Phishing

1
Phishing

• Dennis Schmidt, CISSP
• Director, Office of Information Systems
• HIPAA Security Officer
• UNC School of Medicine

2
Phishing

• Phishing is e-mail fraud where the perpetrator
  sends out legitimate-looking email in an attempt
  to gather personal and financial information from
  recipients.
• Messages appear to come from well known and
  trustworthy Web sites such as
• PayPal
• eBay
• Amazon
• Major banks

3
Note the difference between the URL Label and the
Actual URL
4
Fake Web Site
5
Real Web Site
6
Notice the Difference
7
Dots, not slashes after .com
.info not .com
Fake Site
8
Bad password still brings you to this page
9
Real Site
Slashes after .com
10
Bad password gives you this error! Thats good!
11
(No Transcript)
12
(No Transcript)
13
(No Transcript)
14
(No Transcript)
15
(No Transcript)
16
(No Transcript)
17
(No Transcript)
18
(No Transcript)
19
(No Transcript)
20
(No Transcript)
21
(No Transcript)
22
(No Transcript)
23
(No Transcript)
24
(No Transcript)
25
(No Transcript)
26
(No Transcript)
27
(No Transcript)
28
(No Transcript)
29
(No Transcript)
30
Protect Yourself from Phishing

• Be suspicious of any unsolicited e-mail.
• Never provide sensitive information to their
  query.
• Check it out from second source (Telephone, etc.)
• Dont use the phone number provided in the
  e-mail.
• Misspellings, bad grammar, etc., should be clues.
• Look out for link names that dont match actual
  link addresses.
• Remember Your bank will not ask you to verify
  that your account information is still accurate.
• If it does, you need to find a new bank!

31
Questions?