How do I know if an email is a phishing attempt?

The heading of this blog is one  of the questions I am asked quite frequently in my security and password sessions. Specifically, how I tell personally,  if an email is a phishing attempt- and what advice I give for managers to take back to their teams and any future staff around dealing with phishing attempts. Phishing and preventing people from being taken in by scammers is something of a focus for us – we’ve even previously written about phishing on this blog specifically from a small business perspective Phishing: The Small Business Lowdown. So we’ve put together our Phishing Check List for business teams.

Whilst not exhaustive by any means, this list has served me, and my team well.

Here’s my check list –  if something doesn’t look right to me, in my inbox , this is usually how I evaluate and deal with it. Admittedly, the items have become second nature – so I don’t necessarily need a physical check list – but in case you, or your staff do – there’s a downloadable printable PDF at the end of this article.

There are 7 points – the detailed explanations follow.

Check List

  1. Are you expecting this email?
  2. Does the “From” email address look legit?
  3. Is there a misplaced sense of urgency in the email ?
  4. Google Search is your friend. Use it.
  5. Are there multiple typos, and massive grammar inconsistences in the email?
  6. When you hover over the link (or links) what does the preview show you for the address?
  7. If all else fails – check with the company that appears to have sent the email.

The Detailed explanations

  1. Are you expecting this email ?

Email is used to validate identity when new accounts or profiles are created , so often you may be sent an email with a “validation” link in it to confirm your email address and thus if you have just signed up for a new profile or online shopping account – then, yes, the email may be expected. And it’s highly unlikely to be a phishing attempt. Don’t overthink this one. If you’re not expecting a validation email, or a confirmation of identity for anything, then move on.

  1. Does the From email , in all its variations look legit ?

Most email clients (the programs we use to read and work with emails , rather than the actual email exchange ) have tools where you can look at the details of the sender – it can be confusing as sometimes there is a “via” or the reply-to email looks different . Generally what you want to see here is that the email address you see in the name, has the same domain as the company or the sender, and that the reply to address isn’t necessarily completely different. Also if there is a “via” displayed that makes sense.

It’s not always a problem if the email has come via another channel – for example Bank of Melbourne emails are sent to their clients via the St George email servers, so they all arrive with “via stgeorge.com.au” in the from address. Again – it’s not a problem if it makes sense, and you know that the company details are correct.

 

Phishing emails sometimes come via a channel that they do not belong to- it’s a warning flag if you see a “via” in the From address that doesn’t make sense and doesn’t look legit.

 

3. Is there a sense of urgency, related to a deadline or time limit that feels wrong.

Assuming that this is not a validation email of some kind ( see 1. ) that you are expecting , another red flag is when an email purportedly from a bank or another financial institution arrives, demanding a login, for security purposes – and there is a limit or a deadline associated with this login.

Creating a false sense of urgency by threatening to cut off access is a very big warning flag. Assuming that you have not been ignoring notices for weeks from the company in question (don’t laugh, people don’t read anything that comes from a Corporate, even the legit stuff)

  1. Google Search is your friend. Use It.

When in doubt about the sender, the reply-to or the via – use Google Search to find out info about the company and the details shown.

As an example – if you did not know that Bank of Melbourne emails are sent via St George – go to google search and type in “ Connection between St George and Bank of Melbourne” – the search results should verify that

a) yes there is a connection between the banks and

b) in fact Bank of Melbourne is simply a rebranded St George …

which means that – we can safely assume the via stegorge.com.au is not a problem

  1. Is the email badly written ?

Emails and communications go through several layers of checks and several different team members and managers before being signed off, and then sent. This is particularly true in larger corporates.

Spelling errors, and incredibly bad grammar are almost guaranteed not to happen.

It’s a massive warning red flag when there are a large number of typos, spelling errors and bad grammar in an email that’s meant to be coming from a corporate.

  1. What does the link Preview tell you?

Most browsers will show you a preview of the link if you hover your mouse over the link or button – it looks like this –

Screenshot of Learn More link from an email with the URL displayed by the mouse hover

Occasionally you can’t do this as  the links are shortened by services such as Goog.ly or Bit.ly – however, if they are not shortened then, you can see where you’re going before you click.

  1. Check on the website for the vendor, or call your contact

After all of that – if you’re still not sure – either go directly to the website, login and check for any notifications , or pick up the phone and call whomever you normally speak to.

If the email is from a bank, or larger company – call up their call centre – and ask about the email. If it’s legit, they’ll be able to help you with the details.

Phishing Check List

There you have it – the list , plus explanations of the steps we follow to assess a suspicious email.

Opt in below ( to be notified about our corporate and business team training and workshops ) – and we’ll send you a printable copy of this checklist ( 4 copies per A4 Page).


What you need to know about BadRabbit malware

Here’s what’s important to know about BadRabbit malware - if you’re a business owner

BadRabbit is ransomware

If infected,  your computer will be locked down , and you will be extorted to pay money ( currently around $300 or equivalent in bitcoin)

There are 2 ways that it spreads

Primary infection on a network is via infected websites - it then secondarily spread through that network  via a leaked NSA exploit in Windows Operating systems ( not dissimilar to  WannaCry)

What’s that in plain English ?

You, or your staff, will most likely be exposed to it by browsing the web, and coming across an infected website - where you will see a popup that looks like you’re being prompted to download and install an Adobe Flash Update

If your computer is on the company network ( example a business with an internal network of computers ) - then the malware spreads across the network in a very similar way to WannaCry (via security weaknesses or gaps in  Windows XP / Vista / 7 and Windows Server 2003 and 2008 systems. ) The exploit that does this is called EternalRomance, and if this is all sounding familiar , it should be , because WannaCry spread by using an exploit called EternalBlue . Both the Eternals are from the NSA and were leaked out into the wild with devastating consequences.

Where does BadRabbit come from

Current general consensus is most likely it comes from Russia - it appears to be targeting corporates and government installations in the Ukraine and surrounding countries.

Why should you worry ?

Yes, it’s not spreading as fast WannaCry - however because the internet is global and open if you do any kind of shopping online, or global website browsing , you could be at risk of getting infected. 

Risk Points 

Windows software that is not patched or updated regularly - any computer running Windows Vista or XP, and staff that are "too busy" to critically evaluate the messages and popups that they see when browsing the web , especially if their job involves doing any form of online research or searches.

Tips for your staff :

  • Don’t download Flash from any website except Adobe - ignore pop up messages that looks confusing
  • Don’t buy  or order goods and services on a website that does not have a green padlocked SSL
  • Don’t work in older versions of Windows Operating Systems - and specifically move away from Vista, XP and Windows 7
  • Always keep up to date with your Windows security Patches.

What can you do on your website to prevent or mitigate this ?

  • install a business grade Organisational Validation, or Extended Validation SSL certificate
  • Ask your developer to mitigate  that Javascript  injection is prevented on your website.
  • If you have a wordpress website, ensure that comments can only be loaded by verified user accounts and have to be moderated or approved so you can delete the spam and suspect ones.  

 


Image of Steph speaking at an event overlaid with the Rocking Rose Red filter and content depicting the most common 5 passwords of 2017

And the winner is ....

Every year we get to read all about the most common passwords of the year before. This release of info comes from several different companies who compile the information based on the known hacks of the previous year.

In this blog - I'm referencing a company called SplashData .

Their 2017 list was published late in December - and there are some doozies ( as per usual ) on the list.

We published the top 5 in an insta post.

Notable additions to the list ( since previous years) point to pop culture references - such as "starwars"

A note on using pop culture references in your passwords : Don't. Just, Please - Don't. 

Hackers run through these common pop culture references as a matter of course - in addition to trying  all the common standard ones like 12345, or Password.

And in case you're thinking your IT guy said to do letter and number substitutions :P@ssW0Rd is no more secure than pa55w0rd. Because the substitutions are easy to predict, and even easier to check all the permutations with a simple algorithm.

So here's the list of the top 25 for 2017, as released by SplashData - and again, our advice remains the same - find a Password Manager and/or  Generator, and get comfortable with using it. Because your dog's name, your children's names and Birthdays, and your previous 3 houses or the suburb you grew up in are not safe to use as passwords.

1. 123456 (Unchanged)

2. Password (Unchanged)

3. 12345678 (Up 1)

4. qwerty (Up 2)

5. 12345 (Down 2)

6. 123456789 (New)

7. letmein (New)

8. 1234567 (Unchanged)

9. football (Down 4)

10. iloveyou (New)

11. admin (Up 4)

12. welcome (Unchanged)

13. monkey (New)

14. login (Down 3)

15. abc123 (Down 1)

16. starwars (New)

17. 123123 (New)

18. dragon (Up 1)

19. passw0rd (Down 1)

20. master (Up 1)

21. hello (New)

22. freedom (New)

23. whatever (New)

24. qazwsx (New)

25. trustno1 (New)

#ForReal.

Here's 4 suggested Password Managers and Password Generators - there are heaps - the key is to find one that you are comfortable using.

LastPass 

1Password

Dashlane

SplashData (Splash ID personal -- they do have a business version)


Phishing : the Small Business Lowdown

So, you got this email the other day from AGL , or perhaps one of the big banks , Westpac maybe. And the strangest thing happened when you went to login and verify your account because there was apparently an issue , and you needed to confirm some details for them.

You seemed to be creating everything from scratch - so strange - and then something just felt wrong , as you were about to click on that submit button.

So you glance up at the URL - and HOLEY MOLEY - you're not on the AGL/Westpac/Banking website anymore !

Come to think of it , the logo does look very second hand , a bit blurry maybe .

So you close the browser - and thank your lucky stars that you stopped in time.

And that, is the story you tell at the BBQ about how you came *this close* to being caught in a phishing scam. Your identity nearly compromised.

And that email was so good - you could barely tell it wasn't real.

Here are some Rocking Tips for avoiding being caught up in a Phishing scam, as best you can.

  1. Always go directly to the website in a new browser to access and check your account when you get an email about your account that looks suspicious.
  2. Never click on the links in emails from Banks , or other large companies - there are very very few instances where you will need to do this ( see 4)
  3. The only time you click on links is when you are expecting the email - for example when you first open an online account, you will sometimes be sent a verification email to confirm that own the email address - in this instance , you will click on the link , because you are expecting that email ( and its highly unlikely that you are being targeted by a phishing attack within minutes of signing up for something new.
  4. Check the email address where the email came from -- don't just look at the display , open up and inspect the details of the Sender to ascertain if the email is correct for the company represented

Definition of Phishing with steph n the background reading something on her phone at a coffee shop


DDOS : Distributed Denial of Service

Once you have a website for your business, one of your worst nightmares becomes the fear that your website is down.

Today's post is a quick snapshot of one the nasties that could potentially bring your site down - and a couple of recommendations to prevent it ( as much as you can)

So, lets talk about a Distributed Denial of Service ( or DDOS)

What is that ?

In plain english , it's when attackers send so much traffic, from multiple locations ( distributed) to your website, that your server cannot cope with the requests, and eventually it shuts down. While this is happening, your site may slow down dramatically, making it very difficult for genuine clients and prospects to view and interact with your website.

Why do they do it ?

Most DDOS attacks are aimed at government or large companies - from "hacktivists" or people trying to make a political point.

If you are attacked by a DDOS , its likely to be because your IP address is in the same range as a target of interest - because once launched, the attacks are mostly automated by malware and bots.

What can you do about it ?

Mostly - there's not much you can do to stop attacks from hitting you - but you can put measures in place to cope with an attack.

Here are my top two tips to mitigate and prepare for an attack.

  1. Take a Multi layer approach to security mitigation
    • Server level - explicitly ask your hosting company to confirm what measures they take to mitigate
    • Website Framework ( eg Wordpress or Joomla ) - you may want to add a security plugin
  2. Make sure your server host or web developer updates all security patches as soon as they are available
    1. If you do this yourself - then set an appointment weekly to check and run all patches

Password Managers are not a laughing matter.

What is a Password Manager ?

It’s a tool that you use to Store, Create and Manage Passwords across your accounts and multiple devices.

How do they Work ?

On a browser , you will install a plugin to the browser that will prefill the passwords for you , when you are logged into the Password Manager.

They are also available as apps across most smartphones and tablets, where you will be able to copy the password from your Password App and use in a mobile browser or app. There is usually a time limit on the app version , which will delete the password from your clipboard after a minute or so.

Why do you need one ?

  • It’s hard to keep track of all your passwords
  • Re-using passwords is not a good idea ( but we do it because of the aforementioned point re how hard it is to keep track)
  • They can randomise passwords ( ie you only need to remember 1 password and all the others are random anyway)
  • You will never need to reset a forgotten password again ( provided you haven’t lost the login or saved the wrong password to start with)

 

My top 2 recommendations :

Mac  users - 1Password , which has a much slicker UI and works better on Mac than LastPass.

Windows users : LastPass works well across windows environments, also has a decent app for the iPhone and iPad - the Mac experience is a bit clunky