Phishing techniques, consequences and protection tips

In this interview, Rohyt Belani, CEO at PhishMe, illustrates the magnitude of the phishing threat. He discusses techniques, consequences and protection tips.

What happens once your identity gets stolen? How exactly does a phisher benefit from gaining access to your sensitive information? What can he do?
Of course it depends on the information stolen, and the goal of the hacker, as to what can be done with sensitive information. The first thing to clarify is that there are two types of phishing attacks – consumer oriented phishing attacks and enterprise oriented phishing attacks.

In the case of an individual attack the end goal is to steal the person’s identity for financial gain – so to obtain credit cards and launder money through those channels; gain access to online identities – for example bank, PayPal and eBay accounts; make purchases that are easily converted into money such as train tickets and mobile phone top ups; etc. This type of cyber-crime is usually quickly detected, so the payload is limited, but it’s exceptionally difficult to identify the criminal behind the fraud leaving them free to practice their craft with little fear of capture.

More recently criminals have realised there’s more to gain from a corporate attack but with the same anonymity. If you think of a bank – every time a consumer falls victim to a phishing scam the losses are ring fenced to that one account. However, if just one employees’ workstation is compromised and the attackers gain a foothold on the inside of the corporate network then that’s a whole new ball game as theoretically that could expose every customer account and more.

A phisher needs just one person to click on a malicious link, or open an attachment laden with malware, to gain access to the organisation’s network. From this vantage point there’s a multitude of possibilities – stealing R&D information, customer details, even hold the organisation to ransom.

One of the most important things is to be aware that emails are an attack vector and to treat all messages with caution – whether they’re from a stranger, a friend or a colleague.

What are some of the most clever phishing schemes you’ve encountered?
Phishing attacks can be categorised into three main forms – those with an authoritative tone, those that prey on greed, and those with an opportunistic message.

I find that emails that adopt an authoritative approach are 25% more likely to draw the (un)desired response from the victim. Typically they will demand the user complete an action, within a certain timeframe instilling a sense of urgency, and outlines the consequences for non-participation. For example, a message claiming to be from the accounts or HR team stating that the payroll system is being migrated to another company and that the employee must follow a link and validate their bank account details by a certain date or their salary can’t be paid into their account on the next pay day.

Greed is another motivator that attackers will use to draw people in. One such example is a message from the company stating that, due to a particularly successful year, a raffle will be held where one employee will win a prize – it could be a gift card, a holiday, or even a car. Everyone is encouraged to click a link to enroll in the scheme.

Opportunistic messages can also be successful. For example a free lottery to win tickets to the Olympics, every tax season we see a spike in emails claiming to be from HMRC, and even the U.S. presidential elections were used to try to trick people.

While these are the types of themes phishers will use, timing is another tactic they employ. Many successful phishing attacks are launched on Monday mornings and Friday afternoons as this is the time people tend to spend clearing their inboxes and can be distracted more easily.

With the growing sophistication of phishing attacks, what can people do in order to protect themselves?
The best form of defence is vigilance, as all too often security controls alone are not enough.

At the very least – ALL electronic communications should be treated with caution. Even a message from a trusted friend or colleague may not be from who it purports to be. In a corporate environment, it’s important that every employee recognises the part they play in the organisation’s security posture as a whole.

If you receive an email attachment that you weren’t expecting don’t just open it – instead check with the sender that they did indeed send it. While it may take an extra 10 seconds, it could save hours or even days if the attachment proves to be malicious.

Everyone should learn how to read URLs to readily identify which are genuine and which aren’t as attackers often try to entice victim’s to click on a link to a website they control by making it look legitimate.

As an organisation, instead of solely relying on technical controls, spend quality time educating the employee base. And I don’t just mean putting up a few posters as these passive techniques, alone, are not enough. You need to take a pro-active approach and immerse people in on the spot training with true-to-life experiences and scenarios. This way user behaviour can be changed and the message is more likely to be remembered.

What is, currently, the magnitude of the phishing threat?
Spear phishing against employees is the number one threat organisations face today. That’s not just me saying it – there are numerous headlines that validate this statement. If you look at all the major breaches organisations have suffered recently, the vast majority can be traced back to a phishing attack – RSA, Mitsubishi, the chemical and defence sector, the list goes on. The reason this is the attack vector is because it targets the weakest link in an organisation’s security posture – a human.

“A phisher can easily send out millions of emails. Even if it tricks just 1% into clicking the link or divulging personal credentials, that’s quite a lot of hits! When phishers do their homework, and craft legitimate looking emails, the success rates increase.

But when it comes to enterprise grade phishing, it’s a different ball game. The attackers know they’re up against enterprise grade security defences. The first thing they change is keeping the volume of emails low to prevent messages being caught in filters or other technical controls. They will spend time doing their homework and studying the individuals within the organisation, on places like LinkedIn and Facebook and other online forums, to craft a very specific message which is sent to just a handful of people. It takes just one person to respond to the message to give them a foothold in the environment.”

A recent report by Trend Micro estimates that 91% of all cyber attacks that classify as advanced persistent threats begin with a spear phishing email.