A Phishing Expedition Trivia Quiz

Answer: Social engineering

Phishers may use a high-tech medium for their scam, but the con itself is ancient. "I'm trustworthy and important," their messages try to say. "If you'll just tell me everything, I can help you out." Like scammers from time immemorial, however, phishers plan to help only themselves.

They adopt the guise of some trusted institution and coax the victim into revealing secret information, like a password or a credit card number. The phisher can then use that information to pose as the victim and cash in. E-mails and websites designed to lure the "phish" can employ surprisingly sophisticated psychological techniques. Come with me to take a peek into their toolbox ...

Answer: Hacking telephone services to make free calls

In its heyday, hackers saw phone phreaking as an honorable pursuit, an intellectual game rather than a serious attempt to steal services. With enough knowledge of electronics and protocols, and the right set of tools (particularly the famed "blue boxes"), a phone phreaker could prove his or her worth by outwitting the telephone company. Changing "freaking" to "phreaking" gave the phrase a pleasing visual alliteration, and a new spelling tradition was born.

The use of "ph" survived the transition to the online realm.

Answer: No. It points to a page on phish.com, not on YourBank.com.

It's handy to be able to interpret a domain name, which is the part of a URL that comes after the http://, but before the next set of forward slashes. You read them right to left. The rightmost part -- something like .com or .gov -- is the top-level domain.

Some of these (like government or military domains) are legally restricted, but most are available for anyone to register a site, as long as the name you want isn't taken and you can pay the small fee. The name of the site comes right before the top-level domain, as in funtrivia.com. Anything further to the left just points you to a particular place, or a specific server, on the site. So if you're trying to get to YourBank, the domain name had better end in YourBank.com -- YourBank.phish.com is just a part of the phish.com website, with a name that's designed to fool people into clicking on it.

Answer: If you type a lower-case O next to a lower-case O, it looks like the number 8.

In this technique, the URL of a "bad" site is chosen to bear a close resemblance to a legitimate site. Sometimes, it's chosen to entrap careless typists: a phisher might register BankOfCellarDoor.org to catch people who meant to go to BankOfCellarDoor.com.

In other cases, the spoof is designed to look right under a quick inspection. For example, in a research study, scientists were able to ensnare a large percentage of their study subjects with a link to the Bank of the VVest: "vv" may look like "w", but that link didn't take them to the Bank of the West. Be alert if you click on e-mail links; what seems like a small difference to a human being makes a big difference on the Internet.

Answer: The displayed text for the hyperlink doesn't match the place it links to.

In HTML, a hyperlink is divided into two components. First, there's the URL, or address, that you're linking to; this is where you go when you click on the link. Then there's the label or title of the link; this is the text that typically appears underlined and in blue. The Internet is a much more friendly and usable place because this is possible; it's much nicer to access this quiz via a link that says "A Phishing Expedition" rather than via a link that has to incorporate all the internal FunTrivia paths and identification numbers and so on. The downside is that an unscrupulous person can make that label misleading - like another URL that's unrelated to the actual linked address.

In most browsers and email programs, you can get the real scoop by hovering your mouse over the link, without clicking. The actual destination of the link - its "target" - should be displayed, either in a little bubble where your mouse position is, or in the lower left-hand corner of the window. But the much simpler rule of thumb is, again, never to click on an email link you weren't expecting!

Answer: Typing https:// in front of the site address

SSL connections are designed to prevent man-in-the-middle attacks, in which someone in between you and the desired website (maybe at your Internet Service Provider or in your neighborhood) intercepts the communications you're sending back and forth. SSL opens up a secure tunnel between you and the other party -- and, as a bonus, it can authenticate either side. Here's how the authentication typically works. You type in https://www.BankOfCellarDoor.com to indicate that you want a secure connection with the Bank of CellarDoor. While setting up the tunnel, the bank sends you a certificate, which shows that some central Certificate Authority agrees that this outfit is the one true BankOfCellarDoor.com. Your browser, or your operating system, decides whether the certificate is valid and comes from a trusted company. If not, it gives you a warning; if so, it opens the connection, which will be marked by an https:// in the site address and a padlock symbol somewhere on the browser.

SSL connections are a good sign; it's not a good idea to enter your financial information into a non-SSL site. They aren't perfect, though. BankOfPhishers.com can probably get a certificate in its own name, because they are who they say they are; the certificate doesn't say anything about virtue, only identity. Some Certificate Authorities aren't particularly trustworthy themselves, and some have had certificates stolen. And some legitimate websites encourage bad habits by having users log onto a non-SSL page with completely worthless pictures of locks sprinkled around it. Unfortunately, while checking for SSL gives you a good clue to the trustworthiness of a page, it isn't conclusive.

Answer: False

Sometimes there are obvious clues that a phishing attack is underway. A careless phisher might quickly type up e-mails no bank would ever send, with unprofessional mistakes in spelling and grammar. ("You're acount have been suspended," for example.)

A slicker phisher, however, can produce a very polished facsimile of the real thing. A website's look and feel are encoded in HTML (hypertext mark-up language), and the underlying code is sent to web browsers so that they can render the site properly. This code is not secret! The phisher can also copy and re-use images. If there are slight differences, the victim is likely to assume that the legitimate site has done a minor redesign. It's easy to be taken in.

Answer: Spear phishing

Just like a fisherman might target an individual fish with his spear, a spear phisher targets an individual recipient or a small group of recipients. To make this work, the spear phishers need to have some outside source of data. For example, they may know that you do your business with a specific bank, or that you recently bought a high-definition television, and that you might be vulnerable to e-mail that claims to come from the bank or from the TV manufacturer. They might take information from your employer's website, or the Facebook or MySpace pages of you and your friends, to help them make it appear as though the e-mail is from someone you know.

Spear phishing attacks can be very clever and easy to fall for. Remember, if you receive an unexpected e-mail that asks you to do something you're uncomfortable with -- like sending back a password or your financial information or open a strange-looking attachment -- it's better to be safe than sorry. Contact the person who supposedly sent the email and check whether they really did!

Answer: The user's signature

It's tempting to think that an account at, say, TheGenericStore.com doesn't need much security. After all, it's a place for browsing and buying, not for doing your banking; it seems either more anonymous or less important than MyBankAccount.com. However, an attacker can still get quite a lot by phishing account holders at the Generic Store. For each success, our anti-hero has someone's name and password, which -- let's be honest -- he or she probably uses for at least one other website, too. (And maybe that website is a bank...) The phisher has the user's e-mail address, and very likely a real name and real address, too, which can be used for identity theft: posing as someone else in order to open accounts and get credit.

Finally, if the Generic Store saves credit card information or PayPal details, a successful phisher may be able to exploit the data to make unauthorized purchases. In short, it's a good idea to exercise caution everywhere on the Internet -- not just on banking sites.

Answer: Click on the provided link

Phishers often try to create a sense of urgency: if action is required NOW, you're more likely to follow their directions without taking time to think about it. Likewise, making you feel that you might have done something wrong (like "suspicious activity") gives them a psychological edge. But the bank shouldn't prompt you for sensitive information over e-mail, just like the gas company shouldn't send someone to your door without proper identification. (The same goes for telephone calls: if they called you and you don't already know the number, they may not be who they say they are.)

If there's really an issue with my account, then I should be able to handle it by contacting the bank in a way I know will be secure: in person or at their phone number (which is not necessarily the one listed in the e-mail I've received!). Alternatively, I could use a search engine (like Bing or Google) like a phone book, to find the genuine web address. If I've already bookmarked a trusted web address, I could go directly there. At the same time, I can alert the bank to the possible phishing e-mail I've received, and they can take appropriate action.