Watch out: ɢoogle.com isn’t the same as Google.com

It isn't unusual for bad guys to buy fake domain names that resemble real ones. Often they use simple character substitution.

For example, in h0medep0t.com, you'll notice there is a zero (0) where there should be a letter O. Although this example looks pretty obvious, often we don't take time to scrutinize what's in the address bar of the web browser.

Or, we jump to the link without looking closer, such as in an email or a text message where the real URL doesn't match up with the link displayed. In most email programs, like Microsoft Outlook, you can hover over the displayed link with your mouse cursor to see the actual web location that the link redirects you to—the URL—but this feature isn't available in all operating systems or in all email clients. You won't necessarily have this ability on your smart phone or web email client, for example.

This is why I don't click links sent to me—even from people I know—without scrutinizing them first. Here is a PCWorld article with more information about validating links: http://www.pcworld.com/article/248963/how_to_tell_if_a_link_is_safe_without_clicking_on_it.html.

Here is more about the Google scam. Scammers use a domain name that looks like Google.com but isn't: ɢoogle.com. Look at the "G." It isn't a standard letter that you'd type on a keyboard. It is actually a symbol, which uses a different character set. International (or extended) characters like this one are rendered on your computer screen by typing a specific combination of keys and numbers on a standard keyboard.

For more info, do a web search on the phrase "character set."

Here is the full article about the bad ɢoogle.com:
http://www.analyticsedge.com/2016/11/heres-a-secret-%C9%A2oogle-com-is-not-google-com/.

Beware fake phone calls from "customer service"

It cannot be said enough: hang up on callers whom you do not know, especially if they are trying to elicit any information from you. Better yet, if you don't recognize the phone number of the caller, don't pick up. Scam artists are less likely to try again if you're not answering.

Protect yourself and your employer by taking advantage of Caller ID service on your phone. Personally, if a call comes in to my cell phone from an unknown number, I let it go to voice mail.

It seems there is a new phone scam every day. Reported by Trustwave this week is a ruse that targets hotel and restaurant chains. This scam is perpetrated by a known cyber criminal gang that employs very convincing social engineering techniques like name-dropping and familiarity with other "insider" knowledge about your org chart.

When the caller reaches the hotel or restaurant's customer service line by phone, he/she claims to be a client who cannot log in to the reservations system. The caller may claim to know your boss or C-level executive.

Remember that this type of information about your company is available on the web to anyone. It takes little effort to mine LinkedIn profiles and gather intelligence about your organization's personnel structure.

An email is sent to the customer service rep with a malicious Microsoft Word document attached. When clicked, malware is executed behind the scenes that provides access to the company's credit card database and other sensitive information.

Click here for the story: This malware attack starts with a fake customer service call. When in doubt, just hang up!

Election scams - Don't fall for them

It is officially election week in the United States. This opens up lots of opportunities for social engineers and crooks to take advantage of voters. Emotions are high right now, making it tough for us to be at our best, but this is exactly the time to be vigilant.

Be on the lookout for online scams and, as a rule, just don't click. Phone scams abound too—just hang up.

For example, if you receive a message inviting you to vote by texting, forget it. Delete the message. You can't sit in your living room and click a link to vote—at least, not this year. You also cannot vote by phone.

Stay on the lookout for last-minute "urgent" messages saying that your voter registration has expired or your polling station has moved. Ignore requests for last-minute donations to win the election in your party's favor.

Another good way to be duped is through fake email messages purporting to deliver the latest election results. Do not click links or attachments! If you want to know the latest, navigate to your favorite news site in your web browser, or turn on your TV. Don't ever expect emailed or texted links about news articles to be legitimate.

For more information, see the November 3 Huffington Post article: Watch out for these last-minute election scams.

Stop. Think. Do not click!

IRS form CP2000 scam and Hurricane Matthew scams

If you receive an email with an IRS CP 2000 form and a claim that the income reported on your tax return does not match the income reported by your employer, it is a scam. The message may also indicate that your issue is related to the Affordable Care Act. 

Of course, the IRS will never initiate contact with you to collect overdue taxes by email, text message or phone call. If you receive such a text or email, don’t respond. If they call, hang up. If you receive a CP 2000 form in the U.S. mail and you question whether it’s legit, call the IRS at 1-800-366-4484.

Also, watch out for scam and malware messages related to the hurricane. One bogus email that is being distributed now claims that you can click a link to find out about power outages in your area. Other Hurricane Matthew related malware messages may be distributed in the coming days and weeks, including requests for donations. Emails or social media posts may offer links to read news reports about the hurricane. Even if these messages appear to come from CNN or another news outlet, don’t trust them. Stay alert!

Yahoo account holders, you need to do more than just reset your password

By now everyone has heard of the 500 million Yahoo accounts that were hacked and leaked online. CNN story here.

What to do

Of course, if you have a Yahoo login that you use for any purpose (e.g., Yahoo email, Yahoo groups, Yahoo shopping, etc.), you need to navigate to Yahoo.com in your web browser and reset your password to a strong password. While you're at it, reset your security questions and answers and enable two-factor authentication using Yahoo Account Key.

See these Sophos tips for creating passwords. If you're really ambitious, you can take it one step further and use unique user names for the sites that hold your most sensitive data.

What not to do

Do not use that same user name and password combination on any other sites.

What else?

Be on the alert for phishing emails that exploit this "world's biggest hack" story. Scammers will try take advantage of situations like this by emailing users fake messages that are designed to steal your login credentials or banking information.

If you get any email related to the breach, just delete it. Don't reply to it, don't forward it, and don't click any links or open any attachments in the message.

New type of tech support fraud: Email tells you to call toll-free number

In the last few years, web service providers like Google, Yahoo and Facebook have started sending emails to users to warn them when there is a possible security risk to their account, like an impersonator logging in from an unknown computer.

In the past, bad guys would copy these emails into phishing messages that trick you into logging in to a fake website where they steal your user name and password. Now, these fake security emails give you a toll-free (800) number that they claim you need to call immediately.

If you call the number, two things could happen:

• You get to talk with a real cyber criminal, typically with a foreign accent, who tries to scam you. He or she claims there is a problem with your computer then "fixes" it and asks for your credit card info. 
• You get sent to to voice mail or are put on hold until you hang up, but your phone number was recorded and stored in a queue; the bad guys then call you back and try the same scam. 

Remember, if you get emails that either promise you something that is too good to be true, or provoke you to act urgently in order to prevent some type of negative event, stop! Think. Don't click... or, in this case, don't pick up the phone.

If you ever need to call a vendor, use your web browser to navigate to the trusted vendor URL and call the number listed on the legitimate web page. Never use a phone number provided in an email.

Here is a link to a sample (and humorous) fake phone call, click here: http://cdn2.hubspot.net/hubfs/241394/phone_phish.mp3.

Beware email with .DOCM or .DOCX (Microsoft Word) documents attached

According to FireEye, the strain of ransomware called Locky resurfaced a few weeks ago. If you click the Word document attached to the Locky email, it runs a program that encrypts all your files, renaming each with the .locky extension. You have to pay up to get the decryption key that restores your files.

Below are screen shots of sample Locky ransomware emails. For a better view, click the image here, or go to the FireEye article at https://www.fireeye.com/blog/threat-research/2016/08/locky_ransomwaredis.html.

A new variant reported three days ago in the SANS ISC InfoSec Forums uses the subject line "Transaction details." While the email generally looks the same as those pictured here, the attachment is a ZIP file containing a compressed Windows Script File (.wsf).

Any time you receive an email from anyone that contains an attachment or links, stop and take your hands off your mouse and keyboard. You do not want to click anything that is even remotely suspicious or unexpected. When in doubt, delete.

For more information, see "Locky" ransomeware - what you need to know.