U.S. government employees and Israeli academics: Beware phishing attacks

If you receive an unexpected message displaying this adorable kitten, would you click? Would you reply? Would you open any attachments? After all, it's just a cute kitten!

Or... is it? How do you know?

The correct answer is: You do not. 

What if you receive a flattering message from a journalist who expresses interest in your presentation abilities and shares his or her LinkedIn profile with you? Does that LinkedIn page offer credibility to the sender's real identity? 

No! 

LinkedIn unwittingly hosts countless fake profiles. Some of them are very well crafted and could fool the most seasoned cybersecurity professional. These avatars can sell for upwards $5,000 on the dark web. But, in reality, most imposter profiles are lame because they are created by lazy or amateur hackers. 

How can you tell if a LinkedIn profile is fake? Look for these in the profile:

• lots of groups followed
• few connections
• little activity
• the image is fake - upload the photo to images.google.com to find out!
• little activity posted
• the profile is new

For more information about an old phishing trick that has resurfaced and may be targeting you, see this article: The Iran-linked APT is targeting Israeli scholars and U.S. government employees in a credential-stealing effort at https://threatpost.com/charming-kitten-whatsapp-linkedin-effort/158813/

FBI warns vishing attacks are on the rise

This posting is most relevant to those of you working from home, but vishing attacks can happen to anyone with a phone. If you are currently teleworking, read on.

Most successful cyber breaches start when a human with access to a network falls prey to a phishing attack by clicking a link or opening an attachment in a fraudulent email. Attackers use various social engineering techniques in composing a message that is convincing enough for us to believe it is trustworthy.

But some of these attacks can start with a phone call. Vishing is a term used to describe cyber attacks that start with a phone call—in other words, phishing by voice instead of email. 

This week the Federal Bureau of Investigation (FBI) and U.S. Cybersecurity and Infrastructure Security Agency (CISA) posted a warning about vishing scams aimed at teleworkers. Most start with a phone call from someone posing as a member of your organization's information technology (IT) department. The caller convinces you—the worker—to click a link or navigate to a particular web page that is designed to look like your employer's web site.

If you receive a call from your IT department while working remotely, the best thing to do is politely hang up and call the known number for your IT service desk to inquire if they placed a call to you. Remember that you cannot trust the phone number displayed on your caller ID because it is easily spoofed (faked) to look like a trustworthy number.

For more information see Brian Krebs' article at https://krebsonsecurity.com/wp-content/uploads/2020/08/fbi-cisa-vishing.pdf.

For CISA telework security guidance, see https://www.cisa.gov/telework-guidance-home-users.

For tips about recognizing and avoiding phishing scams, see the Federal Trade Commission (FTC) web site at https://www.consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams#recognize.

Two current Facebook 'bank fraud' and 're-posting' hoaxes

Hello, Facebook users!

Here are two new (or recycled) hoaxes going around that you should be on the lookout for:

• Instant bank fraud warning
• How to post more than 25 friends advice

I'm not a FB user, but according to Naked Security (a trusted cybersecurity company whose blog I follow), FB hoaxes generally take on these forms:

• "danger" warnings
• copy/re-post instructions
• "how to check" your FB security settings

Please remember to treat unexpected messages with skepticism until you've verified their legitimacy with the sender or poster. Being alert to scams and questioning any online post, email or text message that triggers even the slightest sense of danger can save your identity and your financial accounts from being hacked.

Pay attention to your "spidey sense."

For more information, see the article at https://nakedsecurity.sophos.com/2020/07/03/facebook-hoaxes-back-in-the-spotlight-what-to-tell-your-friends/.

Hang up on tech support calls

The "tech support scam" has been around a long time—ever since humans started using Internet-connected computers.

I've posted about this previously but thought this might be a good time for a reminder. With the world news spiraling out of control lately, scammers are keen to take advantage of vulnerability arising from our fear and uncertainty.

If you receive a pop-up on your computer or a telephone call saying there is something wrong with your computer that needs to be urgently fixed, it is a scam perpetrated by imposters who often claim to represent Microsoft.

In April 2020, the Federal Trade Commission (FTC) posted a brief but helpful consumer alert entitled Hang up on tech support calls at https://www.consumer.ftc.gov/blog/2020/04/hang-tech-support-calls?utm_source=govdelivery.

Meanwhile, keep these tips in mind:

• Do not respond to unknown callers. Just hang up.
• Do not let any stranger or unverified caller take remote control of your computer.
• Never share your password with any caller, ever.
• Do not provide sensitive information (SSN, bank account number, date of birth, etc.) to any unknown caller. 
• If you do get a call, file a complaint with the FTC at ttps://www.ftccomplaintassistant.gov.
• Limit the amount of personal information you post on social media.

For additional information, see the Microsoft support page at https://support.microsoft.com/en-us/help/4013405/windows-protect-from-tech-support-scams.

You are at very high risk of getting 'phished' right now

This morning there was an unexpected message in my personal email inbox to click a link and sign in to my new "health portal." It was from a healthcare outfit I'd never heard of, and the sender name displayed was "eCW Patient Portal." There was no doctor's name or healthcare group/facility listed anywhere in the message. So I deleted it.

Perhaps it was legit. If so, I don't really care. The last thing I need is another website login. If one of my healthcare providers truly needs me to log in to their patient portal, I'm sure I'll be informed sooner or later by the trusted source.

Right now, with the COVID-19 pandemic and all the associated new rules that go with it, scammers are having a field day with phishing emails, websites and phone calls. Don't fall for these. Seeing information online (in any form, including video) does not make it real.

There is more fake news, misinformation, and disinformation online than we would like to believe. And it spreads rapidly across social media platforms like Facebook, Instagram and Twitter.

Check out this Wired magazine article about Internet deception (December 2019): https://www.wired.com/story/internet-deception-stay-what-do-now/.

Avoid falling for phishing scams by scrutinizing the sender information as well as the content. Do not click links or open attachments unless you have validated they are safe. When in doubt, contact the sender via an alternate communication channel to validate the message is real.

Even if you know and trust the sender, if anything seems just a tiny bit "off" about the message, trust your instinct and don't click. Every week at work I see at least 10 emails come in from hacked accounts, trying to fool our employees with phishing messages. We train them not to click.

It really is that simple: stop clicking.

Ignore child pornography scares

Hackers will do anything to get your attention, including making threats against you based on fraudulent claims you've been watching child pornography on your computer.

While most of us are a bit on edge right now, as we attempt to adjust to an uncertain new world amidst COVID-19 fears, we need to maintain good sense and not let our fears get the best of us.

Security expert Brian Krebs warns of a new email scam suggesting that someone using your unique IP address or network interface card address ("MAC") has been caught viewing child pornography. The sender name is fraudulently displayed as "Microsoft Support," and the message indicates that your Windows license will be suspended unless you call a particular number to reinstate it.

This story is so far out there that some of you may wonder how people can possibly fall for this scam. But the truth is, given the right state of mind and circumstances, any one of us can fall victim to a social engineering attack. And the elderly and mentally challenged are prime targets for a scam like this.

Always be skeptical of any email containing a threat or false accusation.

For the full article, go to https://krebsonsecurity.com/2020/05/tech-support-scam-uses-child-porn-warning/.

COVID-19 insurance scams

This week at work I found another great site that informs the public about the latest scams. It is the Coalition Against Insurance Fraud at https://www.insurancefraud.org/index.htm.

According to the coalition, the top five COVID-19 insurance scams are:

• Fake "corona" insurance.
• Cancelled health insurance.
• Corona medicines, tests.
• Senior scams.
• Bogus travel insurance. 

To download this infographic and others, visit https://www.insurancefraud.org/Infographic.htm.