In the past, I've written about "phishing." Basically, it's a way for unscrupulous thieves to steal your identity. They send you an e-mail that includes a link to a bogus site that asks you to type in your personal information. Keeping yourself safe from phishing is simple: never, ever click a link in your e-mail that asks for any personal information. If you are a PayPal or eBay member, for example, and you get an e-mail that seems to be from them, don't click the link in the e-mail. Take the three extra seconds to open up a new browser window and type in www.paypal.com or www.ebay.com directly into the address bar.
Avoiding this form of identity theft is easy, however, there's a new type of attack that's more complex. A term called "pharming" describes a new way to trick you out of providing personal information. Pharming is another name for something that's been around for a while called "domain spoofing." Instead of sending an e-mail, pharmers attack a fundamental piece of the Internet called domain name servers (DNS).
To understand pharming, you need understand a bit about DNS. Basically, the Internet is really made up of numbers, not names, to describe the location of Web sites. So a site called www.mywebsite.com might really be 64.85.12.12. Domain name servers sit out there, and by accessing large databases of sites, they translate the text you type into the numbers the Internet needs to take you to the site you requested. Unfortunately, DNS is a weak link because a number of years ago, hackers figured out how to "poison" DNS and change the records for certain sites. They pretend to have authority to change the destination of a Web address. If they do this to an information site, it's really not a big deal as far as identity theft is concerned. If they do it to a banking site, it becomes a really big deal.
The scary reality of pharming is that even if you were to type in www.mybank.com into your browser's address bar, you could be taken to a site that looks like mybank.com, but really is not. However, by paying attention you can keep yourself safe. Any reputable banking or ecommerce site has a security certificate (or SSL certificate) from an authority such as Verisign or Thawte. That's what gives you the little lock icon or https:// in the address bar. A pharmed site won't have a valid certificate.
So you want to make sure your Web browser checks for a valid SSL certificate. To do that, you need to set some options. In Internet Explorer, choose Tools|Internet Options. In the Advanced tab, look under the Security section. Add check marks next to: Check for publisher's certificate revocation, Check for server certificate revocation, Use SSL 3.0, and Warn about invalid site certificates.
Sure, people are working on making DNS more secure. But the criminals are working just as hard on ways to defeat new security. So when you surf, always pay attention. If something looks a little "off" with a site, it may be, so exercise caution before providing any important information.
|
