![\"\"](\"http:\/\/blog.zoha-islands.com\/wp-content\/uploads\/2017\/11\/phishing03_web-300x169.png\")
<\/h2>\n<\/p>\n
Phishing, the art of getting users to click on malicious links in bogus emails, is the favorite tool of scammers, by far. The reason is, phishing works. Scammers are getting better are slipping their phishes through spam filters and past anti-malware software. Ironically, the successful campaign to raise users\u2019 awareness of online security hazards is making phishing more successful. Read on to learn about the latest phishing developments…<\/p>\n
The irony is that increased awareness of phishing techniques has driven scammers to adopt techniques that are more sophisticated, and often more successful. Since January, 2017, a phish email targeting Netflix subscribers has been highly successful. The email tells dismayed users that their Netflix account has been suspended. It says the account can be restored by updating payment information, and provides a link to a page where the user can log in and update said info.<\/p>\n
<\/h2>\nOf course, that link actually takes the user to a fake Netflix login page, and from there into a series of forms that demand ever more sensitive personal information. If you take the bait, your account password (and any other information you provide) is sent directly to Hacker HQ.<\/p>\n
Several things stand out about the Netflix phish. First, its creators have gone to great trouble to replicate familiar Netflix pages almost exactly; there\u2019s even a background image on the login screen that promotes recent Netflix\u2019s original content. Second, the phishing site to which users get connected encrypts the HTML of fake pages it sends to victims, making it impossible for anti-malware apps to scan it for suspicious code.<\/p>\n
A third line of defense for the scammers is that the pages won\u2019t load for IP addresses that belong to Internet security monitoring groups, like Google, or the anti-phishing initiative Phish Tank. This trick keeps the Netflix scam sites off the blacklists of real-time Web monitoring services.<\/p>\n
Phishers also evade detection by hacking into well-known, reputable sites and hosting their fake pages there. A fake page delivered from a reputable site will not be flagged by Web reputation services like Google\u2019s Safe Browsing<\/a> or the Norton SafeWeb<\/a> service.<\/span><\/p>\n And of course, scammers are not interested only in your Netflix account, The same techniques are being used by phishes that purport to be Second Life, big banks, online publications, email services, and social media sites. Paypal, eBay, Facebook and Capital One bank have long been targets of phishers. But more recently there has been a focus by phishers on your Apple ID, Microsoft Outlook and Google Drive credentials. Be especially careful when dealing with online document signing services.<\/p>\n Use the phone.<\/b> Yes, it’s old school, but a quick call to your friend, mortgage broker, attorney, customer service, or the bank’s security department can confirm if an email is legit or not.<\/p>\n Don\u2019t re-use a password on multiple sites.<\/b> Use a password manager such as RoboForm to generate strong passwords and audit your entire database of passwords for duplicates. If you use the same password everywhere, it takes just one phish to open all of the doors to your digital life.<\/p>\n Confirm the apparent sender<\/b><\/span> really is sending from the right email address (e. g., john@doe.com if you know that\u2019s John\u2019s address). In Gmail, you can do that by opening the email, clicking the down-arrow in the upper right corner, and selecting \u201cShow original\u201d to find the “From:” line. But just because a message comes from someone you know, that doesn’t mean it’s safe to open links in it. Your friend’s email account may have been compromised, spewing malicious emails to all of his or her contacts. (See “use the phone” above.)<\/p>\n Hover over an email link,<\/b> and its full URL should appear. Does it lead to where it should, based on where the email seems to originate? An alert from Netflix.com should not steer you to a page hosted on some other website. When in doubt, don’t click a link in an email. Instead, go directly to the site via a browser bookmark, or by manually entering the URL.<\/p>\n Beware of email subjects<\/b> that urge you to take action immediately. Phishers don\u2019t want you to take time to think, or to research their bogus domains. \u201cPanic\u201d or alarm makes people act hastily, so it\u2019s no surprise that the most successful phishing email subject lines include \u201cSECURITY ALERT,\u201d \u201cREVISED VACATION & SICK LEAVE POLICY,\u201d \u201cPASSWORD CHECK REQUIRED IMMEDIATELY,\u201d and the straightforward \u201cURGENT ACTION REQUIRED.\u201d The use of all-caps is deliberate, as it induces the adrenaline rush that comes with being shouted at.<\/p>\n Be careful with shortened URLs.<\/b> Text messages that contain short URLs are another type of phish that targets mobile devices. Much to my alarm, I cannot find any simple way to preview the full URL represented by a shortened URL such as https:\/\/goo.gl\/uNEbdN or http:\/\/bit.ly\/2iT3S5y — it just takes me directly to its target, which may be a phishing trap. (Those examples are both shortcuts to AskBobRankin.com.) (You can do a “long press” on the message, then select “Copy text” and paste the URL into CheckShortURL.com\/<\/a>, but that’s a bit tedious.)<\/p>\n The fake invoice: invoices are hardly surprising during the busy shopping season, especially if it seems like something you\u2019d buy as a gift. You may be inclined to click to see exactly what you\u2019re being asked to pay, but that click may lead to a malicious download.<\/p>\n Shipping status notifications: a \u201cclick here to learn about the delay in your shipment\u201d often works.<\/p>\n Unbelievable bargains, or even believable ones, appeal to greed, which is always unthinkingly in a hurry to be satisfied. \u201cHurry, only one hour left!\u201d \u201cLast one, on sale for 90% off!\u201d is another good one.<\/p>\n Fake surveys promise some sort of reward for completing them. They start out innocently, asking reasonable questions about your shopping habits. But the questions get more and more personal, leading to requests for your name, address, phone number, and even credit card data (to defray shipping charges). If the questions get personal, it\u2019s time to stop. Let that “reward” go.<\/p>\n Bottom line: Bad guys are getting better at evading all sorts of anti-phishing defenses, and at crafting bait that people will take. Ultimately, the best defense is your own thinking skills and common sense.<\/p>\n Have A Great Week and Be Safe This Holiday Season!<\/p>\n Deuce Marjeta and The Zi Staff<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Phishing, the art of getting users to click on malicious links in bogus emails, is the favorite tool of scammers, by far. The reason is, phishing works. Scammers are getting better are slipping their phishes through spam filters and past anti-malware software. Ironically, the successful campaign to raise users\u2019 awareness of online security hazards … Continue reading Simple Things You Can Do To Avoid Phishing Traps<\/h2>\n
![\"\"](\"http:\/\/blog.zoha-islands.com\/wp-content\/uploads\/2017\/11\/phishing-slide-01-300x123.jpg\")
<\/p>\nLet’s Review Some Perennial Favorite Holiday Phishing Scams
![\"\"](\"http:\/\/blog.zoha-islands.com\/wp-content\/uploads\/2017\/11\/santa-scam-300x168.jpg\")
<\/h2>\n