We always think that a website with the green padlock states that we are connected to a secured connection and nothing to worry surrounding our details. But new research states that half of all phishing sites display the padlock, making people think they are safe. The report by the PhishLabs states that 49% of the phishing websites are using the SSL certificate, it was up to 25% in the last year, but now its been increased up to 35%.
This brings a shock to everyone and people are scared to enter their details on any website. Before getting into the topic, let’s see what is phishing for your clear understanding. Phishing is actually a type of cyber attack targets the people in order to steal their confidential or sensitive information for a financial gain or as a criminal act.
This attack is really a serious one and even brings down a true website business down. Hackers are really talented and can pose as someone honest such as a charity, a bank, an insurance firm, government departments that a victim is likely to give the information. Then the hackers will use this data to break the entire network of an organization. This mostly happens to the people who may not know how to check whether the email is trustworthy or not.
An Email was the best choice for phishing. Because it is very cheap to send messages to hundreds of people at a time and can fool people to collect their data. Now the hackers have turned into web pages and started phishing sites to gather the information. Now the green padlock trust is completely broken. The padlock on the website has a security certificate installed and the connection is completely secured using the HTTPS connections.
But then this HTTPS connection has certain drawbacks such as their no barrier to anyone obtaining HTTPS certification, which made the hackers a gaining advantage of starting their work to attack people. The green padlock guarantees that you are sending the encrypted data, but not that the person on the receiving end has scruples.
So when hackers created a website to grab your information, they obtain a security certificate that will work on HTTPS and it will be displayed with a padlock symbol on your web browser. In that case, you will feel that the connection is secured, but on the back end, it is completely a phishing website that is been run by hackers.
“The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers,” said Brian Krebs in a report on the finding. John LaCour, chief technology officer at Phishlabs told Krebs that the adoption of SSL by phishers is a good example in which fraudsters are taking their cue from legitimate sites.
“PhishLabs believes that this can be attributed to both the continued use of SSL certificates by phishers who register their own domain names and create certificates for them, as well as a general increase in SSL due to the Google Chrome browser now displaying ‘Not secure’ for websites that do not use SSL,” he said. “The bottom line is that the presence or lack of SSL doesn’t tell you anything about a site’s legitimacy.”
Paul Bischoff, the privacy advocate with Comparitech, told IT Pro that the study goes to show that there’s no one way to identify a phishing website. “Making sure the site has a valid SSL certificate indicated by HTTPS and a padlock in the URL bar is just one step. Users should also look for character replacement (“Punycode(Domain Name)”), subdomains, and other inconsistencies in a websites real URL and webpage.
You can usually find the real site by Googling the company name, then check it against the suspected phishing URL. Other means of combating phishing usually deal with emails and other means of getting victims to the phishing site,” he said.
Common Phishing attacks and Solutions to overcome
- Don’t click on links in an email to a website unless you are absolutely sure that it is authentic. In case, if you have doubt, open a new browser and type in the URL in the browser and check if it is true.
- Beware of emails id it’s asking for your personal details, or message displaying like [urgent] enter the details etc. Don’t share your personal information via the internet.
- Don’t click on any download files, links, open attachments in emails from any unknown senders.
- You should never email personal, or financial information to anyone even if to the known recipient.
- Beware of pop-up links that ask you to enter the personal details. Don’t copy any address from the pop-ups in your web browser. Don’t click any links in the pop-ups.
- Always protect your computer with spam filters, firewall, anti-virus, and anti-spyware software.
- Turn on Secure DNS that protects against DNS hijacking. DNS hijacking is a type of malicious attack that redirects you from the site you want to visit one that may look just like it.
- Make sure you check your online accounts and bank details regularly.
- Check for the email if it has improper or wrong spelling. If you find something like that, it is a spam email and doesn’t do anything with that email.
- The hyperlinked URL will be totally different from the one shown. The URL will look similar to any of your known enterprise. But once you hover the mouse on the small popup window, you will find a different URL.
- You may get an email stating that you have won this contest and enter your personal details. In that case, it is completely phishing and never share those details.
- They will spoof the sender address in an email to appear as a reputable source and request you for sensitive information. Don’t trust the mail and share the information.
- You have to recognize the improper use of copyright or trademark notices.
Conclusion:
Getting an SSL certificate is not really a big task, a lot of certificates are available for free of cost as well even criminals sell it online. The best way to find out the worth web page is to use a website scanner and not just depend on the padlock hereafter.
Always stay safe by cleaning the cookies regularly, search history, card details, personal information etc. Hope you understood about the topic half of all phishing sites display the padlock, making people think they are safe. If you have any queries please feel free to comment to us. You can subscribe to us at Facebook and Twitter.