hijacked for use in sending more spam.

Often though, initial targeted phishing emails sent to workplace accounts are simply a first step to more sophisticated and devious phishing ploys. If a spammer can collect private information from company memos or other correspondence, he can create new emails that seem legitimate for what they know. The spammer can even use real company email accounts to send them. In addition, once one email account is made available to a spammer through targeted phishing, it’s likely the same spammer will have access to an entire directory of company email accounts with which to work. Now a spammer is ready to do real damage with further spear phishing efforts.

When an employee is successfully scammed by a spear phishing attempt, it can put the whole company at risk, jeopardizing private information that can be used in an array of nefarious ways. The personal or financial information of a company’s customers or clients may be betrayed, which is a violation of trust that can have serious legal and public relations ramifications.

Another often-unforeseen risk for a business successfully targeted by a spear phishing spammer is blacklisting and reputation damage. If company email accounts are adopted for originating outgoing spam, spam filtering technology will soon catch on. Some of the various spam filtering technologies keep track of email account activity to determine whether they are trustworthy points of origin. A spammer using business email accounts can get the company’s IP addresses or domain blacklisted as a spammer or otherwise identified as untrustworthy. The result is that legitimate emails from the company–many of which are undoubtedly essential to daily operations–will be blocked by the spam filters of the recipients.

While web-savvy employees are likely to identify many spear phishing messages correctly, spammers are getting more sophisticated and finding new ways to make their scams appear more legitimate. This is an increasing concern as more businesses avail themselves of social networking tools and websites that can be studied and even hacked for useful information. All it takes is one employee to fall for one targeted phishing attempt. From there, the effects can easily snowball.

Smart companies are educating all employees about the risks of spear phishing, but because of the dangers and because all it takes is one slip-up on one person’s part, there is mounting pressure for companies to simply prevent phishing spam from ever reaching their employees’ inboxes. Sophisticated filters that use a variety of methods to identify spam are no longer just a way to save aggravation, time, and money; in today’s spam climate, they are a crucial security investment.

Be the first to comment

Recent Spam Phishing Trends and Targeting Free Online MMORPG Users

June 10, 2011

With the release of the Kaspersky Lab May 2011 internet security report, we’ve seen a slight dip in the use of phishing ploys in spam email messages. While the global spam rate rose 2.1 percentage points from April to May, to 82.9 percent of all email traffic worldwide, phishing attempts dropped to 0.02 percent of […]

Read the full article →

Imposters Send Spam from Fake Apple Online Store

June 7, 2011

There’s a new presumed phishing campaign underway involving spam email messages alleging to be from Apple’s online store. The emails contain links that take you to a dummy website set up to closely resemble the website from which Apple users can purchase the company’s products. However, the fake website’s offerings are apparently limited to software. […]

Read the full article →

Sony Struggles with Online Security Shortcomings

May 22, 2011

In the wake of a Sony PlayStation Network security breach and frequent security-related network outages, Sony is again getting bad press due to inadequate online security measures. Recently, PlayStation Network users have faced significant downtime as Sony IT staff struggles to close network vulnerabilities. Now, a phishing website targeting customers of an Italian bank has […]

Read the full article →

Spear Phishing on the Rise Following the Epsilon Breach

May 3, 2011

On March 30, 2011, the databases of the marketing firm Epsilon were successfully hacked by cybercriminals. The company handles email campaigns for many of the world’s largest corporations. In the breach, hackers got their hands on the full names and email addresses of basically the entire roster of customers and clients of more than 100 […]

Read the full article →