Have you heard of phishing attacks? Typically, they are done via spam mails, where the sender wants the recipient to think that the email is authentic, and so are the links within the email. A usual practice followed is to show a hyperlink that supposedly takes the recipient to a known/safe website, but the hyperlink actually points to a similar looking website that would capture the user credentials and other sensitive data. Beware of such links in the email. Use your browser instead. How exactly? Just a minute, I am coming to that.
Another form of phishing is where the user, in an attempt to get to a website, is lured to such a similar looking website, thanks to the typo of the URL (website address) in the browser. For instance, if I mis-type the URL for a website, such as wikipidea.org, instead of the original wikipedia.org, I get redirected to a dubious looking site such as channel-reward-central.com. This one, though, has a look similar to YouTube! But anyway, you get the idea. So, how do we overcome such issues?
For one, use a very little used feature of your browser's - the favorites links. In fact, browsers these days show you a list of frequently visited web sites when you open a new tab. So, that's a good place as well.
But what if you have got a new PC, have installed a new browser, or have just not visited your bank's website in a month, and it isnt saved in your favorites either? Or let's say, what if I want to install Firefox, and i am not sure whether I need to go to firefox.com or mozilla.com? These are situations when your favorite search engine can help as well. Hopefully, you have set that as your home page, or are able to type in the URL with errors, otherwise we are back to square one: goog.com or googe.com for instance is where you shouldn't go. Now, with google.com open, search for the website or the product you are looking for, and the first non-ad link should get you there safely.
Here are some more tips: http://support.google.com/websearch/bin/answer.py?hl=en&answer=8091
Apologies to those who feel this to be a typical case of too many words and too little substance. :)
Another form of phishing is where the user, in an attempt to get to a website, is lured to such a similar looking website, thanks to the typo of the URL (website address) in the browser. For instance, if I mis-type the URL for a website, such as wikipidea.org, instead of the original wikipedia.org, I get redirected to a dubious looking site such as channel-reward-central.com. This one, though, has a look similar to YouTube! But anyway, you get the idea. So, how do we overcome such issues?
For one, use a very little used feature of your browser's - the favorites links. In fact, browsers these days show you a list of frequently visited web sites when you open a new tab. So, that's a good place as well.
But what if you have got a new PC, have installed a new browser, or have just not visited your bank's website in a month, and it isnt saved in your favorites either? Or let's say, what if I want to install Firefox, and i am not sure whether I need to go to firefox.com or mozilla.com? These are situations when your favorite search engine can help as well. Hopefully, you have set that as your home page, or are able to type in the URL with errors, otherwise we are back to square one: goog.com or googe.com for instance is where you shouldn't go. Now, with google.com open, search for the website or the product you are looking for, and the first non-ad link should get you there safely.
Here are some more tips: http://support.google.com/websearch/bin/answer.py?hl=en&answer=8091
Apologies to those who feel this to be a typical case of too many words and too little substance. :)
Well, there is substance in this and a very valid point too.
ReplyDeleteFirst and foremost, the USERS need to be aware of what they need to type to go where. "ignorantia legis neminem excusat". By law, ignorance of the law excuses nobody. :-)
From my 3-4 years of ethical hacking and vulnerability assessment experience, I have repeatedly seen all such "What-Ifs" paying for it. There are phished URLs looking worse than dungeons. You misspell and hit enter, you suffer till you reformat your machine.
USER AWARENESS and ALERTNESS is all that can help. Learn to spell well & don't take wild guess typing the urls. :-)