#SpearPhishing Archives

Phishing and Pharming: All of it You Must Know

Posted on 05/04/202129/05/2021 by Anteelo Master

Today, the ever-evolving technology has taken society to the next level of evolution. However, it has also paved a path for malicious actors to misuse it and exploit unwary users. Day after day, cyber criminals are growing more sophisticated and smart. They have been honing their skills in order to bypass the latest security standards and obtain money and data illegally.

Phishing and pharming are two major types of cyber attacks that involve tricking others into providing their personal information. Although cyber criminals use both these tactics to obtain sensitive information, they work differently.

What is Phishing?

Phishing is basically a social engineering attack that uses emails as a disguised weapon. In short, the cyber criminals impersonate a legitimate source to trick the target into clicking on a malicious link or attachment to acquire their personal information.

The scary part is, cyber criminals are not only limited to using emails for launching phishing attacks. They can also phish over a website and sometimes go with SMS (smishing) or voice call/messages (vishing) to trick users. According to a report from Security Boulevard, 97% of the users are unable to recognize a sophisticated phishing email.

In another report from The National News, 94% of UAE businesses experienced phishing attacks in a year. The same report also highlighted that 77% of email spoofing attack victims had money and valuable data stolen in the UAE, as compared to the global average of 73%.

Example of a Common Phishing Scam Attempt

A spoofed email impersonating incometaxindiaefilling.org.in to distribute it to as many taxpayers as possible.
The email claims that the taxpayers are qualified to obtain a refund and prompts them to submit the tax refund request within 3 days.

Several things can happen if the users click on the link to submit the request. The users might be redirected to a bogus page, where they may be asked to submit their personal information.

The hackers can harness the information and use it for other malicious activities such as identity theft. This can often lead to more disastrous and grievous consequences. Furthermore, on clicking on the link, the users might end up downloading malware infections like ransomware.

What is Pharming?

Pharming is the combination of two words “phishing” and “farming”. Pharming refers to the redirection of the users to a fraudulent website without their consent.

For example, an employee routinely logging into a payroll account may be redirected to a forged website instead. And, if the fraudulent website looks legitimate enough, the victim may end up getting tricked.

The motive behind phishing and pharming attacks remains the same, however, the techniques used to carry out these attacks are different. In pharming, cyber criminals carry out a two-step procedure in order to succeed.

First, the malicious actors push a malicious code on the victim’s computer or server. Second, the code redirects the victim to a fraudulent website where they are asked to enter their personal information.

To completely understand how pharming works, one must understand how Domain Name System (DNS) servers work. Whenever a user enters a domain name, the DNS servers translate that domain name into an IP address. It is the IP address that indicates the actual location of the website.

So, once a user visits a certain website, a DNS cache forms to prevent the need for visiting the server each time the user returns to that site. However, cyber criminals can corrupt both the DNS cache and the DNS servers through pharming. As a result, the users assume the bogus website to be legitimate and end up submitting their personal information.

How to Prevent Phishing and Pharming?

Several enterprises are implementing security protocols and taking steps to protect customers from phishers and pharmers. For example, in April 2020, the UAE Banks Federation launched a fraud awareness campaign to prevent digital banking service users from falling for scams. However, all it takes is one click for someone to fall for a scam.

Though as harmful as these attacks are and as easy as it is to fall for these attacks, they can be easily prevented. Taking the basic precautions listed below can help you and your organization in mitigating the risk of these kinds of attacks:

Look Out for URLs

Make sure your employees pay attention to the URL of the website when browsing on the internet. Legitimate websites always have the upper domain or TLDs (Top Level Domains) such as .org, .com, .edu, .net, etc. For example, www.google.com.

However, if on visiting the site, it is www.google.ad.com or www.Goodle.com – even a minor mistake in the website URL is a hint that the DNS cache has been compromised.

Brand Monitoring

As an organization, promoting your brand is essential to foster the identity of your company. If cyber criminals impersonate your brand for malicious purposes, it can bring down everything you have worked for. Therefore, it is highly recommended to keep track of how your brand is being represented online.

Avoid Clicking on Links

Make sure that your employees pay extra attention whenever they click on a link embedded in an email, especially one from an unknown source. It is advisable to make a habit of hovering over the link to check its destination before clicking on it.

Additionally, implement a phishing incident response tool like TAB to enable the employees to report any malicious links or attachments getting delivered through an email.

Cyber Security Awareness Program

Even if your organization has implemented all the best cyber security tools, it all comes down to how cyber aware and vigilant its employees are. So, organizations should conduct regular cyber security awareness training programs to raise awareness amongst the employees.

For instance, an employee working in the accounts department is more likely to open an email or click on the link embedded in it if it is related to the organization’s financial statements. Simulating phishing attacks on the employees can help them understand how to spot phishing attempts and react to them in real life.

No matter how strong an organization’s IT security infrastructure is, addressing the employees is a must for every organization. Remember, all it takes is one simple click for an employee to jeopardize the whole organization.

Phishing Attacks Preventative medicine for 2021

Posted on 04/04/202129/05/2021 by Anteelo Master

Phishing attacks use deceptive emails to trick users. They have become one of the foremost attack vectors to deliver malicious content into computer systems.

There are two ways to carry out a phishing attack. The first uses website spoofing, in which the perpetrators create an almost perfect double of a legitimate website and then ask the victim to log in with their credentials there. The attacker then gets hold of these credentials. The second one uses a malicious attachment and tricks the victim into downloading it.

Overall, the objective of phishing attacks can vary. It may be launched to-

gain access to the sensitive information of the victim
block the services from the legitimate user for ransom or other reasons
make undetectable changes to the crucial information held by the organization

Moreover, threat actors use phishing emails during crisis situations to create panic among users and lead them to spoofed websites. For example, the rise of phishing incidents during the recent coronavirus pandemic.

Phishing affects organizations in a major way. Additionally, it affects individuals and their cyber security negatively. For organizations, phishing attacks can also lead to a leak of organizational secrets. Consequently, this can cause a major loss to the reputation of the brand. An article published by CSO Online in March 2020 revealed that 94% of malware is delivered via mail.

Phishing Attacks: More Complex Than Ever

With each passing day, threat actors have evolved their phishing methods and taken their game up a notch. Presently, they are coming up with more sophisticated phishing email templates every day. As a result, these phishing emails are now almost impossible to differentiate from legitimate emails. Phishing can take various forms like-

Spear Phishing – In spear phishing, the emails are targeted at a specific group of victims and the phishing email template is designed according to the targeted group. It is made to look like it’s coming from a trusted source.A phishing email may use the domain of an organization and a person sitting at a position of authority in that organization as the sender. For example, the sender ID in a phishing email meant to trap employees of an organization named ‘company’ may look like ceo@companny[.]com.
Clone Phishing – Attackers may get hold of previously sent legitimate emails and design similar-looking emails. These phishing emails usually contain a malicious attachment or link to trap the victim after they download the attachment or click on the link.
Whaling – Whaling is a type of phishing attack that targets high-profile executives of an organization. Attackers can fetch high returns through such attacks.

All things considered, defense against phishing includes everything from awareness and training to automated cyber security solutions. With the rise in the trend of emails being used as a medium to deliver malicious content, defense against phishing has become all the more important.

Measures to Prevent Phishing

Generate Awareness – Awareness training tools can help in generating cyber security awareness among employees. It uses cyber attack simulation to launch dummy attacks on employees of an organization. Moreover, after an attack campaign, it also imparts awareness and training to educate employees about how they should react in such situations.
Be wary of offers too good to be true – Employees should be on the lookout for emails that contain offers that are too good to be true. It is a common practice among cyber attackers to use such lucrative offers to prompt the victim to click on the link in the email.
Encrypting Email Content – Attackers can get hold of legitimate email content in the inbox. They can then design their phishing attack templates accordingly. To avoid this, encryption can be a very effective method.
Multi-Factor Authentication (MFA) – MFA is important to minimize chances of data theft if a threat actor gets hold of account credentials. Therefore, it provides an extra layer of protection in case someone loses their credentials in a phishing attack. In a way, it delays losses arising from human error.
Keep Up With The Trend – Keeping up with the ongoing cyber trend is equally important. If your employees are aware of the cyber attack trends of the time, it is easier for them to tell a legitimate email apart from a phishing email. Consequently, they will not click on any suspicious links or attachments the phishing email contains.
Use Phishing Incident Response Tools – Using phishing incident response tools like Threat Alert Button can help in removing malicious emails from the inbox of the users. Moreover, it also empowers the employees to report suspicious emails immediately.
Secure Your Organization’s Email Domain – It is advised that organizations secure their email domain using tools like KDMARC to minimize the chances of spear-phishing attacks on their employees. Furthermore, this can also help in the maintenance of brand reputation and the prevention of domain misuse.

Conclusion

Phishing attacks can affect individuals and organizations by compromising their information security. In addition, threat actors have become more advanced in their methodology and this should be reason enough to become more watchful. They pose a threat to our privacy, our finances, and almost every other well-functioning system in the world. To sum up, phishing attacks exploit human negligence. Therefore, every internet user, irrespective of the value of the information they possess, should be alert and proactive in securing their cyber space.

Spear Phishing vs Phishing

Posted on 31/03/202128/05/2021 by Anteelo Master

What is Spear Phishing?

Along with the evolution in technology, a rapid and dramatic shift has been experienced in the occurrence of cyber attacks. The new targeted email-based phishing attacks have replaced the old extensive spam attacks. These phishing campaigns are causing major financial, brand, and operational harm to organizations across the world. The most notorious crime that is affecting major banks, corporates, media companies, and even security firms is a spear phishing email attack.

Spear phishing is an email scam that is targeted towards a particular individual, an organization, or a business. Attackers install malware on the targeted user’s computer system besides stealing user’s data.

Follow the image to understand how a spear phishing attack works:

Spear phishing attack example:

Spear phishing and phishing attacks are deployed with similar forms of email attack which includes a typical malicious link or an attachment. The primary difference between them is the way of targeting individuals.

For instance, you have posted a social media update about traveling to a different state or country. You might receive an email from a colleague saying, “Hey, while you are in New York, make sure to try the famous Joe’s Pizza. Click Here, *link* to check out their menu list!” While you click on the link to browse their menu, a malware is quickly installed in your system.

Such emails are sent to target individuals by tricking them with a spoofed email address of someone they know or are well acquainted with.

How Can We Define a Phishing Attack?

While spear phishing emails are sent to target a single recipient, phishing emails are sent to a large number of recipients. It is an unethical use of electronic communication to deceive users by taking advantage of their vulnerability in cyber security.

These attacks are carried out to obtain sensitive and confidential information like the credentials of users. Cybercriminals use social engineering to trick victims into performing certain actions such as clicking on a malicious link or opening an attached file.

Phishing attacks are wide-spreading cyber threats every year. If you are not yet aware of this ever-growing cyber scam then one wrong click can easily flip your world upside down.

Phishing attack example:

Here is a real-life phishing attack example of Facebook and Google. Both the companies were together scammed out of $100 million+ between the years 2013 and 2015 through a fake invoice scam. A Lithuanian hacker accomplished this feat by sending a series of fake invoices to each company. It impersonated as a large Asian-based manufacturer that they used as their vendor. Source: The Dirty Dozen

Such phishing attacks have been exploiting the data of various organizations and have led to a huge loss in revenue for many organizations. Be it phishing or a spear-phishing attack, it is vital to take preventive measures to decrease the occurrences of these cyber attacks.

How to prevent spear phishing attacks?

Just like phishing, spear attack prevention can be done in the following ways:

Spelling & Grammatical Errors:

Usually, genuine emails are error-free because of the professionalism and image reputation they hold. On the other hand, spear phishing emails have spelling and grammatical errors that are oblivious to the recipient’s eyes.

General Greeting:

If you are in contact with any individual or an organization, they would certainly use your name in the email greeting. But if an email says anything unusual like “Hello email user or attn: user”, then it’s a red alert.

URLs & Attachments:

Cyber crooks make sure to convince users into clicking on the link or on the attachment that comes along with the email. Never click any of the attachment that comes with suspicious-looking email.

Cyber Security Awareness for employees:

Every employee and individual in an organization should be provided with proper cyber security awareness training. A simulation spear phishing attack can be performed on the employees in order to make them proactive towards the latest attack vectors.

Tag: #SpearPhishing

Phishing and Pharming: All of it You Must Know

What is Phishing?

Example of a Common Phishing Scam Attempt