Last week email marketing firm Epsilon had their systems breached according to several sources, such as CNN. Customer email lists of major companies like TD Ameritrade, Citi, AT&T, 1800Flowers, and more were reportedly stolen as part of that breach. What this means for you is that instead of receiving random phishing emails from companies that you don’t have accounts with, you’ll likely start receiving more targeted phishing emails from companies that you do have accounts with (which some security folks have termed ‘spear phishing’). Here’s what you need to do to better protect yourself over the next couple of months.
What You Can Do
When it comes to phishing email attacks, we’ve all been taught to look carefully at links before we click them, making sure it’s from a trustworthy source. I want you to shelve this idea for a little while and get into the habit of “manually typing in URLs“. That’s right. If you receive an email, for example, from Bank of America indicating you need to change your password with all sorts of links to click, ignore them (even if they look 100% legitimate and you actually do have an account with that bank), open up a Web browser and manually type in the URL for Bank of America that you personally know and trust.
The reason for this is because of what is known as a open redirection vulnerability. This type of vulnerability allows hackers to present you with a valid URL that you recognize and trust, but when you click on it you’ll still get redirected to a fraudulent site designed to steal your passwords. Get into the habit of actually manually typing in URLs for your important accounts and this problem almost goes away entirely. Your accounts stay safe, and everybody (but the bad guys) wins.
Good luck,
–Kevin
LOCKBOX SFT, the easiest to use and most secure file transfer service