Spyware, viruses, & security : Security Watch: When two factor fails
Security Watch: When two factor fails
by Robert Vamosi - 7/14/06 12:32 PMThe following Security Center Weekly discussion question relates to this week's Security Watch column:
Security Watch: When two factor fails
Phishers, senders of e-mail linking to fraudulent Web sites, are poking holes in traditional Internet security and undermining our faith in the Internet itself. In the latest instance, they compromised a supposedly secure two factor authenticated banking system. Read more:
http://reviews.cnet.com/4520-3513-6552837.html
Question:
Seen any good (I mean really good) phishing e-mail? Did it make you want to click? Talkback to me.
Feel free to join this discussion.
I have been tempted, but...
by clsmith - 7/17/06 5:33 AM In reply to: Security Watch: When two factor fails by Robert VamosiI investigate any suspicious email I find in my inbox. I use a pre-McAfee version of SpamKiller which allows me to highlight the potential spam message and view detailed header information. I check items like the server names that it went through, the sending email address and the actual destination address. Any or all of these items send up red flags when they don't look right. If I find it to be a bogus attempt at getting information from me I report it to my ISP. I have caught several phishing messages trying to look like official eBay or PayPal messages and also reported those to the respective parties. You can't be too careful and sometimes clicking these links gives the sending party unrestricted access to your system(s). Thus the reason why I also have a combination of hardware and software firewalls on my DSL connection.
I've seen a couple very 'good' ones
by MichieS - 7/17/06 6:58 AM In reply to: Security Watch: When two factor fails by Robert Vamosihowever, took care first. I also use the excellent ideas in dsmith's response.
I just wish there was a common (well publicized) method to alert/forward such messages to the legitimate website -- like Ebay and PayPal's spoof@xxxx.com -- so they can investigate it. I *always* forward phishes like that to those two sites (unless I recognize that it's a dup of one I've forwarded before -- don't want to inundate them needlessly).
I've tried spoof@ on other phishes but most are returned as undeliverable.
Thanks for bringing this up. Some phishes are *very* clever, and there needs to be an awakening to the dangers.
I tend to be paranoid about emails sent to me!
by dgc49 - 7/17/06 8:21 AM In reply to: Security Watch: When two factor fails by Robert VamosiI naturally mistrust any email sent to me claiming to be from some one who is an account holder of mine and always verify it with the them first. Some times the email was from from a valid account holder and was a valid email, but most of the time it was not. By doing this, I have never been burned yet by giving out my private info to hackers. I can't say that I am sure about the people that handle my account info though. After the feasco over the VA and with some of the Banks, I'm more concerned with the people charged with the security and handling of my accounts. That's where most of the security laspes seem to be happening these days.
I have also seen quite a few very legimate looking ones but
by EZRIDER714 - 7/17/06 9:44 AM In reply to: Security Watch: When two factor fails by Robert VamosiThey all have one thing in common.They are addressed to Dear Member, or User or something to that effect, because they do not have your personal info, that is what they are after.
EZ
Those who do click on phishing
by btljooz - 7/17/06 10:48 AM In reply to: Security Watch: When two factor fails by Robert Vamosie-mails aren't smart enough to come to sites like this to learn about them.
I DO know how to spot them and do NOT open them UNLESS it's to report them to those who are being Spoofed (facilitating SOME of the Phishing that goes on) like, eBay, Yahoo, etc. Sites like eBay, Yahoo, etc. almost always have addresses where you can send Spoofed mail for them to track down and put a stop to.
Paypal Spoof
by Irishkate - 7/21/06 3:03 AM In reply to: Security Watch: When two factor fails by Robert VamosiI have received this same e-mail probably a dozen times. It looks like a Paypal purchase verification. It made me look the first time because it did look real. I now forward them to spoof@paypal.com without clicking on them.
Email phishing scam -
by kassi59 - 7/21/06 3:51 AM In reply to: Security Watch: When two factor fails by Robert VamosiNow this one is to me obvious - but the one thing that they are getting to me with is the close personal information - meaning exact addresses,legitimate church,knowledge of my territory, all that for some would make it sound more believable. Of course you call the church, which I should and havent, but if they are going to be THAT asstute, then why not book the church?! So as when someone calls it just looks even more legit?...Of course there are the obvious 'stop signs', 'Hello', 'hows business', those arent client greetings. Not to mention that my photographic business doesnt do weddings..lol..but! very scary to say the least. Heres the email -
Hello,
How is Business today?
My name is Mrs Dolly Gbabs. I am an handicap and i reside in U.K.
The reason i am contacting you is that my Sons will be getting married soon in Vermont,United States on the 26th of August 2006 and I will like you to take care of the Photographs.
The address for the wedding is at Community Bible Church Assembly of God,2025 Williston Road,South Burlington, VT 05403.
I came across your advert on the Internet and am impressed with your services.
All expenses would be taken care of,Please I want the best service from you, because this is my only Son so I want the best for him. So your best effort is needed at this occasion.
Pls Let me know your price to work for 4 Hours on that day,12 noon to 4 pm in the evening.We want about 40 copies of different photos in coloured form in the church and reception and of both the bride and the bridegroom,their parents, the officiating ministers and our guests.
We want you to work for at least 4 Hours at the occasion.
Also,we will have the photographs snapped at the wedding forwarded to the Publisher of a Magazine Company in United Kingdom so they could feature it in their celebrity journal.
I look forward to your response
Pls email me soon :dollygbabs@yahoo.co.uk
Best Regards
Nearly missed the real thing!
by kgilbert - 7/21/06 5:01 AM In reply to: Security Watch: When two factor fails by Robert VamosiI've become so used to deleting these things that I nearly deleted a real email notifying me that I had won a Palm Pilot. I was about to hit delete when I remembered that I had actually completed the survey in question at a reputable website. I sent a separate email back to the individual in question (with my work address, not home address) and have received my winnings! Don't forget about the boy who cried spoof.
P.S. Sometimes I click on spoof links and enter totally bogus information just to waste their time trying to verify it. Gives me a sense of satisfaction.
PayPal phish
by trilldax42 - 7/23/06 1:34 PM In reply to: Nearly missed the real thing! by kgilbert<<<P.S. Sometimes I click on spoof links and enter totally bogus information just to waste their time trying to verify it. Gives me a sense of satisfaction.>>>
*chuckle* My office's tech was telling me the same. He said he sometimes uses the fields to type out rude messages to them!
I was testing SiteAdvisor a few weeks back, using an email from PayPal. I have no PayPal account. I clicked on the email to see what would happen and there was the ''website'' asking me to log in. Since I could not, I hovered over the icons on the ''page''. Watching the status bar at the bottom of the browser, every icon gave the same result... no data, or some such. I found it highly amusing. And, by the way, even though I like and use SiteAdvisor, it gave me no warnings whatsoever.
Steps to stop phishing
by sumukh - 7/21/06 5:31 AM In reply to: Security Watch: When two factor fails by Robert VamosiPhishers are basically scammers who are after your important details like credit card details, bank account numbrs etc. Please check out
http://www.cheapest-computer-hardware-software.com/securybanks-phishing-trojans.html
It covers Steps to Prevent Phishing.
best regards
Sumukh
how droll. I just got this from "ebay"
by ackmondual - 7/21/06 7:45 PM In reply to: Security Watch: When two factor fails by Robert VamosiWhile I do have a 2nd account on ebay that I use just for forums and don't really have any hard info inputted, this sounds fake anyways.
wadda ya guys think 
=========================
from: eBay Inc. [pw-conf@02.ebay.com]
eBay Security
Dear eBay User ,
During our regular update and verification of the accounts, we couldn't
verify your current information. Either your information has changed or
it is incomplete. If the account information is not updated to correct
information within 5 days then, your access to bid or buy on eBay will
be restricted. Please update your information by completing the form
from the forwarded link :
http://www.multipledad.net/int/
And login to eBay in order to update your informations. As outlined in
our User Agreement, eBay will periodically send you information about
site changes and enhancements.
Visit our Privacy Policy and User Agreement if you have any questions.
Regards,Safeharbor Department
eBay, Inc.
Per the User Agreement, Section 9, we may immediately issue a warning,
temporarily suspend, indefinitely suspend or terminate your membership
and refuse to provide our services to you if we believe that your
actions may cause financial loss or legal liability for you, our users
or us. We may also take these actions if we are unable to verify or
authenticate any information you provide to us.
As outlined in our User Agreement, eBay will periodically send you
information about site changes and enhancements. Visit our Privacy
Policy and User Agreement if you have any questions.
Copyright © 2007 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective
owners.
eBay and the eBay logo are trademarks of eBay Inc.
Phishing
by Marianna Schmudlach
- 7/21/06 8:28 PM
In reply to: how droll. I just got this from "ebay" by ackmondual
EBay/PayPal Email Scam - 'Phishing'
http://www.zincweb.co.uk/scams_news_ebay_paypal.htm
Report it to Ebay!!!!! ;)
by btljooz - 7/22/06 11:02 AM In reply to: how droll. I just got this from "ebay" by ackmondualFind out for SURE! Send it to Ebay:
spoof@ebay.com
Forward that WHOLE e-mail to that address. Within minutes Ebay will send you first a confimation that they recieved your report, then they will send you information about that letter as to whether it is legit or not.
already done. Here's their response (surprise, surprise)
by ackmondual - 7/22/06 2:03 PM In reply to: Report it to Ebay!!!!! ;) by btljoozHere's Ebay's response below if anyone's interested.
I consider myself lucky. Between '99 through '03, I've accumulated so much ad/spyware and other malicious stuff that it rendered my hardrive permanently defective, or at the very least, it went defective on its own, but even if either wasn't the case, the 'bad stuff' was slowing my PC down sooo much that it was close to unusable anyways. Since then I've gotten some advice on avoiding this for the future and have been using 2 - 3 anti ad/spyware apps and firewall in addition to an AV app.
I'm surprised I've never attempted to be gotten phished. I suppose having some, but only few online purchase accounts back then helped, but a couple of them in '02 did include Ebay and Amazon. However, I was pretty good at spotting junk mail at the very least, so if not knowing that some of them were actual spoof emails, I probably ended up avoiding them altogether.
===============================================
Hello,
Thank you for writing to eBay regarding the email you received.
Emails such as this, commonly referred to as ''spoof'' or ''phished''
messages, are sent in an attempt to collect sensitive personal or
financial information from the recipients.
The email you reported was not sent by eBay. We have reported this email
to the appropriate authorities.
In the future, be very cautious of any email that asks you to submit
information such as your credit card numbers or passwords. If you are
ever concerned about an email you receive from eBay, simply follow these
steps:
1. Open a new Web browser and type www.ebay.com into your browser
address field to go directly to the eBay site.
2. On eBay, click on the ''My eBay'' link at the top of the page and sign
into your account.
3. Check the ''My Messages'' link located on the left side of the My eBay
page. If an email affects your eBay account, it's now in ''My Messages.''
Any email sent to your registered eBay email address from eBay or from
another eBay member via eBay's member-to-member communication system
will also appear in ''My Messages.''
Just remember, if you get an email regarding a problem with your account
or that is requesting personal information, and the email looks like it
is from eBay, please check My Messages first. If it's not there, it's a
fake email.
If you still have any doubt about whether an email message is from eBay,
please forward it to spoof@ebay.com immediately. Do not respond to it or
click any of the links. Do not remove the original subject line or
change the email in any way when you forward it to eBay.
If you have already entered sensitive personal information, financial
information, or your password into a Web site based on a request from a
spoofed email, you should take immediate action to protect your identity
and all of your online accounts. We have developed an eBay Help page
with valuable information regarding the steps you should take to protect
yourself.
http://pages.ebay.com/help/tp/isgw-account-theft-reporting.html
To review eBay's new tutorial about Spoof Emails, please see the
following Web page:
http://pages.ebay.com/education/spooftutorial/
To help you better protect yourself from fake eBay and PayPal Web sites,
we have developed a feature for the eBay Toolbar called ''Account Guard.''
Account Guard includes an indicator of when you are on an eBay or PayPal
Web site or a known spoof (or ''phishing'') site, buttons to report fake
eBay Web sites, and a password notification feature that warns you when
you may be entering your eBay password on an unverified site.
To learn more about the eBay Toolbar with Account Guard, please go to
www.ebay.com, click on ''Downloads'' at the bottom of the page, and then
click on the ''eBay Toolbar'' link.
We also recommend that you keep your browser, operating system, and
virus protection software up to date. Check for updates at the ''Windows
Update'' link on www.microsoft.com and scan your computer for viruses
often.
Once again, thank you for alerting us to the spoof email you received.
Your efforts help keep eBay a safe and fair place to trade.
Regards,
Ande
eBay SafeHarbor
Investigations Team
______________________________
eBay
The World's Online Marketplace! ®
*******************************************
Important: eBay will not ask you for sensitive personal information
(such as your password, credit card and bank account numbers, Social
Security numbers, etc.) in an email. Learn more account protection tips
at:
http://pages.ebay.com/help/confidence/isgw-account-theft-protection.html
_____________________________________________
For our latest announcements, please check:
http://www2.ebay.com/aw/announce.shtml
_____________________________________________
In order to better serve you, we'd like to occasionally
request feedback on our service. If you would rather
not participate, please click on the link below and send
us an email with the word ''REMOVE'' in the subject line.
If that does not work, please send an email to the
email address below. Your request will be processed
within 5 days.
mailto:cssremove@ebay.com
*******************************************
| Forum legend: | |
 |
Locked thread |
 |
Moderator |
 |
CNET staff |
 |
Samsung staff |
 |
Norton Authorized Support team |
 |
AVG staff |
 |
Windows Outreach team |
 |
Dell staff |
 |
Intel staff |
