Phishing Attacks

By Shehan Dhaleesha

What is PHISHING??? 

 The term Phishing comes from the analogy to “fishing”. The phisher uses a bait to lure victims into giving out personal information like passwords and credit card numbers. The bait is typically and urgent plea from one of the victims friends or trusted websites, asking for information to resolve some sort of problem with their account.

The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information.

Phishing is the attempt to obtain sensitive information such as user names, passwords, and credit card details (and money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication. The word is a neologism created as a homophone of fishing due to the similarity of using a bait in an attempt to catch a victim. According to the 2013 Microsoft Computing Safety Index, released in February 2014, the annual worldwide impact of phishing could be as high as US$5 billion. (WIKIPEDIA).

Phishing Types

• Spear phishing ->
  Phishing attempts directed at specific individuals or companies have been termed spear phishing.
• Clone phishing ->
  Clone phishing is a type of phishing attack whereby a legitimate, and previously delivered, email containing an attachment or link has had its content and recipient address(es) taken and used to create an almost identical or cloned email
• Whaling ->
  Several phishing attacks have been directed specifically at senior executives and other high-profile targets within businesses, and the term whaling has been coined for these kinds of attacks

Mobile Phishing 

Phishing scams are not limited to the Internet. Some phishers use the telephone to make requests for information. If you get a call from your banking institution asking for personal information, hang up and call your bank directly. Your bank will have your social security number and account information on file and should only ask you to verify a few digits.

like I phone,Apple ,i Tunes n more…By SMS.

Ex:- 

Congratulations! Your mobile phone has won US$ 10 Million prize money. To claim your money, call this number XXXXXXXX,give your permanent address,pin number,account number or credit card number…
The phisher can ask like it They want your personal Information.

Some people do the reply to phisher then after he/she can be target of Phisher… so never be reply these type of Messages or Mail.

 In a phishing attack, the attacker creates a situation wherein people believe that they are dealing with an authorized party, like their bank or another service provider. The attacker will ask the victim for sensitive information such as credit card information.

General Targets

* Bank information

* User name and password information.
* Social Security numbers.
* Information which can be used to retrieve forgotten or lost credentials.

  

The way to PROTECT

· Your bank will never ask you to divulge account information or passwords via email. Never   give out this information, especially via email.
· Don’t open emails that come from untrusted sources.
· Don’t run files that you receive via email without making sure of their origin.
· Don’t click links in emails. If they come from a known source, type them on the browser’s address bar. If they come from an untrusted source, simply ignore them, as they could take you to a web designed to download malware onto your computer.
· Keep your computer protected. Install a security solution and keep it up-to-date.

 Anti-phishing software is a must for anyone that accesses the Internet. Most of the Internet service providers have some safety measures included as part of their online security software. Most web browsers also have add-ons that can detect most phishing scams. Unfortunately, these measures are not enough. Some of the more clever phishers have found ways to trick the anti-phishing software so you need to be cautious of suspicious emails and messages.

References : https://en.wikipedia.org/wiki/Phishing / Google