Example of phishing from Citibank:

There are many prevention methods to prevent or stop phishing:
1) Never reply to e-mail message that request your personal information.
Legitimate companies don’t ask for this information via email. If you are concerned about your account, contact the organization mentioned in the email using a telephone number you know to be genuine, or open a new Internet browser session and type in the company’s correct Web address yourself but don’t cut and paste the link from the message into your Internet browser — phishers can make links look like they go to one place.

2) Don’t click links in suspicious e-mail, the link might not be trustworthy. Some scammers send an email that appears to be from a legitimate business and ask you to call a phone number to update your account or access a “refund.” If you need to reach an organization you do business with, call the number on your financial statements or on the back of your credit card. In any case, delete random emails that ask you to confirm or divulge your financial information.

3) Help protect your PC, keep your PC updated & use antivirus software.
Anti-virus software scans incoming communications for troublesome files that can effectively reverse the damage; and that updates automatically. A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It’s especially important to run a firewall if you have a broadband connection. Operating systems (like Windows or Linux) or browsers (like Internet Explorer or Netscape) also may offer free software “patches” to close holes in the system that hackers or phishers could exploit.

4) Don’t send personal information in regular e-mail messages.
Email is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization’s website, look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins “https:” (the “s” stands for “secure”). However, no indicator is foolproof; some phishers have forged security icons.

5) Monitor your transaction, and review credit card and bank account statements as soon as you receive them
Check for unauthorized charges. If the statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.

Although internet has given us many convenience especially in buying or selling goods or services, but the awareness must be taken into account so that we will not been cheated.

References:
http://www.planb-security.net/wp/503167-001_PhishingDetectionandPrevention.pdf

http://chowkamleeng.blogspot.com/2008/06/phishing-examples-its-prevention.html

by Lim Hui Min

There are a few simple approaches I would like to share on how to safeguard our personal and financial data:

Nowadays, people rely on computers to create, store and manage critical information. Consequently, it is important for users to aware that computer security plays a major role in protecting their data from loss, damage, and misuse.

Most security threats are made by attackers using a relatively small number of vulnerabilities. Attackers, being relatively opportunistic, take the path of least resistance, and continue to take advantage of these most common failures, rather than seeking out new exploits or taking advantage of more difficult ones.

According to the SANS Institute (SysAdmin, Audit, Network, Security Institute), the top ten threats are:

• Web servers and services. Default HTTP (Web) servers have had several vulnerabilities, and numerous patches have been issued over the past several years. Make sure all your patches are up to date, and do not use default configurations or default demonstration applications. These vulnerabilities may lead to denial-of-service attacks and other types of threats.
• Workstation service. An attacker can obtain full control over a computer by compromising the Windows Workstation service, which is normally used to route user requests.
• Windows remote access services. A variety of remote access methods are included by default on most systems. These systems can be very useful, but also very dangerous, and an attacker with the right tools can easily gain control over a host.
• Microsoft SQL Server (MSSQL). Several vulnerabilities exist in MSSQL that could allow an attacker to gain information from a database or compromise the server. In addition to applying all the latest patches, enabling SQL Server Authentication Logging and securing the server at both the network and system level will prevent most of these attacks.
• Windows authentication. Most Windows systems use passwords, but passwords can be easily guessed or stolen. Creating stronger, more difficult to guess passwords, not using default passwords, and following a recommended password policy will prevent password attacks.
• Web browsers. Your window to the Internet, a Web browser contains much vulnerability. Common exploits may include disclosure of “cookies” with personal information, the execution of rogue code that could compromise a system, and exposure of locally-stored files. Configuring the browser’s security settings for a setting higher than the default value will prevent most Web browser attacks.
• File sharing applications. Peer-to-peer (P2P) programs are commonly used to share files. In a P2P system, computers are open to others in the P2P network to allow for all participants to search for and download files from one another. Many corporations forbid use of P2P networks because of the obvious risk of compromised data.
• LSAS exposures. The Windows Local Security Authority Subsystem (LSAS) has a critical buffer overflow that can be exploited by an attacker to gain control over the system. Again, proper configuration and application of patches will prevent most exploits.
• Mail client. Attackers can use the mail client on a computer to spread worms or viruses, by including them as attachments in emails. Configuring the mail server appropriately, and blocking attachments such as .exe or .vbs files, will prevent most mail client attacks.
• Instant messaging. Many corporations also block employees from using instant messaging, not only because of the technical threats but also because of the possibility of lost productivity. Configuring IM properly, applying all the latest patches, and taking control over any file transfers that occur over IM will prevent most attacks.

In conclusion, risk exposed by computer users is increasing with the increasing developed technology. Therefore, safeguards developed must be always up to date to enhance the defenses against online security threats. In the same time, users must be educated and informed about the crucial damages and loss caused by imposing online security threats.