1. Information Security Session October 24, 2005
11/10/2018
Information Security Session October 24, 2005
Bill Eaheart
Network Security Coordinator
DePaul University
NIDS with Snort

2. What is spam? Email advertising for some product or service
Unsolicited Commercial (UCE)
Electronic version of junk mail
Not necessarily virus or malware
11/10/2018
Information Security

3. How do ‘spammers’ get my email?
11/10/2018
How do ‘spammers’ get my ?
Harvesting WebPages
Harvesting Newsgroups
Guessing
Buying lists from other spammers or companies
From a mailing list
By people themselves
Other ways
11/10/2018
Information Security
NIDS with Snort

4. Can you limit the amount of spam?
Don't give your address out arbitrarily
Check privacy policies
Be aware of options selected by default.
Use filters
Don't follow links in spam messages
Disable the automatic downloading of graphics in HTML mail
Consider opening an additional account.
Don't spam other people
11/10/2018
Information Security

5. What is ‘Phishing’? Scam to steal valuable information – Online Fraud
Attacks use ‘spoofed’ s and fraudulent websites
Designed to fool users into divulging personal data – credit card numbers, user ID’s, passwords and social security numbers.
Hijack trusted brands of well-known banks, retailers and credit card companies
Anti-Phishing Working Group – Up to 5% success rate
11/10/2018
Information Security

6. Why is ‘Phishing’ so popular?
Effective Social Engineering
Technique for manipulating people to disclose sensitive information
People trust information in s or websites
Simple for people to disguise addresses and location of websites
11/10/2018
Information Security

7. Gartner Study
STAMFORD, Conn., June 23, 2005 — Increasing reports of lost consumer data files and disclosures of unauthorized access to sensitive personal data are taking a toll on consumers' confidence in online commerce, according to Gartner Inc., the world's largest technology research and advisory firm. A Gartner survey of 5,000 U.S. adults showed that phishing attacks grew at double-digit rates last year in the United States. In the twelve months ending in May 2005, an estimated 73 million U.S. adults who use the Internet said they definitely, or think, they received an average of more than 50 phishing s in the past year.
2.4 million online consumers report losing money directly because of the phishing attacks. Of these, approximately 1.2 million consumers lost $929 million during the year preceding the survey. Survey participants indicated most of the money stolen was repaid by banks and credit cards.
11/10/2018
Information Security

8. How do I spot a Phishing scam?
Attempt to grab your attention
Suspicious
Can be difficult to tell without research
Closely resembles website – same graphics
11/10/2018
Information Security

9. Examples
11/10/2018
Information Security

10. Examples – Bank of America Phish
Target: Bank of America customers
Spoofed Sender: Online Banking
Goal: Bank Username/Password and ATM card information
Visible Link: ‘Sign in to Online Banking’ :
Phish site IP Address:
11/10/2018
Information Security

11. Recommended Steps
Use Caution/Common Sense - Be suspicious of s asking for sensitive information
Reputable organizations will not request information through
Never respond to an for personal information
Never follow the links in an you suspect might be phishing
Use a browser to type in the site mentioned in the
Check to see if the site has an announcement about phishing attacks targeting it.
Check to see if the privacy policy of the website has a policy about collecting private data.
If you determine that a website is legitimate, make sure it encrypts your data by using SSL.
11/10/2018
Information Security

12. How do I report Phishing scams
Federal Trade Commission
FBI's Internet Fraud Complaint Center
Attacks targeting DePaul University
11/10/2018
Information Security

13. Additional Information
If you think you are a victim to a phishing scam:
Anti-Phishing Work group
Microsoft Video: Phishing and Identity Theft
11/10/2018
Information Security

14. The End! Thank you Any questions weaheart@depaul.edu 11/10/2018
Information Security