I read a really disturbing article on Wired yesterday about how internet service providers (ISPs), including some biggies like Earthlink, have been unwittingly complicit in helping these nasty scammers steal passwords, credit card numbers, and account information from unwitting 'net users - or they download small programs on the computer without you ever knowing. The ISPs thought they'd found a clever way to make a little extra ad revenue off mistyped domains. Instead, scammers were hijacking a security hole in their process to make illegitimate domains look legitimate to would-be victims.
Just this past week, our CEO Don got a very targeted bit of phishing: the hackers were only sending their emails to presidents and CEOs of companies, in the guise of an official subpoena (using uscourts.com rather than uscourts.gov as the domain name -- clever). Fortunately for us, our Fraud Prevention Manager, Shawn Moylan, is on top of the latest schemes and had already given us the heads-up, and Don was aware enough not to click. This email would have downloaded a trojan horse program onto Don's computer - one that even updated virus software would not have caught. Ouch.
In 1996, I was a volunteer in AOL's community area that dealt with the first password-phishing schemes (it was actually a trip to read that Wikipedia article I linked above and go down memory lane about that!) Educating AOL's members about never giving out your password or credit card information online was trickier than you think. The internet was as new to most people as a 33.6 dial-up modem in your shiny new 486 PC running Windows 3.1, and an AOL 2.0 diskette that you picked up at the grocery store. The idea of online security and things like viruses were simply unheard of. If someone sent you an email or instant message, said they were an AOL employee, and told you to click on a link and put in a password or credit card number - well, chances were in those early days that you'd believe it. Fortunately, we had a great group of volunteers (some of whom, like me, later worked for AOL) that got people educated as quickly as possible on the dangers of clicking on random links. Later, I worked on a team that developed education for eBay's and PayPal's users about account phishing, where we saw the phenomenon of the URLs that *almost* looked like eBay's, and HTML pages that were dead-on knockoffs of legitimate eBay pages. Tough times, those, and eBay still struggles mightily to stay one step ahead of the criminals and keep their customers educated on how to avoid being phished.
A certain innocence persists even among the most jaded old internet veteran - and I'm probably referring to myself there - about the intentions of people on the web. Too often we're lulled into a false sense of security by our antivirus software, for instance. When's the last time you updated yours? (Nudge to you if it doesn't update every day.) And if you say you don't have any at all, may I heartily recommend the free and easy to use AVG Anti-Virus and Anti-Spyware suites. And even if you DO update every day, situations like what happened to BigDog come along often, where a virus never seen before in the wild attempts to visit you before an update can be created. The German technology publication Computertechnik tested 17 leading antivirus solutions in January 2008 and concluded that the detection rate of new malware was between 20% and 30%. PC World found similar results in December 2007. Even with the best, most up to date, anti-virus software out there, 3/4 of the malware will go undetected. As Mad-Eye Moody said in the Harry Potter series, "Constant Vigilance!"
Phishing is as old as the public Internet; scammers keep having to find new and improved ways to steal your information, but they aren't going to stop, so it's important to know how to protect yourself. I recommend this informative and concise article to get your thinking cap on about keeping your computer and your information safe: 44 Ways to Protect Yourself.
Anyone have any stories about being phished, or the successful sidestep of such a scheme? It's a topic of great interest to me (if this ramble didn't convince you of that, I don't know what will...) Let me know!
