New Zealand Latest NewsLinks from Around the Web

PC World - 3 Dec (PC World)

Phishing attacks are popular because they work. A bad actor sends you a phony link through a realistic text message or email, and you click it thinking you’re going to the official site. The fake URL then captures your login info (or other sensitive info). Browsers and antivirus software try to block these sites, but they’re not foolproof. So, how do you learn how to spot phishing links? Look for the clues. Check the URL zulfugar karimov / unsplash Phishing scams work because of two reasons. People just don’t look at the links they click on. The text in the message or email looks legitimate, but the link is actually coded to send you to a fake site. Obviously, the second scenario is way sneakier and harder to catch immediately. But you can figure this out in a few different ways. Option A: Consult VirusTotal Difficulty rating: Easy VirusTotal / PCWorld VirusTotal is a respected online security website that checks files and web addresses (URLs). You can also even look a bit into the history/reputation of a site via its domain or IP address. To use it, visit the website, and click on the “URL” tab. Enter the web address you want to investigate. VirusTotal will check against multiple security vendor databases to see if any malicious results come up. This step is a good initial way to let automation flag anything obvious. But because phishing, malicious, and scam websites now appear and disappear from the internet very quickly, don’t expect VirusTotal to catch everything possible. Option B: Examine the link yourself Difficulty level: Medium Because of AI tools, phishing emails like this example (where the text sounds unpolished) are becoming more rare. But you can still pick up on the sketchy vibes through that web address, which has no relation at all to Wells Fargo Bank.Phishing.org A visual check of the web address is always a good idea, and it takes just a minute. You can see the full URL by hovering your mouse over a link. (The info will appear either in a small context window pop-up, at the bottom left of your window, or both.) You can also right-click on the link and choose Copy link address, then paste that into another screen. Here’s what to look for: Does the link match the official URL? (For example: Is it nike.com or are you seeing nieke.com, nike.xyz, niike.com, or another close variant?) Hover your mouse on the link. Does the link information that appears at the bottom of your browser or email client window match the official URL? If the first part of the link doesn’t match the official URL, don’t use it. Treat the message as a phishing attempt. How to figure out a business’s official URL For big corporations, this is pretty easy. You can use a well-known search engine (ex: Google) to look up the store by name. Look for the first non-sponsored result. Why? Sponsored results are advertisements, and bad actors have used them for malware attacks. (One way to help avoid this: Use an ad-blocker.) Now compare that result against the link you received. Option C: Go internet sleuthing Difficulty level: Medium-high ICANN / PCWorld Usually, going with options A + B covers your bases pretty well. If you’ve still got a weird feeling in your gut, trust it and avoid the URL. Instead, if the matter’s urgent, get in touch with the company or service directly, using info from your statements (or the back of your credit card, if applicable). But perhaps you just want to know what’s up. So here’s a third way you can help better decide if a link is truly suspicious or not. Or you want to verify that your search result for the official URL is trustworthy. It’s still no guarantee that everything is legit, but you’ll have better info for an educated guess. Head to ICANN’s lookup tool (https://lookup.icann.org/). ICANN stands for Internet Corporation for Assigned Names and Numbers—it’s the organization in charge of the infrastructure that allows us to type in domain names like nike.com instead of an IP address. Next, enter the URL you want to check on. This lookup tool lets you perform a whois query—aka a lookup of a domain’s registration information. Find the nameservers for this domain. (Nameservers handle the conversion of the domain name to its corresponding IP address.) Study the nameserver info. Larger businesses usually manage their own nameservers or contract with a major host like Amazon Web Services (AWS). If the link is supposed to be for a major company, but you don’t recognize its nameservers’ domain or they link to a standard web hosting company, that’s a red flag. Fun fact: In the old days, you could check to see if the address, phone number, and email address in the registration records matched the company’s info. But for safety purposes, most everyone uses private registration, which masks that info. Pay attention to your password manager Password managers help online security in multiple ways. Besides creating and remembering unique, strong passwords for you, they can also indirectly signal that you’re on a phony site. How? They won’t prompt you to login when you load the site. Ideally, you wouldn’t ever click on a bad link. Better to not tempt fate, etc. But if you happen to go that far, a password manager’s lack of engagement with the site is another indicator that something isn’t quite right. If this happens, either go back and check the URL before you proceed further. Or just quit the tab all together, open a fresh one, and head to the site directly and login. Two extra precautions you can take Passkeys are fast and easy to create. Managing them is simple, too.Microsoft Getting up close and personal with URLs can feel complicated—and it is extra work. So if you don’t have time for that, you can do a couple of faster, easier things instead to stay safe. Always log into sites directly Treat notifications and messages as prompts to open a fresh tab (or open the app) and login yourself. Don’t use the links in email or text messages. Switch to passkeys as your primary login method Wherever possible, create a passkey and use it as your usual method for login. (You can keep a password on the account as a backup, but make it long, random, and strong—and pair it with two-factor authentication so it’s not an easily exploitable way into your account.) Passkeys can be stored in a password manager, and unlike passwords, they’re tied both to the service and the website they’re created for. That means you can’t accidentally use a passkey on a phishing site. And a hacker can’t steal a passkey and use it to remotely log into your accounts. (A hacker can breach your password manager or Google/Apple/Microsoft account where you store passkeys if you don’t secure it properly, though—so make sure you keep that locked up tight!) As always, online security is a multi-layer approach. Knowing how to spot a good vs bad link supplements a good antivirus app, up-to-date browser, and a reliable password manager. All the steps work together to protect you, so that if one thing fails, the others are in place to shield you. Read...

Computing