Protect Yourself From Spear-Phishing Scams

Humans are still our biggest cybersecurity weakness. Here's how to be smarter when it comes to avoiding scams through email and on your phone.

When dozens of celebrity Twitter accounts started promoting a Bitcoin scam one Friday in July, something was clearly going wrong down at Twitter HQ. By the end of the month, Twitter said certain employees had fallen for a scam and unwittingly helped hackers gain access to sensitive login credentials. 

The hacker, allegedly a teenager in Florida who's now charged with 30 felonies, tapped the usernames and passwords to access an internal system at Twitter and take control of high-profile accounts. The breached accounts included those of Elon Musk, Bill Gates and Joe Biden.

In your work or personal life, chances are you have access to a system or account that hackers would like to breach. The prize could be customer data that would help identity thieves do their work, your company's intellectual property or even your personal income data, which could help someone steal your tax refund or file for unemployment benefits in your name.

That access means you, too, could be the target of spear-phishing, a juiced-up hacking technique that tries to trick you into handing over login credentials or download malicious software. Twitter says the attack targeted employees on their phones, which means the hackers could have used phone calls or text messages to mislead their targets. 

Spear-phishing attacks also often take place over email. The attacks typically pair an urgent sounding message with credible-sounding information specific to you, like something that could have come from your own tax return. These scams are extra hard to avoid falling for, because they aim to override any red flags you might notice about the email with details that make the sender sound legitimate.

Despite corporate training and stern warnings to be careful who you give your password to, people do fall for these tricks. 

Another consequence of falling for a spear-phishing scam could be downloading malicious software, like ransomware. You could also be convinced to wire money to a cybercriminal's account. Still, you can avoid falling for these scams by taking these security habits to heart. Here's how to avoid a spear-phishing scam.

Know the basic signs of phishing scams

Phishing emails, texts and phone calls try to trick you into visiting a malicious website, handing over a password or downloading a file. This works in email attacks because people often spend the whole day at work clicking on links and downloading files as part of their jobs. Hackers know this and try to take advantage of your propensity to click without thinking.

So the No. 1 defense against phishing emails is to pause before clicking. First, check for signs the sender is who they claim to be:

• Look at the "from" field. Is the person or business's name spelled correctly, and does the email address actually match the name of the sender? Or are there a bunch of random characters in the email address instead?
 
• While we're at it, does the email address seem close, but a little off? Such as, Microsft.net, or Microsoft.co.
 
• Hover your mouse over any links in the email to see the true URLs they will send you to. Do they look legitimate? Remember not to click!
 
• Check the greeting. Does the sender address you by name? "Customer" or "Sir" would be red flags.
 
• Read the email closely. Is it generally free from spelling errors or odd grammar?
 
• Think about the tone of the message. Is it overly urgent or trying to get you to do something you normally wouldn't?

Don't fall for more advanced phishing emails that use these techniques

more of this post ▼

How To Know If You've Been Hacked, And What To Do About It

Sometimes your accounts get compromised. It's key to understand the threats.

Everyone is vulnerable to the threat of cybercriminals or hackers getting access to your information, but the threats aren’t equal for everyone.

The average person will likely face fewer sophisticated threats than, say, a senior politician, activist or CEO. More high-profile figures may be targeted with phishing emails that are looking to steal secrets from corporate networks or initiate the transfer of large sums of money. You, your friends and your family will likely face different threats: from people you know seeking revenge, or, more likely, crime groups using automated tools to scoop up credentials en masse.

We all like to think that we’re not susceptible to social engineering or other kinds of cyberattacks but the truth is that even intelligent, self-aware people still get caught up in online scams that can have very damaging consequences. Many people will even admit they don’t click on phishing emails but may still get caught up in online scams. A number of emails may still slip through the net without realization and can have serious effects financially or socially.

Understanding the threats is key. Everyone has their own threat model that includes things that matter most to them, what’s important to you may not be equally important to someone else. But there’s a value to everything you do online, from Facebook and Netflix to online banking and shopping. If one of your accounts is compromised, stolen login information or financial details can be used across the web.

While Facebook, Twitter, Instagram, and other social networks are less likely to contain your credit card details there are other types of risk. Hacked social media accounts can be used to post compromising messages that could embarrass or defame somebody, be used for harassment or building up a picture of who you are and everyone you know.

Discovering if you have been hacked can be a rather complicated task. You could wait to have it proven by losing control to your precious accounts although like anything, it is better to be proactive and stop it from happening in the future. If you think you’ve been hacked, here’s where to start and what you can do next.

The clearest sign that you’ve been hacked is when something has changed. You might not be able to access your Google account using your regular username and password or there may have been a suspicious purchases charged to one of your bank accounts. These are fairly obvious indications that you’ve been compromised in some way and hopefully banks will detect any suspicious payments before things spiral too far.

However, before any of your accounts are compromised there may be warning signs. The account that someone is trying to break into may warn you about unusual attempts to log in, for instance, Facebook and Google will send notifications and emails alerting you to attempts to access your account. This will usually be if someone has tried to get in and failed but alerts can also be when someone has successfully signed-in from unfamiliar locations.

more of this post ▼

And You think your computer problems are big ones!

Tech News and Views

Here's what happens when computer systems are not backed up.

The "Robbin Hood" ransomware attack against Baltimore City has thus far cost the city over $18 million—a process made much more expensive by the widespread absence of data backups or any sort of disaster recovery planning. Over the summer, temporary workers were brought in to replace hard drives and monitors on affected computers, and new servers were purchased to replace those affected by the ransomware.