"Spear Phishing" - New and Improved Spam

Maybe "improved" isn't the right way to describe "spear phishing," a new and personally focused sort of spam.

CNNMoney described this new wrinkle in annoying (and possibly dangerous) email: "Unlike traditional spam, most of which is blocked by e-mail filters, personalized spam, known as 'spear phishing'" messages, often sail through unmolested. They're sent in smaller chunks, and often come from accounts the criminals have set up at reputable Web-based e-mail services. Some of the messages are expertly crafted, linking to beautifully designed Web sites that are bogus or immediately install malicious programs...."

These messages could look legitimate, since they may include personal data that the spammers have mined: like where you went to school, your mother's maiden name, or where you do your banking.

Part of the idea is to trick business owners into, for example, giving data about their

• Google (or other) advertising accounts
• Bank accounts

There's even something called "whaling," where an email to an executive claims that the business is under investigation by the FBI. I suppose that a panicked exec might be less than cautious.

How to Avoid Being Spear Phished

It boils down to three words: Don't be stupid. "Imprudent" might be a nicer word than "stupid."

There is pretty good advice in several places: including Microsoft and SANS Technology Institute (Which refers back to Microsoft's resource).

Some major points I found are:

• Don't send sensitive information in response to an email - no matter who seems to have sent it
  • Call (don't email) the presumed sender, to make sure the request is legitimate
  • 'Trust, but verify' applies here
• Don't click links in an email that asks for personal or financial information
  • Never
  • SANS T.I. says to put the Web address in your browser window instead - Microsoft has some advice about how to avoid bogus URLs

It Couldn't Happen to Me - Five Dangerous Words

I've been spammed, and phished, and fielded quite a few bogus phone calls. The experience has given me an appreciation for how easy it is to get fooled. One of my kids has called me "paranoid," for the way I insist on verifying a message before believing it. Much less responding to it.

Well, maybe so. I prefer terms like "cautious."

In the news:

• "Personalized spam rising sharply, study finds "
  CNNMoney (December 17, 2008)
• "Personalized spam rising sharply, study finds"
  Associated Press (December 17, 2008)

Of Selling Furniture Online, Marketing, and a Linkback Contest

This is a good idea I probably won't be using soon. Unless I can think of a valuable and desirable prize that costs me nothing.

However, Barn Furniture's Linkback Contest looks like a good idea for marketing.

The webmaster of Barn Furniture, an online furniture retailer, left a comment on one of my posts on another blog, "Thursday: More Family Stuff." Barn Furniture has a blog linkback contest and, more to the point for this blog, the company has a pretty good website, and an attractive line of furniture.

I checked out their Home Office Furniture section: wishful thinking on my part: I've got a home office, but no budget for new furniture. Barn Furniture also has quite a decent display of Bedroom Furniture, Amish Furniture, and other breakouts of their selection on their website.

I also checked out their domain registration. For me, this isn't anything unusual. Before I send my name and a valid email address, I like to know who I'm dealing with. Besides, these days research like this is fast and easy.

The addresses on Network Solutions' WHOIS Search, Barn Furniture's website, and Google maps all match: plus, a few clicks over, Google even had a photo of the storefront that more-or-less matched Barn Furniture's 'here's our store' photo.

Selling furniture online? Furniture?!

It's not as far-out an idea as it sounds. A few years ago, I heard a small business conference speaker tell how he turned a billiard table retail store around by marketing and selling the things online. He found out that people were willing to pay shipping charges, if they found something they liked. So, selling furniture online can work.

Studying the Barn Furniture website didn't convince me that I should be selling furniture. On the other hand, what I saw helped me get more specific about an idea or two that have been sloshing around in my head. If anything comes of that, it'll show up here.