coxy's blog

So today I've spent about an hour in total going through people's various Facebook accounts. Why? Because people are stupid.

Someone set this fake Facebook page up and set it going around the internet. It basically looks like a Facebook login page, but if you check the address bar you'll notice the site is actually hosted at photos-c-ak.com and not facebook.com. Obviously some people aren't clever enough to realise this and attempt to login.

Logging in doesn't actually log you in; it just takes what info you've put in the form (ie, your email address and password) and then saves it to a text file. You will be then taken to the real Facebook login page to sign in, if you're not already, and then onto the photo / video / page you're meant to be looking at. The victim is non-the-wiser to what's happened.

You can view the big long list of people's names and passwords by reading the text file. This is just one of a few text files to store this information - so there's more people that's been fooled by this than what you see there. And, because the scam has been posted on various internet forums, there's lots of fake login details.

Minor details aside, the major issue is that you can have the most secure password in the world; human error (ie, not recognising a fake site when you see one) will prevail. Whilst this is the case, there are a few steps you can take to prevent any phishing attempts you may encounter:

1. Check the address bar
   When signing in on a website, check the address bar to make sure it's a real website. Make sure the Facebook Login page says http://www.facebook.com/login.php, or http://mmu.facebook.com/login.php - the important part is that the .com comes after 'facebook'. If the address reads http://www.facebook.hs.com or http://facebook.photos-c-ak.com - for example - that's fake. Do not proceed.


2. Use a good web browser
   Whilst a web browser can't offer 100% protection, you should make sure you're using a browser with built-in Fraud Protection. Opera Web Browser is fast, free, safe, secure and has fraud protection. If you come to a fake website that's ready to steal your login details - you're more likely to be alerted to this. View a demo of how this works - then download Opera.


3. Use multiple passwords
   Make sure your email account has a unique password to any other internet account you may have. If someone found out your Facebook password, they could change it - using your email address is the only way of retrieving your account from the intruders.
   
   If your email account password is the same as any of your other website passwords - go change it now - an intruder could log into your email and change your password. This would essentially lock you out of ALL your accounts on the internet because email is used as a method of reclaiming your account / resetting your password.

I added the site to Phishtank - sorry to spoil anyone's fun. Hopefully some of this blog post was useful to you - even if it was only to provide entertainment in logging into other's Facebook and email accounts.

Staying safe on the internet is just common sense; but you have to know what to look out for to begin with.

Subscribe to coxy's blog:
Add to Google | Add to My Yahoo! | Add to Netvibes | Generic RSS Feed | widgetize!