Phishing

The organizers of phishing attacks use mass mailings of e-mails on behalf of popular brands. In these letters, they insert links to fake sites, which are an exact copy of these. Once on such site, the user can inform the criminals with valuable information that allows him to manage his account from the Internet (first name of the user and password for access), or even his credit card number.

That is, it is not necessary to forge money, you can forge securities or something else, for which you can get the same money, for example official sites.

How it works

Fisher send out mass email messages on behalf of a legitimate online seller or financial institution.
Usually they contain a requirement to immediately send some information, for example, passport data, your Internet account data (login and password for access) or even credit card details.
Often in such messages, the recipient is invited to enter the fake Web site, which is an exact copy of the present, arranged by phishers to collect information.

The phishers began to supplement their intrigues with all sorts of tricks - including pop-ups with fraudulent messages, "masks" URLs that mimic real web addresses, and programs for registering keyboard input that intercept account numbers and passwords.
And to top it off, an organization with a significant online presence is subject to direct blackmail.

The sites of banking structures, online shops, hosting providers and Internet access are most often attacked. The five leaders of Western leaders are PayPal, followed by eBay, BOA, Fifth Third, Wachovia - the more famous a bank or a store, the more often they attack its customers.

New type of phishing

• We go to the site, the meeting is quite ordinary;
• switch to another tab;
• JavaScript defines that there is no activity to the site, changes the icon and page content to Google mail (or something else)
• we decide to look at our mail and accept this reference for real;
• enter your login, password and click OK to send your access to the hacker. Having access to the mail can be accessed almost everywhere we are registered.

PREVENTION

First of all, store your email.
Do not get your email spammers - there will be no spam. Will fall - will be.
Do not get your email phishers - there will not be phishing. Will fall - will be.
The most basic - get 2 email addressa:

1. Permanent, which will be on your business card, for registration on official sites. Keep it and do not give it to anyone.
2. Temporary, for registration on forums and for registration on the Internet. Go spam or phishing, throw out and start a new temporary.

Use the security code for email on your site (if you have one).

more

Protection:

1. Financial organizations and other responsible companies do not request confidential information via email.

2. Phishers may threaten to close the account or terminate the service until you update certain information.

3. Do not trust withoutaddress requests for information. Meanwhile, in letters from your bank or ISP, they will most likely call your organization or the accounting first name.

4. Never enter confidential information into forms embedded in email messages.

5. Always make sure that you use an encrypted connection to send personal information. Address must begin with "https://", not with "http://".

6. By using the link in the email, it can look absolutely normal - www.paypal.com/us/cgi-bin/webscr?cmd=_login-run, but hover over the cursor and see a completely different address. Type address manually.

7. Actually, if you are registered on PayPal or elsewhere, then you can conduct all transactions through your account. You were not born yesterday, use the old ways of working with official organizations. They will treat you with understanding.

8. To verify the legitimacy of all transactions, regularly check the status of your bank account, credit and debit cards. If you find something suspicious, contact the bank and all credit card issuers.

9. For more recommendations, please visit the Anti-Phishing Workgroup website (www.antiphishing.org).

10. Most often, scammers require logins, passwords, credit card numbers, etc.

When you access the site using http://, the browser establishes an encrypted connection, analyzes the site's submitted information and tries to verify it for authenticity by verifying the signatures using root certificates. And even if all the Internet is completely under the control of intruders - all the same the verification of certificates will be based on data embedded in the browser, which will detect the attempt to attack.

And most importantly - look closely at the messages that your browser shows before quickly clicking on Yes or OK! After all, who knows, maybe, this time he yells to you that your data is being stolen ...