In the vast and almost never ending realm of the cyberspace, where every click could be the start of a costly disaster, there exist a technique, sinister in all definition and targeted at the most vulnerable element of the cyber world. The human element.Â
Though it was first described in a paper by the International HP Users Group, Intertex, in 1987, Phishing attacks got its wide spread notice and fame from the “Love Bug”, a malware that was spread around the world via email titled “ILOVEYOU” in year 2000.
This email message came with a harmless looking “.txt” file entitled LOVELETTER. On the other hand, when a user opens the “.txt” file, it opens a can of malware that quickly spread within the system and network, overwriting image files while also sending a copy of it’s self to all the contacts in the victims outlook address book.
What is Phishing?
Phishing attack is a type of malicious cyber attack that takes advantage of the human curiosity, this attack is crafted such that, it’s able to convince the victim into taking action he or she wouldnt take. This action usually end up compromising the victim. Either the victims sensitive information are stolen or there devices are infected with malware such Ransomeware. The most used means for carrying out phishing attack is the email, though it can also come through other medium such as text messages, social media DMs( Direct Messages) or even phone calls which is termed “Vishing“.
A typical example is when a potential victim receives a malicious mail claiming to have originated from the victims bank, while requesting immediate action, either to click on a link or reply with a sensitive information such as credit card numbers or pin to avoid being locked out or denied access to there funds.
Types of Phishing
Phishing is the umbrella term for quite a number of malicious attack, below, we’ve highlighted some of the different types and variants.Â
Email Phishing: Though the term phishing is usually referred to the malicious message received via email requesting users to take action immediately, email is the most widely used medium by cyber criminal. This can be attributed to the fact that, official communication are usually done via email, thus promising more return if an employee of an organisation end’s up biting the bait.Â
Vishing (Voice Phishing): This type of phishing attack employs the use of voice call, the victim is contacted using a spoofed mobile number seemingly originating from a superior officer or service provider. For more effectiveness, sophisticated vishing attackers go the the extra length of employing a voice manipulation software. This helps them sound like who ever they claim to be.
Smishing (SMS Phishing): Smishing is another variant of phishing attacks, this type uses SMS (Short Message Service) as it’s medium for contacting his/her victims. Just like the email variant, users are usually required to click on a malicious link or respond with an information, such that, without the victims knowledge, ends up compromising him or her.Â
Spear Phishing: This is a more targeted type of phishing attack, unlike other types where the bait is thrown into the wild, the content of this type of phishing attack is crafted specifically to suit the intended victim. This could be an individual or organisation.Â
Whaling: This type of phishing attack are usually effective after a Business Email Compromise (BEC), such that the highest ranking official is targeted, once this succeed, every other member of the organisation can now be required to take undesired action using the authority of the high ranking official that has been compromised, thus further compromising the entire organisation.
Â
How To Recognise Phishing Attacks
Cyber criminals are getting creative by the day when it comes to crafting phishing campaigns, yet, there are tell-tales that help an average user identify a phishing campaign. Below we’ve highlighted some of the ways to identify of a potential phishing attack:
Generic Greetings: Although targeted phishing campaigns do background research on there victims, phishing messages usually starts with generic greetings such as “Hello user” or “Dear Customer” instead of addressing the user by name.
Sense of Urgency and Threatening Language: Phishing attacks or messages usually comes with a tone of urgency and danger, requiring a user take action else he or she will incur a dire consequence. This is one of the easiest ways to identify a phishing message.
Misspelled Words and Grammatical Errors: Aside professional or organised malicious actors, phishing mails or messages ausually has high amount of grammatical errors, highlighting that the message was not giving much attention as oppose to official emails.Â
Mismatched URLs: Before clicking a URL a user should take time to inspect the URL he or she is visiting, by hovering over a URL, one can find the actual destination of a Link, a phishing mail always never match the description of the URL.Â
Request for Sensitive Information: A legitimate service provider will never request for sensitive information like password, credit cards, pin among others. When the content of an email is requesting for the above, it’s usually a tell tale that this is a phishing email.
Too Good To Be True Offers: Offers promising a high reward for minimal or no effort at all are usually obvious red flags, if it looks too good to be true, it usually is and should be treated as such.Â
Unsolicited Message and Attachments: Mail from unknown senders should be scrutinised properly, especially unsolicited message containing attachment, usually prompting the user to download attachment.Â
How To Stay Safe From Phishing Attacks
Phishing attack are usually targeted at individuals, it becomes important for every individuals to put measures in place that will keep them safe from this threat. Below are some measures that ensures you don’t fall a victim:
Staying Informed: Education is the most important requirement to protecting individuals and organisation from cyber attacks, by having knowledge of the latest phishing techniques, one can easily recognise the attack when it’s targeted at them.Â
Beware of Urgent Language: As highlighted above, phishing email usually comes with a sense of urgency, it is important that every individual take time to assess the content of the message before taking any action.
Use Antivirus and Email Filters: Antiviruses and email filters helps recognise malicious emails and attachments, as a result, protecting it’s users by either warning it’s user or moving the messages to spam to folder which then highlight the need for the user to further investigate the content of the mail before taking any action.
Implement Multi-Factor Authentication (MFA): Multi-Factor authentication add an extra layer of security to your services such that, even if a password got compromised, the adversary will still be required to provide the MFA before being granted access.
When in Doubt, Verify: After putting all the above measures in place, always verify using a trusted medium if there is still doubt of the legitimacy of the message.
How To Report Phishing Attack
It’s important to report phishing attacks, especially in a work environment as this help everybody stay informed and alert. Some of the medium to use are as follows:Â
Notify the IT department: Almost every organisation has an IT department that oversee’s its cyber security related issues. it’s important that every member of the organisation is encouraged to report any suspicious message via email or any other medium.Â
Contact the Affected Organisation:Â Â If the phishing email impersonates a specific organisation, contact them directly to inform them of the attack. This will help them know of the impersonation, as such they can take informed decision to protect there organisation image and reputation
Forward the Email to Anti-Phishing Organisation: https://apwg.org is a global cyber crime response organisation, that collect and analyze phishing activities. This will help other service provide know of that phishing activities.
Conclusion
Phishing attacks are a pervasive and persistent threat in the digital landscape. By understanding what phishing attacks are, their effects, and how to identify and protect yourself against them, you can significantly reduce the risk of falling victim to such scams. Reporting phishing attempts is also vital to help authorities and organisations combat these threats. Stay vigilant, stay informed, and keep your digital domain secure. Together, we can fight the battle against cyber criminals and protect our online communities.
A&D Forensics offer services which includes Penetration testing, Cryptocurrency Investigation, Digital Asset Compliance and Training, You can view all our services HERE
