View the email from Baker College regarding Phishing.
It is important to safeguard yourself from potential online schemes. Review the list of recent online schemes and learn out you can protect yourself.
Select an item below for more information.
The terms virus and malware are often used to explain common software threats to computers, but are they the same thing? The answer to this question is a little complicated. While a virus is a type of malware, not all malware is considered a virus.
Malware is an umbrella term used to explain any software designed to harm your computer. Viruses on the other hand are a specific type of malicious software that can spread and self replicate to other programs. So while both terms describe software intended to harm your computer, they are not the same. Since they are not the same we must take different approaches to protect our devices from each of them.
This is where antivirus and antimalware programs come into play. Both are designed to protect your computer against malicious software, but they do not function in the same way. Antivirus tools are designed around the idea of preventing known viruses from ever making it onto your device. Whereas, antimalware tools are geared towards identifying unknown threats and the removal of malicious software that may have already made its way onto your computer.
The real question comes down to whether you need both antivirus and antimalware protection, and the answer is yes. Some antivirus programs are designed to accomplish both tasks, but not all are. So you need to be aware of the level of protection being provided by your antivirus software. If your antivirus does not provide antimalware protection, you should add the additional protection of an antimalware program. Keep in mind, to ensure your software provides the best protection possible it needs to be updated regularly. You can also check with your Internet Service Provider to see if they offer free antivirus software.
In the past we have provided examples on many of the different types of phishing attacks that exist and showed how to identify them. Most of the examples we have provided revolved around email and how to identify a possible phishing attempt. While email is one of the most popular ways of phishing, it is not the only way.
Recently a previously novel method of phishing has become more prominent and it is almost impossible to spot. This type of phishing is called a Browser in the Browser (BITB) attack. When you visit a website and choose to login with Facebook, Google, or Microsoft, you are using Single Sign On (SSO) . A BITB attack uses a fake website and takes advantage of SSO to capture your login credentials unknowingly.
A BITB phishing attack can mimic a legitimate webpage without the user even knowing. This means all of the normal ways we identify phishing (hovering over links, bad grammar, misspelled URL) do not necessarily work with BITB. The attack uses the normal login behavior of SSO by presenting a popup window to enter credentials. Once the user submits their credentials they are in the hands of the attacker.
The good news is there are ways to beat this attack. First of all when searching for a website make sure you avoid clicking on links that say AD next to them. Using a password manager may also help as it will not populate a password for the fake login. The best defense is to use Multi Factor Authentication (MFA). With MFA, even if the attackers get your username and password they do not have access to your second form of identification that is required to complete the login process.
We've probably all received them at one point or another - the dreaded "You've been locked out of your account" emails. Most likely you are familiar with the Nigerian Prince scam that has been around since the 90's, but would you believe that this email scam still traps people for over half-a-million dollars yearly? Phishing attempts through email are extremely profitable for cyber criminals and a nightmare for the business world. Having well-educated employees (and students) is nothing less than critical in providing a front-line defense against such attacks.
Top 10 very common phishing emails; each may have several variants or the wording may be different, but the subject is usually similar. See if you recognize any of the following:
Your best defense against falling victim to one of these misleading emails is knowledge and a bit of common sense.
For example, “We’ve locked your account…” Is there any reason why it would be locked? Did you recently attempt to login and forget your password somewhere? If not, then why would you get that email?
“A delivery attempt was made…” This one is a little more tricky because at some point or another, most individuals order products and get them in the mail. Ask yourself - did I recently order something that I’m expecting? Is there a reason someone would send me a gift? Again, if your situation doesn’t call for it, why would you believe the email?
“We’ve issued a refund…” If you haven’t returned a product or bought anything that needed to be returned, then why would you be receiving a refund?
These 10 email phishing attempts come in many varieties and there are many more out there with different subjects. All are attempts at making you react on impulse and click a link or make you give out information that you really don’t need to do. Best option? Just delete the email without opening it. If you do open it, hover over any links in the address area, subject area, or body (but DON’T click)...does the address that shows up at the bottom of your screen look legitimate? Does it reflect the company’s name that is implied in the email? Is there a secure “https:” at the beginning of the address? The old adage, “if it sounds too good to be true, it probably is” also works here. If it doesn’t look or feel right, it probably isn’t! Be safe and delete or if you’re still unsure you could always call the company being represented; if it’s a legitimate email they should be able to confirm what you’re seeing. Stay smart and stay safe!
Cybercriminals continuously change their tactics. While some may be very sophisticated, often a simple weaknesses is all they need to cause damage. Practicing everyday techniques to improve your security and learning what to do if you become a victim will better position you to navigate the increasingly digital world.
Tips To Keep Your Devices Secure (44:56)Join Scott, CIO of Baker College, and Todd from the Baker College IT department to learn the importance of keeping your devices protected.
(Click the image below to download the slide deck for this presentation.)
Having MFA, or Multi-factor authentication, activated on your account is a surefire way to increase security. In the chance that your account information is compromised, the bad guys will need your One Time Password or authenticator code in order to get into the account completely.
Recently, there has been an increase in MFA Fatigue attacks where the threat actor will send repeated requests to your SMS or Authenticator, causing your phone to explode in notifications. Don't panic, contact customer or technical support in order to have them reset your password - once that is done, the attackers can’t send requests anymore as they can't sign into the account. NEVER authorize a MFA request in these attempts, as enticing as it is, as this allows the attackers immediate access to your account and the ability to revoke your access to make any changes.
What Is Multi Factor Authentication (MFA) and Why Use It? (32:45)Join Nick from the Baker College IT department and Matthew, Instructor and Lead Advisor of the Baker College Cyber Defense Team, for a discussion about multi factor authentication. Explore some common MFA methods and the future that is passkeys.
Strong passwords are the first line of defense in keeping your accounts safe. They are something only you should know, should not be shared, and are best saved securely in an encrypted password vault. Additionally, never use the same password for multiple accounts. With the methods hackers utilize today, weak passwords can be cracked in less than a second! Guard your data by learning how to make quality passwords and managing them effectively.
For more information on Password Requirements, visit our Password Management page.
Why Using Strong Passwords Matters (29:55)Join Stephen, VP of the Association for Computing Machinery at Baker College, and Ryleigh, member of the Baker College Cyber Defense Team, for a presentation on the importance of strong passwords to keep your accounts safe.
Smartphones have made it increasingly easy for us to have access to all of our information at the drop of a hat. Emails, instant messaging, texts, phone calls, all in a one-stop-shop; however, this ease of access has a downside. With quick access to our emails, we are more susceptible to phishing attacks that hit us with sensationalized content to spur us to click links. Cable bill suddenly ten times your normal rate? Missed a potentially important shipment? Someone just logged into your account? All of these strike us with a sense of urgency and spur us to knee-jerk click. We want to figure out what is happening, but this puts our information at risk. Do not worry though, there are some steps that you can take while on a smartphone to protect yourself and your data.
Be calm. If an email says URGENT, uses a lot of capital letters to point out that SUDDEN actions are going to be taken unless you IMMEDIATELY respond, then the attacker is trying to trick you into acting first and thinking second. Look for these senses of urgency and think twice before clicking.
Be aware. On most mobile email systems, you are able to tap on or near the name to reveal who the email is from. Look to see if there are any misspellings of common organization names. Zero’s instead of O’s, hyphenated addons like .com-help.ru, or even blatantly wrong names could be an indicator it’s not a real email.
Be sure. Some email apps allow you to tap and hold on a link in an email to give you a full preview of where the link goes. A pop-up window will show you what the full URL is. If the link says it’s taking you to Google in the email, but is actually taking you to g00gle.com-security.ez then it is a phishing attempt. If your email app or phone does not allow this, check the email on your computer so that you can hover over the link instead.
Be safe. If you are receiving a notice from a shipping company, an online store, or a phone or internet company, you can always validate that the information is truly theirs by going directly to their website to verify the information. You can write down a tracking, billing, or order number and visit their website to see if it is a real charge or notice.
With these few steps, you and your information will be safer from the bad guys.
Social media has created a way for people to share what they are doing, important life updates, and sharing funny things or breaking news. With the far reach that it has, bad guys have learned ways to collect your data without you even being aware of the dangers.
A recent trend is the inclusion of apps and connected sessions on social media accounts. You can use them to stay logged into a game or another app across multiple devices, or even use it to create a fun little picture for your profile; however, these connections could have serious security issues tied in with them.
One such trend was to create a family based on who you interacted with on the social media platform, creating a unique and fun way to connect with your friends. What wasn’t clear to most until further inspection was that the app also took a few extra liberties with permissions the user granted.
It took a savvy user to realize that they had a list of new followers not connected to their normal trend, and then upon closer inspection of their own account to see the muted account that they had no recollection of ever dealing with.
The best way to safeguard yourself from data collection like this is to review app permissions before granting them access to features on your account.
Social Engineering is the gateway to loss of personal information, data breaches, and ransomware attacks. With so many easy means to get in contact with people, it is no wonder that these are the tools of choice.
Phishing is the act of tricking someone into clicking on a link or giving out personal information like bank information, account information, or passwords via email. A few ways to spot a phish is to look for shocking information that is urgent or time sensitive. You can also look for poor grammar, it’s unlikely a professional company would allow a typo-ladened email to go out to customers in an official communication. Be on the lookout for requests for information like your bank account number, credit card number, or even a username and password - companies will never ask you for this information and will always urge you to go to their website to enter that in. A good practice is also to never click on links in an email, but rather navigate to the website directly to make any changes or confirm any information.
Smishing is the act of sending a text message masquerading as someone who you trust. Shortened URLs and requests for cash apps or cash advances are prime indicators of this attack. Always verify through another means of contact if you receive a request for urgent money from someone you know and trust - Do they normally contact you on this number and why aren’t they reaching out to you via your saved contact info? Never use a link in a text message to go to your account information, instead go to the site directly and verify your account.
Vishing is a phone call you receive saying it’s from someone important. An anti-virus company, the local magistrate or sheriff’s office, or health insurance or student debt relief programs are all common entities that the bad guys like to say they are in order to fool you into giving up your information. If something seems out of place, hang up, don’t call the number they called you from or gave you, but rather call the company directly.
How To Recognize and Defend Against Phishing (49:58)Join Todd from the Baker College IT department and Jack, President of the Baker College Cyber Defense Club for an informative session on the concerns of phishing, vishing, and smishing.
Links inside emails don’t always go where they say they’re really going. Emails can be made so that the text says one thing (for example saying the link will go to the Baker website), but instead actually lead you to somewhere completely different. This is very dangerous, especially if the link brings you to a login page. There are a few extra precautions you can take in order to protect yourself from these crafty attacks.
Hover over it. If you hover over a link or a picture inside the email, you are able to see where the clickable is actually taking you. This is displayed at the bottom of the page. Make sure that the website matches where you think it should be going.
When in doubt, don’t click it! If you know where you are supposed to go to make an account change or check the status of an online order, go directly to the website yourself. Navigate to the webpage using your browser and not the link in the email.
Heed the prompts. Gmail, along with other services, will sometimes prompt you if they feel the link is unsafe. Take notice of where the prompt warns that you might be going. This isn’t a guaranteed pop-up, but it is a second chance to get out safely.
In Gmail, the pop-up looks like this:
Safety Security Best Practices
Baker College's Cyber Awareness Committee has assembled this informative PDF document to help raise awareness of Cyber Security among Faculty, Staff, and Students.
View Safety Security Best Practices
View the Baker College Best Practices for Wireless BYOD (Bring Your Own Device)
Baker College Wireless Guide