When (Real and Virtual) Worlds Collide

Once upon a time, there was a pretty clear line of demarcation between RL (Real Life) and cyberspace. When I first started using the Internet, those worlds only occasionally merged. Oh, sometimes a friendship that started out in a chat room or on an email discussion list progressed to meeting in person, even eventually - for me and a number of others - to marriage. But once a relationship "went live," its status changed, and it moved from the "online" category to the "real world" category.

Even now, I think there is a subtle difference in the way I relate to those of my online friends that I know in person and those who remain words (and sometimes photos) on a computer monitor. But the distinction between the two is blurring more all the time. A couple of years ago, we threw a party and invited the members of one of the mailing lists I'd belonged to for a dozen years. People came from as far away as Australia, and we were meeting some of them in person for the first time - but it didn't feel like a first-time meeting. We had shared so much for so long I felt as if I knew those online friends much better than, for example, I knew my neighbors.

On the list, this little group had become almost like family. We'd helped each other through illnesses, divorces, deaths in the family, job changes, and other traumatic life events. We'd celebrated one another's birthdays, marriages, new children/grandchildren, promotions and other happy times. We'd had friendly (and occasionally not so friendly) disagreements about politics, religion, lifestyles, and values. We'd lost list members along the way - some who got mad and left when the arguments got heated, one who passed away after months of battling cancer. We had talked to each other about things we couldn't discuss with our "real world" friends or even our spouses. Finally being together geographically was less like "meeting" than like going home.

But the convergence of the virtual and real worlds isn't just about relationships. What we do online now often leaks out into our offline lives. And it can go the other way around, with things in the real world affecting our computers. We think of malware threats as something that comes to us over the Internet, but hackers are going "real world" now, too. Recent reports tell of a new scam that uses the credibility of the offline world, along with your fear of the law, to launch a phishing attack.

Here's how it works: you find an official-looking "parking violation" notice on the windshield of your vehicle, but instead of (or maybe in addition to) a phone number, it lists a web site you can visit to find out how to take care of the ticket. The site installs malware on your PC, giving the hacker a back door by which he/she can steal your data and/or take control of your computer.
Computer Security Research - McAfee Avert Labs Blog

The first incarnation of this scam is not very well done and has been limited in geographic scope, but it's a good bet that others will follow suit with more sophisticated versions. With more and more government agencies encouraging people to do business with them through the web, it's likely that a well done fake could lure quite a few folks to the malicious site. After all, your guard is up when you get an unexpected email message, but many people are much less suspicious of a printed document that appears in the "real world."

Scammers have also taken to using the telephone in a similar way to initiate their attacks. You might never click a link in an email purporting to be from your bank, but what if someone from the bank called you on the phone and informed you that your account may have been compromised, and asked for your credentials? The best of these scammers will express concern for "security" and insist that you call them back to "verify" that the call is legitimate. And of course, the number that they give you to call is answered with the bank's name. Some even go so far as to spoof the caller ID information so your phone displays the name of the bank when they call.

Once you're satisfied that they are whom they claim to be, they may direct you to a special "secure" web site (one that they've set up with an SSL certificate so you'll get that comforting little "lock" displayed in your browser to assure you that it really is secure) or they might just bypass the computer altogether and ask for your logon credentials over the phone. Unfortunately, many people will comply.

Phishing attempts may also come through the postal service. Ever received a letter from a collection agency, stating that it's attempting to collect a debt? The problem is that you've never heard of the "original creditor" nor do you owe any money, or at least not in the amount that the letter claims. Usually these letters offer to allow you to pay off the debt for a much lesser amount, but only if you send the check right now to the listed P.O. box or mail drop (they never give a real physical address). Of course, legitimate collection agencies use the same tactics, so it can be difficult to know the difference if you really do have outstanding debts. In today's economic climate, with many people falling behind in their payments, we can expect more scammers to get in on the gravy train and send these letters, hoping the victims will assume they're real and send the money.

Sometimes when the paths of your online and real world lives cross, it's a good thing. Other times, it's not. Most of us have raised our awareness about the threats that come through email and other online venues, but it's important to realize that those same scammers are getting smart and taking their games offline in an attempt to con more people.

What about you? Have you ever been the victim of a "crossover" scam attempt? Do you tend to put more trust in a phone call or letter you receive in the mail than you would place in an online contact? Do you know someone who would fall for the parking ticket scam, or would you have been likely to fall for it yourself before reading about it? How about the good ways in which the virtual and real worlds collide? Do you find that those two worlds are much less separate now than they used to be? Tell us what you think