That’s what has happened in the case of Ramnit, a malicious worm that has been spreading via executable and HTML files since April of 2010 (yes, almost two years ago). Security firm Seculert recently noticed that it has begun to target Facebook users, stealing their login credentials. Most of the users targeted so far live in the United Kingdom and France.

While it’s impossible to know exactly why these logins were stolen, it’s fairly easy to guess. Compromised Facebook logins are an excellent way to spread malware or conduct phishing attacks. A simple wall post with a shortened URL can easily direct the friends of a compromised account to malicious websites. This can allow malware to spread or trick users into giving up personal information.

It’s also possible that victims with compromised accounts could have them used to grant access to other services. Many people use the same password for Facebook as they do for other sites including email and even online banking. In addition, most people list their employers on their profile, which opens up the possibility of attacks against governments and corporations.

Consider this a reminder that you shouldn’t use the same password for all your accounts. Also, it’s wise not to click through links on social networking sites without using a website or browser plugin that can reveal the link’s full URL, making it possible to verify that it goes where it claims.

Source: Ars Technica

Victims are hooked by an official-looking fake email informing them they need to update their billing information with Apple. A link that appears to point to the Apple Store is included, but when clicked it re-directs users to a fake website that is apparently hosted on its own server.

To make matters worse, the fake site looks like a legitimate Apple login page. Only a support number that begins with a 0 instead of a 1 might alert users that something strange is going on. The site otherwise appears professional and is free of the grammar issues and improper or missing images that often give away such facades like this.

So what can you do to protect yourself? You could just avoid clicking email links, though that may not always be practical. Another idea is to pay attention to your URL bar to make sure that the proper URL appears when you visit a site. In the case of the fake site, the URL shows the IP address of the scammer’s server rather than the real Apple Store address. You could also use a security suite with built-in anti-phishing features.

For more tips on how to avoid these sorts of attacks, check out Danny’s article on common tactics that can help you avoid being phished.

Source: CNET

A “phish” is a term for a scam website that tries to look like a site that you know might well and visit often. The act of all these sites trying to steal your account information is called phishing. While it’s very easy to spot some sites as a phish, others aren’t nearly as easy.

Here are four different anti-phishing methods you can use so that you don’t fall victim to phishing.

1. Use a Custom DNS Service

You need a DNS resolution service so that you can access all the sites that you go to. Your computer doesn’t automatically know where Facebook is (as far as its Internet address, or IP address, goes), so it needs to ask a DNS resolution service for that IP address. The good thing is, all Internet users have this service, thanks to their internet service provider. The bad news is that’s all they do.

Aside from name resolution, the DNS servers at ISPs do nothing else. However, there are some custom and independent DNS companies that do more than just name resolution. They can also filter sites based on content and malware/phishing concerns. There are many out there that can do this, but the most popular one (last time I checked) is OpenDNS.

2. Use Your Browser’s Phishing List

Did you know that modern browsers offer a phishing list? The browsers check the site you’re visiting against the list to see if it’s possibly a phishing site. If it is, your browser will start freaking out about it in your face like a good boy. For possible phishing attacks, why not throw out a big red page to warn you?

3. Use Sites To Check Links

In case you’re presented a link but you’re not sure about clicking it, you can copy and check it on a number of different sites. These can tell you whether there’s something bad about these sites, including malware and phishing. Where can you find all these wonderful sites that do this for you? Try checking out one of our articles on the subject.

4.  Use Your Own Ninja Skills

This may sound like useless advice, but using your own skills to detect phishing sites can go a very long way as well, and may even protect you from phishing sites that haven’t made it onto any lists that would throw an immediate flag. There are a few things that you should look for to see if you’re being faked:

1. Look for a secure connection. This is usually identified by a green area in the address bar, along with https in the URL.
2. Look at the domain of the URL. If you don’t know what the domain of a URL is, here is an example: The domain of MakeUseOf is makeuseof.com, while the domain of PayPal is paypal.com, and so on. Look to see that the domain is as it should be, and not something bizarre.
3. Look at the site itself. If it doesn’t look exactly like the site you’re always used to, it may be a scam site. You can double check by opening a new tab and visiting the main page of the site you think you’re on (if possible). If they’re quite different, then you’re more than likely dealing with a phishing site.

Now that you’re equipped with these tips, you can take this handy little Phishing Quiz provided by OpenDNS where you are presented with screenshots of some websites. Some are real, while others are phish. You can take the quiz and see how well you do. Afterwards, you can see why a certain site is a phish and not real.

Conclusion

With these anti-phishing tools and tips, you are well equipped to spot phishing attempts and avoid them. Therefore, you’re much safer and your account information will remain private. If you feel enough like a pro, go and spread the word! The more people know how to spot phishing attacks, the better off they will be while surfing the internet.

How do you detect phishing sites? Do you think it is getting easier or harder to identify them? Let us know in the comments!

Image Credit: Shutterstock

Similar to real-life fishing, phishing scams aren’t always best when they rely on advanced tactics, but there are many new techniques motivated by social networks. So what is phishing, and what should you be wary of?

The Basics of Phishing

According to Microsoft’s Safety & Security Center, phishing can be summed up as:

“A type of online identity theft. It uses email and fraudulent websites that are designed to steal your personal data or information such as credit card numbers, passwords, account data, or other information”.

In other words, phishers are the Loki of the Internet. They’re tricksters. Often, the techniques used by phishers have absolutely nothing to do with exploiting zero-day threats. Instead, they exploit human psychology.

There is one point on which I disagree with Microsoft, however, and that’s their description of phishing as “a type of online identity theft”. This isn’t always the case. As I’ll explain in some examples of recent scams, phishing tactics are often used to simply harvest data or to trick people into purchasing a product.

Traditional Phishing

In many cases, Microsoft is correct. Many phishing attacks are attempts to steal personal information. Often, they do so using link manipulation and website forgery. The traditional example is an email that seems to come from a legitimate source, like your bank. It claims that there’s been some problem, or perhaps offers you a lower interest rate on a credit card. All you need to do is log in via the link in the email, which appears legitimate.

But it’s not. The link has been manipulated to look correct, but it actually redirects you to a forged website. Once you enter your login information, the phisher has it, and can use it to log in and use your account. Sometimes, the attack will go further and request you to fill in personal information like your social security number, credit card number, address, and so on. Identity theft is just a hop, skip and a jump away from there.

Traditional phishing can be combated by refusing to follow links in such emails. If you receive something from your bank that claims you need to log into your account, simply go to your bank’s website by entering the URL manually and then log in. In fact, some banks and other organizations no longer even send links to users precisely because doing so makes phishing attacks more effective, as users become confused about what is and is not legitimate.

You can also combat phishing using an Internet Security suite with anti-phishing features. These monitor your browser and look for signs that a website is a forgery. Extensions like Web of Trust can also be effective.

Phone Phishing

Within the last few years, phone phishing has become a popular tactic. I myself received a phone call last month claiming to be from the Federal Credit Union Administration, which said my debit card had been locked due to potential identity theft. All I had to do to rectify the situation was give them my debit card information so my account could be verified. Of course, it’s a total scam, and one that’s been going on for years. If you enter your information, it can easily be used for fraudulent purchases.

There’s no software solution to this particular threat, so you simply have to be skeptical. If you receive a call from an organization that wants personal information, call them back at a publicly listed number, rather than the one provided for you in the voicemail.  Phone phishing also tends to give itself away by being vague – usually, it won’t claim to actually be from your credit card company or bank specifically, but something more general, such as the “Federal Credit Union Administration” call I received.

Social Network Phishing

The rise of social networks has given phishing new life. After all, social networks are all about sharing. It’s not at all unusual for a friend to post a link to a nifty article, so users are less likely to be skeptical, and more likely to click on a phishing link.

That’s the bad news. The good news is that phishing on social networks usually isn’t as severe. Usually, the deception will be something like the recent Steve Jobs’ death scams, which are simply looking to harvest email addresses or send people to affiliate links. You might be annoyed by additional spam, but that’s it.

Still, some of these attacks can be fairly harmful. Banks have Twitter feeds and Facebook pages too, and fake ones can be used to try and lure users to forged websites, just like a bogus email. These accounts can be hacked, too. The Bank of Melbourne experienced this, although as is often the case with phishers, the messages sent by the compromised account weren’t of high enough quality to fool many people.

Phishing on social networks can be combated the same way as phishing through email. Security software and extensions can help. You can also use a link preview extension to see if an abbreviated link is sending you where it claims.

Conclusion

Phishing will always exist, because there will always be ways to trick people. It’s easy to look down upon the victims as being stupid, but often the people who fall for the tricks simply lack proper education about computers, or are in a situation that compromises their judgment (don’t check your email while drunk, or excessively tired).

In this case, knowledge is power. With skepticism and a few security tools, you can avoid phishing threats and shut down one of the most common methods of identity theft.  Have you been a victim of phishing?

Image Credit: Pro Team Sport Fishing

As a general rule of thumb: if it looks too good to be true, it probably is – and this advice is well worth remembering.For extra peace of mind you can also do your own research and investigate the current threats yourself.

The more prepared you are, the easier you’ll be able to spot a scam and steer clear – so without further ado here are some resources to keep you, your friends and family wise to online fraud.

USA.gov – Consumer Frauds and Scams

Probably the best governmental resource for US citizens concerned about fraud, this section of the country’s main online political portal contains a bounty of information about scams in the wild. There is plenty of in-depth, easy-to-understand information on a huge variety of schemes designed to trick and steal.

News is provided courtesy of other sources at the foot the page, and while more regular updates would be nice, the service is a fantastic resource for anyone concerned that they have been hit with fraud. Detailed descriptions of known scams will also help you identify potential dishonesty.

LooksToGoodToBeTrue.com

The aptly named LooksToGoodToBeTrue.com tracks known scams and reports the findings in their Action Centre. The website comes recommended by several government portals (including USA.gov above) and contains more advice for those concerned about fraud.

On a very human level is the Victim Stories section which invites victims of fraud to share their experiences in the hope of raising awareness. The website also has a File A Complaint section which provides the links to several US government department including the FBI-run Internet Crime Complaint Centre.

419 Legal

Named after the 419 scams that once ran rampant online, 419 Legal is in fact a message board where the active community reports on scams, phishing and general fraudulent schemes. Due to the fact that it’s a community and not a news agency or government body, reports are a lot more frequent than on comparable sites.

As well as the Scam Alerts forum where users submit their own reports, there is a General News section, 419 News and archives of past scam email templates to help identify potential scam emails. 419 Legal is a fantastic site with a supportive community and years of archived scam identification techniques.

ActionFraud

ActionFraud is the UK’s national fraud reporting centre, and contains plenty of information that resonates not just in the UK but all over the world. If it’s alerts you’re after then the News & Alerts section contains a run-down of the latest known threats.

As well as news, the rest of the site serves as a useful portal for anyone who has been hit by or is concerned about the dangers of online scams. As well as being able to report the fraud, victims can find out information about what to do next, who to contact and future prevention.

MillerSmiles.co.uk

Despite being a UK-based site, MillerSmiles is a definitive resource for phishing and email scams wherever you are in the world. As well as the latest reports of known scams the website conducts a weekly analysis of all reports submitted.

It is possible to subscribe to alerts via RSS, submit your own scams and search the database of past incidents. The website also organizes threats by company, so if you have received a dodgy looking email from your bank, PayPal or email provider it’s easy to check it against the list.

ScamWatch.gov.au

The final resource on this list comes all the way from Australasia and is a joint effort between the governments of Australia and New Zealand. The ScamWatch Radar keeps track of known threats down-under and it is even possible to subscribe via email for alerts in your inbox.

The rest of the site is packed with helpful advice regarding every kind of scam you can think of, and there is an area to report local scams.

Conclusion

Even if the sites on this list aren’t specific to your locale they can still help identify known scams, phishing attempts and other fraudulent correspondence. If you do receive a suspicious email requesting personal or financial information then alarm bells should always ring. Your bank won’t ask for that information in an email, and if they do then you should always contact a local branch first. Bargains at unbelievable prices usually aren’t bargains and if you use online dating sites then never hand over money to someone you hardly know, no matter how nice they seem to be.

Good luck out there, it’s a big bad Internet!

Have you been scammed, defrauded or had information stolen? Do you know any other good websites that cover the latest frauds and scams? Share your links and experiences in the comments section!

Image Credit: Shutterstock