Phishing

Phishing

Phishing is a type of cyberattack in which an actor tries to get users to reveal their personal or sensitive information, such as passwords, credit card information, or bank details, or to download something. The attacker often impersonates an organization or a person the user trusts, such as a bank, social network, or government agency.

Typically, phishing attacks are carried out via email, where the attacker sends out mass email messages to potential victims. Such email may look like a legitimate communication from a known organization and often contains links to fake websites designed to look like the original websites. When the user clicks on the link, they are often redirected to a fraudulent website where they are asked to enter their personal details.

Examples of Phishing

Phishing can also be carried out through other channels, such as text messages (SMS phishing or smishing), phone (vishing), or through the use of fake social media or apps. Here are some examples of phishing:

• Email phishing: This is the most widespread form of phishing. The attacker sends emails that appear to be from a legitimate organization, such as a bank or company. The message may prompt the user to click on a link that directs to a fake website asking them to enter their personal information.
• Website – Phishing: In this type of phishing, the attacker creates a fake website that appears to be a legitimate page, such as a fake login page for a popular platform or an ISP. Users are tricked into entering their login credentials, which are then collected by the attacker.
• Man-in-the-Middle (MITM) phishing: Here, the attacker creates a position between the user and a legitimate website or service. The attacker can monitor and gain access to the communications that occur between the user and the website, including login credentials and other sensitive data.
• Smishing: This type of phishing occurs through text messages (SMS). The user receives a message prompting them to reply or click a link. The link may lead to a fake website or to malware being installed on the user’s device.
• Vishing: In this type of phishing, attackers make use of telephones or mobile phones. A targeted user receives a call from someone pretending to be from an organization, such as a bank, and they try to trick the user into doing something harmful such as giving out their personal information or transferring money to an account.
• Spear phishing: This type of phishing is more targeted and personalized. The attacker collects information about their specific target, such as name, job title, or interests, and sends fraudulent messages tailored to appear more credible. It can be aimed at companies or individuals.

Attacks in the Nordic region

Phishing is one of the most rapidly growing hacker attack types in the world right now.

The Nordic region has also been affected by these attacks which is evident from the below examples:

• On December 16, 2021, Kalix municipality was hit by a serious hacker attack that resulted in their IT systems being knocked out. This attack led to significant disruptions in the municipality’s operations and forced them to switch to manual ways of working. The situation required immediate intervention by municipal staff to deal with the ongoing crisis.
• On March 19, 2019, the Norwegian company Norsk Hydro suffered a major hacker attack that had serious consequences for their global business. The attack was classified as a ransomware attack and the malware used was identified as LockerGoga.  The effects of the attack were extensive. The company’s computer systems and network were affected, leading to major disruptions in production and daily operations. Many of the company’s sites were forced to switch to manual and analog processes to continue operating.

Both these attacks began with a phishing attack. The purpose of phishing is to steal users’ sensitive information and then misuse it, for example by committing financial fraud, identity theft, or spreading malicious software as in the Kalix and Norsk Hydro cases.

Tips and tricks

To avoid being victims of a phishing attack, here are some tips you can follow:

• Be careful about clicking on links: Avoid clicking on links in unsolicited emails, text messages, or social media. If you receive a message prompting you to click on a link, first check the sender by going directly to their official website or contacting them directly.
• Double-check the identity of the sender: Be skeptical of emails that appear to come from known organizations or individuals. Phishing can use advanced techniques to mimic senders, so check spelling, grammar, and the sender’s email address carefully.
• Be careful when sharing personal information: Legitimate organizations will rarely request personal information via email or text messages. Never give out your password, account number, or credit card information to anyone who requests it through insecure channels.
• Use strong and unique passwords: Use unique and strong passwords for each online account you have. Combine uppercase and lowercase letters, numbers, and special characters to create complex passwords that are hard to guess. Also, use a reliable password manager tool to manage your passwords securely.
• Be careful when downloading attachments: Be skeptical of attachments in emails, especially if they come from unknown senders. Do not download or open attachments if you are not sure of their authenticity.
• Update your devices and software: Keep your operating systems, browsers, and other applications up to date with the latest security patches. These patches patch known vulnerabilities and reduce the risk of falling victim to attacks.
• Be careful when sharing information on social media: Be careful about the type of personal information you share on social media. Scammers can use this information to target you in phishing attacks.
• Use security software: Install and update a reliable antivirus and security software on your devices. These programs can help detect and block phishing attempts as well as other malicious activities.

Why Security Awareness?

Security awareness plays a crucial role in protecting against phishing attacks. Here are some key reasons why security awareness is important:

• Identify suspicious communications: By being aware of phishing techniques and common characteristics, you can more easily identify suspicious emails, text messages, or other forms of communication that may be fraudulent. By being vigilant, you can avoid falling for phishing attempts.
• Avoid clicking on malicious links: Hackers often use links to trick users into fake websites or to download malware. By being aware of the risks, you can be wary of clicking on links in messages.
• Update knowledge and protection techniques: By being aware of the latest phishing techniques and vulnerabilities, you can stay up-to-date and take appropriate steps to protect yourself. By learning about new methods used in phishing, you can adapt your behavior and use effective safeguards, such as security software and strong passwords.

What can eBuilder Security help you with?

• We can help you with a situation analysis, how aware your organization is, and how it responds to threats today.
• Complorer is a market-leading security awareness product in the Nordics and helps organizations test and train their employees to improve their security culture.