Phishers of men!

Phishing ~ the fraudulent practice of sending emails or other messages purporting to be from reputable companies to induce individuals to reveal personal information, such as passwords and credit card numbers. Or to install malware on their device.

Spear phishing ~ is the fraudulent practice of sending emails or other messages purporting to be from reputable companies, targeted towards a specific individual, organization, or business. 

Social Engineering ~ the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.

URL ~ Uniform Resource Locator aka link

Malware ~ software specifically designed to disrupt, damage, or gain unauthorized access to a computer system. (street name virus.)

 

Just for laughs: A virus is to cyber security, what Colgate is to toothpaste in a black community.

 

 

Phishing happens when an attacker sends a fake email to a victim asking them to perform a specific action. Either click on a link or download a document with malware or give out sensitive personal information.

I will give you a typical example using one email that everyone with an email address has received at some point, “your deceased cousin in Dubai has listed you as a beneficiary and we need you to claim, you need to pay a certain amount, however, to release the funds”. Now, if an email like this, finds you in a distressed state and in desperate need of money, you can fall for it, as some people have in the past. Although that trick does not work anymore as people get more educated about how this scam works, the attackers always come up with new ways to attack, for example, they would send an email posing as your boss asking you to send certain documents urgently, and without thinking twice, as the good employee you are, you oblige. The list of things they can say is very long and we would not be able to cover it in this short article, but we will however, discuss how to tell when an email is fake. These are just a few ways you can use to limit the risks. But nothing in security as is in life, guaranteed.

 

1.       Spelling Errors

We used to think that most attackers come from countries that do not have English as a language taught in school or spoken at all, so we expected a lot of errors. Unfortunately, now we have chatGPT (a very smart chatbot by openAI, self-learning artificial intelligence), which is generally a good thing but, unfortunately, everything good can be weaponized. Now the attacker can use it to write a well-formatted email with better grammar with a sense of emotion for the reader to feel empathy towards the sender(attacker). But you can still check your personal details if they are correct. Question the email if they do not refer to you by name.

 

2.       The email address.

When an email is sent, you have the sender’s name and email address. The name has a bigger font, and the email address does not, the name can be so long you can miss the email address altogether, unless you look for it specifically, hence why in many cases, the lazy soul in all of us, wants trust that the person that sent the email is whom they say they are. You should always trust the email address and not the name.

 

3.       The content

There are a lot of things to look at in the content. Questions to ask yourself before you reply or do what the sender is asking you to do.

·       Are you expecting this email?

·       Does the sender usually send you emails regarding anything, for example, the CEO of your company, hand-picked you to send the very sensitive document, in a company that respects hierarchy, (he could’ve asked your boss), or maybe HR is asking you to send your personal details when you have a portal that has all your details and anything missing can be easily uploaded there. In case this email is really from your CEO, call them on their number and act dumb asking for clarity. 2 things, you either get them what they want, or you bring it to their attention that they are being impersonated. Win-win for you!

·       Does the content relate to you? Are you the person the email is directed to? If not, do not click on any links or download attachments.

·       What name do they use to refer to you? Legitimate emails would call you by name.

·       Never pay for anything upfront. Do not pay any amount in order to release your inheritance or whatever competition you won without entering.

 

4.       The link, the link, the link!!!

Well, I said link 3 times but it’s also attachment, attachment, attachment!!! This is another thing that will make the whole process of phishing worth it. If the sender/attacker is not asking you for any money or documents, they probably just want you to click on the link or download a harmful file to your PC. A malware that will, for example, track your activities on your device so they can steal any personal information, i.e. banking details, confidential emails you send, etc. In the screenshot below, I show an example of an email with a URL. When you hover over a link, it will show you at the bottom left corner of your screen, what the URL you will be going to is. Ways to spot a bad URL is a long topic and will not be covered in this article.

 

Spearphishing.

 

Spear phishing is difficult to spot as a phishing email. A lot of research goes into this type of attack as it is targeted at a specific individual and is not as generic as any other phihs email. The attacker would visit your social media pages to find out where you live, where you work, what kind of content are you posting online, your interests, the car you drive, I could go on, but the list of things they could find about you is long. The email will come in directed at you, with your name, if they used chatGPT, the grammar will be fine, The URL will resemble exactly what you expect the website to look like, will probably have a tiny spelling error to fool you. For example, google.com will be goog1e.com or microsoft.com will be rnicrosoft.com, absa.co.za would be albsa.co.za. If you are not looking at the spelling you will click on the URL. Sometimes, it would be the exact website but with a redirect once you click on it.

 

Now, if you have read my article, you will remember how I emphasized how you could become a target based on where you work. A group of hackers from Russia known as “Cold River” attempted to hack 3 US nuclear research laboratories. They created a fake URL that probably looked like one that the researchers usually visit, with a fake login page. If a researcher falls for the trap and enters their credentials, they would be sent to the attacker and the attacker would then use the victim’s credentials and login to the legitimate site. Fortunately, this was picked up as a phishing email sooner and the attempt failed. See the full article here. Now, imagine it’s your credentials used to gain access to your country’s nuclear weapons. 

 

About 91% of attacks started with an email. Do not let it be you who enables the attacker to in.