Who doesn’t love a good fishing trip? Go ahead, picture the scene: it’s just you, some cold ones, and your boat, sailing along in the middle of a serene silver-blue lake. But wait! What’s that grabbing hold of your line, tugging as if it’s the master and you’re the one getting caught? Well, guess what? When it comes to phishing, you’re the one being reeled in.
A History of Phishing
Phishing refers to any attempt to collect sensitive information via misleading and or malicious emails or websites. Unfortunately, it isn’t a new phenomenon – it’s a threat that’s been making rounds and evolving since the mid-1990s. Starting back in the heyday of AOL, the technique was developed by a bunch of technically inclined criminals who recognized the unique opportunities they were presented with by the emergence of this flashy new invention: The internet. (Disclaimer: The internet wasn’t actually all that “new” by 1995, but around that time frame is when it became popular among even non-techies.)
Crime and/or scamming people are hardly new concepts; But paired with the power of the internet, they create one heck of a powerful punch. A group of hackers known collectively as “Warez” was exploring the idea of creating randomized credit card numbers to be used to open AOL accounts. Eventually, AOL caught on to the rouse and suspended all users with whom they could associate the fraudulent credit cards. Sensing it was time to go bold, the group created an AOL hacking tool called AOHell, which allowed hackers to pose as legitimate AOL representatives over Instant Message. The “representative” would then tell the potential victim that AOL needed to verify the account, in an attempt to coax passwords and credentials out of them.
As the internet has evolved, so have the tactics, and so have the stakes. Today, when we talk about the current phishing epidemic, it’s true that we may be talking about the troves of badly spelled, almost funny emails that go straight to your Spam folder. Surely, you’re far too savvy to fall for emails from stores and/or people that don’t exist. You’re on guard when it comes to clicking links. You hopefully even have some sort of understanding that phishing attempts can come via your favorite social media platforms. In this model, many, maybe even millions, of emails are sent at a time to email addresses that hackers have scraped with specialized tools. The return is low because most people know how to spot these baddies a mile away. The investment is equally low, but even if a just small proportion of potential victims fall for the rouse, the hacker turns a nice little profit.
What is Spear Phishing?
Phishing can get much worse and way more personal, however, with a tactic called Spear Phishing. So, what is Spear Phishing? - Think of phishing like a tuna fisher’s net; many fish may swim into the net, but more wiggle their slippery way out than those who meet their untimely end on a dinner plate, next to a main of mac n’ cheese. Spear Phishing, on the other hand, is like a harpoon, one long and deadly instrument, zeroed in on one unfortunate target. When it comes to Spear Phishing, personalization is the name of the game. The less generic, more tailor-made the ploy, the higher the chances are that the attack will succeed. Spear Phishing is a much higher stakes game than regular ‘ol phishing.
What is a Spear Phishing Attack?
Whereas phishing requires little more than someone who has an email address scraping tool and less than stellar writing skills to craft a few email scripts, a huge amount of effort goes into creating a convincing Spear Phishing Attack. So, what exactly is a Spear Phishing Attack? Attackers might spend months crafting their ploy:
- First, they’ll scope out corporate social media accounts, company websites, and blogs, studying them to learn the intricate workings of the company hierarchy.
- They will learn who works in which department, who the influencers are, and the company values. They might even learn which third-party companies their target deals with and the type of vendors that would typically solicit them.
- With this information, they craft highly convincing emails that appear as if they have come from a trusted source, like another company looking to do business with them, or the company bank, or something along those lines.
How Do Spear Phishing Attacks Differ From Standard Phishing Attacks?
How do Spear Phishing Attacks differ from standard phishing attacks? Spear Phishing Attacks differ from standard phishing attacks primarily in their level of personalization and specificity. Traditional phishing attacks are wide, generic tries to trick as many recipients as possible all at once. They often involve mass emails or messages that appear to come from reputable sources like banks, popular websites, or government agencies. These emails contain general requests for sensitive information or urge recipients to click on malicious links or download attachments, hoping to trick a small percentage of a large audience.
Spear Phishing Attacks are highly targeted and tailored to a specific individual or organization. Attackers invest significant time and effort in analyzing their targets and collecting information. This allows them to craft personalized messages that appear credible and relevant to the recipient. The attacker might impersonate a colleague, supervisor, or a trusted business partner, referencing specific projects or recent events to increase the likelihood of deceiving the target.
The personalized nature of Spear Phishing makes it more dangerous and harder to detect than standard phishing. Because the messages are customized and appear legitimate, they are more likely to bypass generic email filters and security measures. Victims are also more inclined to trust and act on these communications, leading to higher success rates for attackers.
DNC Hack
The hacking of John Podesta’s DNC email account reads something like a comedy of errors. Naturally, the campaign was facing a constant barrage of phishing emails. They knew which ones to watch out for until an utterly well-crafted one came, throwing his poor aide for a loop. The email warned of the many attempts to access Podesta’s account and instructed him to change his password immediately using the link in the email. Spooked, his aide sent the email to the campaign IT staff to inquire about its validity. The IT personnel told her it was “legitimate” and to “change his password immediately”.
What he meant was that it was **IL-**legitimate and he should reset his password directly with Google. That’s not what the aide heard though; The aide thought he meant that she should reset the password with the link in the email, which directly led to the exposure of over 60,000 emails. This isn’t the first time nation-state entities have used spear phishing techniques and it’s far from the last — because, as we see so clearly, spear phishing is incredibly effective and efficient.
How to Defend Against Spear Phishing Attacks?
Concerning the question of, ‘how to defend against Spear Phishing Attacks?’, there are a few things you can do:
- Employ multi-factor authentication: This will keep hackers from accessing your data even if they have bypassed the password.
- Think like a hacker: With every questionable email, think “Is there a chance this can be malicious?” Any time you answer yes, hit “delete”.
- Learn their methods: Education is the number one way to keep safe from getting reeled in, so read as much as you can and learn what’s out there and what’s trending in phishing techniques.
- Silence social media: One of the best tools hackers have with which to collect data on you is your social media profiles. Once they know where you live, what you do for a living, and other details, they have all they need to create a perfect attack email.
- Check out URLs and look for padlocks: True, this tip wouldn’t have kept you from getting hit with the Gmail tactic above, but in most cases, the URL and the HTTPS and padlock will indicate if a website is legitimate or not.
- Implement a reliable security program: A solid security program like RAV Endpoint Protection will keep nasty malware off your computer and out of your devices.
- Keep away from shady links: There you go, we said it again. Maybe this time people will listen.
What Helps Protect From Spear Phishing?
What helps protect from spear phishing? Protecting against Spear Phishing requires a multi-layered system that integrates user education and cybersecurity defenses.
- Regular training sessions can help employees recognize the signs of Spear Phishing, such as unexpected requests for sensitive information, messages containing urgent or threatening language, or emails from seemingly familiar sources that contain subtle anomalies. Awareness campaigns and simulated phishing exercises can reinforce this knowledge and improve vigilance.
- Implementing advanced security solutions like RAV VPN, Online Security, and other anti-phishing filters, spam filters, and malware detection can help identify and block suspicious emails before they reach users' inboxes. Utilizing two-factor authentication (2FA) for email and other critical systems adds an extra layer of security, making it harder for attackers to gain unauthorized access even if they manage to steal login credentials.
- Enforcing strong password policies, ensuring regular software updates and patches to fix vulnerabilities, and establishing clear procedures for handling sensitive information can significantly reduce the risk of a successful spear phishing attack.
By combining these strategies, organizations can create a strong defense against Spear Phishing, protecting their sensitive data and systems from targeted attacks. The Spear Phishing epidemic isn’t going away anytime soon. The more you know about the tactics, the better prepared you’ll be to stand up to them. To learn more, visit https://www.reasonlabs.com.
