Saturday I started getting messages on twitter. The format was: “Is this you in this picture?” and then a link. I thought that it was probably a scam, but I don’t live in fear. I went there on my iPhone and found that it wanted me to sign it. I didn’t do it. I got another and then a third, followed by a fourth. One of these was from someone I’ve met in real life.
I sent him a message. He was immediately concerned that his personal data was at stake. So I asked him a couple of questions. First, when he typed in his twitter password (this was a phishing scheme), was he on a PC, Mac, or some other device. Secondly, was his antivirus up to date (if he was on a PC).
As it turns out, he was on an iPad. He was concerned that there was a PC on the same network. I told him that it was theoretically possible, but I hadn’t heard of any attacks from phishing sites that could cross infect other machines on the same network from one platform to another (in this case iOS to Windows).
I told him not to beat himself up. With 1000 followers, I’d gotten the same message multiple times and that’s why I didn’t fall for it. I couldn’t imagine that four people (most of whom I don’t know personally) could have come across a picture of me. My 9 year-old thinks I’m famous, but my bank account shows I’m not.
This brings me to three pieces of advice:
1. If you click a link someone sends you that asks for a login and password, don’t give it. In a separate browser, preferably on a different machine, go to the known site that the site claims to be to access the information. Double check the url in the suspected browser window. Twitter isn’t going to send you to a phishing site with a similar, but different enough url.
2. Use a browser or a dns service with phishing detection. I use Chrome and OpenDNS. Chrome warned me when I went to the site on my MacBook Pro. If I’d ignored the warning (which I didn’t), OpenDNS would have warned me, too.
3. If you get phished on a site that doesn’t include financial info (like Twitter, Youtube, etc.), change your password at the real site immediately to one with upper and lower case letters, numbers, and at least one other character. A lot of banks make you do this. There’s a reason. At current computing power, a password like that would take over 100 years to break with brute force. Letters only or numbers only is a matter of seconds.
Happy twittering,
Paul