Contents
Cal Poly Pomona

Security Advisory: Phishing

Choose a category:

Signs of Phishing:

  1. Email that asks for sensitive information (account number, SSN, credit card numbers, etc). Financial institutions and businesses that you have dealings with would never send you email to verify your account.
  2. Unusually long and incoherent URL. The address bar should make sense, and should explicitly indicate the site being visited.
  3. Lack of necessary security measures that are now de facto standards on financial institution websites.
  4. Phishing emails usually have typographical and grammatical errors. However, it's also wrong to assume that a professionally crafted email/site can never be a phishing email/site.

back to top

Phishing Examples

Example: PayPal - "Yout PayPal account will be suspended"

An email stating that your PayPal account will be suspended can be well designed and look convincing.

Note the spelling error in the subject heading. Spelling, punctuation, capitalization and grammatical errors from renown, professional companies should alert the user as to the probability of fraud.

Additionally, an anonymous greeting of "Dear Paypal Customer" should immediately raise suspicion. There is no reason why PayPal wouldn't use your real name. Anonymous greetings are characteristic of scams.

 

Scam Overview:

Email title: WARNING!!! Yout PayPal account will be suspended!!!
Scam target: PayPal users
Sender:

Unknown
Scam objective: Obtaining PayPal username/email and password
Phish link method: "Click Here" type link
Is link masked? Yes
Visible link text: "Click here to confirm your account"
Actual link to: http://www.paypal-cgi.us/webscr.php?cmd=LogIn
Phish site IP : 68.142.234.44

 

For full text, follow the link

A single, login-page scam is quite dangerous.

The phish site is on a domain that closely resembles PayPal.

The user should consider an unsecured page (no lock icon) as fraudulent. Sites such as PayPal would process your login information via a HTTPS session. HTTPS is the secure version of Hyper-Text Transfer Protocol or HTTP that uses Secure Socket Layer (SSL) technology. HTTPS is now a de facto standard for websites that gather sensitive information (e.g. account and credit card information, etc.). The use of only HTTP in the URL shows that this website is not secure, something that a respectable financial institution like PayPal® would not risk.

If a user does enter his/her personal information, the page returns a failed submission attempt. Most users dismiss the failed submission message as a technical error on the part of PayPal and close the window, making it easy for the unscrupulous source to acquire the user's email address and password successfully and inconspicuously.

For full text, follow the link

 

Comparison:

  Fraudulent PayPal Site True PayPal Site
Address Bar (URL)

http://www.paypal.securevrs.com/.cgi-bin/?webscr?cmd=_login-run

  • Domain name here is www.paypal.securevrs.com, definitely not www.paypal.com.

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

  • The “s” in HTTPS means your browser is using secured HTTP and running Secure Socket Layer (SSL) to connect to the PayPal® server.
  • Domain name here is www.paypal.com.
Links

Professional sites are well maintained and would rarely have dead or non-responding links.

The navigation links at the bottom of the page are un-clickable.

The navigation links at the bottom of the page take you to the indicated service (i.e.: Sign Up, Log In, Help, etc.).
SSL Padlock Icon The use of only HTTP in the URL shows that this website is not secure. The use of HTTPS in the URL would show a padlock icon on the far right end of the address bar and the bottom right page.

 

Disclaimer: The use of PayPal® here does not mean a weakness in the security of PayPal® and its online transactions. This example is meant for educational purpose only. PayPal® is a registered trademark, and is no way connected to Cal Poly Pomona.

For phishing examples that purport to be from Cal Poly Pomona, see eHelp's Scams and Phishing page at http://www.csupomona.edu/~ehelp/scams_phishing.shtml.

back to top

 

Example: FedEx - "FEDEX COURIER SERVICE"

An email from FedEx stating that representatives need to confirm your address in order to deliver a large sum of money to you in the form of a check can be well designed and look convincing.

Note the spelling error in the paragraph just above the payment information request . Spelling, punctuation, capitalization and grammatical errors from renown, professional companies should alert the user as to the probability of fraud.

Note the grammatical errors throughout the email. Also note the punctuation errors in the last paragraph, closing and signature line.

Additionally, an anonymous greeting of "Attention" should immediately raise suspicion. There is no reason why FedEx wouldn't use your real name. Anonymous greetings are characteristic of scams.

Note the email address to send your sensitive info is a Google email account, not a FedEx email address.

The phish email is sent from an address that purports to be from FedEx. The sender's email address should immediately raise suspicion. If you look at the domain name - "walla.com", it shows that the email is not from any one officially connected to FedEX.

If you enter "www.walla.com" into a browser, you'll find that walla.com is a web-based email service. This fact is emphasized at the foot of the email by advertising text promoting Walla Mail.

 

Scam Overview:

Email title: FEDEX COURIER SERVICE
Scam target: Cal Poly Pomona Students, Faculty and Staff
Email sent: Fri 7/11/2008 4:34 AM
Sender:

Unknown
Scam objective: Obtaining name and address
Phish link method: Reply to email with sensitive personal information
Is link masked? N/A
Visible link text: N/A
Actual link to: N/A

 

For full text, follow the link

Disclaimer: The use of FedEx ® here does not mean a weakness in the security of FedEx ® and its online transactions. This example is meant for educational purpose only. FedEx ® is a registered trademark, and is no way connected to Cal Poly Pomona.

For phishing examples that purport to be from Cal Poly Pomona, see eHelp's Scams and Phishing page at http://www.csupomona.edu/~ehelp/scams_phishing.shtml.

back to top

 

Example: Mail Box Access Limitation

An email stating that your email account will be closed can look convincing. However, upon closer inspection, note the inconsistencies in capitalization, punctuation, spelling and grammar.

  1. An anonymous greeting should raise suspicion. Anonymous greetings are characteristic of scams.
  2. Note the awkward grammar of the first and second sentences.
  3. Note the capitalization errors of the second paragraph.
  4. Note the grammatical errors of the second paragraph.
  5. Note the punctuation errors of the second paragraph.
  6. The phish email is sent from an address that gives the impression that it is from a Cal Poly email address. The sender's email address should immediately raise suspicion. If you look at the domain name - "henrico.k12.va.us" and "live.com", it shows that the email is not from any one officially connected to Cal Poly Pomona.
  7. Note the message is signed anonymously. Unidentifiable senders should raise suspicion.

    NOTE: Remember, no one officially connected to Cal Poly Pomona will email, asking for any sensitive information.

    For phishing examples that purport to be from Cal Poly Pomona, see eHelp's Scams and Phishing page at http://www.csupomona.edu/~ehelp/scams_phishing.shtml.

 

Scam Overview:

Email title: Mail Box Access Limitation
Scam target: Cal Poly Pomona Students, Faculty and Staff
Email sent: Monday, March 23, 2009 4:29 AM
Sender:

Unknown
Scam objective: Obtaining user name, password and address
Phish link method: Reply to email with sensitive personal information
Is link masked? Yes
Visible link text: customer-care-accounts@live.com
Actual link to: N/A

 

 

From: Rudolph F. Ward (rfward) [mailto:rfward@henrico.k12.va.us]
Sent: Monday, March 23, 2009 4:29 AM
To: undisclosed-recipients
Subject: Mail Box Access Limitation

An unusual activity has been detected in your mailbox. As a result, access to your mailbox has been limited until the issue has been resolved. Unfortunately, if access to your mailbox remains limited for an extended period of time, it may result in further limitations or eventual mailbox closure.

You are required to contact your system administrator with your Email User name and Password to enable them resolve the issue and reactivated your mailbox.

System Administrator
E-mail: customer-care-accounts@live.com

NOTICE: The information contained in this e-mail may be confidential and is intended solely for the use of the named addressee. Access, copying or re-use of the e-mail or any information contained herein by any other person is not authorized.

 

Disclaimer: The use here of Henrico County Public Schools does not mean a weakness in the security of Henrico County Public Schools and its online transactions. This example is meant for educational purpose only. Henrico County Public Schools is no way connected to Cal Poly Pomona.

For phishing examples that purport to be from Cal Poly Pomona, see eHelp's Scams and Phishing page at http://www.csupomona.edu/~ehelp/scams_phishing.shtml.

back to top

 

Tips: How to avoid being "hooked"

  1. Carefully review any email asking for personal information. If you are contacted to verify account information, call, write or visit the website of the institution that ostensibly sent you the email to verify if it is its policy to send account inquiries using email.
  2. Make sure the email is from the intended website. For example, clicking on the PayPal phishing link gives you a website with a URL of: http://www.paypal.securevrs.com/.cgi-bin/?webscr?cmd=_login-run.
    1. Opening another browser page and manually typing "www.paypal.securevrs.com/" returns a blank page. This
      fact alone tells you that this is not a legitimate PayPal® page.
    2. Entering " www.paypal.securevrs.com/.cgi-bin/" into a browser window would give you a log-in page even though you haven't finished typing the whole URL.
  3. Check if the site uses “HTTPS” and has the small padlock icon at the end of the address bar and at the bottom of the right page.
  4. Practice safe and secure emailing. Never open an email from a sender you do not recognize and be extra cautious with email from unknown senders with blank or gibberish subject lines.
  5. If you receive an email that is obviously a phishing email, don’t open it. If you do open it, don’t click on the enclosed link. Add the email to your spam list. Then delete the email.
  6. Learn to spot phishing sites using the techniques listed/delineated above. If you're still not sure, type the full URL of the website manually in the address bar of a browser window.

To report a security attack directed at your computing resources or to notify us of a compromise of the Cal Poly Pomona network, contact the Incidence Response Team at abuse@csupomona.edu or call the Cal Poly Pomona (I&IT) Help Desk at 909.869.6776.

For more information on computer and network security incident protocol, visit Report a Security Incident.

back to top

Did you know?

Targeted Phishing:

Spear phishing, a targeted version of phishing, targets bank and online payment service customers. While the first such examples were sent indiscriminately, phishers may now be able to determine which banks potential victims use, and target those people with bogus emails accordingly.

Whaling is a phishing attack directed specifically at senior executives and other high profile targets within businesses.

 

Quiz Yourself

Think you won't be "hooked"? Take the SonicWALL phishing and spam IQ quiz and find out!

http://www.sonicwall.com/phishing/index.html

back to top

This page was last updated on August 10, 2009.

  Did you find what you were looking for?