Heart of Texas Network Consultants Blog

Poking at Spear Phishing

Poking at Spear Phishing

Hopefully, you’ve heard of phishing at this point: the method cybercriminals use to scam their targets by impersonating someone that their targets would trust, requesting access credentials or other sensitive information. Did you know that there are specific kinds of phishing? Here, we’ll review one of the biggest risks to your business... spear phishing.

What’s the Difference Between Phishing and Spear Phishing?

In a word, personalization. Your typical phishing campaign, in keeping with the analogy, casts a wide net to try and catch as many victims as possible. By writing a very vague and generic email that appears to be from some large company or organization, the typical phishing attack can be leveraged against almost anyone with a reasonable chance of success - although this also makes them easier to spot if one knows what to look for.

Spear phishing, on the other hand, goes for quality over quantity. Instead of casting out a wide net to snare a large group, spear phishing requires a focused approach, as it targets a single, influential individual.

In order to do this effectively, a cybercriminal can’t just rely on a generic message. Instead, the hacker will do some digging, finding out everything they can about their target - where they work, who they work with, and what it is that they do. Once they’ve collected the information they need, the hacker will spoof an email - often referencing some project or mutual contact to prove their “legitimacy” - with a link to a downloadable file.

This link will take the recipient to what appears to be a login page for Google Drive or Dropbox, but is actually another part of the hacker’s trickery. Once the user enters their credentials, the scammer has them to use for themselves, completely undermining the user’s security and potentially causing a business crisis.

How Do Spear Phishers Fool People?

There are a variety of ways that hackers can make their messages more convincing, especially when they’re leveraging a spear phishing strategy. These methods combine some practical skills with a bit of psychology, supported by the research that these types of hackers do.

As a result, instead of the phishing message being vague and generic, it might reference actual events, people, and things relevant to the target. They will often be spoofed to appear to come from an authority figure, like a manager or the CEO, to encourage the recipient to do as the email says without really thinking about it or questioning it too much. Unlike many other phishing messages, spear phishing messages are typically well written, without spelling or grammar errors.

These cybercriminals can be especially devious and will even buy close-match domains to make their attacks that much more convincing.

Let’s say that you owned the domain example-dot-com. Someone trying to phish someone else by posing as you could purchase their own domain, example-dot-com. Looks the same, but by using a capital “i” instead of a lowercase “l”, the phisher can create a lookalike site that truly appears to be legitimate.

Who Do Spear Phishers Target?

This is one of the main reasons that spear phishing requires so much research - not only does the hacker have to identify who they are going to target; they have to also identify the best way to scam them. As a general rule, however, spear-phishing attackers will target those people in an organization who have access to the information that the phisher wants, but not enough clout to question a request from (what appears to be) up the chain of command. In other words, a business’ end users.

So, what can you do to prevent spear phishing from impacting your business? There are a few things:

  • Check to make sure everything about an email is as it should be. Is the sender actually , or is it ? Are there any files included with the email? They could be a means of installing some kind of malware, so avoid clicking on them.
  • Take any urgency in the message with a grain of salt. Many hackers will make their messages sound more urgent in the attempt to scare their targets into action. You should also keep an eye out for any changes in standard operating procedures as well… like if your company typically utilizes Google Drive to share files, but you’re being asked to download a file from Dropbox instead.
  • Make every effort to confirm any messages you find suspect through another means. The few moments it takes to pick up the phone and ask the person who seems to have sent an email will be well worth it if it helps you avoid a data breach.

Threats like spear phishing are just the start of a business’ security concerns. For more assistance with your business’ IT and its security, subscribe to our blog, and give Heart of Texas Network Consultants a call at (254) 848-7100.

Taking a Look at Wearable Technology in 2019
Tip of the Week: Bring Your Own Device Policy Cons...
 

Comments

No comments made yet. Be the first to submit a comment
Guest
Already Registered? Login Here
Guest
Tuesday, June 18 2019

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Tag Cloud

Business Computing Windows 8 Windows 10 Google Shortcut Networking Data Management Best Practices User Tips Wearable Technology Managed IT Information Application Backup WiFi Health Privacy Word IT Support Security The Internet of Things Business Continuity Holiday Data Recovery Internet Hackers Outsourced IT Saving Money Apps BYOD Risk Management IT Support Wireless Best Practice Network Save Money Education USB Humor Wi-Fi Google Drive Ransomware Spam Social Vendor Management Office Unsupported Software Data Backup Efficiency BDR User Error Productivity Search Alert Users Laptop Passwords Technology App Law Enforcement Cloud Computing Two-factor Authentication Proactive IT Malware Server Customer Relationship Management Mobile Office Android Microsoft Facebook Office Tips Printer Government Software Communication Browser IT Solutions Antivirus Update Avoiding Downtime Hardware Router Gmail Wireless Technology Chrome Upgrade Mobile Device Management Telephone Systems communications Unified Threat Management Cybercrime Smartphones Tech Term Data Security Information Technology IT Services Mobile Computing Windows Employer-Employee Relationship Cost Management Cloud Smartphone Bring Your Own Device Business Gadgets Applications Maintenance Managed IT Services Internet of Things Hard Drives Tech Support Small Business Data Mobility Automation Computer Encryption PowerPoint Artificial Intelligence OneNote Tip of the Week Innovation Hosted Solutions Telephony Social Media Computers Going Green Password Money Tablet VoIP Collaboration Quick Tips Office 365 History Virtualization Workplace Tips Miscellaneous Email Mobile Devices Business Management Current Events Phishing Hacking iPhone Managed Service Provider Microsoft Office Network Security Productivity Big Data Managed IT Services Vulnerability Operating System Lithium-ion battery Windows 10 Disaster Recovery Marketing Cybersecurity Bandwidth Remote Computing