Practice
Phishing is a fraudulent attempt to obtain sensitive information, such as usernames, passwords, and credit card details, by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out via spoofed email or instant messaging, phishing often directs users to enter personal information on a fake website that matches the look and feel of the legitimate site.
Phishing is an example of social engineering techniques used to deceive users. Users are often lured by messages purporting to come from trusted parties, such as social networking sites, auction sites, banks, online payment processors, or IT administrators.
Attempts to deal with phishing incidents include legislation, user education, public awareness, and technical security measures (the latter being tied to phishing attacks, which often exploit weaknesses in current network security).
Phishing attempts directed at specific individuals or companies are known as spear phishing attacks. Unlike bulk phishing, attackers behind spear phishing often gather and use personal information about their target to increase the likelihood of success.
The first study of social phishing, a type of phishing attack that exploits friendship information from social networks, achieved over 70% success in experiments.
Threat Group-4127 («Fancy Bear») used phishing tactics to target email accounts linked to Hillary Clinton's 2016 presidential campaign. They attacked more than 1,800 Google accounts and deployed the accounts-google.com domain to threaten targeted users.
The term «whaling» refers to phishing attacks aimed specifically at senior executives and other high-value targets. [16] In these cases, the content is crafted to target the senior manager and the person's role within the company. The content of a whaling-related email might involve an executive matter such as a subpoena or a customer complaint.
Catphishing (spelled with «ph») is a type of online deception that involves getting acquainted with someone in order to gain access to information and/or resources, typically under the mark's control, or otherwise gain control over the target's behavior.
Catfishing (spelled with «f»), a similar but distinct concept, involves a person creating a presence on a social network as a sock puppet or fictitious person to lure someone into a (usually) romantic relationship. This typically starts online, with the hope or promise that it will develop into a real romance. It is never the perpetrator's actual objective; generally, they seek access to the mark's money or resources, or to obtain gifts or other rewards from the victim. Sometimes it can be a form of self-serving attention-seeking.
Clone phishing is a type of phishing attack in which a legitimate, previously delivered email containing an attachment or link has its content and recipient address(es) taken and used to create an almost identical, or cloned, email. The attachment or link in the email is replaced with a malicious version and then sent from a spoofed email address that appears to come from the original sender. It may claim to be a resend of the original or an updated version of the original. This usually requires either the sender or recipient to have been previously compromised so that the malicious third party can obtain the legitimate email.
Most phishing methods use some form of technical deception designed to make a link in an email (and the fake website it leads to) appear to belong to the spoofed organization. [21] Misspelled URLs or the use of subdomains are common tricks used by phishers. In the following example, the URL http://www.yourbank.example.com/ creates the impression that the URL will take you to the example section of your bank's website; in fact this URL points to the «yourbank» (i.e., phishing) section of the example website. Another common trick is to make the displayed text of a link (the text between the tags) suggest a trustworthy destination, when the link actually leads to the phisher's site. Many email clients and desktop web browsers will show a link's target URL in the status bar when the mouse pointer hovers over it. This behavior, however, can in some cases be overridden by the phisher. Equivalent mobile applications generally lack this preview feature.
Internationalized domain names (IDN) can be exploited via IDN spoofing or homograph attacks to create web addresses visually identical to a legitimate site, which lead instead to a malicious version. Phishers have taken advantage of a similar risk by using open URL redirectors on trusted organizations' websites to disguise malicious URLs with a trusted domain. Even digital certificates do not solve this problem, because a phisher can quite easily purchase a valid certificate and subsequently alter its contents to spoof a genuine website, or host a phishing site without SSL at all.
Phishers sometimes use images instead of text to make it harder for anti-phishing filters to detect text commonly used in phishing emails. [29] In response, more sophisticated anti-phishing filters are able to recover hidden text in images using optical character recognition.
Some phishing scams use JavaScript commands to alter the address bar of the site they lead to. This can be done by placing an image of a legitimate URL over the address bar, or by closing the original bar and opening a new one with the legitimate URL.
An attacker can also potentially exploit flaws in a trusted site's own scripts against the victim. These types of attacks (known as cross-site scripting) are especially problematic because they direct the user to log in on their bank's or service's own web page, where everything from the web address to the security certificates appears correct. In reality, the link to the site is crafted to carry out the attack, making it very difficult to detect without specialized knowledge. Such a flaw was exploited in 2006 against PayPal.
To evade anti-phishing techniques that scan websites for phishing-related text, phishers sometimes use Flash-based websites (a technique known as phlashing). These closely resemble the real website but hide the text within a multimedia object.
Covert redirect is a subtle method of carrying out phishing attacks in which links appear legitimate but actually redirect the victim to the attacker's site. The flaw is usually disguised as a login popup based on the vulnerable site's domain. It can also affect OAuth 2.0 and OpenID based on known exploit parameters. This often exploits open redirect and XSS vulnerabilities in third-party application websites. [37] Users can also be covertly redirected to phishing websites via malicious browser extensions.
Ordinary phishing attempts are easy to detect, since the malicious page's URL usually differs from the real site link. In a covert redirect, the attacker can instead use the genuine website by compromising the site with a malicious login popup dialog box. This is what sets covert redirect apart from other techniques.
For example, suppose the victim clicks a malicious phishing link starting from Facebook. A popup window from Facebook will ask whether the victim wants to authorize the app. If the victim chooses to authorize the app, a «token» will be sent to the attacker, and the victim's private, sensitive information may be exposed. This information can include email address, date of birth, contacts, and work history. If the «token» has greater privileges, the attacker may obtain more sensitive information, including the mailbox, online presence, and friends list. Worse, the attacker may gain control over and manage the user's account. Even if the victim does not choose to authorize the app, they will still be redirected to a website controlled by the attacker. This could potentially put the victim at risk.
This vulnerability was discovered by Dr. Wang Jing, a mathematics doctoral student in the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore. Covert redirect is a notable security flaw, though it does not represent an internet-wide threat deserving of significant attention.
Users may be persuaded to click on unexpected content of various types for a variety of technical and social reasons. For example, a malicious attachment might be disguised as a benign linked Google Doc.
Alternatively, users might be outraged by a fake news story, click a link, and become infected.
Not all phishing attacks require a fake website. Messages claiming to be from a bank told users to dial a phone number regarding problems with their bank accounts. After dialing the phone number (belonging to the phisher and provided by a voice-over-IP service), the user would be prompted to enter their account number and PIN. Vishing (voice phishing) sometimes uses spoofed caller ID data to create the impression that calls are coming from a trusted organization.
In-session phishing
In-session phishing is a form of potential phishing attack that relies on one browsing session being able to detect the presence of another session (for example, a visit to an online banking website) in the same web browser, and then launch a popup window that pretends to originate from the target session. This popup window, which the user now believes is part of the target session, is then used to steal the user's data in the same way as other phishing attacks.
The advantage of in-session phishing for the attacker is that it does not require compromising the target website in any way, relying instead on a combination of data leakage in the web browser, the ability of web browsers to run active content, the ability of modern web browsers to maintain more than one session at a time, and social engineering of the user.
A technique that exploited a vulnerability in the JavaScript handling of major browsers was discovered by Amit Klein, CTO of security vendor Trusteer, Ltd. Subsequent browser security updates may have made this technique impossible.
There are anti-phishing sites that publish exact messages that have recently appeared on the internet, such as FraudWatch International and Millersmiles. Such sites often provide specific details about particular messages
People can be taught to recognize phishing attempts and to counter them through various approaches. Such education can be effective, especially when the training emphasizes conceptual knowledge and provides direct feedback
Dedicated spam filters can reduce the number of phishing emails that reach their recipients' inboxes. These filters use a number of techniques, including machine learning and natural language processing approaches, to classify phishing emails and reject emails with spoofed addresses.
Another popular approach to combating phishing is maintaining a list of known phishing sites and checking sites against the list. One such service is the Safe Browsing service
Several companies offer banks and other organizations that may be affected by phishing attacks round-the-clock services for monitoring, analysis, and assistance in shutting down phishing websites.
Solutions have also emerged using a mobile phone [166] (smartphone) as a second channel for verifying and authorizing banking transactions.
Organizations can implement two-factor or multi-factor authentication (MFA), which requires the user to use at least 2 factors when logging in. (For example, the user must provide a smart card and a password.) This reduces some risk: in the event of a successful phishing attack, the stolen password alone cannot be reused to further compromise the protected system. However, there are several attack methods that can defeat many typical systems.
On January 26, 2004, the US Federal Trade Commission filed the first lawsuit against a suspected phisher. The defendant, a Californian teenager, allegedly created a web page resembling the America Online website and used it to steal credit card information. [169] Other countries have followed suit, tracking down and arresting phishers.
Comments