Cryptocurrency Phishing Attacks Be Cautious!

Best Binary Options Brokers 2020:
  • BINARIUM
    BINARIUM

    Top Binary Options Broker 2020!
    Best For Beginners!
    Free Trading Education!
    Free Demo Account!
    Get Your Sign-Up Bonus Now:

  • BINOMO
    BINOMO

    Only For Experienced Traders.

Cryptocurrency Phishing Attacks: Be Cautious!

Ever since the very beginning of the internet, there has been a type of malicious activity almost immune to technological progress in cyber-security, social engineering. Nowadays, the target of these practices can be anyone, including you and your coins.

The type of attacks known as phishing relies on the fallibility of human judgment and perception. Phishing, the most widespread form of attack, is used to extract sensitive data such as credit card numbers, social security numbers, passwords, and other confidential information from unaware users online by letting them submit this information directly to the attacker.

Trust your device

Your internet browser and software wallet are often prone to malware, viruses or various types of attacks. If you have the Trezor wallet, however, you are offline i.e. being isolated from the malicious attempts.

The fundamental purpose of safe hardware wallets such as Trezor or Ledger is to keep your recovery seed isolated. Nevertheless, you should always thoroughly check your device for confirmation of all features, especially when interacting with Trezor. Your PC should never require the use of your seed unless you want to recover the wallet (for example, after losing the device).

More, should you ever need to use the recovery seed to access your accounts, the device will always instruct you to enter the words in a shuffled order. We recommend entering the words of your seed directly on the hardware wallet instead of on PC. This will help you maximize the safety of your transactions.

Impersonation technique

The impersonation technique is one of the fastest to execute and technologically simplest to implement. The attacker usually impersonates a customer services agent or sales rep of the manufacturer of the wallet and tries to lure sensitive information from an unaware user using e-mails, phone communication or a spoofed website.

Remember, Trezor (SatoshiLabs) representatives will never ever ask for your recovery seed (in any form) or a credit card number.

If you ever have a problem with your device or would like to ask a question about Trezor-related issues, the only safe way of contacting Satoshi Labs is by sending a support ticket to their Support center. Alternatively, you can write your comments here on our website. We will do our best to answer all your questions.

SatoshiLabs do not provide phone call or live technical support. Therefore, never call numbers that claim to be associated with Trezor’s support team.

Many phishing techniques aim to bring you to a fraudulent site where all information can be collected and controlled by the attacker. Similarly to the impersonation techniques, these techniques are designed to rob you of your private keys.

DNS Spoofing (“DNS poisoning”)

is an attacking technique which takes advantage of the way DNS works to navigate the visitor in a wrong direction, making the site appear to be offline or even redirecting users to a server controlled by the attacker. On the other hand, BGP hijacking is a technique in which the hacker takes control of a group of IP prefixes assigned to a potential victim. Both methods can be identified by an invalid SSL certificate, however, users tend to overlook the warning, leading them to the malicious site. It is, therefore, crucial to carefully watch all signs, especially when working with sensitive things such as cryptocurrencies.

Unicode domain phishing

Another potential type of attack unicode domain phishing attack, also known as IDN homograph attack, relies on the fact that the affected browsers show Unicode characters used in domain names as standard characters, making them impossible to distinguish from domains that are legitimate.

Best Binary Options Brokers 2020:
  • BINARIUM
    BINARIUM

    Top Binary Options Broker 2020!
    Best For Beginners!
    Free Trading Education!
    Free Demo Account!
    Get Your Sign-Up Bonus Now:

  • BINOMO
    BINOMO

    Only For Experienced Traders.

While your browser may show the address as www.bitfinex.com the legitimate domain may be slightly different e.g. www.bítfínex.com.

If an attacker registers a domain that is visually indistinguishable from a legitimate one, he or she can trick users into trusting the site.

E-mail phishing

Another well-known technique is distributing SPAM e-mails aimed at luring from users name and password of any crypto exchange or their e-mail account/s.

This is what a fraudulent e-mail may look like

The above screenshot depicts the photo of an e-mail which was sent to a crypto trader who then passed it onto Facebook as a means of warning for the rest of the users

Notice that the sender’s e-mail address is [email protected], while the official website of Poloniex is poloniex.com. (Notice that the end segment of the sender’s e-mail address should have been @poloniex.com!)

Cyber-squatting

Cyber-squatting or domain squatting refers to illegal domain name registration or use. While the forms differ, the goal remains the same: to steal or misspell a domain name. Cyber-squatting can also include “advertisers” who mimic domain names that are similar to famous, busy websites.

A few recommendations to protect yourself against becoming a victim of a phishing attack:

  • Trust your device. Look for confirmationon the screen, especially when it involves transactions or your recovery seed
  • Make sure the URL is exactly: https://wallet.trezor.ioor https://beta-wallet.trezor.io.
  • Save the https://wallet.trezor.io as a bookmark to avoid misspelling it in the address bar of your browser
  • Although the green lock on your browser (on the left-hand side from the address) may not be a guarantee of the authenticity of the website, be alarmed if it is missing
  • Never give your recovery seed to anyone (including Trezor’s technical support, CEO or anyone else).
  • Carefully observe the website addresses and watch out for any mistakes in the spelling or atypical characters.
  • Use updated security software, install security patches and updates once available
  • Avoid clicking on links in an e-mail or social media unless you are absolutely sure that these are authentic
  • Pay close attention to shortened or incomplete links, especially on social media
  • Remember, the representatives of SatoshiLabs (manufacturer of Trezor) or Ledger will never contact you on Facebook or by e-mail to give them any data

Author

More about the author J. Pro

Unlike Stephen (the other author) I have been thinking mainly about online business lately. I wasn’t very successfull with dropshipping on Amazon and other ways of making money online, and I’d only earn a few hundreds of dollars in years. But then binary options caught my attention with it’s simplicity. Now I’m glad it did because it really is worth it. More posts by this author

Phishing attacks

Crypto phishing attacks are evolving into one of the most profitable methods for cybercriminals to steal cryptocurrency (digital assets). These attacks are developing to the point where even cautious users could fall for them. Because we crypto community members don’t rely on anyone else when moving funds, being extra cautious is of great importance. While it is hard to summarize all of the types of attacks, we will list the most frequently used techniques and how can you protect your funds in a proactive way.

Phishing is a fraudulent practice where a malicious entity (“hacker”) uses social engineering to masquerade as a reputable source in an attempt to dupe the user into revealing his/her private information, e.g. login credentials, passwords and credit card numbers. Phishing today is considered to be one of the most commonly used cyberattacks, posing an especially great threat in the cryptocurrency world. In the next few paragraphs, we will expose the most common crypto phishing attacks – which are similar to other phishing attempts, yet distinct in that they are meant solely to steal your information in order to obtain cryptocurrencies.

Phishing is the most used cyberattack

Most often, phishing attacks range from fake emails, seemingly sent from a trusted sender, to downloadable malware to scam websites. This is why staying informed, preparing for the worst and always using a verified, preconfigured step-by-step workflow is crucial. To give you a better idea of what phishing is, we’ll give an example of what a specific attack looks like.

Deceptive phishing

The most common cyberattack is deceptive phishing, also known as fake emails.

In this scenario, the recipient gets an email trying to persuade him/her to make a mistake: to click the link in the email in order to (supposedly) verify account details, reset credentials, verify a transaction, or for a fake giveaway, etc. This sort of email might look as if it came from a known company or a trusted source, e.g. Tokens.net domain (no fear; we have not yet come across such an email!), but do not be fooled. No serious crypto company would ask you to do anything like this. You can determine where the email is from yourself simply by looking at the sender address.

If we at Tokens.net ever send you an email:
a.) It will not be a random email with a request for you to click a link, it will be an email from the Tokens.net platform, a support center answer to your question, or a newsletter.
b.) We will never request your private key (or other confidential information).

If we come across any information regarding phishing attempts using our domain as a sender, we will do our best to notify you as soon as possible. But keep in mind that we are not a bank, so please be careful.

Pharming

Another popular and even more successful scamming alternative is pharming. This is when a fraudulent website appears to be legitimate and it isn’t as easy to notice it’s a scam website. In this scenario, a victim is presented with a recreated or cloned known webpage so that it looks like the original. In some examples, victims do not even have to click a malicious link in order to be taken to the bogus site. Attackers can infect either the user’s computer or the website’s DNS server and redirect the user to a fake site even if the correct URL is typed in. Malicious websites are most of the time very realistic-looking fake websites, and their main intention is to obtain the user’s credentials.

Always double check page and URL you are visiting

Sometimes you won’t receive an email; the website will be the first hit on Google search, even an ad. This type of hacker steals your information and then steals your money.
Sometimes attackers fool even the Google Play Store, where users can download a wallet app that is malicious. In November 2020, there were at least 4 of these. A recent example in 2020 is the malicious fake Trezor app; the app was nothing like the original SatoshiLabs graphics, yet many people fell for it.

First application is fake and second is the real one.

A combination of the previously mentioned methods and some extra skillfulness can produce downloadable malware, an application coming from a link on a scam website, a link in a fake email, or as an attachment in an email. This ransomware will not steal your credentials, but will lock your computer and you may even get extorted. This sort of phishing was common a year or two ago, where victims received an email with an .exe file that encrypted computer files and the attacker then demanded bitcoins in order to present the victim with a key to unlock his/her data.

Cryptojacking

Another cyberattack also considered phishing is cryptojacking. This form of attack is more often intended for businesses, but it is not to be disregarded, so take the necessary precautions. Cryptojacking is illicit crypto mining using a computing device to mine cryptocurrency without the knowledge of the device’s owner. Warning signs for this include slowdown of your device, heat generation and shorter battery life. Monero became famous for cryptojacking due to its ability to mine on lower-tier hardware.

Another cyberattack that recently became known is the Electrum wallet attack, where Mac Electrum wallet users lost 2.3M in stolen coins.

Don’t trust, verify!

There are numerous ways for phishing attacks to happen, and we cannot list them all, so the best advice we can give you is the well-known crypto motto: Don’t trust, verify! There is no single cybersecurity technology that can 100% protect you from phishing attacks, but following basic security measures will help you avoid them successfully. Our team of security experts advise you to always use best practices to protect yourself! Even if it sounds boring, you and only you are responsible for your security.

In order to feel as safe as you can, securing your funds doesn’t just mean buying yourself a hardware wallet. If you have more than a month’s worth of salary in crypto, buy one and you will be able to access websites with greater ease. But even cold storage cannot protect you if you enter your private key on a phishing website. You will have all your funds taken. Remember the previously mentioned example of Trezor (the dev team is ensuring Trezor was not compromised). Even some big exchanges have faced phishing and consequently been hacked.

How to secure your funds

Securing your funds means you must go through all the verified steps each and every time. Follow the instructions, which should serve as a basic guideline for the due diligence process, and your probability of being a phishing victim gets smaller. Nonetheless, we are an exchange service providing support; we are not a bank and we need you to understand that we cannot act like one. Secure your funds at all times. If our website is compromised or you accidentally visit a different website, your funds will be stolen. Please consider the actions listed below to protect yourself from phishers and from loss.

  • At the very beginning, make sure you have entered the real website, your first access should be from a trusted source.
  • Install software or browser extensions that detect phishing domains. Install EAL, MetaMask, Cryptonite by Metacert or the MyEtherWallet Chrome Extension to block malicious websites (although lately this is no longer enough to protect yourself; browser extensions have also become part of hackers’ strategies to carry out malicious attacks).
  • Bookmark your verified access point for later reference and always enter from this exact bookmark.
  • Enable Two-Factor Authentication because this is harder for a hacker to obtain. Our website prompts you to do so straightaway. If you don’t set it up, you cannot deposit, withdraw or use any other function of our service.
  • An optional step for phishing prevention on our platform is setting up an Anti-Phishing message. You can set a message (3-40 characters long) that will be included in emails sent from Tokens.net regarding your account, be careful, as our newsletters do not include the message. Therefore, if you do not see this message, the email was not sent from Tokens.net!
  • Be diligent in keeping your private key and password safe. Your private key is sometimes called your mnemonic phrase, keystore file, UTC file, JSON file, wallet file, etc. Do not store your private key in Dropbox, Google Drive, or other cloud storage sites. If that account is compromised, your funds will be stolen. DO NOT share your private keys.
  • Buy a hardware wallet. No excuses. It’s worth it. We promise.
  • Fishy-smelling emails are easily verified with the support team of the supposed sender. There’s no shame in asking. Verifying is a thing in crypto.

When you are not sure if a website that is asking for your credentials is legit, you should follow these common sense steps:

  • Never click on any unidentified links! Do not trust messages or links sent to you randomly via email, Slack, Reddit, Twitter, etc.
  • Inspect the website and email addresses. Hover over without clicking on it!
  • Always check what website you are visiting and that the URL is correct:
  • Check that the website is not a homograph. IDN homograph attacks look like the correct URL but are fake.
  • Check business’ web domain endings. Hackers will usually change one letter or ending, such as from .com to .org. Normally you wouldn’t pay attention to this, and this is how they can exploit you.
  • Check for Google typos. Paste the domain into the Google search bar, and if Google shows you a typo notification then it is the wrong domain name.
  • Does the site use https? Check the SSL Certificate validation (this step is less recommended as lately malicious sites do have https encryption, presenting a problem for users as SSL encryption has traditionally been one way to determine whether a website is trustworthy or not).
  • Make sure the URL bar looks something like this:
  • If it is too good to be true, it probably is.
  • Ask questions when you don’t understand something or when something doesn’t seem right.
  • Don’t let fear, FUD, or FOMO win over common sense.

The most recommended way to keep calm and trade on is that you stay vigilant and follow routine steps that you set up from the start.

As cryptocurrency prices rise, so do the phishing culprits. Stay vigilant and do your due diligence.

Cryptocurrency Phishing Attacks: Be Cautious!

Scams in general has been around ever since humanity existed; and around a decade ago, it looks like scammers has found another industry to make money off— the cryptocurrency space. The cryptocurrency space is infested with scams simply due to the pseudo-anonymous nature of bitcoin and cryptocurrencies, allowing scammers to get away with huge heists with potentially little to no trace if they know what they’re doing.

The best way to not get caught up by these scams is to simply educate yourself and be extremely cautious in everything you see online in general.

Listed and described in this article are some of the common scams that are being used in the cryptocurrency space.

Phishing Attacks

One of the most effective scams until today; not only in the cryptocurrency space, but in the world wide web in general.

A phishing scam is an attempt to steal account login information, credit/debit card information, your bitcoin or crypto wallet’s recovery phrase, or whatever valuable information that a bad actor can take advantage of, mostly through fake clone websites and software.

One simple way of scammers spreading phishing sites is through the Google ads platform. You do a simple Google search query, typing up “Binance”, and if you don’t use an ad blocker, there’s a decent chance that the top search result would be an advertisement.

It clearly says “ www.binance.com/ “, on the link text, but when you actually click on the link and take look at your browser’s address bar , there’s a decent chance that the site you’ve just opened is going to be something like “ binancel.com “, “ binancesite.co “, or something else that isn’t the legitimate “binance.com“.

Some of these methods are so tricky, as they use domains like “ biṇaṇce.com “. You might not have noticed it immediately, but it’s actually an ‘ ‘ , a Latin character.

Google ads is just one way of spreading phishing sites and software though. Other ways and methods of them spreading phishing sites and software includes:

  • social media: scammers could create fake accounts Facebook, Twitter, Instagram, or other social media sites and communities in general, masquerading as certain companies(Ledger, Coinbase, Trezor, etc).
  • hacked YouTube accounts: scammers have been hacking YouTube accounts with a decent number of subscribers and change the YouTube channel name to a certain company. They would then say that they’re conducting a “crypto giveaway” or something similar, while posting a video(live or not) with a link to a phishing site or to a download link of a fraudulent software.
  • fake customer support: this is mostly happening on Reddit and Twitter, but it could happen on all social media sites. Scammers would target people who had made a post concerning issue(s) with certain services(Binance, Ledger Nano S/X hardware wallet, etc) by messaging them and sending them a link to a phishing site or to a download link of a fraudulent software.

Always keep your eyes peeled. Some hackers and scammers are extremely smart and they can create other more convincing ways to trick people into opening their phishing links. It’s heavily recommended for people to always check their browser’s address bar if they’re actually on the legitimate website.

Tips to not get phished:

  • always do a double or triple check on your browser’s address bar to confirm that you’re actually on the legitimate website.
  • install a well-known and reputable ad blocker like uBlock Origin on your browser, or use the Brave browser instead.

Twitter Giveaway Scams

Fortunately, Twitter giveaway scams have died down a bit, though they could still appear on Twitter once in a while.

Twitter giveaway scams are pretty straightforward. The scammer would make a fake Twitter account masquerading as a famous person(mostly people in the tech industry). The scammer would then reply to the legitimate person’s tweet, saying something along the lines of:

As you can see, Elon Musk’s legitimate Twitter username is @elonmusk whereas the scammer is using the Twitter username @elonmusk___.

This scam should be pretty obvious, but unfortunately some people might still fall for it.

Investment scams/Ponzi schemes

Investment scams has existed pretty much since the internet was first gaining traction.

Investment scams and ponzi schemes mostly have well-designed websites that claims to give you 10% profit daily from your initial deposit or something along those lines.

They ask you to deposit a certain amount of money (or crypto, in this case), and promise a certain amount in return daily, weekly, or monthly . Some investment scams allow you to withdraw your profit for a while, in the hopes of you depositing more money, then they simply lock up your account after a while. Losing you access to your funds.

Today, most of these scams mostly pretend to be “ trading bots “, “ cloud mining“ sites, “ bitcoin/crypto investment“ sites, etc.

Yes, some people do make money off these sites, by using the site’s referral program . If you invite another person into the program and get the person to deposit money , you get a small percentage off the deposit. These scam sites mostly use referral programs to get people to spread these scams online for them; sometimes even to the point of YouTubers spreading them, causing a huge number of people to fall for these scams.

If you wanted to invest in the cryptocurrency market , buy the coins or tokens yourself using a reputable exchange and hold them on your own secure wallet.

  • BitConnect
  • DavorCoin
  • HashOcean

Pump and dump schemes

Pump and dump schemes are pretty easy to spot, as pump and dump group leaders usually advertise them as “trading signal groups“, or sometimes even straight-off shamelessly advertise them as “pump groups”.

The scheme is pretty straightforward: The group leader asks his/her members to buy a certain coin/token that is quite low in marketcap to make the price far easier to manipulate, claiming that it will rise or “pump” in price.

The thing is, before the group leader announces which coin/token to buy, the leader already bought a significant amount of that certain coin/token, so the leader can sell them in a significantly higher price. The price of that coin/token does then increase because of the group members buying loads of the specific coin/token, while the leader is selling at higher prices; earning the group leader significant amounts of profit, sometimes even as high as 10x.

How do you not fall into these schemes? Easy. Simply don’t join these groups, and invest wisely.

Scam ICOs

Initial Coin Offerings or ICOs is quite similar to crowdfunding whereas the company/team accepts BTC/ETH from the people in exchange for a certain amount of their coins/tokens, depending on how much you sent them.

ICOs aren’t really scams as some are definitely legitimate, but a big percentage of ICOs are indeed either scams, or are bound to fail. Unfortunately, some well-made ICO scams are quite hard to detect as a scammer could create a legitimate well-thought project and simply just not deliver the product and run away with the money. Though there are some characteristics that could be enough proof for you to stay away from certain ICOs.

For a more in-depth guide about ICO scams: Detecting Scam ICOs

Gambling/exchange site deposit scams

This scam usually takes place by someone asking the victim to use a certain gambling site, and them saying that they gave the victim some free bitcoin to start playing/gambling with. If the victim attempts to withdraw the funds, the website then asks the victim to deposit a certain amount of bitcoin, claiming that deposit to be for the “withdrawal fees”; but in fact, the victim is sending the bitcoin to the hacker’s bitcoin wallet. After the victim made a deposit, the scammer then runs away with the deposited bitcoin.

This scam usually is being attempted via private messages on forums and some social media sites, to prevent people from calling out the scammer.

You can easily avoid this scam by simply not entertaining such offers on private messages or emails.

Best Binary Options Brokers 2020:
  • BINARIUM
    BINARIUM

    Top Binary Options Broker 2020!
    Best For Beginners!
    Free Trading Education!
    Free Demo Account!
    Get Your Sign-Up Bonus Now:

  • BINOMO
    BINOMO

    Only For Experienced Traders.

Like this post? Please share to your friends:
Binary Options Theory and Practice
Leave a Reply

;-) :| :x :twisted: :smile: :shock: :sad: :roll: :razz: :oops: :o :mrgreen: :lol: :idea: :grin: :evil: :cry: :cool: :arrow: :???: :?: :!: