Hello people,
Today I was alerted via @cryptoempire about a phising scheme that almost tricked @sames.
@Sames didn't fall for it, although he was close, and @eonwarped already flagged the guy, and he wasn't the first since his rep is 0.
However, this alerted me to the fact people need to be alerted not only towards basic phishers, but advanced ones using smart tactics as well.
I thought about it and since even basic phishers stole loads of accounts not long ago, people should be warned about smarter "hackers" who will try to steal their accounts.
Read below to learn more...
Basic Phishing: The Bread and Butter of STEEMit scams!
Now, first of all, do you remember when there were those comments taking you to steemil.com or something like that to get your password?
Well, those were basic phishers.
They were leaving comments from random accounts that linked to an external site to take your password.
And there were loads of victims.
Now, you may notice that STEEM now has a symbol that tells people that you're going towards an outside link or page... like this one.
Notice the little arrow?
That tells you you're going to go to an off-blockchain site.
But there are now new tactics, the one that @sames encountered and warned us about was one from the next category.
Advanced Phishers: Stealthy, Sneaky "Hacks"...
Now, advanced phishers worry about framing their little scheme just right.
They give authors a valid reason to click the link, and they highly customize the pages to try and look like SteemConnect or Steemit itself.
Here's the comment the phisher left @sames:
So, the comment refers to someone stealing @sames's content and the link apparently goes towards a report.
Not only that, do you see the little arrow pointing out you're going to an external site?
- NO!
Why?
Well, that's what made me laugh at the resourcefulness of these people... they found a "homemade workaround".
Here's why you didn't spot it:
They spaced it and spaced it and spaced it to push the symbol to the page's footer.
At a first glance it looks legit, and people usually don't go peek the footer.
What a smart guy... but there are even more advanced phishers to be careful about.
Read below...
Smart Phishers: They Aren't Only Resourceful, They Know How to Segment Their "Markets"
Now, there are phishers out there who start via the advanced tactic, but they switch it up as soon as they get 1 or 2 bites.
After they successfully get access to an account, they use that person's identity to phish other people.
What does that mean?
Well, imagine if that above comment wasn't made by that 0 rep person, but by ME!
I'm a person @sames trust, I'm reputable on the blockchain, and I'm even the leader of the crypto empire community.
@Sames wouldn't have scrolled down to the footer, he wouldn't even read the link or search for the arrow, he would click right on it...
...and that's what a smart phisher do.
People, now matter how good a certain person is, don't click their links without checking it twice... it may be a smart phisher.
BE CAREFUL!
In Conclusion:
No matter how much you trust someone, never ever log in anywhere from a link, especially one marked as external.
Be sure of where you are, look at the URL and the page's certificate, or you may help spread the disease.
Cheers!
Join the Crypto Empire Community
Bucket of Goodies:
- Trade Your STEEM: Binance Exchange
- Hire Me on STEEMGIGS
- Get Universal Basic Income - Free Tokens
- SEED Airdrop: Farmville for Crypto
- All Images Copyrights Free From Pixabay
Don’t develop an unnatural fear of external links. After all, that’s how the Internet works.
The key learning here is DO NOT reveal your login info to anyone. The only place you enter them is on Steemit and type in the Steemit URL yourself.
And when I put a link in any of my posts, I leave it naked. You know where you are going when you click it.
I appreciate that idea; as someone who has learned a few tricks in markdown and suddenly think I'm the dog's bollocks, it is very tempting to figure out fun little teasers to be the link for an external resource. But by being naked, it is very transparent and if we're in this network, we like that. I plan to adopt your practice, can always just use a footnote to keep the flow of the piece while maintaining proper citations.
And even further protection with regard to logins, be familiar with the levels of security for the different keys so even if something is exposed, damage control is as high as possible.
Fearless!!
Well, it's not my intention to trigger fear of external links, just to let people know what they look like and what they are so they dont fall for Steemit clones.
It’s always good to remind folks to keep their guard up.
Yes, used naked link for first time this morning. Felt more transparent. As @thisismework said, we like that here on Steemit.
Good info. People need to be made aware.
The trick with all the spaces is smart, very smart.
In your third scenario, it wouldn’t take long before the phishing comments sent out with your account got flagged, which would bring your rep score (and credibility) back to 0 rapidly. That’s what happened during the recent series of phishing scams. An account(like mine) was stolen and used to send out the messages. Before those got flagged, the sustem still said my tep was 53. So nobody saw anything suspicious. But the flags were there fast, bringing my rep to -1.
I wouldn’t click a link from anyone - not even my best friend - if there would be 0 or -1 next to his name..
Indeed, I remembered your case when writing this article... closest weirdest case I knew.
This disappoints me a lot , I put some external links in my articles to add extra information and sources, but now that everyone is paranoid (for good reason) I think no one will open any external link specially when it comes from a Minnow. Now I stopped making comments using external links, but when it comes to your post, you have to give it a little more context, now some of us will have to come up with new ideas to solve this issue, because every time a site becomes famous the cheaters come around.
Thank you for warning us @spiritualmax.
I think for now, we just need to elaborate more in our comments and posts about the external links that we are sharing. It sucks though.
Well, opening the links can't harm you per se, it's "logging in" on the site that gets you!
The reason I forward engineer is because I couldn't stomach the paranoia induced by spending all my time thinking like someone trying to trick people. I've learned though that it's a balance. You have to have a healthy skepticism in order to ensure you're not a target. Thanks for pointing this out.
No problem, glad you took value out of it!
Great insights to the phishing tactics. Thanks for the examples, it makes it clear. Keep educating everyone!
Very good information bro! I just got on Steem a little bit ago. I’m posting about Heroin Recovery coaching! I haven’t got any traction yet. I’m praying. Love the way you tell it straight.
wow! catch fishes.there are some amazing photo.really amazing...@spiritualmax.... visit my profile,upvote my post, support me,please
Im confused you just talked all about the little pushing arrow and how to avoid scams..then you have a box full of them at the end? Can you explain them or the group your trying to grow. .
The difference is he is showing that they are external links. The scammers are trying to hide that from you by adding a lot of space, tricking the eye. That is what he is warning us about. The ones who 'hide' it.
The group I think you are referring to is Crypto Empire. I am part of that group as well. We connect with people, talking about cryptocurrency, (I am learning all of that) and a bunch of other stuff there as well.
Oh but i thought we should never click a link that takes us off the site from the site? Now its ok to click a link to go off the site if they dont try to hide the arrow?
if you get a reply from someone saying come check this out. dont go. if you get a reply from someone that looks legit and is inviting you to click the link, look for the arrow first. if its not there dont go.
Thanks for helping out Foxy!
The arrows just mean external site, they aren't ALWAYS scams, sometimes they are good sources, but they MAY BE scams.
Where there's money, there are people who'll try to take that money... Amazing post that will surely help so many people!
Agree, human nature unfortunately.
Thanks so much for this wonderful infos. So many people on the platform are still ignorant about this especially the newbies that just joined. I hope they get a look at this especially since most of them still utilize their master key to log into their accounts.
Great writeup and thanks again
No problem! Glad you found it to be of value!
Yes! These tips are really helpful especially if you are the type that likes to click any link sent to you
Thank you for telling us about smart fishers.
This is informative. Thanks. personally, while on steemit, i refuse to give myself reason to go out to another off blockchain site. If i wanted that, i'd head there first.
So basically those wannabe smart phisher dudes can just about send there links and i never really follow them up. It is easier for me that way.
I about to have to upgrade my armor for these trying times.
Appreciate the headsup.
Gotta stay on top of your game and watch out for the snakes in the grass.
Paf! Human nature eh...
xox
Good to see you again Laforge!
Thanks ~ enjoyed the break but good to be back.
Hope all is spiffy for you!
xox
I don't exactly get the point. They use a link?
Yeap, the link goes to a page that looks like steemit but isnt.
WARNING! A link in this post by @spiritualmax leads to a known phishing site that could steal your account.
Do not open links from users you do not trust. Do not provide your private keys to any third party websites.
@guard , @mack-bot please tell me where's the link to a phishing site! Just because I have links and phishing on the same post? WTF!
Fix this...
lol, fucking bots and scammers man. We're doomed!
Seriously though, great info., I'd like to get this translated into Japanese. I'll hit you up on Discord.