Phishing expedition

[Half Dimes]

Every now and then I get one of those phishing emails where I'm told there's a problem with my bank account and I should immediately complete a long form with all my personal information. Before I delete it I usually look the form over for amusement. And I'm never disappointed.

The latest one I received was very polished with all the right logos. Putting aside for the moment that I did not receive it at the email address I use for banking and the premise of too many invalid sign ons was bogus, the form among other things asked for my father's maiden name ...

[bluepill]

Something lost in translation?

[Ramblin]

Originally Posted by bluepill

Something lost in translation?

Or there's something about dad that we didn't know.

[BFlinn181]

There's no such thing as a free lunch.

I respond to these 'notices' by checking that the code isn't automatically grabbing my email, then fill them in with names like "Ura Crook, Duane Pipe, etc.

3 months after my sister passed away, I started getting emails from 'her' telling me about a great work at home opportunity. Russians had grabbed her yahoo mail account and was using her address book.

[99-Am.Star]

Originally Posted by BFlinn181

There's no such thing as a free lunch.

I respond to these 'notices' by checking that the code isn't automatically grabbing my email, then fill them in with names like "Ura Crook, Duane Pipe, etc.

3 months after my sister passed away, I started getting emails from 'her' telling me about a great work at home opportunity. Russians had grabbed her yahoo mail account and was using her address book.

Maybe thats where the name world wide web came from

[wa8yxm]

That's a good one, Well considering that today Gay couples have the right to marry and adopt children, In fact one of my facebook "Friends" (he's been a friend for many years, Even if we have never met face to face, and he will remain nameless here since his name is very very well known in some rather large circles) happens to be a Homosexual adoptive father.

Perhaps "Father's maiden name" is not such a strange question.....

The above is true, but also a joke. Hopefully you are laughing, If you wish to debate gay marraige or adoption.. I'm not the person to argue with as I am.. Well, simply not interested in those topics.

More to the point.. You could fill out the phis

Father's maiden name: Puddingtame

Account number 1234 5678 0987 6543

Password goto7734

Well you get the idea.

Note to phishers,, Not one bit of data in those answers is true.

[Wayne M]

So the "Dad's" out of the bag, errr closet eh?

[mrblanche]

I got a Java exploit when it was bright and shiny new, apparently downloaded in a jpg or something from an RV parts web site. It started sending out e-mails to everyone in my address book, including me, since I always keep myself in that book so I know when such a thing happens. I struggled for two months with that thing, including a wipe of my hard drive, and a replacement of the drive. Finally got it stopped from sending e-mails from my own computer...but now I occasionally get an email that looks like it came from my account, but wasn't sent by my computer.

There's also a motorcycle site I visit regularly (a Kawasaki motorcycle forum) that has had an exploit on its opening page for several months, and the administrators can't seem to kill it. Turn out it won't be cockroaches who take over the world when we're gone--it will be computer viruses! (Think...Matrix?)

[Ramblin]

Spammers are always looking for ways to circumvent spam control techniques. So, one of the things spammers value most is relationship data.

If they know that bill@example.com is accosiated with mary@sample.com, they can send an forged email to mary that appears to come from bill with a high degree of confidence that it will not be filtered, and will probably be opened. This email doesn't have to (and probably doesn't) originate at bills computer.

They have a number of ways to get this. Some involve malware (viruses, etc) that steal your address book. Some trick you into voluntarily revealing that information.

Just as an example, here's a scenario. Some websites have cute internet greeting cards that you can send to others. You enter your email address, your friend's email address and pick a card. Suppose you pick a HAPPY BIRTHDAY card from a spammers website.

You have just given them your email, your friend's email, and the approximate date of their birthday. Next year, the spammers can send an email from you to your friend with the subject 'Happy birthday!'. Do you suppose they will open that email? What if it has a link to a malware loader in it? What are the chances they'll click it?

The takeaway here is:

1) The email protocol (SMTP) is older than the internet itself and was not designed with any sort of security in mind. There is (currently*) no sender authentication. So, everything about an email that is immediately visible to the normal user is easily forged. You can not believe the FROM field. Just because it says it's FROM your friend, does not mean it came from their computer. Anyone, using only the software that comes with Windows (or any other operating system), can forge an email that appears to come from anyone else, and send it anywhere. There are no checks* to make sure the sender is who he says he is.

2) Never, ever enter anyone's email address other than your own into any website. It is not YOUR information to give them. How would you like it if your friends gave out your phone number to any yahoo that asked for it? It's the same thing.

3) Never, ever open any attachment or click any link in an email. Only when you have independent confirmation, is this safe. For instance, your friend calls you and says "I just sent you some pictures of our new RV, check your email".

4) Banks, the IRS, UPS, and other similar institutions will NEVER send you emails with links in them asking for your information. Never.

5) Links are easily forged to look like they will take you one place, but actually take you somewhere completely different, even in forums like this. See where this takes you: http://www.disney.com Don't be fooled!

*there is SPF but it is not widely used yet.