In this lesson,
we're going to cover phishing attacks.
We will discuss the different types of phishing attacks,
including phishing, vishing, smishing,
whaling, spear phishing, and business email compromise.
First, we have phishing.
Phishing is an attack that involves sending
fraudulent emails that appear to be from a reputable source,
with the aim of convincing individuals
to reveal personal information
such as passwords or credit card numbers.
These attacks often lure victims with a sense of urgency
or fear, and will prompt them to click on malicious links
or attachments that lead to the theft of sensitive data.
Phishing is like a fisherman who casts a wide net
into the sea in hopes to catch as many fish as possible.
Cyber criminals send out mass email campaigns
to hundreds of thousands of email addresses
while trying to appear to be from a trusted source
in hopes that some recipients will fall for the tricks
and click on a malicious link,
or providing system information.
For example, if you click on a link
that looks like it's from Google,
asking you to verify your identity by logging in,
and you enter your email address and password,
and then the attacker can capture those credentials
that you just entered and then use them later on
for their own malicious purposes.
Second, we have spear phishing.
Spear phishing is a more targeted form of phishing
that is used by cyber criminals who are more tightly focused
on a specific group of individuals or organizations.
These attackers will first gather detailed information
about their targets in order to make
their spear phishing attack more personalized
and convincing.
This means that spear phishing is more targeted
and more sophisticated than phishing,
since it uses a higher level of customization
to make detecting this type of attack harder,
and the attack itself potentially more damaging.
At its core, spear phishing is just like phishing,
but more targeted, and has a higher success rate
in convincing users that the email they receive
is really genuine.
For example, if I send an email to 1 million
random Americans and try to impersonate Bank of America
in that email, and told the email recipients
that their account was compromised
and they need to click a link in the email
to reset the password to secure their account,
that may work out pretty well for me as an attacker
since there are 68 million Americans
with a Bank of America account
out of the total population of 340 million Americans.
This means that out of every five Americans,
one of them is a Bank of America customer.
But if we can conduct this campaign,
we would classify it as phishing and not spear phishing
since I just sent emails to a million random Americans
in hope that they were a Bank of America customer.
Unfortunately, for the attacker though,
if they sent this to me, it wouldn't work
because I have never been a Bank of America customer,
so I would instantly recognize this
as an impersonation-based phishing campaign.
Now, on the other hand, if I had my personal bank account
at a financial institution named Dion Savings and Loan,
who suffered a data breach over the past year or so
that caused their customers' names
and emails to be posted on the dark web,
then an attacker could pick 500 people from that list
and send them a well-crafted and targeted
spear phishing email trying to trick them
into resetting the password or disclosing
other sensitive information to the attacker.
Now, notice a difference here.
Phishing is the widest net, and the attacker
is essentially trying a spray and pray approach
by sending out 1 million untargeted emails
in hopes that some of those people have an account
with the impersonated bank, but with spear phishing,
we are only targeting people who are known
to have a connection with this specific organization,
and the size and scope of our attack is much more limited.
The spear phishing emails that the attacker sends
is tailored to recipients, and this makes it harder
to recognize it as a potential attack vector.
It's almost as if the hunter has been studying
their prey's habits and behaviors
before they craft their attack and strike at their prey.
Third, we have whaling.
Whaling is a form of spear phishing
that targets high profile individuals like CEOs or CFOs.
This is called whaling because an attacker
isn't trying to catch the little fish in the organization,
but instead, they want to catch one of the executives,
board members, or higher level managers in the company,
since the rewards are potentially much greater.
The challenge with whaling is that it takes
a lot more preparation, effort,
and precision to pull off this type of attack.
If they're able to trick one of these executives, though,
it can lead to massive financial gains,
since these people usually have the ability
to approve large fund transference
on behalf of their organization.
Often, whaling is used as the first part of an attack
so that the attacker can take over the executives account
and use it for following attacks
across the rest of their organization.
Fourth, we have business email compromise.
A business email compromise, or BEC,
is a sophisticated type of phishing attack
that usually targets businesses
by using one of their internal email accounts
to get other employees to perform
some kind of malicious action on behalf of the attacker.
A business email compromise involves taking over
a legitimate business email account
through social engineering or cyber intrusion techniques
to conduct unauthorized fund transfers,
redirect payments, or again, steal sensitive information.
With a business email compromise,
the attacker impersonates a senior executive
or a trusted partner and sends seemingly legitimate requests
for wire transfers or confidential data
to employees in finance or human resources.
The malicious actor relies on the trust
established by the compromised account
to deceive the recipient into taking the desired action,
which often leads to significant financial losses
and data breaches for the targeted organization.
According to the FBI's Internet Crime Complaint Center,
there was a 14.5% increase
in business email compromise attacks last year,
and this cost businesses 2.7 billion in losses.
So business email compromises are definitely a significant
and costly threat that you need to be aware of.
Fifth, we have vishing.
Vishing, or voice phishing is an attack
where an attacker tricks their victims
into sharing personal or financial information
over the phone.
The attackers often impersonate legitimate organizations,
such as banks or government agencies,
and use social engineering techniques to manipulate victims
into providing sensitive or confidential data.
In general, most people tend to be friendly,
and I have personally found that it is much easier
to trick people into providing their information
over the phone than over an email,
which makes vishing pretty effective.
A simple example of vishing might involve an attacker
pretending to be a bank representative
with the aim of tricking you into revealing
your personal banking information,
or performing some sort of action
that will compromise your security.
Sixth, we have smishing.
Smishing, or SMS phishing, is an attack
that involves the use of text messages
to trick individuals into providing
their personal information.
These text messages will often contain a link
to a fraudulent website or a phone number to call,
while attempting to bait the victim
into action by creating a sense of urgency.
So remember, phishing is not just a specific attack,
but it is really an entire category
of social engineering attacks that include phishing,
spear phishing, whaling, business email compromise,
vishing, and smishing to attempt to trick
an organization's user to revealing sensitive information
or performing actions that might
compromise your enterprise's security.
Phishing is a general method of tricking individuals
into providing sensitive information or downloading malware
by disguising it as a trustworthy entity.
Spear phishing is a more targeted version of phishing
where the attacker customizes the bait
for a specific individual or organization.
Whaling is similar to spear phishing,
but specifically targets high profile individuals
like CEOs or CFOs by attempting to trick them
into revealing sensitive data
or initiating unauthorized transactions.
Business email compromise, or BEC,
involves impersonating or compromising
an executive's email account to deceive the organization
to making unauthorized transfers
or revealing sensitive information.
Vishing, which is short for voice phishing,
attempts to trick victims into providing
sensitive information over the phone.
Finally, smishing uses deceptive text messages
to lure victims into downloading malware
or revealing personal data.
By understanding these different types of threats,
you can be well positioned to implement countermeasures
to protect yourself and your organization
in the digital realm.