Subscribe Now

* You will receive the latest news and updates on the Canadian IT marketplace.

Trending News

Blog Post

Tech experts fooled by latest phishing attack
SECURITY

Tech experts fooled by latest phishing attack 

Cyber-attacks are growing in numbers but what is more concerning is that attackers are getting more sophisticated in their work and are even pulling off attacks that are deceiving even tech experts. In one of the latest attacks, hackers created a login page for Gmail that looks like the authentic Gmail login page to fool users.

In this attack, the hacker sends an email with a sender name of one of your contacts, on seeing this you automatically think that this is a valid email with an attachment that looks normal. By trying to open the attachment a new tab opens to the fake Gmail login page. By entering your email and password you are giving your login credentials over to the hacker and your account compromised.

This attack was discovered by Mark Maunder, CEO of Wordfence, a company with a security plugin that has been downloaded more than 10 million times for WordPress websites. In a blog post on his website, Maunder wrote about this “phishing technique stealing login credentials that is having a wide impact, even on experienced technical users.”

After your account is compromised, Maunder went on to explain that “the attacker also has full access to all your emails including sent and received at this point and may download the whole lot.

“Now that they control your email address, they could also compromise a wide variety of other services that you use by using the password reset mechanism including other email accounts, any SaaS services you use and much more.”

In response to this attack, Google provided an official statement: “We’re aware of this issue and continue to strengthen our defenses against it. We help protect users from phishing attacks in a variety of ways, including: machine learning-based detection of phishing messages, Safe Browsing warnings that notify users of dangerous links in emails and browsers, preventing suspicious account sign-ins, and more. Users can also activate two-step verification for additional account protection.”

The “2-Step Verification” is the safest way to protect against an unauthorized login to your account. With this process, after entering your password to sign in to Google, you will be asked for a code to complete the login process which can be sent to you via a text message, voice call, or Google’s mobile app. This is a second layer to ensure that no one can access your account without you knowing. 

Other ways to keep safe online are:

1. Don’t click links or provide personal information without first verifying that the page is safe.
2. Check to see that the protocol and hostname have the right look, for example, there should be nothing before the ‘https://’ and the green lock symbol. In this attack, the link used was: data:text/html,https://accounts.google.com instead of https://accounts.google.com.
3. Confirm that the sender’s email matches the sender’s name.
4. Check links by hovering over to see if it matches the description.

If you believe that your account was compromised, we recommend that you change your password immediately and enable “2-Step Verification” from Google.

Source: Wordfence

Related posts