URGENT NOTICE: Read This Article Immediately
How Spoofers Grab Your Attention
by Tracy Baker
Ever been to a movie set? Stand in the middle of a Hollywood recreation of Main Street, U.S.A., and all those houses and storefronts look just as real as the ones back home. Change your perspective a bit, and you’ll see it’s just a big façade held up by a bunch of sticks. The Internet works much the same way, except that most people don’t ever bother to peek behind the curtains.
Criminals know this and use it to their advantage using a trick called spoofing, which is the Web equivalent of creating an Academy Award-worthy movie set. They steal graphics, text, and other components of real corporate emails and Web sites to create carbon copies that can fool even the most vigilant Web experts. Then they use a variety of means to get you to click links within emails or visit fake sites. Pure spoofing attacks download malicious software such as viruses to the computer once a link is clicked. A more common spoofing variant called phishing lures unsuspecting victims to legitimate-looking Web sites, where users part with sensitive personal information that the spoofer can misuse. Spoofing represents a huge threat to Internet users because it’s so easy to let your guard down when you think you’re dealing with a trusted company. Fortunately, there are ways to detect and avoid spoofing attempts.
Smoke & Mirrors
The most common way spoofers draw you to a phishing site or a page that loads malware onto your PC is by sending an email announcing that something dramatic is happening to one of your accounts that requires your immediate personal attention. Maybe the email claims there’s a big problem with your PayPal account or that there’s been some strange activity with your credit card, or even that you’ve won some sort of prize that can only be claimed in a short period of time. The specifics don’t really matter—spoofers just want to create a sense of urgency that will make you click the link embedded in an email or Web page.
Spoofing techniques are often used in the email so that the link looks like it’s going to lead to a legitimate Web site, but it’s actually pointing to a spoof site. Emails are also doctored to look like they come from a real company, and while there’s really not much an average user can do to determine whether an email is legitimate, there’s plenty a user can do to investigate the links the email contains.
Anatomy Of A URL
Pretend you receive an email claiming to come from Smart Computing, telling you about a special offer that can only be claimed by clicking a link in the email. The underlined or highlighted text for the link might say something like “Click here for special offer” or even “www.smartcomputing.com,” but what you see isn’t necessarily what the link really is. Place your mouse cursor over the link, and a tooltip pops up that shows you the exact URL that the browser will load when the link is clicked. This tooltip is your first line of defense when deciding whether a link in an email is legitimate.
URLs for Web pages all follow the form http://XXX.YYY.ZZZ or sometimes http://YYY.ZZZ. The first part, “http,” tells you that the protocol (or computer language) used to access the page is the Hypertext Transfer Protocol, which is used for nonsecure Web pages. XXX represents a subdomain, YYY is the registered domain name, and ZZZ is the top-level domain.
If the email link tells you it leads to a login page, or if you accidentally click the link and end up at a login page, look closely in the Address bar to see if the protocol is HTTP or HTTPS. Data flowing through an HTTP is not encrypted, while data flowing through HTTPS is. Most legitimate sites use HTTPS at the login page, so that any information you type there is transmitted securely. Spoofers will sometimes overlook this and create a fake login page that uses HTTP, which is a dead giveaway that you’re at a fake site.
Even if HTTPS is used at the login screen, the rest of the URL provides several clues that can expose an illegitimate site. The top-level domain will always be something like .com, .org, or .edu, so look to make sure that a link that said it was taking you to SmartComput
ing.com, for example, didn’t actually take you to SmartComputing.cat. Registered domain names must be registered separately for each top-level domain, so it’s possible that a legitimate company registered for common top-levels, such as .com and .net, while a thief registered the same name under a more obscure top-level domain.
If the top-level domain checks out (and it often does), look just to the left of it in the registered domain name portion of the URL. This is the name of the company or Web site—for example, smartcomputing, amazon, ebay, etc.—that the site uses to identify itself. If it reads differently, something fishy is probably going on.
The biggest clue to watch for is a legitimate-looking subdomain name placed next to an illegitimate-looking registered domain name. For example, “smartcomputing.spoof.com” is completely different than “spoof.smartcomputing.com.” The former would take you to the smartcomputing subdomain at a site called “spoof.com,” while the latter would take you to the spoof subdomain at a site called “smartcomputing.com.” Always look at the text immediately to the left of the top-level domain and pretend subdomains don’t even exist.
Even an authentic-looking URL within an email or displayed in the browser’s Address bar should be viewed with suspicion. Spoofers have been known to use PayPa1 (with a number one on the end) instead of PayPal, for example. A misspelling such as this may stand out on a printed page; but in an Address bar, it is difficult to distinguish from the real deal. In fact, according to a joint Harvard and Berkeley study titled “Why Phishing Works,” 90.9% of participants—all trained to spot fakes—fell for a site called “www.bankofthevvest.com” (with two V’s in the middle), thinking it was the real bankofthewest.com Web site.
Let Your Fingers Do The Walking
If you receive an email that appears to be from a legitimate business where you have an account, don’t click any links it contains. Instead, manually navigate to the business’ Web address using its standard URL and then access your account from there to see if the issue referenced in the email exists. Better yet, call the company using the number printed in the phone book or on a recent statement and talk to a representative. If there isn’t a problem with your account, the institution you’re calling can start investigating the possible spoofing attempt.
Watch Your Browser
There are some tools built into Internet Explorer 7 that can help you determine whether a site is legitimate. If the Address bar turns green, the site’s security certificate checks out, and it is verified by the browser as a legitimate secure site. If the bar turns red, there’s a very good chance you’re looking at a spoof site. Also, keep an eye out for a padlock icon, which should lock when HTTPS is displayed in the Address bar. If a site claims to be secure but the padlock isn’t locked, call the company.
Update, Update, Update
Many of the most insidious spoofing tricks rely on weaknesses in Web browsers to immediately install malware on the PC as soon as a link is clicked. Most of these weaknesses are fixed once they are detected, but your browser will only benefit from the update if you download and apply patches on a regular basis using Windows Update (update.microsoft.com). For maximum protection, automate this process. In Vista, click Start, click Control Panel, double-click Windows Update, and then click Change Settings to access these options. In Windows XP, right-click My Computer, click Properties, and select the Automatic Updates tab to configure the feature.
Spoofers sometimes attack your ISP (Internet service provider) to redirect you to a spoof site even when you click a legitimate link or enter a legitimate address in the browser bar, foiling all of your efforts to avoid a spoofing attack. If this happens, contact the institution in question immediately and then pray for technology that makes spoofing impossible in the future.
Reprinted with permission from PC Today. Visit http://www.smartcomputing.com/groups to learn what Smart Computing can do for you and your user group!
Smart Computing Tips & Fun Facts
Another Man's Treasure: Almost everyone has at least an old cell phone or two lying around the house. Donating these older gadgets will both declutter your home and help someone out. Many organizations, including women's shelters, provide reprogrammed phones to people in high-risk situations. Secure The Call (www.securethecall.com) is a nationwide organization that collects phones and programs them for 911-only purposes. If your old phone is totally kaput, recycle it. Best Buy, for example, has collection bins for cell phones, inkjet cartridges, and rechargeable batteries in the front of each of its stores.
Camera Modes: Use the Beach/Snow mode on your digital camera when you're in a situation with a lot of glare: the sun reflecting off snow, sand, water, or even shiny metal, for instance. Ordinarily, the camera's light meter would react to this glare by sensing more light than is actually there, thus underexposing the shot. Beach/Snow mode counteracts that tendency. The trouble is, though, these are often the trickiest conditions to shoot under, so the camera may still be fooled. Examine your shot, and if it still looks dim, try another with your exposure compensation set to +1.
Wireless Router Issue: If your wireless router drops the connection to your home computers, there are some things you can do to try to solve the problem. Your wireless router assigns an IP (Internet protocol) address to each of the computers on your network. If your computer drops its wireless connection and doesn't produce any error messages, you can probably reinstate the connection by reassigning an IP address via router. Routers generally use DHCP (Dynamic Host Configuration Protocol) to automatically assign IP addresses, so you'll want to release the router's DHCP assignments and then force it to assign new IP addresses.
To force a DHCP release, enter your router's firmware menu and look for a DHCP Release feature. Your router's manual or the firmware's support documentation will help you find the feature. Many routers feature DHCP Release and DHCP Renew buttons that let you quickly complete this task.
Reprinted with permission from PC Today. Visit http://www.smartcomputing.com/groups to learn what Smart Computing can do for you and your user group!
