Internet is like an open market where honest and dishonest people come to transact businesses. As a rule, you should be careful about revealing your personal and financial information over the internet so that internet scammers will not scam you through phishing.
Phishing occurs when there is an attempt to obtain sensitive personal and financial informaon like passwords, usernames, PINs and credit card details by a fraudster in an electronic communication.
- Buhari gives bandits 2 months to surrender – Zamfara governor
- FG introduces temporary passports for Nigerians abroad
Cybercrime experts said phishing attacks have continued to play a dominant role in the digital threat landscape. In its 2020 Data Breach Investigations Report (DBIR), for instance, Verizon Enterprise found that phishing was the second topmost threat action variety in security incidents and the topmost threat action variety in data breaches. It therefore comes as no surprise that more than a fifth (22%) of data breaches analyzed by Verizon Enterprise’s researchers involved phishing in some way. Digital fraudsters show no signs of slowing down their phishing activities, experts said.
A report from Google found that phishing websites increased by 350% from 149,195 in January 2020 to 522,495 just two months later. Many of these websites likely used coronavirus 2019 (COVID-19) as a lure.
Indeed,Barracuda Networks observed that phishing emails using the pandemic as a theme increased from 137 in January 2020 to 9,116 by the end of March—a growth rate of over 600%.
The rise of phishing attacks poses a significant threat to all organizations. It’s important that all companies and individuals know how to spot some of the most common phishing scams if they are to protect their corporate and personal information. It’s also crucial that they are familiar with some of the most common types of techniques that internet scammers use to pull off their scams.
Deceptive phishing
Deceptive phishing is by far the most common type of phishing scam, have said. In this ploy, fraudsters impersonate a legitimate company in an attempt to steal people’s personal data or login credentials. Those emails frequently use threats and a sense of urgency to scare users into doing what the attackers want.
Techniques used in deceptive phishing
Vade Secure highlighted some of most common techniques used in deceptive phishing attacks:
Legitimate links: Many attackers attempt to evade detection from email filters by incorporating legitimate links into their deceptive phishing emails. They could do this by including legitimate contact information for an organization that they might be spoofing.
Blend malicious and benign code: Those responsible for creating phishing landing pages commonly blend malicious and benign code together to fool Exchange Online Protection (EOP). This might take the form of replicating the CSS and JavaScript of a tech giant’s login page in a bid to steal users’ account credentials.
Redirects and shortened links: Malicious actors don’t want to raise any red flags with their victims.
They therefore craft their phishing campaigns to use shortened URLs as a means of fooling Secure Email Gateways (SEGs), “time bombing” as a means to redirect users to a phishing landing page only after the email has been delivered and redirects to legitimate web pages after victims have forfeited their credentials.
Modify brand logos: Some email filters can spot when malicious actors steal organizations’ logos and incorporate them into their attack emails or onto their phishing landing pages. They do so by looking out for the logos’ HTML attributes. To fool these detection tools, malicious actors alter an HTML attribute of the logo such as its color.
Minimal email content: Digital attackers attempt to evade detection by including minimal content in their attack emails. They might elect to do this by including an image instead of text, for instance.
How to defend against deceptive phishing
The success of a deceptive phish hinges on how closely the attack email resembles a piece of official correspondence from the abused company. As a result, users should inspect all URLs carefully to see if they redirect to an unknown and/or suspicious website. They should also look out for generic salutations, grammar mistakes and spelling errors scattered throughout the email.
Spear phishing
Not all phishing scams embrace “spray and pray” techniques. Some ruses rely more on a personal touch.
They do so because they wouldn’t be successful otherwise. This is why fraudsters use spear phishing schemes.
In this type of ploy, fraudsters customize their attack emails with the target’s name, position, company, work phone number and other information in an attempt to trick the recipient into believing that they have a connection with the sender. Yet the goal is the same as deceptive phishing: trick the victim into clicking on a malicious URL or email attachment so that they’ll hand over their personal data. Given the amount of information needed to craft a convincing attack attempt, it’s no surprise that spear-phishing is commonplace on social media sites like LinkedIn where attackers can use multiple data sources to craft a targeted attack email.
Techniques used in spear phishing
Provided below are some of the most common techniques used in spear phishing attacks:
Housing malicious documents on cloud services: CSO Online reported that digital attackers are increasingly housing their malicious documents on Dropbox, Box, Google Drive and other cloud services. By default, IT is not likely to block these services, which means the organization’s email filters won’t flag the weaponized docs.
Compromise tokens: The security news platform also noted that digital criminals are attempting to compromise API tokens or session tokens. Success in this regard would enable them to steal access to an email account, SharePoint site or other resource.
Gather out-of-office notifications: Attackers need lots of intelligence in order send a convincing spear-phishing campaign. Per Trend Micro, one way they can do that is by emailing employeesen masseand gathering out-of-office notifications to learn the format of the email addresses used by internal employees.
Explore social media: Malicious actors need to learn who’s working at a targeted company. They can do this by using social media to investigate the organization’s structure and decide whom they’d like to single out for their targeted attacks.
How to defend against spear phishing
To protect against this type of scam, organizations should conduct ongoing employee security awareness training that, among other things, discourages users from publishing sensitive personal or corporate information on social media. Companies should also invest in solutions that analyze inbound emails for known malicious links/email attachments. This solution should be capable of picking up on indicators for both known malware and zero-day threats.
CEO fraud
Spear phishers can target anyone in an organization, even executives. That’s the logic behind a “whaling” attack. In these scams, fraudsters try to harpoon an executives and steal their login details.
In the event their attack proves successful, fraudsters can choose to conduct CEO fraud. As the second phase of a business email compromise (BEC) scam, CEO fraud is when attackers abuse the compromised email account of a CEO or other high-ranking executive to authorize fraudulent wire transfers to a financial institution of their choice.
Techniques used in whaling
Whaling attacks commonly make use of the same techniques as spear phishing campaigns. Here are a few additional tactics that malicious actors could use:
Infiltrate the network: A compromised executive’s account is more effective than a spoofed email account. As noted by Varonis, digital attackers could therefore use malware and rootkits to infiltrate their target’s network.
Follow up with a phone call: The United Kingdom’s National Cyber Security Centre (NCSC) learned of several instances where attackers followed up a whaling email with a phone call confirming the email request. This social engineering tactic helped to assuage the target’s fears that there could be something suspicious afoot.
Go after the supply chain: Additionally, the NCSC has witnessed a rise of instances where malicious actors have used information from targets’ suppliers and vendors to make their whaling emails appear like they’re coming from trusted partners.
How to defend against whaling
Whaling attacks work because executives often don’t participate in security awareness training with their employees. To counter the threats of CEO fraud and phishing, organizations should mandate that all company personnel—including executives—participate in security awareness training on an ongoing basis.
Organizations should also consider injecting multi-factor authentication (MFA) channels into their financial authorization processes so that no one can authorize payments via email alone.
Vishing
Until now, we’ve discussed phishing attacks that for the most part rely solely on email as a means of communication. Email is undoubtedly a popular tool among phishers. Even so, fraudsters do sometimes turn to other media to perpetrate their attacks.
Take vishing, for example. This type of phishing attack dispenses with sending out an email and instead goes for placing a phone call. As noted by Comparitech, an attacker can perpetrate a vishing campaign by setting up a Voice over Internet Protocol (VoIP) server to mimic various entities in order to steal sensitive data and/or funds.
Techniques used in vishing
Here are some common techniques used in vishing attacks:
“The mumble technique”: Digital attackers will oftentimes incorporate unique tactics to go after specific targets. For instance, as reported by Social-Engineer, LLC, when they attempt to target customer service representatives or call center agents, malicious actors might use what’s known as “the mumble technique” to mumble a response to a question in the hopes that their “answer” will suffice.
Technical jargon: In the event that malicious actors are targeting a company’s employees, Social-Engineer, LLC noted that they might impersonate in-house tech support by using technical jargon and alluding to things like speed issues and badging to convince an employee that it’s okay for them to hand over their information.
ID spoofing: With this tactic, a malicious actor disguises their phone number to make their call look like it’s coming from a legitimate phone number in the target’s area code.Twinstate noted that this technique could lull targets into a false sense of security.
How to defend against vishing
To protect against vishing attacks, you should avoid giving out personal information over the phone and use a caller ID app to identify callers.
