This past weekend, we learned that Vice President Pence had a personal AOL email account compromised while he was governor of Indiana. You can read the story in the Wired article The Golden Age of Email Hacks Is Only Getting Started. A phishing attack was used to compromise then Governor Pence’s email account. Phishing and whaling (a phishing attempt with a specific high-profile target) are probably the most common ways to compromise an email account. Phishing is an attack in which the person performing the attack is trying to get some sensitive information (such as login credentials) through a deceptive email. We’ve seen a rise in phishing attempts at SBTS this past year. These attempts are far more sophisticated than fake court settlements and Nigerian princes (although those are still very lucrative attacks). These attacks are often disguised as links to sensitive information hidden behind a fake login page. The purpose of this article is to help you spot the phishing attempt before you become a victim.
Does it make sense that you should have received this email?
To spot a phishing attempt, the first step is to ask, “Does it make sense that I received this email?” Were you expecting this email? Imagine you are a part-time Housing employee at SBTS. You receive an email from Dr. Mohler requesting that you review a budget discrepancy with a link to a Google doc. Does it make sense that Dr. Mohler would be sending you this budget discrepancy? Probably not, so it was either legitimate and sent to the wrong person, or else it is a phishing attempt.
In either case, the right thing to do would be to notify the sender of the error, which allows him to either correct the error, or at least raises awareness to the phishing attempt. Unfortunately, the sinful side of our curiosity often gets the best of us, and it is tough to resist the temptation to know that information meant for someone else.
Pay attention to your address bar.
While the original link included “google.com” in the path, it lead us to a page hosted on “dropbox.com”. We’ve seen this exact example work several times.
In a phishing attempt we saw this semester, someone received an email that appeared as a Google Drive sharing notification, but it linked to a fake Google login page hosted from within Dropbox.
Does the page look like the normal page you would see, or are the elements in the page slightly off?
If you are already logged into your email in the browser, then why are you being prompted to login to access this file?
If you have Two-Factor Authentication turned on for your email account, then why weren’t you prompted for the token or the second factor?
If there is any clue that the page you’re on may not be legitimate, close the tab or browser and back out. If you are unsure, you can always forward those emails to campustechnology@sbts.edu and we can check it out for you.
Lastly, if you are an SBTS student or employee, you can go here https://portal.sbts.edu/phishing and enter your email address, birth date, and employee/student ID number to receive an automated phishing attempt via email from us as practice.