WHAT IS A PHISHING ATTACK?

September 6, 2022

What Are Phishing Attacks?

In our previous article, we answered the question of ‘what a social engineering attacks is’ and more importantly, ‘why they matter to you and your organisation’. If you missed that, you could read it here. Today, we will be diving into the detail of what is arguably the most common type of social engineering attack, phishing.

Phishing attacks are a type of technique that involves an attacker sending or requesting malicious information from their victim. Quite literally, attackers use the technique to ‘fish’ for user information. They throw a ‘hook’ through an email or link and wait for the user to ‘bite’. By simply clicking these attachments, the victim runs the risk of compromising their credentials, sensitive company data and in the worst of scenarios, their whole company network.

Email Phishing

In the majority of scenarios, phishing is used to describe social engineering attacks arriving via email. Often, email phishing is carried out through a targeted ‘spear phishing’ approach. Here, the criminal uses information from the victim’s social media profiles and other sources to create ultra-realistic emails.

This type of attack can be difficult to stop because spear phishers often use personal data about the target to make their message seem more credible. For example, if the criminal knows details about a users work history or hobbies, they can manipulate their email to look like it is about that topic. As a result, the victim is more likely to click the link or attachment and reveal their desired personal information.

Voice Phishing (Vishing)

Voice phishing, or vishing, is a technique used to target people in an impersonated video or telephone call by making them alert or emotional and causing them to panic. A common vishing technique that you’ve probably heard of is ‘cold calling’, a technique where the caller pretends to be from the bank or the government, demanding money or credit card details.

With advancing technology, vishing attacks are becoming more sophisticated to include ‘deepfakes’ – where calls are created to sound and look like a familiar voice is on the call when in reality, it is just artificial intelligence. This attack evolution can be extremely dangerous as with increased trust, victims are significantly more likely to share confidential information like accounts, files or even make bank transfers to, for example, a ‘friend in need’.

SMS Phishing (Smishing)

Smishing is similar to that of email phishing but rather than email, attackers will contact the victim via SMS. The message will contain a malicious link which when clicked on, grants the attacker access to confidential systems. An attacker can spoof a phone number to look like someone else’s and therefore this can make a victim even more vulnerable to fall for the attack.

During the peak of the pandemic, smishing frequently took place through fake ‘positive COVID-19 test results’, ‘close contact detection’, or through fraudulent ‘vaccine booking’ messages which triggered panic and curiosity in their victims.

The Rise in Phishing Attacks

Phishing is one of the most common forms of cyber attacks due to the affordable and readily available nature of the technique, making it easy for a hacker to administrate on a large scale. As email, phone calls and messaging platforms are used in almost every modern organisation, the attackers’ options are limitless and phishing is not forecasted to slow down any time soon.

As a result, the Anti Phishing Working Group (APWG) reported its highest ever number of incidents in Q1 of 2022, with attacks exceeding 1 million for the first time on record. Every organisation is vulnerable to the risk of phishing attacks. However, industries who are particularly vulnerable include those in finance, SaaS, e-commerce, retail, social media and cryptocurrency.

How Can You Prevent Phishing Attacks?

Sadly, the short answer to this question is that there is no way to prevent phishing attacks altogether. However, there are numerous steps you can take as an individual to dramatically reduce your chances of falling victim, including:

Limit the amount of information that you share online. This way, attackers will find it harder to discover and use your weaknesses against you.
Be alert when receiving emails. Especially if they are from unknown senders, don’t open the link and make sure to carefully read all email addresses for any typos or spoofing techniques.
If you need to inspect a hyperlink you can hover over it for a preview to check whether it is safe to open. If you receive an unexpected text containing a link, refrain from opening it.
Never give out personal details over the phone such as passwords or bank details.
When in the workplace you can put a list together of things that you will never be asked to provide over the phone or by email by one another.

Alternatively, when installing a phishing-vigilant culture within your organisation, there are two primary steps to consider:

1. Your People

No matter what security protocols you have installed, the people within your organisation will always be your first line of defence. We believe that if you have even the slightest of doubts about an email, it is always best to report it to your cyber security or IT team. If it is legitimate, your team will notify you of this and you can continue as usual. Would you rather leave a correspondence waiting for an hour until you are sure it is safe to proceed, or risk compromising your entire company?

Behavioural training and learning how to spot/report an incident is vital to the prevention of social engineering attacks. However, with 9 in 10 cyber incidents being a result of human error, relying on employee training methods is unsecure. For ultimate security, you must also consider your technology…

2. Technology

Without the correct security policies and procedures in place, suspicious emails can slip through an email server which could have otherwise been easily prevented. To boost your email security, we recommend that end users apply strong passwords, implement password rotations, use spam filters to block spam/un-wanted senders and integrate desktop AV/anti-spam applications.

Best enterprise level security practices often implement email security through their servers by using ‘secure email gateway’. In short, this is essentially a firewall for email which scans inbound and outbound traffic for malicious indicators to effectively block and quarantine these threats.

To conclude, phishing attacks are an extremely real and growing threat for every modern business. However, despite all that we have discussed, the truth is that you cannot truly stop a phishing attack. While there are steps you can take to reduce your chances of being victimized, nothing is perfect. The best way to protect yourself is to become as aware as possible, know what phishing messages look like and how they are delivered. That way you should be able to walk away from an attack unscathed.