Undetectable Phishing Attack Serious Risk for Chrome, Firefox, and Opera!

by Enstep Team | Apr 27, 2017 | Tech Scams

Chances are you and your employees use one or more of these very popular web browsers: Chrome, Firefox, and Opera. If so, you need to know about a very dangerous phishing attack that’s currently making its rounds. It’s dangerous because it’s nearly impossible to detect by even the savviest Internet users. Hackers are using it to collect sensitive information from users such as login and financial credentials.  

How This Phishing Attack Works

In general, when a hacker uses a phishing attempt, they create web pages and send emails that are very close to the color, feel, and style of legitimate institutions. For example, a bank or other financial institution. When a user thinks they are verifying their bank account number or logging into their account, they’re actually giving it to hackers. No legitimate institution will ask you for sensitive information via an unsolicited email. If you look closely, you will see oddities in the web address URL or the from email address.

With this phishing attempt, however, you most likely will see nothing different than what you’d expect, even if you look closely. The reason is, they are using Unicode characters from foreign alphabets such as Greek or Cyrillic to hide their malicious web pages behind legitimate names. These characters are very close to their Latin alphabet counterparts by sight, but treated differently by your computer. For example, they may use a Cyrillic “а“ as opposed to the Latin “a”. Virtually impossible to tell apart, even when you know to look. Look at this example created by the Chinese researcher who discovered the attack, Xudong Zheng. If you see “apple.com” in the url when you click the link, your web browser is vulnerable to the attack.

Help is on the Way

Mozilla is working on a fix for Firefox and Google is set to release an updated browser at the end of the month for Chrome to address this weakness. In the meantime, if you are a Firefox user, follow these steps:

  1. Type about:config in your address bar. Hit enter.
  2. In the search bar, type Punycode.
  3. Look for the parameter titled: network.IDN_show_punycode. Right click and select Toggle to change the value from False to True.

Unfortunately, there isn’t a temporary fix like this for Chrome or Opera.

Protect Your Business Against These Attacks

The best way to protect you and your employees from homograph attacks like this is by using a reputable password manager for all logins. It will store your usernames and passwords and authenticate each user automatically when a site is visited. These managers can detect sites that look legitimate but aren’t and won’t auto-populate your login credentials. Also train your employees to always manually type in the web addresses for sites dealing with sensitive information: email, social media, banking and other financial sites, etc. Don’t click on links sent in emails to access them. Finally, take advantage of our FREE security assessment for your business and consider utilizing managed IT services. This includes 24/7 system monitoring, so you know your business data remains secure.

Be Informed

Hackers are becoming increasingly more sophisticated in their methods to steal your sensitive information. It’s crucial to stay informed and keep yourself protected from the latest attacks. Use this guide for you and your employees to avoid homograph phishing attacks. Contact Us for your FREE security assessment and to find out how managed IT services will keep your business data secure.

Related Posts

Protect Your Business From These Common Email Scams

Protect Your Business From These Common Email Scams

As a business owner communicating through email, you need to be aware of common email scams to be on the safer side. Email security risks go beyond receiving messages with malicious links and attachments to infect your devices with a virus. This guide looks at the...

6 Common Types of Malware to Protect Your Business From

6 Common Types of Malware to Protect Your Business From

As a business performing its operations online, you need to beware of all the common types of malware. Malware infections can infiltrate your IT system via emails or other means. According to Purplesec, there were 812 million reported cases of malware attacks in 2018....

2022 Trending Computer Viruses

2022 Trending Computer Viruses

Technology is fast-growing, and so is the number of trending computer viruses. Viruses and malware attacks are dangerous to computer users because they steal personal information and data. Unfortunately, cybercriminals are willing to do anything to track and steal...

FIND OUT WHAT YOUR BUSINESS SHOULD EXPECT TO PAY
FOR HOUSTON TECH SUPPORT

Give us a call and discover how great local IT services and computer support can be!