Ever since Binance created a bounty on the phishing hackers, a very powerful message was sent to any wanna-be hackers to stay well away from Binance.

Steemit needs to have a bounty as well. It is surprising the numbers of people that fall for the phishing scam here on Steemit.

Image reference @binanceexchange https://steemit.com/cryptocurrency/@binanceexchange/binance-hacker-bounty

Here is how it works:

Hackers set up a phishing website that copies a Steemit page except the website will have a slight difference in the URL address. (Like steemil.com instead of steemit.com). When a Steemian lured there, it will look like a steemit page. Most times, the phishing website just copies a article or page from Steemit. Sometimes the lure is a comment to your blog. The comment may lists a link stating that someone copied your blog. The only page that copied your blog is the phishing website. Once you are lured there, the page loads and then you will get the pop-up that request you to load your master key. It looks legitimate, so you enter your information.

Once the hacker has your active or master key, they drain the account of any liquid Steem or SBD.

Using the hijacked account they start spamming newly created blogs with more phishing links to lure more Steemians to click the link. After that, eventually the phishing spam gets reported to Steemcleaners abuse reporting tool. https://steemcleaners.org/abuse-report/ The abuse team goes after the hijacked steemit account and flags everything driving the reputation to a negative number.

This is a really sad thing that happens to steemit accounts. The account owners lose the control of their account and loose all the hard work to build a reputation and money earned. Sometimes when I comment to warn people not to click the posted link to a phishing attack, I get flagged from others accounts that have been hijacked to keep my comment from being viewed. It is out of control.

How should we fix this?

1. Steemians should know to NEVER provide their master key. NEVER NEVER NEVER! If you are logging in with your master key, you are doing this wrong. The only time to use the master key is to initialize the account to collect the other keys or to reset all the keys. Once you have set up your account, log off and log back in with your posting key. Keep that master key off-line and only use it in an emergency if your account gets compromised.
2. Steemit administrators need to be able to freeze accounts that paste a link to a phishing site. There should be a master list of all known phishing links that is constantly updated. Any time a link is used in a comment or blog, then that account should be frozen immediately. that would lessen the spread of hacked accounts and help those folks that have been hacked to keep reputation from being flagged into the negative territory.
3. Steemians should never follow an untrusted link on Steemit. Furthermore, Steemians should never log in after following a link. Close the browser and reload and verify the URL address before logging in.
4. Steemit should add an option to utilize 2 factor authentication for certain operations. Like transferring money or adding a link to a post or comment.
5. CREATE a BOUNTY to any Steemian who supplies information that leads to the legal arrest of the hackers involved in the Steemit phishing attacks. Steem is fat with money and I've seen multiple powerdowns of 5.5 Million Steem when the price was around $4 to $6. I think throwing a quarter million per attacker for a bounty will really drive the message. Also, Steemians can have an option to place a small portion of their holdings toward this goal to pay to bring the crooks to justice. The holdings can continue to be used like SP, but cash out whenever a crook is brought to justice.
6. Information or leads about the phishing hackers should be made public to support any bounty hunter effort to bring the hackers to justice.

I hope you enjoyed reading my Blog. Please remember to Upvote, Resteem, and Follow. Thank you.

---------------------------------------

For a breakdown of how Steemit Rewards system works:

https://steemit.com/steemit/@socky/steemit-rewards-breakdown-a-simplified-explanation-with-illustrations