Hacking or Phishing?

During the past few weeks, some Maldivian blogs got hacked according to the blog authors or those close to them. How did all these blogs get hacked? Is GMail security that low that any script kiddie could take over your blog? Or is there something else to it? Was the bloggers phished?

As far as I know GMail is pretty secure and there is no known way of hacking into someone's GMail account unless you know their password or secret question answers. Therefore, the only reasonable explanation for the recent "hacking" of several Maldivian blogs can only be attributed to phishing (this seems to be what is suggested by a recent article on the dhiislam website).

If you want to learn more about phishing and how to protect yourself from phishing attacks please read my previous post on phishing attacks. You can also read more about phishing on howstuffworks.com

Protecting yourself from Phishing attacks

What is Phishing?

Phishing (pronounced as fishing) refers to the act of trying to fool someone into disclosing sensitive personal information (such as username, password, credit card number) by posing as a legitimate entity known to the person.

How it works?

There are several ways in which phishing attacks are carried out. Here are some sample scenarios.

Scenario 1

• victim is sent an email claiming to be be from their email provider (gmail, hotmail, yahoo etc)
• the email header is sometimes spoofed so that it appears to be coming from the email provider
• victim is told that the email provider has had some technical difficulties (such as data loss)
• victim is asked to reply to the email with username, password or other sensitive information (such as secret answer)

Scenario 2:

• victim is sent an email claiming to be from their bank or financial institution
• victim is told to update their personal details (or do something similar which encourages the victim to click the link provided)
• victim is provided with a link to do the update (or whatever)
• the link usually takes the form "http://bankname.something.com" in order to fool the victim
• the link takes the victim to a page that is similar to the login page of their bank
• once victim enters their username and password they are stored and the victim is presented with an error page or redirected to the correct website (i.e. the victim's bank's website)

Scenario 3:

• victim receives an instant message on their messenger client or through facebook (or social network)
• the message contains a link
• the message is worded such that the victim is tempted to click the link
• when the victim clicks the link they are taken to a site which looks similar to the login page of their email provider (hotmail, gmail, yahoo etc.) or facebook (or social network)
• when the victim supplies their username and password they are given an error message or redirected to the site they thought they were visiting

How to protect yourself from Phishing attacks?

There are several tools targeted at protecting internet users from Phishing attacks. However, the best way to protect oneself would be to be aware of how phishing attacks are conducted instead of solely relying on security tools for protection. Here are some key things to remember:

• Your email provider, bank, financial institution or any other respectable entity will NEVER ask you for your username or password via email
• ALWAYS check the address of the website in your address bar before you type your username and password to login (http://facebook.com is not the same as http://facebook.evilsite.com)
  The important thing to note here is what appears before the dot com (or dot whatever). That is the domain name. If the domain name (in this case evilsite) is different from the site you think you were visiting (i.e. facebook) then you are being scammed (or phished in this case).

Reducing risk of Autorun viruses

One of the most common and rather annoying way in which malware (viruses, trojans, worms) spreads is via the Autorun feature of most Windows Operating Systems. These viruses silently copy themselves to removable USB storage devices once the devices are plugged into an infected system. The Autorun feature of Windows OSs causes the malware to be launched automatically when the infected USB device is plugged into another computer (or when the user clicks on the drive icon on My Computer). Most of the time these malwares would be stopped by anti-virus software.

However, since the Autorun feature is seldom used (do not confuse Autoplay with Autorun) disabling Windows from parsing the Autorun.inf in the first place is the best way to reduce infection via Autorun viruses. To disable Autorun in windows:

• Open Regedit (Windows+R, then type "Regedit" and click ok)
• Navigate to the following key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping
• Right-click and create new key Autorun.inf
• Set the default value of the created key to @SYS:DoesNotExist

Alternatively you can download the following file and import into the Windows Registry.

• Disable Autorun
• Double click the file.
• Click "Yes" on the message box displayed (but make sure you read it first)