A Good Day for Phishing

If you ask someone who likes to fish, everyday is a good day for fishing. The same holds true it seems for email these days. We had yet another report by fellow handler Scott Fendley of a USBank phishing email. This site collected your personal banking information including asking for your password. The site brought up two webpages, the valid USBank web page and a second webpage that appeared to be from USBank asking you to confirm your information. The information was then posted back to the site where the request originated from. This was reported to the offender's ISP and USBank. Remember to always think before you click. Any request for your personal information that you were not expecting should be verified. Don't let yourself be the "catch of the day."

SSH Followup

A big thanks to everyone for all the log submissions in response to the diary entry http://www.incidents.org/diary.php?date=2004-07-23 by Tom Liston. We have gotten many emails with logs, but if anyone has been able to capture packets for these attempts we would like to see them.
NIMDA, Still There

As a reminder, there are many threats that appear to have come and gone. NIMDA is one of those that most folks consider old news. However, we had another report of it yesterday trying to compromise a webserver. This is just a reminder to everyone to always keep your webservers patched and secure. Don't get caught by something that should be easy to prevent.

Tip for the Day

Many people use credit cards for online purchases. One thing you can do to help protect yourself is to get a credit card that you only use for online purchases and have the limit set low, say for $500. This way if your information is stolen, you have a lower limit for which someone can take advantage. Always make sure to keep an eye on that credit card statement.
Some banks will allow you to setup a one-time use only card number online, or a temporary number that is only valid for a couple of months and has a smaller limit then your main card.
For more information on what you can be held liable for and steps you can take if you believe that your credit card information has been stolen see
http://www.ftc.gov/bcp/conline/pubs/credit/atmcard.htm
Lorna J. Hutcheson

Handler on Duty

www.iss-md.com