Spear Phishing and Internet Security

What is Spear Phishing?

Spear phishing is a more dangerous cyber attack than typically "blind" phishing or spam attempts because they lull people into a false sense of security. Consumers are on their guard against spam from sources they don't know. But when an email seems to be from a trusted entity, or include personal details such as their name, people are more likely to do what it says.

A crude spear phish purportedly from your bank may tell you that your login information needs to be "verified" and instruct you to reply to the email with your username and password. That's a pretty easy phish to avoid; no bank ever makes such a request. But what if the email tells you to "log on securely to our server via this link…"? Many people will do it without a second thought, and get caught without even knowing it.

Links in spear phishing emails don't take you to the Web pages they say they will. While the highlighted text indicating a hyperlink may read, "Chase Bank" or "Your Ebay account," the code underlying the link actually points to a Web page controlled by the phisher. When you go to that page, which is a copy of the legitimate one, you are asked to "log in" and that's how the phisher gets your username and password. Then you may get a message saying, "server overloaded, try again later" or some other brush-off. That's a fairly low-level technique; others are even more insidious and dangerous.

Customers of VioVet, a UK pet supplies dealer, received spear phish emails purportedly from the company, offering discount coupons if they clicked on a link in the email. The link took victims to a page which surreptitiously downloaded a malware program to their computers. The Trojan sniffed out sensitive information on the victims' hard drives and transmitted it to the bad guys. Victims never knew what was going on.

A Growing Problem

Spear phishing is on the rise for several reasons. Users are more alert to ordinary spam and blind phishing techniques, so bad guys have to get more subtle. Personal information that can make a spear phish convincing is more readily available to phishers as users post it on Facebook pages, Twitter, and other social media sites.

Also, trade in stolen customer email lists is on the rise, making it easier to build large-scale spear-phishing campaigns. You may have gotten an email in the past few days, alerting you that an email provider named Epsilon was hacked. Epsilon manages email communications for large companies, including many banks. And although it's "only" your email address that was stolen by the hackers, you should be especially on guard. If the bad guys know your email address, plus the fact that you do business with a certain bank, it's not too difficult in many cases to get your name, and possibly other identifying information from public sources. That gives them a powerful weapon which can be used to fool people who are not vigilant.

To protect yourself against spear phishing, you should pay closer attention to every email even if it's apparently from a trusted source, or a company you regularly deal with. If the email makes an unusual request, such as "verifying" login credentials, it may well be a phish. If you get a social media "friendship" request from someone you've never heard of, be on guard. You even have to look carefully at the link before you click.

Most browsers will display the URL of a hyperlink if you hover your mouse over it. Look for misspelled URLS that won't take you where they suggest they will. For example, faecbook.com is an entirely different domain from facebook.com. Even better, use a bookmark to reach the site in question, or key in the web address by hand.

Do you know anyone who has been victimized by spear phishing? Post your comment or question below...