Home / Blog
Written by: 3/21/2011 10:22 AM
As a former academic advisor, this headline caught my attention:
“Scammers steal entire college website”
‘What?” I thought. “How? How could scammers penetrate the impervious security of the United States university system?”
Wink, wink.
Truth be told, universities are notorious for lax security. I know, because I’ve seen it. Employees are often fully unprepared for a social engineering attack because they are untrained on how to deal with phishing phone calls, email attacks, or even the importance of locking sensitive documents away from prying eyes.
But, I digress. In this case, it actually wasn’t the school’s fault. In the case of Reed College, scammers performed a quick copy-and-paste and, voila! A copycat site that could be used for any matter of evil deeds, including malicious schemes involving application fee theft.
Copying websites and creating nearly identical domain names is certainly nothing new in the world of social engineering scams—but it is baffling how often people are surprised by this technique. No one believes that it is just that easy to fake a site.
We know, because we do it all the time.
When a company hires us to perform a social engineering audit, we will often take just a few minutes to create a mock-up of their site—with a URL that differs from the original by only a character or two. This virtually guarantees that employees will log in to our site and provide whatever information we ask for.
So, here are our two points of advice today:
1) MANAGERS: If you are in any way in charge of your company’s website, be sure your company not only owns your own domain, but also as many other modifications of that URL as possible. This will limit a scammer’s options when attempting to create a fake version of your website.
2) WEB USERS: If you are about to provide any information or make a payment of any kind online, be absolutely certain that your site is the right one. This includes double-checking the URL carefully.
Unfortunately for Reed College, the copycat “University of Redwood” is still lurking out there, though there has been no confirmation as to why. But hopefully applicants to Reed will be circumspect before paying any fees!
Read more here: http://technolog.msnbc.msn.com/_news/2011/02/28/6152475-scammers-steal-entire-college-website
0 comment(s) so far...