What Is Phishing and How to Protect Yourself From It | Total Security

 

What is phishing

Phishing (phishing, from fishing - fishing, fishing) is a type of Internet fraud, the purpose of which is to obtain user identification data (logins and passwords to bank cards, accounts).

Such letters, as a rule, contain a logo, a message and a direct link to a site that is outwardly indistinguishable from the real one. The link is required to go to the site of the "service" and, under various pretexts, enter confidential data in the appropriate forms. As a result, fraudsters gain access to user accounts and bank accounts.

Phishing history

The term phishing appeared in 1996 on the alt. online-service. America-Online Usenet newsgroup. The first mentions of phishers were associated with the media company AOL, when the scammers presented themselves as AOL employees, reached out to users via instant messaging programs, and on behalf of the company's employees asked for their account passwords. After gaining access to the account, it was used to send spam.

In the early 2000s, phishing spread to payment systems, and in 2006, users of the MySpace social network were subjected to phishing attacks, as a result of which their credentials were stolen.

What is the purpose of phishing

Phishing attacks can target both individuals and individual companies. The purpose of attacks on individuals organized by fraudsters, as a rule, is to gain access to logins, passwords and account numbers of users of banking services, payment systems, various providers, social networks or postal services. Also, the purpose of a phishing attack may be to install malware on the victim's computer.

Not all phishers cash out the accounts they access on their own. Cashing out accounts is a difficult process from a practical point of view. Also, it is easier to catch a person who is engaged in cashing in and bring a criminal group to justice. Therefore, having received confidential data, some phishers sell them to other scammers who use proven schemes for withdrawing money from their accounts.

In cases where phishing attacks are directed at companies, the goal of cybercriminals is to obtain the account information of an employee and then an extended attack on the company.

Types and schemes of phishing attacks

The main phishing techniques and techniques include:

Social engineering techniques

Posing as representatives of well-known companies, phishers most often inform recipients that, for whatever reason, they urgently need to transfer or update their personal data. This requirement is motivated by data loss, system breakdown, or other reasons.

A person always reacts to events that are significant for him. Phishing organizers try to alarm the user and provoke an immediate reaction. For example, it is believed that an email with the heading "to regain access to your account ..." grabs attention and forces the person to follow the link for more information.

Phishing with deception

This is the most common type of phishing attack. Fraudsters can spam millions of email addresses in a matter of hours with emails based on this method. In this case, the phisher sends a fake letter on behalf of the organization asking to follow the link and verify the account details.

To steal personal data, special phishing sites are created, which are placed on a domain that is as close as possible to the domain of a real site. To do this, phishers can use URLs with minor typos or subdomains. A phishing site has a similar design and should not arouse suspicion among the user who lands on it.

It should be noted that fraudulent phishing is the most traditional method of phishers and, at the same time, the least secure method for attackers, so it is gradually becoming a thing of the past.

Spear phishing

Harpoon phishing targets specific people rather than broad groups of users. Most often, this method is the first step to overcome the company's defences and conduct a targeted attack on it. Attackers in such cases study their victims using social networks and other services and thus adapt messages and act more convincingly.

"Whaling"

The hunt for confidential information of top managers and other VIPs is called "whale hunting." In this case, phishers spend a lot of time determining the personality traits of the target victim to find the right moment and ways to steal credentials.

Virus distribution

In addition to identity theft, fraudsters also aim to harm individuals or groups of individuals. When clicked, the link of a phishing email can download a malicious virus to your PC: a keylogger, Trojan, or spyware.

Farming

This is a new type of phishing. Using this method, phishers receive personal data not through a letter and following a link, but directly on the official website. Farmers change the digital address of the official website on the DNS server to the address of the spoofed site, and as a result, the unsuspecting user is redirected to the fake site. Such phishing is more dangerous than traditional phishing since it is impossible to see spoofing. eBay auction, PayPal payment system and well-known world banks are already suffering from such attacks.

Wishing

Vishing is a phishing technique that uses telephone communication to obtain information. The notification letter indicates the phone number to call back to eliminate the "problem that has arisen". Then, during the conversation, the operator or answering machine asks the user to provide identification data to solve the problem.

How you can protect yourself from phishing

In response to an email requesting "confirmation" of an account or any other similar request, experts advise users to contact the company on whose behalf the message was sent to verify its authenticity. Also, we recommend that you enter your organization's URL yourself in the address bar instead of using any hyperlinks.

Almost all genuine messages from the services contain mentions of some information that phishers cannot access, for example, the mention of a name or the last digits of an account number. At the same time, any letters that do not contain any specific personal information should cause suspicion.

It should also be remembered that phishing sites can hide behind pop-ups. Targeted advertising can run on them. There are times when in the "login" column the user already sees his email address and he is only asked to enter the password in the lower column. It is possible to see a link to a phishing site in comments on forums and social networks. A link can also be sent to you by a friend or acquaintance whose account has been hacked. If a letter or link has aroused suspicion in you, it is better not to follow it.

The fight against phishers also takes place at a technical level:

Browsers warn about phishing threats, most of them maintain their own lists of phishing sites, after checking with them, services warn users about going to dangerous sites;

Mail services fight phishing in messages by improving their spam filters and analyzing phishing emails;

Large services and companies are also complicating the authorization procedure, offering users additional protection of personal data.

Mikhail Tereshkov, head of information security  at ER-Telecom Holding JSC, in his column on Rusbase, gave such effective, but simple for the user, methods of protection against phishing:

Pay attention to the security certificate of the payment system - in the address bar of the browser, the site name looks like https: // ...

Always change the preset factory passwords of the router to more complex ones, and install updated software versions at least every six months.

Do not shop over public Wi-Fi. Antivirus for your smartphone can provide additional protection.

Before making a payment in an unfamiliar online store, read reviews about it online.

Phishing 

In September 2019, experts of the ONF project "For the Rights of Borrowers" named five fraudulent schemes that were most often used in 2019. Phishing took the first place (34% of mentions), the purpose of which is to gain access to user logins and passwords. A classic example of phishing is malicious links. Its varieties also include advertising on video hosting, promising payment for participation in surveys, and calls on behalf of banks. 

It is reported that the authors of the rating analyzed about 50 thousand messages of citizens and more than 20 thousand publications in the media and other open sources.

In 2020, during the coronavirus pandemic, the number of thefts from users' bank cards increased sixfold, according to the Group-IB company, which specializes in preventing cyberattacks. According to experts, scammers lure users to phishing sites where buyers enter payment information. Attackers use this data to access public p2p services of banks and transfer money to their accounts.

On average, one bank records 400-600 attempts of this type of fraud per month. The average bill of one transfer is 7 thousand rubles. Often, attackers created fake online store pages with masks, gloves, and sanitisers. 

- data from Group-IB.

Conclusion

Cyberattacks have long been a part of our life. Fraud protection is a global challenge for corporations and startups that develop financially, e-commerce and other services. But users should not forget about the simple steps in order not to fall for the hook of an intruder.

 Total Security secures your pc with antivirus.