Spear Phishing

Spear Phishing Understanding an Evolving Security Threat Spear Phishing: Understanding an Evolving Security Threat Table of Contents Executive Summary .......................................................................... 3 Introduction ......................................................................................... 4 Spear Phishing Overview ................................................................. 5 The Enterprise Spear Phishing Risk ............................................. 7 Why a Single Breach Can Be So Damaging .......................................... 7 A Breach Involving Users ...................................................................... 8 Potential Business Impacts of Successful Spear Phishing .............................................................................................. 11 Mitigating the Phishing and Spear Phishing Risk ..................... 13 Anti-Phishing and Anti-Spear Phishing Solution................................14 Conclusion ......................................................................................... 15 2 vadesecure.com Spear Phishing: Understanding an Evolving Security Threat Executive Summary An increasing portion of emails are sent with criminal intent. Phishing, a hacking technique that tricks email recipients into clicking on malware links or divulging personal information, is growing in sophistication and volume. One of the most alarming variants is known as “spear phishing.” Spear phishing personalizes attacks, often sending emails that include the names of friends and co-workers or other personalized data to lure the recipient into clicking on a link or disclosing confidential information. This brief looks at spear phishing from the perspective of enterprise security risk and business impact. It offers a practical definition of spear phishing, examines corporate vulnerability and exposure while suggesting some approaches to mitigating the risk. 3 vadesecure.com Spear Phishing: Understanding an Evolving Security Threat Introduction There might be one in your inbox right now: An email from someone you know asking you to check on the status of a package or open a Word document. The only problem is that your colleague didn’t send you that email. There is no package. The Word document will download spyware onto your device if you open it. The email was sent by someone with malicious intent—a criminal who wants to steal and sell your customer list or an industrial spy from a foreign power. This is known as “spear phishing,” a hacking technique that succeeds by personalizing the attack to lure the recipient into clicking on a malware link or disclosing confidential information. Most of us are savvy enough now to avoid the kind of clearly bogus phishing emails that feature financially strapped royalty and start with “Dear Sir or Madam.” Plus most corporate spam filters will catch the majority of these kinds of brazen, mass- produced scams anyway. These types of emails mainly catch unwary consumers. However, there is an evolving and highly dangerous variation of the standard mass email that is actively targeting your organization’s most vulnerable security threat— your employees. Spear phishing is far more sophisticated than your standard mass phishing email. It targets employees at specific companies in order to gain access to data and systems. Standard corporate spam filters won’t stop them. It’s extremely frequent and widespread, with a surprisingly high 23% open rate and 11% click-through rate.1 It’s possible that you or a colleague has already clicked on a spear phishing link without realizing it. The damage caused might be completely invisible. But damage was done. Someone unauthorized might have gained access to your corporate networks by pretending to be an employee or trusted partner. A successful spear phishing attack can have a devastating impact on an enterprise. The research and care inherent in such an attack is itself evidence of specific intent as well as the sophistication of the criminal network behind the attack. A network that is fully capable of maximizing damage with exposed critical information. The damage might be to your brand, intellectual property and/or have direct financial impact. This brief is intended to familiarize you with the threat of spear phishing, how the hack works and what it means to your business. Its goal is to provide you with a sense of the level and type of risk exposure you have and what you can do to mitigate the risk. 4 1 Verizon 2015 Data Breach Investigations Report, page 13 vadesecure.com Spear Phishing: Understanding an Evolving Security Threat Spear Phishing Overview Spear phishing is a specific type of email hacking known as phishing, which is itself a subset of the broader category of spam email. However, while spam is a nuisance, it’s generally harmless. Phishing is different. The term is a corruption of the term “fishing,” with a “ph” added as a hacker tribute to the notorious “Phone Phreaks” of the 1960s and 70s. Like those early phone phreaks who used homemade electronics to steal free phone service, phishers treat the world of Internet users as an ocean in which they can “fish” for scam victims. Unlike the phone phreaks, though, who were colorful characters working mostly alone in a more innocent time, today’s spear phishers are typically part of large criminal organizations or foreign entities. Phishing involves tricking the email recipient to divulge confidential information, download malware or both. In many cases, the goal is simply to establish a stealth presence on the target’s device, for example to log keystrokes or collect passwords. Let’s take the following example of a real spear phishing attack: This screen shot shows a very advanced spear phishing attack. In this case, the malicious actor studied the victim’s network of people and current projects. Having established that the victim is in the legal field, the attacker uses the name of an actual attorney in the content to make the message seem legitimate. 5 vadesecure.com Spear Phishing: Understanding an Evolving Security Threat Like most advanced spear phishing attacks, this example shows that the goal is not to get credentials or personal information in the first step. The objective is to get in contact with the victim through another email address outside of all sender verification security layers, such as SPF or DKIM. Unlike a simple phishing attack that seeks to steal credentials instantly from a few victims out of hundreds of thousands of recipients, spear phishing creates a safe environment before attempting to collect personal information. After exchanging a few emails using the custom address, [email protected], the victim feels safe and confident enough to give private information to the malicious actor. Most phishing attacks can be blocked by a combination of standard spam and web filters within about 10-12 hours. Unfortunately, on average, about 50% of those who are going to click on a phishing message do so within the first hour.2 Spear phishing, like its marine sport equivalent, adds a dangerously precise level of targeting to the phishing process. Spear phishing uses personal information about the target to increase the likelihood that he or she will fall victim to the scam. A spear phisher would user social media, public information or illegally obtained data to establish a credible reference point for the phishing email. If the target’s name is John, who works with Sally Jones from Logistics, the spear phishing email might contain a subject line and internal reference to, “Sally Jones wants you to track this FedEx package.” John, in receipt of this message from his colleague, is likely to be less vigilant about clicking a link in an email. 6 2 Verizon 2015 Data Breach Investigations Report, page 13 vadesecure.com Spear Phishing: Understanding an Evolving Security Threat The Enterprise Spear Phishing Risk The enterprise is the target, but employees are the point of entry. It’s quite easy to obtain email addresses of employees of major corporations legally. Then, with a little research on Facebook and LinkedIn, supplemented by some selective raiding of email address books, a spear phisher can create emails that draw on existing social connections inside a company. Alternatively, the phisher can aim the spear using plausible commercial relationships as the pretext for an email or malicious URL. For instance, if the target works at a car company, then an email purporting to be from an auto parts supplier is likely at least to get read, if not acted upon. Even well-informed employees are vulnerable because the attacks are convincing. If John receives an Excel document titled “Q4 budget” from Sally, his close colleague, along with a message that says, “I am confused about line 4. Can you look at it and get back to me asap – Sally,” he is probably going to open it. The worst part is that John may have no idea that he or Sally has done anything wrong. It’s not like the movies, where John’s screen turns red and starts flashing “Warning! Warning!” The anti-malware software on John’s computer might catch whatever he downloaded off of the Excel document but it may not. His PC has been silently taken over. Why a Single Breach Can Be So Damaging While restricting employee access to sensitive data and network segments can be a partially effective countermeasure to spear phishing, it is far from a panacea. There is still a significant exposure to risk when even a low-level employee’s device or access information is compromised.

Load more