So let's talk a little bit about how to avoid these really targeted spearfishing campaigns when they
come to you or to one of your family members or to one of the employees in your organization, one of
the first things you can do is train your people to spot these types of attacks.
If I hover over this address in one browser, Firefox, for example, on my Mac, you'll see really
small in the lower left hand corner of the browser window.
I'll try to bring this over a bit by hover over that, you'll see Facebook dotcom at and some address.
Teach your employees, your family members to hover over these addresses and look before they ever click
through.
Never click through a suspicious email, especially when it has something that looks like this Facebook
dotcom at some weird number.
Or if I look at this in Chrome, if I hover over it, notice it resolves down to the ten point nine
four.
Open this up in Chrome, though.
I'm not going to be able to hover over and see it in the current version of Safari.
That is, if I open this up in my Mac Safari browser, I won't be able to readily see that.
But rather than click through any email any time, especially if it has an urgent message.
If this had said Bryson, you're in some inappropriate pictures on Facebook or I can't believe someone
said this about you or it looks like your account has been hacked.
You need to log in to verify that it's you.
All you need to do is come in your browser and type in w w w to Facebook dotcom.
The second thing that we need to do besides typing in the full address is check to make sure that it
is secure that we are using HTP s Coingate whenever we enter our username and password.
It's a small difference in the euro, but it's a tremendous difference in the security of the website.
This https Facebook or https.
Colon slash, slash.
And the name of your bank, that secure connection means that it is encrypted and no one can just pull
your username and password from it, plus you notice that it's going to the real website address not
to attend at 029 or 172 dot something or another Web server halfway around the world that's trying to
steal your credentials.
The next thing you can do is just bookmark those websites.
So if I click my bookmark here and say I want to bookmark Wells Fargo or Bank of America or whatever
your bank may be, if I bookmarklet the benefit to doing that, is it all I have to do is come to my
bookmarks and open up the Wells Fargo account or come to my bookmarks and open up Facebook from the
secure login page when I bookmark it.
Then I just come to my most important pages, like Facebook or Alibaba or WeChat or whatever it may
be.
Wells Fargo, whatever your bank account information is, if you bookmark those, it will also help
you avoid type squatters, which is or typo squatters.
That's let's say that you typed Wells Fargo Dotcom.
Well, if that company hasn't purchased a few extra misspellings of its name, then that might take
us to a malicious website.
I'm not even going to go to this site to see if Wells Fargo owns that one.
Typos are pretty common when it comes to typing in websites.
So type it correctly.
Make sure you've got a secure Web site and then book market.
So that you don't ever have to wonder if you're going to the right site, never click through the link
from an email, even if you hover over it and it looks good like our other one did here, that looks
good.
WW beat Facebook dotcom at something.
Don't click through the link.
Come to your browser and either type it in and make sure it's secure.
Or better yet, Bookmarklet.
So that you can come back to it safely in the future, you especially want to educate your family and
your co-workers that if something in the email seems urgent, hey, you need to log in now to get this,
or if something's giving something away for free, then you need to make sure to tell them never to
click through the link, make them go to Facebook, dotcom and search from there, make them go to their
bank site and search from there and never click through a suspicious email and be suspicious of every
email, even when it looks like it's coming from a friend.
If your friend sends you something that says, hey, it looks like you've been hacked or somebody posted
an inappropriate picture of you, or did you really say this comment on this social media platform because
your friend's account may have been hacked, they may have felt for some fellow fallen for something
like this, and then they sent someone sends you an email asking for money, asking for you to click
through something.
It can come from that other person's account or it can be spoofed to look like it's coming from your
friend's account.
So you have to be really careful whenever you receive anything by email.
If it's coming from a friend, why don't you just text them or call them, see if they're doing OK,
make sure that they don't need help in real life.
But spear phishers, scammers, con artists, predators are getting smarter and smarter all the time.
We saw just a handful of ways to make an email look like it was really coming.
From a social media Web site and not from our fake spearfishing server that we set up in Cali Linux,
so you really need to be careful when it comes to phishing, train your kids, train your parents,
train your family members and friends and definitely train your employees to look out for phishing.
Remember, you can just click on a new browser window and type in the address directly, make sure that
it's secure when you get there and you can verify that with the little lock and https.
And then there are even finally a few tools out there.
If you look for the net craft toolbar, this net craft toolbar will allow you to install an extension
in your Firefox or Chrome or other browser window.
This net craft toolbar will let you install an extension to Firefox, Chrome or whatever browser you
like most that will help you spot fake phishing emails a little more quickly.
So if you get something in, it's from a server that people know is a bad server, then that craft can
give you a little advisory up here if you're wary of installing browser extensions.
And I understand that net craft is a good one.
And if I try to visit that htp ww dot Facebook dot com at ten point nine for address with my Minecraft
toolbar installed and hit Enter says Suspicious You URL detected.
The page you're trying to visit contains suspicious characters indicating that it might be a malicious
site that dot that at ten point nine four.
Do you still want to go there?
No, we don't.
And notice it says phishing site blocked.
This phishing site has been blocked by the Net Craft Toolbar.
Very cool.
So once again, phishing has gotten much, much more difficult to spot.
Be careful with every email.
Be suspicious of any email, even if it looks like it's from your bank, from your organization, from
your email provider or your social media platform or even from one of your friends or family members
because they could have been hacked themselves.
Always look at those you URLs.
And better yet, either type in the URL or bookmark your favorite URLs so that you never click through
a link in an email ever.
And finally, if you want a little extra protection, you can download an extension like the Net Craft
Toolbar for Firefox, for Chrome, for whatever your favorite browser may be, and it can help you spot
those bad URLs that you might try to click through in your organization.
Sometimes these tools can go a long way toward preventing the types of social engineering attacks that
we've been training about in this section.
Well, I hope you've learned a lot about protecting yourself, protecting your organization, even your
family and friends from social engineering attacks like spearfishing some really scary things out on
the Internet.
But you can be safer by always being suspicious of emails, never clicking through those links and emails,
especially if there's a sense of urgency or sense that you're getting something for free or something
exclusive.
Always go out to the Web browser and type in your favorite e-commerce site, type in your bank account,
your bank website, type in your email account.
Never click through those links, especially with a suspicious URL.
And if you want an extra layer of protection, use a tool like Nekrasov toolbar.
I hope you've enjoyed this thorough lesson on social engineering in Calli Linux.
We'll see in the next section.