Serious Discussion Phishing and Spear Phishing

[Practical Response]

What is Phishing and Spear Phishing?

Phishing is an attack method that involves fraudulent emails, text messages "smishing", or websites that look legitimate, and phone calls "vishing", as well as other various types. It is a form of social engineering where users are scammed "tricked" into revealing sensitive information or installing malware/granting access to the system.

Spear Phishing is a more advanced version of phishing that is a specific and targeted attack whereas phishing attempts to target mass groups.

The primary goal to both is to manipulate users. This would include impersonating family members, colleagues, business associates in order to do so.


Some tips to help against both forms.

* Use strong passwords and regularly update them. "credential access via Brute force is an old tactic, and using weak, reused and unchanged passwords leaves one vulnerable to this. Using strong passwords and updating them often as well as setting "many attempts "lockouts" will help negate this type of issue.

* Keep software current and updated. " Keeping software updated can help prevent phishing attacks by closing vulnerabilities that hackers can exploit to access your system or data."

* Never open a suspicious email or text message. "Be cautious of the sender, domain name, content, spelling (Grammar), urgency, attachments and links."

* Use multi-factor authentication "successful phishing allows attackers access to legitimate accounts. Using MFA will give them hoops to jump through trying to access these making it much more difficult.

* Data encryption " in any case where your data is taken of stolen encryption will ensure the attacker can not access it."

* Limit privileges on the system "non-root" & "Standard accounts". Persistence is a problem. Once a hacker gains control of an account the first thing they will want to establish is locking the user out of the account for full control. This can be approached by using minimum requirements of privileges needed in order to perform what ever task you need.

* Frequent education and awareness research "keep informed". Take the time to research occasionally, to view the newest and latest tactics as these type of attacks evolve, stay informed on how to best approach them.

 

[Bot]

You've provided an excellent description of phishing and spear phishing, as well as some useful tips to help guard against these types of attacks. Regular password changes, software updates, cautious handling of suspicious emails, multi-factor authentication, data encryption, and limiting system privileges are all crucial steps in ensuring security. Also, staying informed about new tactics used by attackers is essential as these threats evolve over time.

 

[ForgottenSeer 107474]

This is a good read on email scams.

Spotlight on security: How to recognize email scams

Analysis reports of several sources (US, UK) show that email is and remains the number one delivery vehicle of malware

www.av-comparatives.org

Phishing is often a combination of an email scam leading to a fake website looking like the legitimate website. New AI-solutions interpreting the GUI and brand identity of the fake websites and compare those "brand fingerprints" with URL's and certificates of the legitimate websites is a promising protection technology. An example of AI-based phishing protection is the extension SafeToOpen

SafeToOpen Online Security

SafeToOpen Online Security protects you against scams, viruses, and phishing web pages.

chromewebstore.google.com

Old tech is not that effective (long passwords etc) against spear phishing, Recently a reasonable large marketing agency was tricked into a spear attack. Because the director had posted on X that they were contending for a large contract, the spear phishers attacked an admin faking to be the director needing access to sharepoint immediately for that important proposal (making the request coming from the director, because the mail mentioned name of the admin's wife and children (the admin had posted on facebook that he and his wife had enjoyed a company BBQ with a picture of the director being the BBQ master serving them hamburgers)

 

[Andy Ful]

Fighting phishing can be a challenge.

1. Phishing attacks: defending your organisation
2. What Is Phishing? Examples and Phishing Quiz
3. Advanced Phishing Attacks: How to Stem the Tide
4. https://arxiv.org/pdf/2309.10463
5. The Psychology of Phishing: Unraveling the Success Behind Phishing Attacks and Effective Countermeasures
6. https://www.sciencedirect.com/science/article/pii/S0747563217301504

Phishing is evolving with AI​

The first primitive forms of phishing attacks emerged decades ago in chat rooms. Since then, phishing has evolved in complexity to become one of the largest and most costly cybercrimes on the internet that leads to business email compromise (BEC), (email account takeover (ATO), and ransomware. More recently, AI has made it easier for attackers to carry out sophisticated and targeted attacks by correcting spelling mistakes and personalizing messaging. For example, cybercriminals collect identifying information on groups or individuals they want to target and then use that information to mount highly personalized phishing campaigns called spear phishing. Because spear phishing communications are much more personalized, they can look especially legitimate, and thus are even more dangerous.

The problems with phishing simulations​

No training package, including phishing simulations, can teach users to spot every phishing attempt. Asking users to examine, in depth, every email they receive will not leave enough hours in the day for work tasks. It’s an unrealistic and counter-productive goal because responding to emails and clicking links is an integral part of work.
Phishing simulations can also create legal risk. Since no one can be expected to spot all phishing emails, punishing people for clicking on emails you've sent starts to resemble entrapment. For this reason, you should always check with your HR department before undertaking any phishing simulations (the NPSA has a set of free resources to help you design training.)
More practically, blaming users for clicking on links doesn’t work. People click for a range of reasons. These could be personality traits or situational (for example, if a person is busy and stressed). Threatening someone with punishment doesn't change these factors.