Phishing (pronounced “fishing”) attacks occur when a malicious actor (such as a hacker or a spy) convinces a person to hand over information such as bank details, online account login details or other personal information.
This type of attack has been around since the mid 1990s and has been growing in both popularity and sophistication ever since. One of the key attributes, no matter what the aim of the attack is or what form it takes, is social engineering. This means tricking the victim into thinking the attacker is a legitimate representative of their bank, their internet service provider (ISP), or even their company. As a result, the person being phished is more likely to hand over the same information as they would if they really were speaking to that person and, as such, an attack is less likely to be reported.
39% of phishing attacks last year were via web links in emails. Learn more about how to secure your browser against a phishing attack in this free whitepaper from Citrix:
Phishing is a fairly straightforward way of carrying out a number of cyber crimes, but they can be broken down into a few areas: financial, account take over, and espionage.
Here we run down some of the kinds of phishing attacks you may come across and the motivations of attackers.
Financial
Financially motivated phishing attacks have been used for a long time and take on many different guises.
Many of us will be familiar with the so-called Nigerian Prince scam emails, where the victim is contacted by either a person alleging to be a representative of a Nigerian prince who, for whatever reason, wants to transfer some of his wealth out of the country and will give the victim a cut of the money if they let the scammer use their bank as a conduit. Other variations include the death of a long-lost relative or, more recently, a friend or family member who has been robbed while on holiday and needs an emergency loan.
Normally, this scam results in a loss of money not because bank details are handed over, but because the victim is asked to pay money out to the scammer first, who they never hear from again.
This is a very basic form of a financial phishing attack, but others are much more sophisticated. Scammers are sending out increasingly well-crafted emails that appear to be genuine messages from real banks.
This type of attack is aimed at getting a user to enter all their bank or credit card details into a website accessed through a link in the phishing email that looks like the genuine article but is in fact owned by the criminals. Once that is done, the phisher can use the details as if they were the legitimate card holder or bank customer.
Account takeover
Account takeover is what the first phishing attacks were geared towards – gaining access to another person’s online account, whether it’s on social media, email, a forum or something else and then taking control of it.
This is typically done via a malicious link sent in a legitimate-looking an email, instant message or direct message. Once the user clicks on it, they will be taken to a realistic-looking website operated by the attackers and, much like the banking attacks mentioned above, asked to enter their username and password.
The purpose of an account takeover could be to send spam from that email address or social media account; to find out further information about the person, including financial information or other sensitive data; or as a form of protest – rival ideologies at the fringes of politics have been known to take over and shut down the accounts of their opponents, for example.
Citrix’s whitepaper explores recent trends in phishing and browser security. Download it here for more:
Espionage
This category covers both industrial espionage and state-level snooping. In both cases, the objective is to gain information on your rival with the aim of outmaneuvering them or, in some cases, sabotaging them.
In this case, the email is normally crafted to look like it came from a supplier or perhaps a senior person within the company and has a sense of urgency. This, it’s hoped, will make the recipient of the email more likely to respond with the information quickly, suppressing any doubts if they do arise.
This can be part of a much longer campaign that involves many other types of cyber attack like spyware and specially created malware to harm industrial machinery or national infrastructure.