Body
Phishing
Phishing attacks use email or malicious websites (clicking on a link) to collect personal and financial information or infect your machine with malware and viruses.
Spear Phishing
Spear phishing is a highly specialized attack against a specific target or small group of targets to collect information or gain access to systems.
For example, a cybercriminal may launch a spear-phishing attack against a business to gain credentials to access a list of customers. From that attack, they may launch a phishing attack against the customers of the business. Since they have gained access to the network, the email they send may look even more authentic and because the recipient is already a customer of the business, the email may more easily make it through filters, and the recipient may be more likely to open the email.
The cybercriminal can use even more devious social engineering efforts such as indicating there is an important technical update or new lower pricing to lure people.
Spam
Spam is the electronic equivalent of junk mail. The term refers to unsolicited, bulk – and often unwanted – email. Here are ways to reduce spam:
- Enable filters on your email programs: Most ISPs (Internet Service Providers) and email providers offer spam filters. However, depending on the level you set, you may wind up blocking emails you want. It's a good idea to occasionally check your junk folder to ensure the filters are working properly.
- Report spam: Most email clients offer ways to mark an email as spam or report instances of spam. Reporting spam to abuse@uthsc.edu will also help to prevent the messages from being directly delivered to your inbox.
- Own your online presence: Consider hiding your email address from online profiles and social networking sites or only allowing certain people to view your personal information.
Pharming
Pharming leverages malicious code such as viruses, worms, trojans, and spyware to carry out sophisticated attacks such as hosts file modification, DNS cache poisoning, etc. Pharmers can even hijack domains or spoof static domain names in order to fool users by redirecting them to malicious websites.
The Anatomy of a Pharming Attack
1. The user types in the address of their bank (e.g. www.xyzbank.com) into the address bar of their browser.
2. The request passes to a DNS name server. This server maps www.xyzbank.com to a number such as 210.10.10.3 (IP address, which is understandable to the computers).
3. Normally, the browser connects the user to the authentication site of xyzbank. However, in pharming, the attacker modifies the mapping in the DNS service. Now, the DNS service maps www.xyzbank.com to 230.10.10.3 – the IP address of the attacker's fake site.
4. The customer thinks that they are interacting with their bank, because it so indicates this http://www.xyzbank.com in the browser's address bar, but they are actually connected to the deceptive site of the attacker.
Social Media
Spam, phishing, and other scams aren't limited to just email. They're also prevalent on social networking sites. The same rules apply on social networks: When in doubt, throw it out. This rule applies to links in online ads, status updates, tweets, and other posts.
Here are ways to report spam and phishing on social networks: