Search n00bz.net
Wednesday
May122010

Why Phishing Works...

Finding Nemo - pixar photo

If you spend a lot of time online, you're probably aware of phishing scams and know what to look out for. In other words, you're not one of those ignorant types who clicks on links and starts entering personal information without hesitation. Writer and blogger Cory Doctorow is what you might call hyper-vigilant--he keeps unique passwords, uses a VPN when going online in public, and generally knows not to trust strangers. Still, he got phished a couple of weeks ago.

Doctorow's weak moment was a perfect combination of timing and social cues. He had just wiped his account info from his phone and was therefore primed to be re-entering passwords, the URL was truncated in his phone's browser, he was running late, and he was expecting a message along the lines of the one the phisher sent. In other words, most of the conditions that made the attack work came about organically and with very natural explanations; the phisher just happened to randomly attack at the right time.

His point is that it's naive to think you'll never be vulnerable to a phishing attack, no matter how knowledgeable you are about online scams.

...the stars aligned for that one moment, and in that exact and precise moment of vulnerability, I was attacked by a phisher. This is eerily biological, this idea of parasites trying every conceivable variation, at all times, on every front, seeking a way to colonize a host organism. The net’s complex ecosystem is so crowded with parasites now that it is a sure bet that there will be a parasite lurking in the next vulnerable moment I experience, and the next. And I will have vulnerable moments. We all do.

I don’t have a solution, but at least I have a better understanding of the problem. Falling victim to a scam isn’t just a matter of not being wise to the ways of the world: it’s a matter of being caught out in a moment of distraction and of unlikely circumstance.

Some strategies you can employ to minimize the effects of a successful phishing attack:

  • Use unique passwords to limit cross-contamination. I wrote about this last year, and readers quickly added a ton of better advice in the comments on that post. You should also check out Lifehacker for good password tips.
  • Consider using PwdHash. This can be installed as a Firefox add-on or you can use it manually (you can even save the page and js files to disk). It converts your real password into a random string based on the domain you're visiting. What this means is, if a phisher tricks you into entering your password on a spoofed site, the converted password you enter won't be valid. See details here.
  • Don't make a habit of clicking shortened URLs. Of course, there are going to be times where you just have to know what's on the other side. There are tools for Firefox and Chrome that will let you expand shortened URLs to see what awaits you, and today I discovered resolves.me, a website that will return the destination link as well as the HTML code.

"Persistence Pays Parasites" [Locus]



Wednesday
May122010

Story behind Twitters Follow Bug

Wednesday
May122010

DUI in the making

We have all heard "don't drink and drive because you might spill your beer"! This woman used a cup holder. I guess problem solved.

She wonders why her life is a FAIL!

Tuesday
May112010

KHOBE- AV can't save you

http://m.zdnet.com/blog/hardware/update-new-attack-bypasses-every-windows-security-product/8268

Monday
May102010

Cloud Computing killed the Third Reich

The video is a PARODY of a scene in the movie Downfall. This video is part of a larger group of videos that was posted on YouTube. The videos, called "Hitler knows" or "Hitler Meme." If you search, you can find the fuhrer angry over being baned from Xbox Live, His IPad and most recently having parodies made about him.

Constantin Films convinced YouTube to take down the videos, even though the director Oliver Hirschbiegel spoke positive about the fair-use of the video in production of PARODY video.

As explained by Corynne McSherry, an attorney specializing in intellectual property and free speech issues for the Electronic Frontier Foundation, "All the [Downfall parody videos] that I've seen are very strong Fair Use cases and so they're not infringing, and they shouldn't be taken down."

The video above is not my orginal work. However, I think it is funny.

Cloud Computing Risks discovered in WW2