Posted by: Ken Harthun
cyber security, Hacking, Phishing, Security best practice, spam
A friend of mine, whom I’ll call Sally, told me of a recent hack on their PayPal account that could only have resulted from her clicking a link that a “trusted friend” sent her in an email. You know, one of those “You have to see this!” things. She gets them all the time of course, and most of the time, they are what they claim to be. Only this time, the friend had gotten herself infected with a mass mailing trojan; even though the message appeared to be legitimate (since it was sent from the “friend,”) it was bogus.
The link installed a keylogger. Prior to going on vacation, Sally checked her PayPal and bank accounts. The hackers got her login information. When she tried to use her debit card, she found she was overdrawn by several thousand dollars. It ruined her vacation and took her the better part of two weeks to get her money back. Fortunately, the bank waived all overdraft fees. Lesson learned.
Now, what could she have done? Trust is what these hackers rely on; naturally, Sally would trust an email from her friend. That it wasn’t from her friend, is something that Sally probably didn’t suspect. But, she could have a personal security policy in place whereby she routinely calls her friend and mentions the email/link. If the friend says, “What email/link?” then you had better just delete it.
I have a fellow geek friend who routinely sends me scientific news, astronomy links, etc. I expect them, but I never open them until after I have talked with him (which I do several times a week) because he always asks me, “What did you think about [that particular article I sent you]?” My response is usually, “Oh, I’ve been busy, let me take a look (knowing, now, that it’s from him).” Then, we talk about it.
NEVER click a link you’re unsure about. Make a phone call to the “friend” that sent it to you. If you can’t call them, them just delete the message.
You won’t be missing out on anything important, trust me.