Phishing Quiz

[Evaders99]

http://www.siteadvisor.com/quizzes/phishing_0707/

 

Take it and see how well you can identify a phishing site. With so much spam and other junk coming from computers, identity theft has become a sport. Read all the text carefully.. I missed one due to the minor signs in the text.

[budious]

Hmm... 7 out of 10... and I'm suppose to be an Information Security major

 

I missed the Chase, Amazon, and Capital One websites. Those are tricky.

[Darth_Rob]

I got 8 out of 10, and Im not sure how...

[Eagle]

9 of 10.

 

Didn´t knew which was the most common email scam.

[dodododo]

6/10. Just to save time, I'll just post my credit card, banking info and mothers maiden name here and save myself the embarrassment later...

[Jahled]

A nice post Evaders, that certainly woke me up to a few things I should pay attention to. In all honesty, I simply don't trust the Internet as a whole to feel comfortable enough to use my credit card these days online. Once in a blue moon if it's a product to tricky for a cheque in the post to a business, but that is fairly much hardly ever.

 

The explanation to where one screwed up was helpful. I think i'll hide my credit card where my monitor can't see it.

[Krytos]

Quality thread E.

 

9 out of 10. The annoying thing is, how many people could spot half of these websites without being asked: "Which is the real one?"

Obviously were it through an email, poorley written or didn't use the correct logo's you'd be suspicious. But it really hightens how easy it can be to fool anyone

 

@dodododo: Hahaha

[Mad78]

I got 7 out of 10... Should learn a few of their security tips. The main one I knew was about the "http" and "https".

[DarthTex]

I got 8 out of 10, but should have been 9. For some crazy reason I "picked" the wrong Amazon.com when I clearly mentioned "That's the fake" Must've been a "senior moment"

 

The other one I missed was Chase.

 

The simplest, best defense is NEVER click a provided link! Type in the url address manually; that should help immensely (But with some of our members, the ones who can't spell, you're in for deep doo-doo because there are other sites geared for your "typos". So sorry).

[Eagle]

The simplest, best defense is NEVER click a provided link! Type in the url address manually

Exactly!

 

If you´ve got a mail from a company and you are not sure if it isn´t fake, don´t click on the link in that email. Open another browser-window and go to that site as usual. You may have bookmarked it. Than go to your account and there you may see if the message really came from that company.

 

It´s quite easy to see if you´ve got an authentical mail or not. If there´s a case where a company wants to inform you about some things or you have to confirm something, they will write: "Dear Mr. Eagle". In a phishing-mail they will rather just write: "Dear Costumer". Because they don´t know your real name. Another thing is that most of the phishing mails are written in a poor english. In fake mails they allways tell you that you have to confirm immediately your credit-card or whatever or you will loose your account or something like that. That´s most common on fake-mails for Ebay or Amazon. Both companies won´t close your account just because of some missing datas about your credit-card.

 

Like Mad just mentioned, you can see on the "https" if you are really on a secured site. The address-folder in your browser will also appear in a yellow colour to show you that the site where you have to confirm something is secured. Never give any important data if you are on a site which isn´t secured. The most common secure is SSL.

[Evaders99]

Note that HTTPS doesn't actually mean the site is legitimate. That's what the quiz was trying to stress in one of the questions.

 

HTTPS just means is securing the data between yourself and the web site. Think of it this way... it's like an armored truck. It doesn't mean that the money its holding couldn't be delivered to a criminal's doorstep.

[kaja]

9 out of 10.... stupid my-space... the only people who go to my-space are child-molesters an emo-kids...

 

J.k. incase some of you do go to myspace.

[DarthTofu]

Only Rob goes to Myspace, and he's an Emo child-molester.

 

I feel so non-savvy. I got five out of ten, but then, I rushed through it and was looking for obvious signs that they were scamming you, such as asking for you social security number, asking you to recheck your password, not having a foreign language button if they're global, etc. Good thing that I can't and don't make any monetary transactions with the Internet!

[Darth_Rob]

Only Rob goes to Myspace, and he's an Emo child-molester.

 

Is that slander or libel? I forgot which is written and which is spoken...

And I prefer to do my stalkings on facebook, for your information. So check your sources next time you make wild accusations like that.

[kaja]

Is that slander or libel? I forgot which is written and which is spoken...

 

I belive it's libel.

 

Only Rob goes to Myspace, and he's an Emo child-molester.

...And I prefer to do my stalkings on facebook, for your information. So check your sources next time you make wild accusations like that.

 

Yeah, dude, check your sources! phfff.... jeez.

[Eagle]

9 out of 10.... stupid my-space... the only people who go to my-space are child-molesters an emo-kids...

 

J.k. incase some of you do go to myspace.

Ahem!

 

But I´m there just since two weeks. And why? Of course a women was the reason.

[Moribundus]

Note that HTTPS doesn't actually mean the site is legitimate. That's what the quiz was trying to stress in one of the questions.

 

HTTPS just means is securing the data between yourself and the web site. Think of it this way... it's like an armored truck. It doesn't mean that the money its holding couldn't be delivered to a criminal's doorstep.

 

I believe SSL provides means of determining whether site is genuine or not. The site's certificate has to be signed by some certification authority. If it is self signed (which should not be the case of banks, eshops, etc.) or signed by unknown (or distrusted) CA, most browsers will complain and warn the user. In addition if the certificates have changed since the last visit, browsers will also warn the user of a possible phishing or man in the middle attack.

 

And I got 7 out of 10, my grammar sucks and this SSL related question got me too.

[Evaders99]

SSL doesn't mean anything. You can still buy a certificate signed by Verisign, Geotrust, etc... and it still doesn't mean its genuine. Fake mailing addresses and stolen credit cards makes it all easy to set up your own phishing site.

[Moribundus]

SSL doesn't mean anything. You can still buy a certificate signed by Verisign, Geotrust, etc... and it still doesn't mean its genuine. Fake mailing addresses and stolen credit cards makes it all easy to set up your own phishing site.

 

Hmm, I guess you're right. Certificate signing can protect you from man-in-the-middle attacks, but not from phishing. Since my phishing domain name is not the same as the domain name of the site I'm trying to fake, browsers shouldn't complain. Sneaky.

[SOCL]

7 out of 10.

 

Fortunately, I usually read everything on the site before doing anything, and if I receive something that just seems plain odd or get asked for certain information I'm even a little unsure about, I call the customer service people (via the official page in my favorites or something else I know is legit) and ask about it. Of course, if I get the wrong info there, then I'm screwed.

[tacoJoemeru]

7 out of 10.

 

I did better than I thought I would.