Phishing Attacks
By: Ashvini Bhatnagar
Tags: Hacking, Information Security, Infosec, Cybersecurity, Cyber Security Awareness

The art of fishing information

Image: google.com

Introduction

Phishing is an attempt by any hacker or an attacker to get a hold of your personal information like credit card detail, passwords, usernames, etc. it can contain each and every piece of information which they can get there hands on which eventually can help the hacker or attacker to access your important accounts and can also result in identity theft and financial loss.

Phishing attacks are an example of social engineering attacks which is used to deceive the user or the victim. These can be performed using email spoofing, instant messaging usually tricks the victims or lures the victims to click on a link and will prompt to enter your credentials or by asking you to download a file.

Note: Hereby victims I am referring to any user or a person who gets tricked by the attacker or hacker in providing the personal information.

How it works: a real-life scenario.

Raghu is a regular sales employee of Xyz private Ltd. In the organization, he uses his work email address and a corporate credential to log in to the application he needed to work on a daily basis. Now, one day while following his regular routine he sees an email popped on this outlook from ram which is a client of his with whom he went to a party and posted a pic on Facebook and tagged him the mail contained a business proposal.docx (document file) he downloads the file and opens it the files seems to be genuine.

Now, let me explain what happens from a hacker perspective. I am an attacker and have the intention of attacking the XYZ Pvt Ltd now I came to know that Raghu is a sales employee from his Facebook bio where he mentioned it after browsing through his profile I get to know about the party mentioned above and I know that Raghu trusts Ram enough to go to a party with him and post a picture and tag him. I leverage this information and draft a mail in the name of Ram I made sure that the mail looks legitimate so, Raghu did not suspect anything odd in the mail. I attached a file with malicious code to get access to his system as soon as he clicked I have a session where I have full access to his system now I can exfiltrate any piece of information that I need even passwords or important company information or documents.

See, above is just an example of a real-life scenario, and its just one application of phishing. Using Email spoofing we can send a link to Raghu which contains a clone of a website that may seem legit while looking at it but as soon as you enter the credential you have been compromised.

How to identify a phishing email

A perfectly crafted phishing email is hard to detect but, the following features can help you in doing so.

Attention seekers: These are the types of mails that have eye-catching or attention-seeking statements or offers. Like claiming that you have won an iPhone, a lottery, Tv, etc. Urgency: Like a magician when he is showing you a trick your focus remains on particular situation thinking and trying to understand that what is going to happen next you focus on one thing and while doing so you forget about the environment and what is going on next to you same can be done with a sense of urgency they will urge you or put you in a situation where you seems to focus on one thing and probably will forget about the environment like a limited time offer a super deal or a mail which ask you to login immediately or your account will suspend and change the password in a panic of changing the password you gets tricked into clicking on the link provided. Links: A link may not be all it appears to be. It could be completely different or it could be a popular website with misspellings for example wxx.bankofarnerica.com — the ‘m’ is actually an ‘r’ and an ’n’, so look carefully. Attachments: If you see an attached file in an email which should not be there or which does not make sense to you, or you do not have the use of it please do not click on it these often contain ransomware and viruses. The only file type that is always safe to click on is a .txt file. Always check Senders: Whether you are expecting a mail from someone or not always check the to the field of the mail often phishing mail is generated or forwarded from bogus mail addresses if anything seems out of order or suspicious do not click on the link or the attachments in this mail.

Types of Phishing

Some common types of phishing attacks:

Spear Phishing: Phishing attempts at specific individuals or companies are known as spear phishing. In this attacker gather and use personal information about the target to increase the probability of success as in our example above. Whaling: This refers to spear-phishing attacks directed toward senior executives and high profile targets. Catphishing/catfishing: (spelled with ‘ph’) is a type of deception that involves getting to know the victim closely in order to gain access to the information. (When spelled with ‘f’) is similar but, distinct concept involves a person creating social media presence as a fictional person in order to finagle someone into a romantic relationship. Clone Phishing: In this a legitimate, and previously delivered, an email containing an attachment or link has had its content and recipient address taken and used to create an almost identical or cloned email. Then the attachment or link is replaced with a malicious version and then sent from a email spoofed to appear from the original sender.

Conclusion

I always have been a believer that in the field of security most amount of time the system or an appliance gets affected due to a user than due to misconfiguration as being a human being we are heavily flawed individuals. It's most likely that due to a user posting things on social media can help the attacker to figure out a way to build trust and as soon as you have trust in someone you will not think twice before clicking on a link or downloading an attachment. Moreover, as 90% of the time, we set the passwords which are related to us in some sense like birthdays, events, sometimes our phone number which I think is the dumbest password you can every set anyways, so due to these small human errors we are susceptible to attacks.

In case of phishing always check the sends address, do not click on the mail which you are not supposed to receive or let me put it this way which is not relevant to you. In case of mail stating account deactivation or password expiry do not click on this.

Most reliable organizations give ample time before they terminate an account and they never ask patrons to update personal details over the Internet. When in doubt, visit the source directly rather than clicking a link in an email.