Ransomeware destroys trust. It can also damage the reputation of your business and destroy relationships you have with customers and vendors.
After this year’s recent large-scale ransomware outbreaks My Geek, Inc. would like to provide you with some very valuable information in an attempt to safeguard you as well as your business, clients and vendors.
What is ransomware? Ransomware is a type of malicious software that threatens it’s target (you) with public release of data and or blocking access to files and information until a “ransom” is paid.
How do you get infected? One of the most common ways that these exploits are carried out is through successful phishing attempts. Often times you literally but unknowingly give an attacker your login credentials so they can carry out their attack.
So what’s a phishing attempt? A phishing attempt is a malicious attempt to gain access to sensitive data including usernames and passwords, personally identifiable information (PII) including social security numbers, credit card information and much more!
How are phishing attempts even successful? There are several types of phishing scams, the most common being e-mail, website and phone calls. However, they all have one thing in common, they are disguised as coming from a trustworthy entity or source. Here are a few examples:
- An e-mail that appears to have come from someone you know and trust that includes attachments and or links for you or your users to click on
- A pop-up on a website telling you that your computer is infected or running slowly. These typically appear to come from a vendor like Microsoft and include a phone number for the end user to call for support. They almost always ask you for your credit card number when you call
- A phone call with an offer to solve your computer problems, sell you a software license or help you install the latest security updates or software fixes
How can you avoid being a victim? Be educated and be vigilant! It only takes one user to click a link or call a phone number to allow the attacker access to your livelihood.
Here are a few screenshots of some real world phishing attempts and how to tell that they’re a phishing attempt
Hover over the link and wait for the URL to pop us so you can view the link you’re clicking on before you actually click it. If the link is going to take you to a legitimate source then it will typically show something legitimate in the URL.
You can see the URL by hovering over the link.
If you’re concerned something may be a phishing attempt you can check the digital certificate of the website or verify the website actually has a certificate before using your credentials to sign in. Many of these phishing attempts have URLs that look similar to the real thing and at a slight glance will fool you, however almost every time they’ll start with http instead of https. If it is legitimate and it’s requesting your email and password then it should be a https website and be secured with a SSL certificate which in most browsers shows a lock next to the URL as well as the company the certificate was issued to. Here’s what a Microsoft website looks like from a basic SSL certificate standpoint.
The intruder was impersonating smartsheet.com. The first screen shot is of the illegitimate link and is the phishing attempt. The second screen shot is the legitimate website.
The difference? Strange URL and no SSL lock versus SSL lock and the URL is much more legitimate.
