Spear-phishing hooks

Written by Anthony Voigt Wednesday, 16 November 2011 18:46

Imagine getting an email that seems to come from a good friend urging you to open a joke attachment:  it would be hard to resist.  But if you’re not careful, that humorous email attachment could actually contain a hidden trojan that can be secretly installed on your computer.  If that happens then you’re in trouble, because the trojan can then track and record all your subsequent computer use, including the times you conduct online banking.

The risk of this is growing as cyber-criminal activity is increasingly becoming more focussed… and hence more effective.

A perfect example is the shift in phishing techniques away from wide-scale spam phishing emails to targeted, personalised attacks.  These attacks are known as ‘spear-phishing’ as they target individuals or just small groups. They take the form of tailored, personal emails.  They can sometimes appear to come from reputable organisations or even from friends and family – so they’re harder to spot.

CSO Magazine just released a timely reminder Four spear-phishing hooks for the holidays outlining  the types of spear-phishing attacks that we might expect over the holidays.  Check out these four potential spear-phishing tactics to look out for.

'Kick off your holiday shopping with this 10% off coupon'

If you’ve signed up for email communications from an online shop or even your local shopping centre, then you wouldn’t be surprised to receive a holiday discount offer.  But if you do get one, you might be advised to avoid any links or discount coupons embedded within the email and go straight to the website to check out the offer – you never know.

'We (eg, your employer) would like to thank you for your hard work this year and invite you to enter our holiday raffle'

If you received an email at work offering you the chance to enter into a company raffle would you believe it?  Before inputting your personal details into an emailed form, it might be advisable to check it’s legitimate.  It could be a tactic to steal your personal information.

'An inspection has turned up mould/electrical wiring issues/air-conditioning problems in a number of buildings.  Click here for details'

Imagine receiving an email that seems to come from your building supervisor, advising of the risk of a serious building problem.  Common curiosity mixed with concern would prompt many people to click on the attachment to see if their building is affected.  But of course, that attachment (masquerading as a harmless spreadsheet) might actually contain a trojan… in which case see tactic 1.

'As part of our payroll system migration program, please enter your updated information to avoid interruption of your direct deposit'

Before providing all your personal bank details to cyber-criminals it would be sensible to check on the veracity of any email like this.  It might be legitimate, but then it might not.

As CSO finishes in saying:  while we don’t have to be suspicious of everything; it’s prudent to be slightly suspicious.

Comments

Name *
Email
Code   

Submit Comment