Heart of Texas Network Consultants Blog

Poking at Spear Phishing

Poking at Spear Phishing

Hopefully, you’ve heard of phishing at this point: the method cybercriminals use to scam their targets by impersonating someone that their targets would trust, requesting access credentials or other sensitive information. Did you know that there are specific kinds of phishing? Here, we’ll review one of the biggest risks to your business... spear phishing.

What’s the Difference Between Phishing and Spear Phishing?

In a word, personalization. Your typical phishing campaign, in keeping with the analogy, casts a wide net to try and catch as many victims as possible. By writing a very vague and generic email that appears to be from some large company or organization, the typical phishing attack can be leveraged against almost anyone with a reasonable chance of success - although this also makes them easier to spot if one knows what to look for.

Spear phishing, on the other hand, goes for quality over quantity. Instead of casting out a wide net to snare a large group, spear phishing requires a focused approach, as it targets a single, influential individual.

In order to do this effectively, a cybercriminal can’t just rely on a generic message. Instead, the hacker will do some digging, finding out everything they can about their target - where they work, who they work with, and what it is that they do. Once they’ve collected the information they need, the hacker will spoof an email - often referencing some project or mutual contact to prove their “legitimacy” - with a link to a downloadable file.

This link will take the recipient to what appears to be a login page for Google Drive or Dropbox, but is actually another part of the hacker’s trickery. Once the user enters their credentials, the scammer has them to use for themselves, completely undermining the user’s security and potentially causing a business crisis.

How Do Spear Phishers Fool People?

There are a variety of ways that hackers can make their messages more convincing, especially when they’re leveraging a spear phishing strategy. These methods combine some practical skills with a bit of psychology, supported by the research that these types of hackers do.

As a result, instead of the phishing message being vague and generic, it might reference actual events, people, and things relevant to the target. They will often be spoofed to appear to come from an authority figure, like a manager or the CEO, to encourage the recipient to do as the email says without really thinking about it or questioning it too much. Unlike many other phishing messages, spear phishing messages are typically well written, without spelling or grammar errors.

These cybercriminals can be especially devious and will even buy close-match domains to make their attacks that much more convincing.

Let’s say that you owned the domain example-dot-com. Someone trying to phish someone else by posing as you could purchase their own domain, example-dot-com. Looks the same, but by using a capital “i” instead of a lowercase “l”, the phisher can create a lookalike site that truly appears to be legitimate.

Who Do Spear Phishers Target?

This is one of the main reasons that spear phishing requires so much research - not only does the hacker have to identify who they are going to target; they have to also identify the best way to scam them. As a general rule, however, spear-phishing attackers will target those people in an organization who have access to the information that the phisher wants, but not enough clout to question a request from (what appears to be) up the chain of command. In other words, a business’ end users.

So, what can you do to prevent spear phishing from impacting your business? There are a few things:

  • Check to make sure everything about an email is as it should be. Is the sender actually , or is it ? Are there any files included with the email? They could be a means of installing some kind of malware, so avoid clicking on them.
  • Take any urgency in the message with a grain of salt. Many hackers will make their messages sound more urgent in the attempt to scare their targets into action. You should also keep an eye out for any changes in standard operating procedures as well… like if your company typically utilizes Google Drive to share files, but you’re being asked to download a file from Dropbox instead.
  • Make every effort to confirm any messages you find suspect through another means. The few moments it takes to pick up the phone and ask the person who seems to have sent an email will be well worth it if it helps you avoid a data breach.

Threats like spear phishing are just the start of a business’ security concerns. For more assistance with your business’ IT and its security, subscribe to our blog, and give Heart of Texas Network Consultants a call at (254) 848-7100.

Taking a Look at Wearable Technology in 2019
Tip of the Week: Bring Your Own Device Policy Cons...
 

Comments

No comments made yet. Be the first to submit a comment
Guest
Already Registered? Login Here
Guest
Monday, August 19 2019

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Tag Cloud

Hard Drives Mobility Efficiency Google Drive Avoiding Downtime Users Privacy Bandwidth User Error Disaster Recovery Tech Term Collaboration Browser Outsourced IT Smartphones Chrome Proactive IT Printer Tablet Mobile Device Management Security Information Technology Cloud Data Backup Hosted Solutions Productivity Backup Applications Holiday Mobile Computing Vulnerability Wearable Technology Lithium-ion battery Unified Threat Management Hardware The Internet of Things communications Best Practices Malware Spam Government Network BDR Windows 10 Apps Phishing Wireless Technology Operating System Email Remote Computing Managed IT Services Microsoft Office OneNote Data Security Managed Service Provider IT Support Customer Relationship Management Hacking Education Alert Tip of the Week Cloud Computing Telephone Systems iPhone App Word Smartphone Upgrade Cybercrime Vendor Management Passwords Technology Unsupported Software Windows 10 Business Computing Artificial Intelligence Innovation Business Management Law Enforcement Android Computers Tech Support Password Productivity VoIP Maintenance Miscellaneous Going Green PowerPoint Networking Gadgets Antivirus Facebook Laptop Saving Money Hackers Small Business Risk Management Wi-Fi Internet of Things Office 365 Network Security Office IT Services Mobile Office Big Data Automation Search Communication Money Blockchain Workplace Tips Office Tips Wireless WiFi Ransomware Internet BYOD Bring Your Own Device Current Events Quick Tips Humor Health Microsoft Marketing Gmail Windows User Tips Data Management Two-factor Authentication Social Information Windows 8 USB Business Google Outlook Employer-Employee Relationship Data Recovery Save Money Application Cybersecurity Managed Service Cost Management Router IT Support Shortcut Encryption Server History Best Practice Update Computer Managed IT Services Social Media Data Business Continuity Software Virtualization Mobile Devices