PHISING ATTACKS GET PERSONAL BY KIM KOMANDO

Phishing attacks get personal


You know to watch for phishing attacks. You’re cautious and use a good spam filter. But phishing messages still get through. And these messages are more dangerous than ever.According to Cisco, almost 200 billion spam messages are sent daily. They have one thing in common. They want your money. Few are legitimate.Most computer users can spot phishing messages. Unfortunately, cybercriminals have become more sophisticated, too. Targeted phishing attacks account for 0.4 percent of spam messages. That may seem minor. But it’s 800 million messages a day.
For example, you receive a message purportedly from your ISP. It greets you by name. Your billing information is outdated. You must click a link to update your information.This is the type of targeted attack you will see in 2009.Spear phishing on the riseSmall phishing attacks don’t receive much publicity. And personal information increases recipients’ trust. So, small, targeted attacks are often more lucrative than large ones.Criminals can pull information about you from public sources. Or, someone may be tricked into disclosing it. Either way, it is used to tailor the messages.You won’t see a long list of recipients in targeted attacks. You may also notice a difference in the sender’s address.Criminals used to spoof e-mail addresses. Spoofing is a quick, easy way to cover tracks. But spam filters can spot questionable e-mail addresses.Criminals now create new accounts with reputable providers. Or, they hack users’ e-mail accounts. This helps criminals get past spam filters.People who do business with financial institutions are still prime targets. But small or regional institutions are also targeted, along with ISPs and alumni organizations.Phishing messages generally request your personal information. They may also instruct you to install a security update or browser plug-in. Do that, and kiss your personal information goodbye.But you may not need to take action. Perhaps you haven’t installed updates. Criminals reverse engineer updates to understand the flaws they fix. Then they start probing machines for it. Keylogging software could be installed on your machine. Or, your computer could be added to a botnet.Criminals get socialCriminals aren’t just targeting e-mail accounts. They’re also turning to social-networking sites.

For example, a recent worm infected Facebook users’ machines with malware. Compromised accounts were then used to send spam.There’s also the case of College Prowler. It created more than 300 Facebook user groups. The company was probably gathering information for marketing purposes.College Prowler may be legitimate. But this case underscores one thing. Marketers and criminals alike will do anything to get your data.Be vigilantYour best defense is vigilance. Only a company run by dummies would request personal information via e-mail. So it is unlikely, but possible.Let’s say you get such a message. Hold your mouse over any links. You’ll get the real e-mail address. So, does your bank have a server in Bulgaria? Probably not. Better delete that nice e-mail.You could receive a message purportedly from your boss. Why would he need your Social Security number at 3 a.m.? And why does he want you to reply to Outer Mongolia? At the least, talk to him before answering.Standard security measures are still important. Keep your antivirus and anti-spyware software updated and running. Install Windows updates when they’re released. Criminals are exploiting disclosed bugs faster than ever.


Use a spam filter. You’ll find links to free spam filters and security software at Komando.com/news.But remember, you’re never 100 percent safe. Approach requests for personal information carefully. Don’t let criminals take advantage of you.And do your friends and family a favor. Forward this column to them now. Wish them a less spammy 2009!