Phishing Attempt and a free plug for OpenDNS

The other day I received an email that looked like it came from PayPal asking me to verify my account details with my username and password. After about 10 seconds I realized it was a phishing attempt. The sender wasn't a skilled phisher because the full URL to his site was actually displayed. Even though the link displayed "PayPal.com" it wasn't the actual website it was about to take me to. A quick way to determine the website is to look at the last two sections of the URL (or link), the "dot com dot net dot org etcetera...". I'll use the following fake URL as an example.
"http://www . paypal . com . craptastic . imtryingtostealfromyou . in". Even though  PayPal is in the link text the actual website you'd visit would be "imtryingtostealfromyou.in". This link was displayed. in the email. A decent attempt would be to hide the link with text but that can be easily debunked as well just by holding the mouse pointer over the link. The actual URL will appear in either the tool tip or the bottom of the browser.

Being the curious guy that I am I wanted to see the phisher's attempt at a the website. I fired up a virtual machine that I use for testing malware and virus "combat". After clicking the link I was immediately given the warning you see in the screenshot to the right. OpenDNS blocked the URL after it had been discovered it was a fraudulent site. Nice going by those guys. I don't make money with OpenDNS or am I affiliated with them (I wish :) ) I just think this is a great free service and highly recommend it.

Never Share Your Password

More than 100 drivers in Austin, Texas found their cars disabled or the horns honking out of control, after an intruder ran amok in a web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments.

Read More http://www.wired.com/threatlevel/2010/03/hacker-bricks-cars/#ixzz0iXEHL7mX

Although the article and it's author are emphasizing the use of "hacking" in order to set the car alarms and horns off. I think the main point of the article should be never share your password. Even though the accused supposedly hacked the system he didn't really do anything but use another co-workers username and password. This is a basic social engineering hack where one user gains access to another users credentials and uses them in a fraudulent manner. This could have been avoided if the co-worker never shared his password. I stress this to everyone I help and work with. 

Check Free Hacking Incident

Last week The Register reported CheckFree had been hacked ,directing users to a server in central Europe gathering usernames and passwords.
"Online payment service CheckFree lost control of at least two of its domains on Tuesday in an attack that sent customers to servers run by a notorious crime gang believed to be based in Eastern Europe."
You may use CheckFree's services and not even realize it. Some customers may recieve emails regarding the hack and processes to use in order to be secure. In case you haven't and are wondering if your online payments go through them (CheckFree controls between 70 to 80 percent of the U.S. online bill pay market) please go here.