What is Phishing?
This is the attempt to acquire sensitive information such as usernames, passwords, and credit card details by pretending to be a trustworthy entity in an electronic communication. Phishing attacks usually will involve an email that seems to be from a company with you do business persuading you to log into your account with the link provided in the email. The website that you are taken to looks like the original site but is actually a decoy site. When you login with your username and password which is then captured by the attacker.
What types phishing are used?
These are phishing attempts directed at specific individuals or companies. Attackers may take time to gather personal information about their target to increase their probability of success. This technique is, by far, the most successful on the internet today.
This is a type of phishing attack whereby a legitimate email that contains an attachment or link has had its content and recipient addresses taken/captured and used to create an almost identical or cloned email. The attachment or link within the email is then replaced with a malicious version and is sent from an email address spoofed to appear to come from the original sender. The email may claim to be a resend of the original or an updated version to the original. This technique could be used to indirectly move from a previously infected machine and gain a hold on another machine.
How can I prevent Clone Phishing?
Whenever you receive and email that claims to be a resend or updated version of an email or you receive two of the same/ similar email make sure to compare the two email addresses to make sure they are completely identical. If they are not identical then the “resend” or “updated version” is someone who is trying to acquire your account details.
Several phishing attacks have been directed specifically at senior executives and other high profile targets within businesses. The content of a whaling attack email is often written as a legal subpoena (court summoning), customer complaint, or executive issue and is designed to pretend to be a critical business email sent from a legitimate business.
These are the types of phishers that are using images instead of text to make it harder for anti-phishing filters to detect text commonly used in phishing emails. Luckily this has lead to the creation of higher quality anti-phishing filters that can recover hidden text in images by scanning the image.
What Anti-Phishing strategies should I use?
This involves the usage of software. Many anti-phishing measures have been implemented as embedded browser features, browser extensions and toolbars and website login procedures.
Secure Sockets Layer (SSL)
Secure Sockets Layer is a type of protocol that provides communication security over a computer network. How this works is, the SSL uses cryptographic protocols which encrypts the data that has been transmitted and uses the website URL as an identifier to decided whether or not the email is safe. You also have the option to identify the communicating parties using public key cryptography.
This is a protocol that some browsers use to make the user confirm that the Domain name in the URL bar is indeed where they intend to go. Unfortunately most users don’t actually know or recognize the URL of the site they intend to connect to which makes this authentication meaningless. So make sure when you go onto a frequently used site, make sure you are familiar with the sites URL.
Using a spam filter is a mildly efficient way of reducing the number of phishing emails that you receive. This also involves a new approach called email authentication which basically requires you to put email addresses into a whitelist so that you can receive emails from that email address. If you receive an email that isn’t on your whitelist, the email will be sent to the spam folder.
This involves actively teaching others what they need to look for to catch out phishers or to familiarize them with commonly used phishing emails.
Education through examples
This is strategy is used to train people to recognize phishing attempts and how to deal with them. For example, an experiment was made by sending 500 West Point cadets a fake email from a non-existent Col. Robert Melville at West Point. 80% of these cadets were tricked into clicking on the link that would supposedly take them to a page that required them to enter their personal info (The page told them that they had been lured)
Changing browser habits
You can take steps to avoid phishing by slightly changing your browser habits. For example, when you receive an email asking you to verify your account, it would be a good idea to ask the company from which the email apparently came from whether or not it is legitimate.