Phishing 😈

Phishing is a type of scam in which the attacker disguises himself/herself as a trustworthy entity to make the victim perform an action. For example, the attacker could present himself as your bank, asking for your password. Typically, this is done via email or SMS.

Phishing belongs to the bigger group of social engineering attacks. In Social Engineering, the abused weak points of a security system are not of technical nature, but the people within a system.

After reading this article, you will know what phishing is. You will know several sub-types of phishing and how to prevent those attacks from affecting your organization. Let’s go!

Sub-Types of Phishing

In spear-phishing attacks, the attacker has a very specific target. In contrast to regular phishing attacks in which they just want to scam anybody, in spear-phishing they want YOU. This means the attacker will prepare for you. The attacker will know the names/habits of trustworthy people in your environment. If a spear-phishing attack targets an executive, it’s also called whaling.

Catphishing or Catfishing attacks build a close personal relationship with the victim.

Why it matters

2011: RSA SecurID was affected by a phishing attack which cost them \$66.3 million USD (source).
2015: In December in Ukraine, 230,000 people were without electricity for up to six hours. This was done with a spear-phishing attack (source)
2015: Xoom lost \$30.8 million USD by employee impersonation (source).
2016: Crelan Bank lost 70 million EUR by falling for a whale phishing attack (source, source)
2016: The German car part manufacturer Leoni lost 40 million EUR to a CEO scam. The scammer impersonated employees and asked others for strict confidentiality (source).
2016: FBI warns that CEO scams caused losses up to \$2.3 billion USD (source)
2018: The plane part manufacturer FACC lost 54 million EUR. The fraudsters impersonated the chairman of the board and asked for a strictly confidential transaction (source, source 2)
2018: The french cinema chain Pathé lost 19 million EUR (source)
2019: The actor Lincoln Lewis was impersonated by a woman from Australia. The victim knew Lewis from school. By chat messages, she was made to believe to get into a relationship with Lewis. The victim and the attacker exchanged intimate photos that were used to blackmail the victim. In the end, the victim committed suicide (source)
2019: Google and Facebook lost 123 million USD to scammers by falling for mandate fraud. The scammers forged emails (source 1, source 2).
2020: Many different attackers use Amazon Prime Day to lure people into logging in at websites that imitate Amazon (source 1, source 2, source 3)

How Phishing works

Social Engineering attacks always need a good understanding of how people think to be successful. There are a couple of well-known schemes.

The Grandson Fraud Scheme

This phishing attack targets elderly people. The scammer calls them and claims to be either their grandson or somebody close to their grandson. They claim to be in some kind of emergency situation. Maybe abroad and their stuff got stolen. Or in prison. Hence they put emotional pressure on the victim to prevent them from thinking about this situation.

The CEO Fraud Scheme

In CEO fraud, also called CEO spoofing or Business Email Compromise (BEC), the attacker claims to be the CEO. They give reasons why money should be transferred to the people that can do those transfers. For example, he wants to buy gift cards for the employees as a Christmas present.

In this case, employees are scammed. Time pressure is put on the employees. If questions from the employee are typically discouraged in the company culture, this type of fraud has a bigger chance to be successful. The attacker uses knowledge about internal information such as business partners or current projects.

The Mandate Fraud Scheme

The attacker claims to be a business partner of the attacked company. They might say that their bank details have changed. They might just send an invoice over a non-existing service.

The attackers' tools

Fake websites are likely the most commonly used tool. The attacker creates a website that looks identical to the original website of a bank, Amazon, or just any other interesting target. Once you enter your credentials, the attacker has them. They might forward you to the original website. You might wonder why you’re not logged in, but nothing bad seemed to have happened. There are tools like site cloners available in Kali Linux that make this kind of attack incredibly easy.

The most useful technique to a phishing attacker is probably to forge a faked email sender's address. This is called email spoofing. Imagine if you received an email from your CEO asking for all credentials you have to check for potential alternatives to existing systems. You check the email, and the sender seems to be your CEO. Although it was not sent by him/her. You can read more about that in my dedicated article:

Email Spoofing 😈 Email spoofing is the creation of emails with a forged sender address. Faking the senders’ address is often a part of a…

Deepfakes are another technique you must be aware of. It’s a machine learning technique in which deep neural networks are used to create videos from still images. Imagine the attacker getting image and video footage of your CEO. Then they figure out when your boss is on vacation / not in the office. The attacker then calls you via video call. You might not know the number or the method of the call might look weird, but you can see your boss and hear his voice. The attacker then tells you that there will be a new CTO — but because the old one may not know about it, it has to be kept a secret. You should just give him as many permissions as possible, so that the new CTO gets a good impression of the overall system.

It already happened: in 2024, an employee of the engineering firm Arup in Hong Kong transferred about 25 million USD after a video call with deepfakes of the CFO and other colleagues (source).

How to defend yourself

There are a couple of approaches to defend yourself and your organization:

Identification: Make it as hard as possible to impersonate you or your website. If possible, use cryptographic signatures in emails. Use certificates on websites. Make sure people know about certificates and what it means if a certificate is not valid.
Policy: Never ask your users for their passwords.
Least privilege: If people don’t have many permissions, the harm they can do is limited. Keeping the permissions of people as restricted as possible is desirable from a security point of view.
Train people: Spread awareness of those attacks.

Summary

Every single organization and person is vulnerable to phishing attacks. There is no technical defense if people work around it. The best one can do is to raise people’s awareness.

If you want to get a simple understanding of how those scams can work, you could watch the Netflix series Jamtara — Sabka Number Ayega.