Today's Featured Article - Phishing
-
In computing, phishing is a form of social engineering, characterised by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an email or an instant message. The term phishing arises from the use of increasingly sophisticated lures to "fish" for users' financial information and passwords.
With the growing number of reported phishing incidents, additional methods of protection are needed. Attempts include legislation, user training, and technical measures.
for more information, pls refer to wiki
examples of phishing alerts:
http://www.dbs.com/sg/personal/ebanking/additionalinfo/security/phishing/
http://www.ocbc.com.sg/personal-banking/tools%20and%20info/Toi_Poc_SecTips.shtm -
To know more about social engineering, go to libraries and borrow a book titled The Art of Deception by Kevin Mitnick.
-
me taking Mechanical and Aerospace Engineering, pre-requisite to take Masters of Social Engineering.
-
You can wait. Social engineering has no direct relationship with the engineers you see out there, unless you choose to be a salesman. Salesmen are good talkers, which makes them good social engineers.Originally posted by chunyong:me taking Mechanical and Aerospace Engineering, pre-requisite to take Masters of Social Engineering. -
Mitnick was actually a very resourceful hacker, privately he was a loner and very shy which fits the profile of potential hackers he actually broke into several company systems initially as pranks to boost his ego but later on more dangerously in several notable industrial expionage cases where actually stole entire source codes of giant IT companies for profit. All these he did long before internet became popular like it is today.Originally posted by ndmmxiaomayi:To know more about social engineering, go to libraries and borrow a book titled The Art of Deception by Kevin Mitnick.
In the end he was apprehended by a true security systems expert a japanese american ... this japanese was a true genius hacker. He demonstrated at a security convention where he programmed within seconds and converted a motorolla cellphone into a 30 channel scanner that can listen in on all cellphone conversations within a radius of 200yards. -
Yup, read about this Japanese American trying to capture Mitnick with another reporter.Originally posted by KumSioJui:Mitnick was actually a very resourceful hacker, privately he was a loner and very shy which fits the profile of potential hackers he actually broke into several company systems initially as pranks to boost his ego but later on more dangerously in several notable industrial expionage cases where actually stole entire source codes of giant IT companies for profit. All these he did long before internet became popular like it is today.
In the end he was apprehended by a true security systems expert a japanese american ... this japanese was a true genius hacker. He demonstrated at a security convention where he programmed within seconds and converted a motorolla cellphone into a 30 channel scanner that can listen in on all cellphone conversations within a radius of 200yards.
Although he was a loner, his social engineering skills are so good that no one will suspect that he is a loner. Mitnick did pranks to boost his ego, but too bad he stepped on the wrong person's toes which resulted in his arrest. This Japanese American is a strong believer in privacy and he doesn't like people who steal copyrighted data. -
Cool! But it'll be a nightmare if that kind of phone lands on a parent...Originally posted by KumSioJui:Mitnick was actually a very resourceful hacker, privately he was a loner and very shy which fits the profile of potential hackers he actually broke into several company systems initially as pranks to boost his ego but later on more dangerously in several notable industrial expionage cases where actually stole entire source codes of giant IT companies for profit. All these he did long before internet became popular like it is today.
In the end he was apprehended by a true security systems expert a japanese american ... this japanese was a true genius hacker. He demonstrated at a security convention where he programmed within seconds and converted a motorolla cellphone into a 30 channel scanner that can listen in on all cellphone conversations within a radius of 200yards.
-
but now only College of Social Engineering offer the course leh and must work in the Service Sector for 2 yrs b4 u can apply.Originally posted by ndmmxiaomayi:You can wait. Social engineering has no direct relationship with the engineers you see out there, unless you choose to be a salesman. Salesmen are good talkers, which makes them good social engineers. -
This is latest type of phishing whereby the hackers exploit the re-direct cookie.Originally by zzzjjj2002:The FireIce closed my previous thread.
The new threat over internet is "DNS attack". In previous years people received emails to seduce them giving out credit card numbers, secret personal information, etc. Nevertheless, the phishing is there only when victims lost vigilance.
This DNS attack may change the IP address of your typed website name, transferring you to the vicious site. You gave out all passwords thinking that you are on the right site. This attack is more dangerous, can't you see? -
Theres an article of email scams today Home section ST. Pretty surprising what greed can do. *shakes head*
-
Signs of Phishing
[*]Unsolicited requests for personal information - Most businesses aren’t going to ask you for your personal information out of the blue—especially not an organization such as your bank or credit card company, which should already have this information on file. If you do get a request for personal information, call the company first and make sure the request is legitimate.
[*]Alarmist warnings - Phishers often attempt to get people to respond without thinking, and a message that conveys a sense of urgency, perhaps by saying that an account will be closed in 48 hours if you donÂ’t take immediate action, may cause you to do just that.
[*]Mistakes - The little things can often reveal the biggest clues. Phishers often slip up on the finer details and overlook typos, mistakes in grammar, and so on.
Example of a mistake: Klez.H is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic, most common AV software can't detect or clean it. We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once, and then Klez will never come into your PC. Just have to register your email address and password at this link: http://www.av-patch.trendmicro.com/
Saw the mistakes? Let's see who can point it out.
[*]Addressed as “Customer.” - If your bank, for example, regularly addresses you by name in its correspondence and you get an e-mail addressed to “Dear Customer,” this may be a phishing attempt.
[*]The words “verify your account.” - A legitimate business will not ask you to send passwords, logon names, Social Security numbers, or other personally identifiable information through e-mail. Be suspicious of a message that asks for personal information no matter how authentic it looks.
[*]The phrase “Click the link below to gain access to your account.” - HTML-formatted messages can contain links or forms that you can fill out just as you’d fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company's name, but the link you see is actually taking you to a phony Web site.
Look out for fake websites. For example, mail.google.com can become mail.goggle.com -
What if you have fallen into their trap?
Report the incident
[*]Contact your credit card company if you have given out your credit card information. Reporting that your account may be compromised and closing the account should be your first step. The sooner a credit card issuer knows, the easier it will be for them to help protect you.
[*]Send the entire fraudulent message to the company that's been misrepresented. Remember to contact the organization directly, not through the e-mail message you received. Find out if they have a special e-mail address to report such abuse.
Change the passwords on all your accounts
This is especially important for people who use the same password throughout all accounts that you have. Even if you don't, it is recommended that you change - for security reasons.
Your passwords should have at least 8 characters, containing numbers and letters. If symbols, you can add them in. Make it hard for others to guess, but easy for you to remember. One good way is making a sentence.
Take this sentence as an example. So your password will be:
T@th53@5@n3X -
Protecting yourself
Never give sensitive personal information in a message
Most businesses will not ask for passwords, account or credit card numbers, or other confidential information in an e-mail, instant message, or pop-up window. While browsing, be particularly suspicious of windows that do not include the address bar. If you think you've received a phishing e-mail message, just delete it without responding.
Make sure the Web site is legitimate
Do not enter personal information unless you're sure it is to a Web site you trust and that the site takes appropriate steps to protect your data. Find out if the site uses encryption to protect your data. Look for “https” (the s is for “secure”) in the Web address, and check for a tiny closed padlock or an unbroken key icon in your browser window.
On some systems, the padlock (and key) can be faked, so double-click it to display the security certificate for the site. Look for a match between the name on the certificate and in the address bar. If the name differs, you may be on a faked site. If you have even the slightest doubt about a site's legitimacy, play it safe and leave.
Be wary of clicking a link in a message or pop-up window
If you get an e-mail, instant message, or pop-up window that asks for personal information, do not click the link. Doing so could take you to a phony site where any information you give may be sent to the phisher who built it.
If you're unsure whether a message is genuine, call the company by using the telephone number on a past statement or the telephone book. To visit the companyÂ’s Web site, type the address (do not copy and paste), or use your own bookmark or Favorites list.
Routinely review your financial statements
Carefully check all your credit card and bank statements monthly and regularly log on to any online accounts. If you review your bank and credit card statements often, you may be able to catch con artists and stop them before they cause significant damage.
Improve your computer's security
Phishers hope you haven't been applying the latest security fixes, and may try to take advantage of these vulnerabilities. Some phishing e-mail may contain malicious or unwanted software that can track your activities or simply slow down your computer. -
-
better. don't use computers.
-
Originally posted by Ito_^:better. don't use computers.
You write letters, I write digital letters. Who faster?
-
u wait. i pod u. den i write.Originally posted by ndmmxiaomayi:
You write letters, I write digital letters. Who faster? 
-
Originally posted by Ito_^:u wait. i pod u. den i write.
