Blog

Hi. Today we’re going to talk about spear phishing. Now I’m not talking about diving underwater and trying to catch fish with a spear. I’m talking about spear phishing spelt with a P-H, so P-H-I-S-H-I-N-G. Spear-phishing spelt that way is an email-based scam targeted towards a specific individual or organization. Microsoft report that spear-phishing attacks have doubled in the last year. Now having said that, I should point out that most spear-phishing attacks are aimed at larger businesses and larger organizations because they are really, really targeted and they take a lot of time to get working. But they’re still important to know about.

An example, a basic example of a spear-phishing attack, would be, say, for instance, a job that has been advertised in a large company. The HR person gets an email with all the correct details from a prospective job client. HR opens the resume, which then infects their computer. That’s sort of an example of that.

I bring this up because spear phishing is the highly targeted version of phishing, which is the more common type of attack. These are the ones that you’re likely to get attacked by. An example would be PayPal sends you an email asking you to verify account details by clicking a link, which then can install malware on your computer. The link might say, “Login into this site,” which is a fake site. Then they’ve got your login and your password.

There’s a couple of things you can do about that because a lot of those are quite sneakily done. One is to install two-factor authentication. Microsoft says that two-factor authentication stops 99.9% of automated attacks on your system. That’s number one big one.

Also, a password manager. Say, for instance, fake PayPal has sent you an email requesting you verify your account. You click on the link, you login into a site which looks exactly like PayPal. You don’t notice this: it’s actually spelled P-A-Y-P-A-1.com. So it looks very close to PayPal, and they spoof the site up to look exactly like PayPal. If you go to log in to this fake PayPal account, your password manager, which normally would offer to put your login and your password in, it won’t come up because it doesn’t recognize that as your legitimate site for that instance. There’s sometimes when it is the right one, but at least you can have a look and you can get suspicious.

The other thing is, because a lot of these are automated, there may be slight spelling or grammar mistakes, or just clumsy English. You know if something comes from PayPal or big banks or anyone like that, any big organization, they’re going to send you a well crafted, well written English email. They’ve got paid professionals to make sure the emails come out and look professional. If it’s not the usual level of professionality that you expect from that company, the next thing to do is just roll your mouse over where the link is and you’ll see down the bottom left corner of your browser, it’ll tell you the real link. If you roll over something that says, “Click here to verify your account,” and it’s purportedly from PayPal, then if you look down at that bottom actual URL, the actual web address, it might say abracadabra.com or whatever. Then you know, no, just don’t go there. Just delete the email.

Also, you can enter a fake password first when you login into the site that you’ve been sent by this email. If it’s fake, it will accept your password, if real it will give you an error.

The final thing to do is, if you suspect an email, say a fake one from PayPal. Well, PayPal is not a very good example because they don’t answer their phones, but from a bank or somewhere like that, just ring the bank or ring the organization and ask them. They’ll be really pleased that you’ve rung them because they want to know what phishing emails are about. They’ll almost always tell you if your email is a scam or not. That’s the best thing to do. Even with PayPal, send them an email, unless they’ve changed their policies and they do talk to you now, but they never used to. All right, thank you very much and goodbye.

Black Star Radio talk Aug 23rd 2019 (transcript)

I think most of us have heard of the term VPN and often we don’t really know what it is, or we’ve got a bit of a wrong idea about what it can do. What it actually stands for is, Virtual Private Network and what it does is, it encrypts your data going from your computer to a website.

So say you were filling in a form on a website, which would probably have your name, your address, maybe date of birth, and a few other quite interesting bits of information. Once it gets to the website, as long as the website is a secure website with HTTPS on it, or the little lock you see in your browser window, that means that the data inside the website is encrypted and pretty safe.

But the data that you send to the website, the time that it goes from your computer to that website, often that’s not encrypted, especially in an open wifi system where you’re in a hotel say, or in a cafe, or something like that. Then theoretically someone can grab your data as it’s going to that website, and steal it, and then use it for nefarious purposes. So it’s quite a handy thing to have.

Anonymity – No

Some people think using a VPN makes you anonymous and it doesn’t really. It hides some things that you’re doing, but it doesn’t actually totally make you anonymous. So if you’re looking for anonymity, don’t use a VPN. The best way to think about it is just an extra layer of security. So in our modern world, we have layers of security with what we do in our modern digital world. And a good analogy is, it’s like having curtains on a house. It stops people seeing what’s inside your house, the contents of the house, even though the house is in full view on the street. So that’s a really good analogy and a good way to think about it.

Now another reason to do it is, Australian law now says that ISPs have to collect all sorts of data, what they call the metadata. So what that is, they don’t collect your individual places where you go, but they do collect your name, your address, your date of birth, your email address, your billing details, and a lot of other information with your account, the time and date, and duration of any of your communications, the type, whether it’s phone, text, social media, email, or whatever, and the destination of where you’re going, and your IP address. And that’s available to the government if they need it.

So if you’re upset with that amount of federal government knowledge of what you’re doing, then a VPN can hide a lot of that information. It’s never going to hide everything. It’s still a really good idea to have. And one of the other things it does is, some of the streaming videos sites, for instance, the geo-block you, depending on what country you are in. So with a VPN, you can bypass that if you want to.

Netflix

But there are companies like Netflix who, if they see you’ve got a VPN, they don’t let you in at all. They’ve bypassed you trying to bypass their geo-blocking things. But it’s still quite important these days to actually have one. And particularly if you’re in an open wifi system where there’s no password, then your data is really up for grabs as you go up and down from websites.

One of the things you should be aware of is there’re plenty of free VPNs, but someone once said that if you don’t pay for a product, then you are the product. And I think that’s especially relevant in today’s internet world. So if a VPN company doesn’t make money from charging you for your VPN, it’s got to make money somehow, which is fair enough. It’s got to make money and it’ll make money either from ads, or selling your data. And the whole reason of a VPN is that you don’t want people to see your data. So this is an instance where free is not good, and it’s not really free.

Why it’s worthwhile using a VPN.

a) It’s worthwhile having it.
b) It’s worthwhile just going to Google typing in, ‘VPN Australia’ and then you’ll get plenty of reviews of good VPNs, and what people think of them, which is the more important thing. And all of them have got different prices, and different pros and cons. So you’ll find comparison sites that look through all of them and that’s a really good way to go. And I really still do highly recommend having a VPN for all of those reasons I’ve just talked about.

I use a product called Speedify They describe themselves: “Speedify is a revolutionary channel bonding VPN that combines Wi-Fi and Cellular (and more!) to create a faster, more reliable, and secure connection.”

I use Speedify mainly for combining internet connections but I keep the VPN on because of the reasons I’ve described above.