Your online accounts not as safe as it used to be

Manama

If you have recently received SMSs or emails prompting you to reset your Gmail password, the chances are, you are being targeted by hackers.  A string of phishing attempts was reported recently, which follows this modus operandi, according to a report by Canada-based think-tank Citizenlab.org.

Masquerading as authentic Gmail, the phishing mails direct you to a site that prompts you to reset your passwords.

Two factor authentication used by Google to eliminate such threats are being circumvented by the hackers through this method. This authentication system has been fairly successful in preventing password thefts and phishing, as the attackers needed access to both the password as well as the one-time-security-code received on your registered mobile number.

The new development is worrisome as the report says ‘The attacks point to extensive knowledge of the targets’ activities.’ Also, the present method of attack involves extensive effort through continuous monitoring of target’s online activities.

A second method of attack is posing as an interested party with a proposal.  The report says, ‘The attack began with a morning call from a number in UK. A male voice spoke in Farsi under the pretext of offering a potential collaboration. The caller demonstrated extensive knowledge of the target’s personal hobbies and professional activities. After making several comments, he proposed a business project related to the target’s activities. The call ended with the caller promising to send the target a proposal.’ This was followed with an email with a Google drive lookalike attachment.

Another form of attack involves posing as a journalist from a reputed news agency and sending emails from similarly worded domain-names.

Such phishing attacks can be prevented to a large extend by ensuring ‘https’ instead of ‘http’ in the start of your Gmail web address, for example, https://accounts.google.com . Even though, this simple check isn’t completely foolproof, especially against more sophisticated attackers, it is worth-a-start for protecting your personal and professional data, the report adds.