Some of you may be familiar with what is known as “phishing” online. It goes like this: You receive an e-mail, purporting to be from a bank, credit card company, or some online merchant (eBay, Amazon, et cetera). The e-mail looks legit enough, and it’s telling you that there is some issue with your account. They give you some reason to click their link, go to their website, and hopefully enter in your password, credit card number, or Social Security number.
If you’re not paying attention, you might accidentally fall victim to a phishing scam. The links in these e-mails take you to counterfeit versions of a legitimate website. So, for instance, you might get an e-mail that looks like it’s from, say, Bank of America. They tell you there is a problem with your account, and to click a link to log in and correct it.
These can be pretty tricky, although if you know what to look for, they’re very easy to spot.
The key to their success is they will have you think that you are going to the real Bank of America website. When you click the link, what looks like a genuine Bank of America site will pop up. It might look just like the original Bank of America website, with one huge difference. You look at the address bar, and instead of seeing http://www.bankofamerica.com, you see something completely different. It may be a series of numbers (an IP address), such as http://xx.xxx.xxx.xxx, or it might be something long and confusing like http://bankofamerica.whatever.com/security/login.
If you pay attention, you can easily avoid getting tricked by simply watching the address bar. Make sure that bankofamerica.com is in there. If the website is ANY different — even if it contains the phrase “bankofamerica” — there’s a very good chance it’s a fraudulent website, and only exists to capture your account information.
So with a little bit of vigilance, phishing scams are pretty easy to avoid. Basically, if it’s an e-mail supposedly from eBay, then clicking the link should take you to ebay.com — or something containing ebay.com. If it doesn’t, then it’s probably a fake. Sometimes, the scammers get clever and even will make the address something like http://ebay.com.whatever.com/something/… in hopes of getting you to think it’s safe by seeing, “Good! I see ‘ebay.com’ in there. It must be safe.”
It’s a little tricky to explain why this still isn’t safe without getting too technical. To make it simple, I would say look at the right-most .com, .net, or dot-whatever, and make sure the final one is the site you’re thinking you’re visiting. For example, we can have ebay.famteam.com, but it would still fall under the famteam.com umbrella. However, famteam.ebay.com would mean it’s an eBay site.
Anyway, phishing is definitely a worry, but it’s not that difficult to spot… most of the time.
Imagine this: You visit www.bankofamerica.com. It looks just like your normal banking site. Nothing could possibly go wrong; right?
Well… not necessarily.
There is this practice called DNS hijacking, which is extremely scary. To understand this fully, you should first know that any given website — domain name — redirects to a number, what’s called an IP address. Think of this as a physical address for a computer. So, for instance, www.bankofamerica.com’s IP address might be 171.161.161.173.
When you enter www.bankofamerica.com into your browser’s address bar, behind the scenes your computer is finding out what bankofamerica.com’s IP address is, if it doesn’t know it already or “remember” it in its cache.
This is all done in milliseconds, so we don’t really notice it. But that’s what is going on in the background. Enter address -> browser translates bankofamerica.com into an IP address -> browser then loads the website at that IP address.
The process of translating a domain name into an IP address is known as DNS resolution. DNS hijacking occurs when you are redirected to a different IP address other than the authentic one.
This would mean that you can enter www.bankofamerica.com into your address bar, yet your are getting redirected, behind the scenes, to a phony BOA website. And since the counterfeit sites can look identical to the authentic ones, how in the world would you know the difference? You would go ahead and enter in whatever information you had to, unaware that you’re just giving away this sensitive info.
Scared yet?
What really frightens me is that the telltale sign of visiting a fake (phishing) website has always been weirdness in the address bar. Instead of www.bankofamerica.com, you’d see something else, and that would be a dead giveaway. But that’s not the case in this instance, because you ARE going to bankofamerica.com; yet your computer has essentially been “tricked” into accessing a dangerous website.
And unless you would pay very close attention to what IP address you are actually talking to when you visit a given site — which, honestly, is very unlikely — you would likely have no idea that you are in an unsafe situation.
The reason this is so fresh in my mind is because it just happened. I worked on a computer recently that couldn’t get online. It could access the local network just fine, but it couldn’t bring up any websites.
After my usual troubleshooting steps proved unsuccessful, I was a little baffled. Eventually, I got around to looking at the IP configuration settings, and I finally saw that the DNS servers had been changed. So instead of the computer automatically getting the DNS information from a trusted source, the computer was trying to access these specific servers.
Imagine a DNS server containing an extremely long mapping of domain names and their corresponding IP addresses, such as:
famteam.com: 100.100.100.100
google.com: 200.200.200.200
bankofamerica.com 210.210.210.210
ebay.com 101.101.101.101
…and so on.This computer’s DNS being “hijacked” or pointed to a DIFFERENT server other than the trusted one meant that, in theory, the “hijacker” could have edited ANY website out there, sending the user to any fraudulent website. Imagine a listing that would redirect traffic to www.mcafee.com to a fake McAfee site that lets you download a “fix” which is, instead, a virus. Scary stuff.
Thankfully, none of that happened in this case, since the change in the DNS servers rendered the Internet unusable. But it could have very well have been working perfectly, with a few select sites being forged. That is a scary thought, in my opinion.
I think we were very fortunate to have this “hijack” do no damage but only keep us offline until we fixed it. It could have easily gone undetected for the longest time, and damage could have been done.
This is one of those new threats which really scares me, because it seems so difficult to detect, yet has potential to cause all sorts of problems.
Obviously, this is something we all want to avoid. A good practice would be to have an antivirus program running, and to follow smart practices online. That is, don’t open strange attachments. Be careful what you say “Yes” or “Allow” to when visiting a website. In this particular case, the DNS-altering virus was contracted by installing what was believed to be a legitimate Flash plugin. Instead, it was a bogus update that ended up changing the DNS settings on the computer and putting it in a very risky position. I’m just very relieved that we caught it before any damage was done!