How to avoid phishing attacks

[Объединенное Детективное Бюро]

Many people occasionally receive disturbing emails, forcing them to take some urgent action (usually leaving no time to think) in order to prevent some impending disaster: “Our bank is changing its security system. Enter your details, otherwise you will not be able to access your account "or" Click here for more information. " Or even so: a situation is simulated in which you need to transfer the amount of money, you follow the link and see a visually familiar page (fraudsters often copy the image of the bank’s original website; the page may also contain a link that copies the link to the bank’s resource, but keep in a completely different place; plus you can see a familiar address in the URL bar, say mircosoft.com) and enter your details: username, password, credit card number, bank account information or other private information that helps in the work of scammers. This has a definite name: phishing - fraud for the theft of personal data. Some phishing attacks can be easily calculated, but some are plausible - they are disguised as banks, online sales, payment services, and even government agencies.

How to avoid phishing attacks
How to protect yourself from phishing attacks?

* Be careful when responding to emails requesting personal information. Be careful when clicking on the links in your email. Remember: serious and reputable companies never ask for such information through the mail.

* Instead of following the link, go to the bank. If you suspect that the link leads to a fake site, just open a legitimate site in a new window (especially since its address is most likely stored in your bookmarks). If you really need to contact the bank, there is usually a notification on the page. And never be shy to check the information - one personal call will take a little time, but will save a lot of money.

* If you visited the site using the link provided, do not rush to log in and enter the password, make sure that you are on the official site. For example, check the URL carefully to make sure the page is the organization’s page and not fake (like g00gle.com.).

* Beware of “incredible offers!” and the "fantastic prizes!" with which fraudulent emails abound. “All this is too good to be true” is the only thought that should appear in your head. If you still believe in miracles, before providing personal information, make sure you ask a million questions and there is nothing more to ask.

* Use a browser with a phishing filter. Recent versions of most browsers - Firefox, Internet Explorer, Opera - include phishing filters to help you identify potential phishing attacks.

It's quite simple - they saw a request for personal data, immediately beware. This is the best defense against phishers.

[url = http: //selfhacker.ru/] https://selfhacker.ru/ [/ url]

 

[Матушкин Андрей Николаевич]

Thank!

 

[parbaude]

I decided to replenish this article, because I believe that this issue is not fully disclosed.
It should be noted that this method of obtaining information, although it is illegal, is often used and brings great damage to Internet users.

This article will discuss some aspects of the information and financial business intelligence and security on the Internet. We specifically consider one of the ways to gain unauthorized access to business correspondence using an electronic mail system (e-mail), as well as similar access to conducting financial transactions using an “online” payment system (Yandex Money, MoneyMail, WebMoney, Egold, Imoney, AstraMoney , Rupay, PayPal, Platinum Trade, ElecPay, ICQ, Money and others), or an “online” bank account management system, that is, there is a method called FISHING : Internet fraud, the purpose of which is to obtain credentials user (login and password).
The basis of this method is to obtain the victim’s identity using a fake site (hereinafter referred to as the phishing site), which is an exact copy of the present.

In practice, two types of attacks can be distinguished to obtain the desired information:
Mass attack of users is used to obtain the greatest amount of identification data, with the aim of stealing money, accounts or collecting large amounts of information about the banking network.
Targeted attack of a specific user - in order to obtain the largest amount of business and financial information about a specific individual or legal entity.

The algorithm of actions in both cases is the same:
- Selection and study of electronic payment, postal or online banking system.
- Collection of information about the clients of this system, or about a specific client.
- Creation and placement of a phishing site on the network.
- Referral of clients of a real online system to a phishing site.
Next, we consider practically this algorithm.

Selection and study of electronic payment, postal or online banking system.
The choice of object depends on the experience, technical support and the specific purpose of the person engaged in phishing. The study of the system of interest begins with a visit to the site and a study of the components of the site. The phisher pays special attention to the section of the site “Logging into the personal section of system customers”, as well as the conditions for using this electronic system, the technical support section, the security section, news and information sections, and e-mail addresses of services of the system of interest. It is also possible that the phisher can register his personal section in the online system of interest, which gives him additional information for better activities.
An experienced phisher will use the information obtained to create the impression of the greatest reality happening to the potential victim while sending it to the phishing site.

Collection of information about clients or a specific client of a given system.
The method of collecting information depends on which of the attacks will be conducted and the clients of which of the online systems will be attacked.
The basis of this operation is the collection of e-mail addresses of potential victims - clients of the online system, to which subsequently an information message or letter is sent, allegedly on behalf of the administration of a real site or online system, in order to send the victim to a phishing site.
As a rule, a mass attack of users is carried out on clients of an electronic mail or payment system and powerful botnets are used to collect e-mail addresses (a program is a robot that collects e-mail addresses for spam sheets) or less powerful programs for collecting spam sheets, such as Advanced Email Extractor, E-mail Collection 0.1, BBSRobot, Advanced Direct Remailer, Dynamic Mail Pro 3.0.83, Email Spider 9.0, Robospam, E-Mail Addresses Extractor, E-MAILS HUNTER, NetTools, some of these programs have an e-mail collection function mail addresses according to a given algorithm - can collect the e-mail addresses of one particular mail system and, as a rule, the same electronic payment system, since the login is the same for both the mail and payment systems. Yandex and @ MAIL.RU serve as an example; it should be noted that @ MAIL.RU also serves the @ inbox.ru, @ bk.ru, @ list.ru mail system.
The method of collecting information in a targeted attack is different in that it collects information about a specific electronic payment system (for example, WebMoney, Egold), an online bank account management system and a specific individual or legal entity.
The main difference between this collection of information is that at the end of the collection of information, the phisher uses not only information about the e-mail address of the potential victim, but also details of bank accounts (bank account and correspondent account number, address of the bank or its branch, owner’s personal data accounts), as well as account details of electronic payment systems, which enables him to prepare a better and more reliable information letter to a potential victim and a phishing site.
In this case, Internet information search programs such as Internet EZ Search, Genius !, Quintura Search, Surf Pilot, aSearch.INFO, Hotkey Search Tool, LENIN INC Search Machine, SpeedySearch, or Internet Search Systems such as like Yandex, Rambler, Google and others.
With a correctly specified request, the search system can provide several hundred thousand links to the details of bank accounts of individuals and organizations. At the request “Details of our current account”, the Yandex system issues about 400,000 page links to bank users with information that is of interest to the phisher, the Google system - about 250,000 links. About 15,000 links to the request “Details of our current account Alfa-Bank”

Creation and placement of a phishing site on the network.
To obtain the victim’s identification information, a fake login page is created, which is identical to the real page on the online system’s website, and the server side of the script for processing the data entered by the victim.
The technical side of creating a phishing site does not take much time, since a ready-made page of the original site is copied (copying can be done using the copy function of a web browser or a copy program for websites such as Teleport Pro, WebCopier, HTTrack, WebZip and others) and using the HTML editor (Macromedia Dreamweawer, 1stPage2000, WebCoder, WYSIWYG Web Builder and others) creates a phishing site page.
Experienced phishers additionally creates one or more pages of the site, to minimize the suspicion of the victim that he was sent to the phishing site. The information content of these pages can be very diverse, but there are some basic composite pages of a phishing site:
- Specially, in accordance with the information letter sent, prepared by
the page to which the victim is redirected after he led the identification
information.
- A copy of the main page of the original site.
- Pages with a server failure message to which the victim is redirected, if
she tries to go to other snares on the page of the phishing site.
Such a phishing site does not establish links that redirect the victim to the real pages of the original site, since the visitor accounting system records the passage from the pages of other sites and there is a threat of establishing the presence of a phishing site.
Inexperienced phishers, as a rule, create one page of the site on which the victim must enter the identification data (Yandex, Alfa-Bank), or additionally another page where he informs the victim that the username or password is incorrect, or this service is temporarily not available and asks you to contact again after a while.
The pattern is as follows: the more experienced and professional the phisher himself, the more likely the phishing site looks.
A phishing site on the network is hosted using two methods:
Free hosting server: domain zone “ru” - HUT.RU, Holm.Ru, Jino-net.ru, AYOLA.net, Fatal.ru, HOSTLAND and others; other domain zones - ho (ua, org), AYOLA.net (com, net, biz), Bravanet (com), 007 Sites (com), 110MB HOSTIHG (com) and others.
Using your HTTP server: Apache, Small HTTP server, Sambar Server, KF WEB Server and others, which is installed on the phisher computer or on the zombie computer (specially for such purposes a hacked computer).

Referring clients of a real online system to a phishing site.
The potential victim is sent to the phishing site by sending a special information letter to his e-mail.
For mass attacks of potential victims, e-mail spammers are used: Advanced Direct Remailer, mcspammer, Rich Mailer, Easy Mass Mailer, HNC E-Mail Spamer, Advanced Mass Sender and others.
For a targeted attack of a potential victim, the above-mentioned “e-mail spammers” programs and anonymous mail sending programs are used: Crazy Mail Quinto, Megasoft Crazy Mail, MailTO, AniMail, Advanced Direct Remailer, Mix2Minion, 123 Hidden Sender, AnonyMail, Smtp Client, DirectMailer, Anonym Mailer and others, or almost anonymous servers.

It should be noted that using almost anonymous sending programs, the phisher has the ability to spoof the sender’s e-mail address, that is, he can specify any other real or nonexistent e-mail address. It uses the information received about the ability to contact the services of the online system, that is, the real e-mail address of the online system.

The text content of the newsletter is developed depending on the attacked “online” system and the content of the phishing site.
The simplest informational letter, at the moment, is an informational message confirming the login and password:
-------------------------------------------------- -----------------------------
Dear user, Yandex mail service!
Due to a hacker attack on the Yandex mail server and recovery of client accounts, we ask you to go to the Yandex website and confirm your account
Email sent by mailing robot. Please do not reply to this email.
We apologize for the
inconvenience.
Sincerely, Yandex Support.
Yandex mailbox without spam and viruses.
-------------------------------------------------- -------------------------------
Dear user, Alfa-Click Internet Banking system!
Due to a hacker attack on the Alfa-Click Internet Bank server and restoration of client accounts, we ask you to go to the Alfa-Click Internet Bank server and confirm your account or contact your Alfa Bank branch.
Email sent by mailing robot. Please do not reply to this email.
We apologize for any inconvenience this may cause.
Sincerely, Support service “online” of the “Internet Bank Alfa-Click” system.
Other Internet projects of Alfa Bank.
-------------------------------------------------- ------------------------------
As a rule, newsletters of such content are not very effective, since they have been used for a long time and most users of “online” systems know that this is Internet fraud.

A more plausible newsletter that does not arouse suspicion of a potential victim can be written in this way:
-------------------------------------------------- ---------------------------
Hello, User!
You have a post card.
Postcard sender: ХХХХ <хххх@хххх.ru>
To become the discoverer of this postcard, click on the link.
Please do not reply to this email.
To send a postcard in response, select a postcard on the Yandex.Cards website or draw using Yandex.Colors
Yandex. Postcards. Open before the holiday.
Hi, Polzovatel, you've just received a postcard.
To view the postcard click this link.
Please do not answer this e-mail.
Yandex.Postcards. Pre-holidays Postcards.
-------------------------------------------------- ------------------------
Dear user, Alfa-Click Internet Banking system!
The management of Alfa Bank announces a lottery for customers of Alfa-Click Internet Bank.
You will familiarize yourself with the terms of participation in the lottery, and you can confirm your participation in the lottery by going to Alfa-Click Internet Bank or in your Alfa Bank branch.
Email sent by mailing robot. Please do not reply to this email.
Sincerely, Support service “online” of the “Internet Bank Alfa-Click” system.
Alfa-Click Internet Banking is the simplicity and speed of connecting to the system, the absence of the need to install special software.
Main office
107078, Moscow, st. Kalanchevskaya, 27
XML: NAMESPACE PREFIX = SKYPE (+7 495) 620-91-91 (+7 495) 620-91-91
(+7 495) 797-31-60 (+7 495) 797-31-60
(+7 495) 974-25-15 (+7 495) 974-25-15
-------------------------------------------------- ------------------------
Dear user of the Yandex.Money payment system!
The management of the Yandex.Money payment system announces a lottery for its customers.
He will familiarize himself with the terms of participation in the lottery, and you can confirm your participation in the lottery by clicking on the link.
Email sent by mailing robot. Please do not reply to this email.
Discounts this month. More details
Yandex mailbox without spam and viruses.
-------------------------------------------------- ------------------------
The content of the newsletter can be very diverse and consideration of all options is simply not possible. You can get acquainted with many types of newsletters and phishing sites on the site Anti-Phishing Working Group.

Protected against phishing attacks and security principles when using “online” systems.
Consider the basic security principles of using “online” systems and are protected from phishing attacks.
The main thing that users of online systems should remember:
- The support service of the “online” system does not send information letters requesting water or confirming identification data.
- Upon receipt of such a letter, the transition to this “online” system is performed using only the command line of the web browser. Do not copy or enter the link specified in the newsletter into the command line of the web browser.
- Do not enter the required identification data if the specified link leads to the page for entering the identification data “online” of the system.
- Do not indicate on the pages of the site an e-mail address for communication. Use scripts of feedback forms.
- Do not indicate details of payment “online” systems or details of bank accounts on the site.
- Use of scripts prohibiting the copying of web site pages. It should be noted that almost all “online” systems sin about the protection of information in this case.

Signs that may indicate a possible phishing attack:
E-mail address of the recipient. Upon receipt of such an information letter, it is necessary to pay attention to what e-mail address is indicated in the “To” section. If another e-mail address is indicated in this section, and not the recipient, the letter was sent by the “e-mail spammer” program. Also, in this section several e-mail addresses can be indicated, which indicates a “spam” sending.
E-mail address of the sender. It does not matter much, since there is the possibility of spoofing the e-mail address when sending an information letter by the program almost anonymous.

Date: 05/10/07 10:03 PM
From: Yandex.Cards <xxx@yandex.ru> - sender address
To: Your address@yandex.ru - recipient address
Subject: Postcard from XXXX to you!

IP address of the sender. You can set the IP address of the sender by opening the “Message Properties” option, where the original address is always the IP address of the sender. “Letter properties” in the Yandex mail system

Received: from mxfront6.yandex.ru ([213.180.XXX.XXX]: 61840 "EHLO - IP mail server.
mxfront6.yandex.ru "smtp-auth: <none> TLS-CIPHER: <none> TLS-PEER-CN1:
<none> ) by mail.yandex.ru with ESMTP id S2965911AbYERLI6 (ORCPT
<rfc822;kjhgfdsgjh%yandex.ru@mxc10.yandex.ru> );
Sun, 18 May 2008 15:08:58 +0400
Received: from [61.106.66.XXX] ([61.106.66.XXX]: 44804 - Sender IP "HELO 213.180.XXX.XXX"
smtp-auth: <none> TLS-CIPHER: <none> TLS-PEER-CN1: <none> )
by mail.yandex.ru with SMTP id S40413AbYERLIw (ORCPT

You can check who owns the sender's IP address using the WHOIS service. If the sender's IP address matches the IP address of Yandex or Alfa Bank, we get the following answer:

Yandex
inetnum XXX.XXX.XXX.XXX - XXX.XXX.XXX.XXX
netname YANDEX-XXX-X
descr Yandex enterprise network
country RU
admin-c YNDX1-RIPE
tech-c YNDX1-RIPE
remarks INFRA-AW
status ASSIGNED PA
mnt-by YANDEX-MNT
source RIPE # Filtered

Alfa Bank
inetnum XXX.XXX.XXX.XXX - XXX.XXX.XXX.XXX
netname ALFA-BANK
descr Alfa-Bank Moscow Russia
country RU
admin-c LSS2-RIPE
tech-c DV672-RIPE
tech-c SP6271-RIPE
status ASSIGNED PA
mnt-by ALFABANK-MNT
source RIPE # Filtered

If the sender’s IP address in the letter does not match the IP address in the WHOIS service, this indicates a phishing attack , even though a real-life e-mail address of the online support service is indicated.
In the same way, you can check the IP address of the site or domain on which it resides.
There is also the opportunity to check the history of the site to which the link of the newsletter sends us, that is, using the site “Internet Archive” we check when the site of interest was posted and how many Internet pages. To do this, copy the web address of the site from the command line of the Internet browser and enter “Internet Archive Wayback Machine” into the search box. If the search engine does not find data on the verified web address, this means that the site is phishing.

 

[Матушкин Андрей Николаевич]

Thank.