Misspell A URL And Give Up Your Sensitive Information

It’s not important to know what GitHub is or even what cryptocurrency is. However, there is a new phishing scheme that uses malware residing on the former to steal the latter, as well as lift your sensitive information. In this case, it uses fake phishing sites that look so similar to the real one for GitHub, that it’s incredibly difficult to tell the difference. It employs a method called typosquatting to take advantage of users who are trying to download the source code for the cryptocurrency platform EtherDelta and who have “fat fingers.”

First, “fat fingers,” is a reference to clumsy typing or making typos. Typosquatting (also referred to as domain jacking) is the term used to describe someone who takes advantage of a brand by buying a domain that looks like or is a typo away from one that is well-known and in this case, using it to deliver malware or something else that isn’t desired by the user. Cybercriminals used small misspellings, or typos, of the development platform GitHub, to get malware onto the computers of unsuspecting victims that stole cryptocurrency and other valuable information.

The best way to avoid becoming a victim of typosquatting is to bookmark your frequently visited sites and uses those instead of manually typing in the address.

Alternatively, check the web addresses when you type them in manually very carefully before hitting the “enter” key on the keyboard. Make sure it reflects the site you really want to visit.

If you’re doing a web search for a site and using keywords, examine the result closely before clicking on the links that appear in the results list.

Doing this is very important particularly when going to websites that store your sensitive data, such as your financial institution or healthcare site.

© Copyright 2017 Stickley on Security
September 22, 2017