What’s My Login?

Riverbank Ruminations; Observations from The Banks of The Technology River

Tom Evans ~  Ashton Engineer Emeritus

From 1950 to 1967 there was a quiz show called “What’s my line?”. There was a panel that tried to guess the occupation of the guest. The panel could only ask questions that elicit a Yes or No answer. The top prize money to be won was $50 for ten No answers. There were two to three contestants and one or two celebrity guests. For the celebrity round the panel was blindfolded. All contestants would sign in before the round began.

Today the scammers want your login, not your ‘line’. There is no end of the variety of attempts that will be made to get this information. Unfortunately, one large source of this information is out of your control and that is when a company is breached. Google ‘data breaches’ and you will get a variety of figures, but one I saw was for January to June: 540 breaches affecting 163,551,023 individuals. Given that some breaches are not reported for years, it is hard to keep anything confidential when it comes to data.

You might think that the dark web, where this data is freely sold, would be sufficient for scammers to work with.  But no, they still will try to get your data on an individual basis. Perhaps they like their data fresher than can be found in breach repositories. Who knows? Your username and password is still a desirable commodity for scammers.

As evidence of the desire for login credentials by bad guys, this article offered some interesting information about fake login pages. These are pages that look like the legitimate login page but are reached by clicking on a link in a phishing email and exist solely to harvest credentials.

Here are some numbers from the article:

• 50,000+ fake login pages detected
• 2,500 were polymorphic (able to impersonate more than one login page)
• 200 top brandnames spoofed.
  • PayPal 11,000
  • Microsoft 9,500
  • Facebook 7,000.

In addition to scammers working hard to confuse you, some companies don’t help matters. Suppose that, like many companies, your company is using Microsoft 365 or whatever Microsoft decides to call it next. What is a valid link for you to login? I did a small amount of testing to see what links might look like. Here is what I found:

Which of the links above will take you to a valid Microsoft login? The answer is ALL of them, even www.live.co, which seems strange but I understand it. Imagine now, trying to sift out whether a link is valid when you get an email, supposedly from Microsoft, telling you there is an issue with your account and you need to login and fix it. There is some good news at least for Microsoft 365 users. The official emails from Microsoft will tell you to login but there will NOT be a link in the email for you to click.

The takeaway here should be that care is needed when you are ready to click on a link. Hover your mouse (long press on a phone) over the link and see what it is, not what you see in the email. Be like the panel on “What’s my line?” and ask questions. What’s my destination? Will this link take me there? Pay attention because when you rush, Microsft.com can easily be misread as Microsoft.com. (You did see the misspelling right?). And because breaches do happen, keep these points in mind:

• DON’T REUSE PASSWORDS!!!!
• DON’T assume your data is private
• DON’T assume a company has NOT been or will not be breached
• DO use long, random passwords
• DO use a password manager

If you’d like to learn more about protecting your network and educating your user base, give the Ashton Solutions team a call at 216 397-4080.