Phishy Business

Yesterday, we were caught up in what is referred to as a "phishing" attack. Suddenly a ton of emails came through our district accounts with the same subject line: _________ has shared a document on Google Docs with you. It seemed so legitimate, right? Phishing is a form of fraud in which the attacker tries to learn information such as login credentials or account information by masquerading as a reputable entity or person in email, IM or other communication channels. You've probably seen notices by your bank warning against phishing attacks--but phishing can happen in ANY type of online account. In the phishing attack yesterday, people all around the world received that same innocuous email. Just like the fish swimming in a pond, many were unable to resist the lure of the bait so cunningly placed before us. The good news is that within one hour of the report of the first phishing email, Google had resolved the issue and shut it down. 

So, the question has to be addressed that I know many of you are asking. "How can we prevent this from happening again?" The sad thing is that we cannot because phishers are a dime a dozen. There are a few precautions we can take, however, that can limit the number of people affected.

1. Header of Email

The very first of the suspicious emails in yesterday's attack was with Chris Teal's account (I verified with Coach Teal that it was okay to use him in this blog). As soon as I opened the email I knew it was not correct. This is how:

If you notice, in the orange highlighted box the information was definitely "phishy." Another interesting part of this email header is highlighted in green--if Coach Teal were sharing a document with me AND someone else, why would I be blind carbon copied? 

2. Prompted to Reenter Account Information

If a document is shared with you through your school account and you open it through your Gmail account, you will not be prompted to enter your account information. You are already signed in if you can open your email.

3. Educate Yourself!

Panda Security has a great informational article on preventing phishing attacks. I've listed the top nine tips below, but there is more in-depth information on their site. Please take the time and educate yourself on what you can do to protect yourself!

• Learn to identify phishy emails.
• Check the source of information from incoming mail.
• Never go to a bank's website by clicking on email links.
• Enhance your computer/phone security.
• Enter sensitive data in secure websites only.
• Periodically check your accounts.
• Phishing can be done on any online account.
• Phishing knows all languages; if yours suddenly changes you've been hooked.
• When in doubt, just don't click.

All in all, PRCSD did a great job yesterday through this insanity. Many of you recognized the threat as soon as the email hit your account. Please continue to practice due diligence with internet safety.

http://www.pandasecurity.com/mediacenter/security/10-tips-prevent-phishing-attacks/