网络钓鱼和社会工程

• 什么是社会工程?

  In a social engineering attack, an attacker would use human interaction (social skills) to obtain or compromise information about UNC or its computer systems. 攻击者 may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. 然而, by asking questions, he or she may be able to piece together enough information to 潜入联合国军司令部的网络. If an attacker is not able to gather enough information from one source, he or she may contact another source within UNC and rely on the information from the first source to add to his or her credibility.  

• How do I protect myself and UNC against a social engineering attack?
  • If you ever suspect you may be involved with a social engineering attack, refer the 立即去找你的主管.  如果你的主管不在，那就放手 the individual know you will have your supervisor get back with him/her.
  • Do not give sensitive information to anyone unless you are sure that they are indeed who they claim to be and that they should have access to the information.
  • Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. 如果有未知的人提出索赔 to be from a legitimate organization, try to verify his or her identity directly with 该公司.
  • Do not provide personal information or information about UNC , including its structure or networks, unless you are certain of a person's authority to have the information.
• 什么是网络钓鱼?

  网络钓鱼是一种社会工程. 网络钓鱼攻击利用电子邮件或恶意攻击 web网站s to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that 有一个问题. When users respond with the requested information, attackers can 用它来进入账户. 网络钓鱼攻击也可能出现来自 other types of organizations, such as charities. 攻击者经常利用 current events and certain times of the year such as:

  • 自然灾害(e).g.、卡特里娜飓风、印尼海啸)
  • 流行病和健康恐慌(e).g.,H1N1)
  • 报税季节
  • 经济问题(e).g.、国税局诈骗)
  • 主要政治选举
  • 假期
  • 高调人物的死亡
• How can I protect myself from receiving phishing attempts?

  Install and maintain anti‐virus program, an anti-malware program, and a personal firewall 你的电脑. Students can download Symantec Endpoint or Microsoft Security Essentials 免费下载 大熊星座 which contains all three of these critical components.

  • Take advantage of any anti‐phishing features offered by your email program and web 浏览器.
  • Mark suspicious items as SPAM or JUNK within your email program.
• 我如何发现网络钓鱼骗局?
  • Generic email greeting-A typical phishing email will have a generic greeting, such 作为“亲爱的用户”.”
  • False sense of urgency-“Your account will be disabled if it’s not updated within three (3)工作日!”
  • Fake Links-Many phishing emails have a link that looks valid, but sends you to a fraudulent 网站. 例如:www.secure-贝宝.com
  • Attachments- Similar to fake links, attachments can be used in phishing emails and 是危险的.
  • Sender’s email address-The “From” line may include an official-looking email address that may actually be copied from a genuine one. 然而，电子邮件地址可以很容易地 be altered – it’s not an indication of the validity of any email communication.
  • Poor English or misspellings  - "You want hamblurger I know god place?"
  • 欺骗性URLs-Examples:

  http://signin.贝宝.com@10.19.2.4/
  http://83.17.125.18 / pp /更新.htm?= http://www.贝宝.com/ = cmd_login_access
  www.secure-贝宝.com

• 但如果这封邮件是真的呢?

  If you feel the email is valid but are not sure, the best thing to do is to open a new 浏览器 window and type the address of the web网站 you trust in manually. 或联系 the supposed sender of the email via phone at a number published on their company-owned 网站核实电子邮件的合法性.

• 如果电子邮件有附件怎么办?

  Avoid clicking on email attachments whenever possible, especially if you don’t know 发送方! It could cause you to download spyware or a virus.

• Is there somewhere I can go to see if I would be able to spot a phishing scam before 这发生在我身上?

  是的! Test yourself with this fun interactive game from OnGuard.

• 我如何知道一个网站是否安全?

  There are 2 things to look for to know if a web网站 is secure:

  看网站地址. http://表示该站点是安全的. 如果它只有http://， 这并不安全. Don’t enter any personal information on a web网站 (including username 和密码)，如果网站不安全.
  If there is a secure lock icon in the status bar at the bottom right-hand corner of 打开浏览器窗口，网站是安全的. 许多假冒网站会把这个图标放在里面 主窗口欺骗你.

• Will Microsoft Tech Support call me because I have a virus or my computer is slow?

  No. UNC’s Information Security Team has been notified that there is a company posing as Microsoft Support saying that your PC has a virus or is running slow and that they 我愿意帮忙.  The support person then wants to get access to your computer 通过远程会议. At this point they want to install software on your computer 并可能向您出售防病毒程序.  

  What they are really doing is attempting to Phish you or use Social Engineering to gain access to your credit cards and bank accounts.
  If someone claiming to be 来自微软技术支持 calls you:

  不购买任何软件或服务.
  Never give control of your computer to a third party unless you can confirm that it is a legitimate representative of a computer support team with whom you are already 一个客户.
  Please take the caller's information down and immediately report it to your local 当局.
  Never provide your credit card or financial information to someone claiming to be 来自微软技术支持.