Nobody wants to fall prey to a phishing scam, let alone the disruption and issues they can cause to your school or trust. There's a good reason that such scams will continue, though: They are successful enough for cybercriminals to make massive profits. Phishing scams have been around practically since the inception of the Internet, and they will not go away any time soon.
Here are some of the techniques used for phishing that you need to be aware of both whilst in and out of your workplace:
Types of Scams
Email/Spam
Using the most common phishing technique, the same email is sent to millions of users with a request to fill in personal details. These details will be used by the phishers for their illegal activities. Most of the messages have an urgent note which requires the user to enter credentials to update account information, change details, or verify accounts. Sometimes, they may be asked to fill out a form to access a new service through a link which is provided in the email.
Spear Phishing
While traditional phishing uses a 'spray and pray' approach, meaning mass emails are sent to as many people as possible, spear phishing is a much more targeted attack in which the hacker knows which specific individual or organisation they are after. They do research on the target in order to make the attack more personalised and increase the likelihood of the target falling into their trap.
Whale Phishing
Whaling is a type of spear phishing attack that focuses on high-level executives (e.g. the C-suite). Whaling differs from normal spear phishing as it tends to be highly researched in order to seem more credible. Hackers can either target the executive themselves or send emails pretending to be them to other members of staff. The hackers may glean information from the executives' LinkedIn profiles and news articles. They may also research industry terms to make their emails seem more credible.
Web-Based Delivery
Web-based delivery is one of the most sophisticated phishing techniques. Also known as "man-in-the-middle," the hacker is located in between the original website and the phishing system. The phisher traces details during a transaction between the legitimate website and the user. As the user continues to pass information, it is gathered by the phishers without the user knowing about it.
Link Manipulation
Link manipulation is the technique in which the phisher sends a link to a malicious website. When the user clicks on the deceptive link, it opens up the phisher's website instead of the website mentioned in the link. Hovering the mouse over the link to view the actual address stops users from falling for link manipulation.
Keyloggers
Keyloggers refer to the malware used to identify inputs from the keyboard. The information is sent to the hackers who will decipher passwords and other types of information. To prevent key loggers from accessing personal information, secure websites provide options to use mouse clicks to make entries through the virtual keyboard.
Trojan Horse
A Trojan horse is a type of malware designed to mislead the user with an action that looks legitimate, but actually allows unauthorized access to the user account to collect credentials through the local machine. The acquired information is then transmitted to cybercriminals.
Malvertising
Malvertising is malicious advertising that contains active scripts designed to download malware or force unwanted content onto your computer. Exploits in Adobe PDF and Flash are the most common methods used in malvertisements.
Session Hijacking
In session hijacking, the phisher exploits the web session control mechanism to steal information from the user. In a simple session hacking procedure known as session sniffing, the phisher can use a sniffer to intercept relevant information so that he or she can access the Web server illegally.
Content Injection
Content injection is the technique where the phisher changes a part of the content on the page of a reliable website. This is done to mislead the user to go to a page outside the legitimate website, where the user is then asked to enter personal information.
Phishing Through Search Engines
Some phishing scams involve search engines where the user is directed to product sites which may offer low-cost products or services. When the user tries to buy the product by entering the credit card details, it's collected by the phishing site. There are many fake bank websites offering credit cards or loans to users at a low rate, but they are actually phishing sites.
Vishing (Voice Phishing)
In phone phishing, the phisher makes phone calls to the user and asks the user to dial a number. The purpose is to get personal information about the bank account over the phone. Phone phishing is mostly done with a fake caller ID.
Smishing (SMS Phishing)
Phishing is conducted via Short Message Service (SMS), a telephone-based text messaging service. A smishing text, for example, attempts to entice a victim into revealing personal information via a link that leads to a phishing website. Many people have experienced these around tax return time, claiming to be from the Inland Revenue.
Malware
Phishing scams involving malware require it to be run on the user's computer. The malware is usually attached to the email sent to the user by the phishers. Once you click on the link, the malware will start functioning. Sometimes, the malware may also be attached to downloadable files.
Ransomware
Ransomware denies access to a device or files until a ransom has been paid. Ransomware for PC's is malware that gets installed on a user's workstation using a social engineering attack where the user gets tricked into clicking on a link, opening an attachment, or clicking on malvertising.
How to stay safe
Fortunately, there are ways to avoid becoming a victim yourself or your school.
Here are 10 basic guidelines for keeping yourself, and your school, safe:
1. Keep Informed About Phishing Techniques
New phishing scams are being developed all the time. Without staying on top of these new phishing techniques, you could inadvertently fall prey to one. Keep your eyes peeled for news about new phishing scams. By finding out about them as early as possible, you will be at a much lower risk of getting snared by one. For school administrators, ongoing security awareness training and simulated phishing for all users are highly recommended in keeping security top of mind throughout the organisation. If your school is struggling to stay on top of new techniques and scams, contact us about how our data protection officer can help.
2. Think Before You Click!
It's fine to click on links when you're on trusted sites. Clicking on links that appear in random emails and instant messages, however, isn't such a smart move. Hover over links that you are unsure of before clicking on them. Do they lead where they are supposed to lead? A phishing email may claim to be from a legitimate company, and when you click the link to the website, it may look exactly like the real website. The email may ask you to fill in the information, but the email may not contain your name. Most phishing emails will start with "Dear Customer", so you should be alert when you come across these emails. If the branding looks wrong or there are errors in the email, think twice. Also, if you receive an email saying you have to act urgently, be cautious. If it feels wrong, then it probably is wrong. When in doubt, go directly to the source rather than clicking a potentially dangerous link.
3. Install an Anti-Phishing Toolbar
Most popular Internet browsers can be customised with anti-phishing toolbars. Such toolbars run quick checks on the sites that you are visiting and compare them to lists of known phishing sites. If you stumble upon a malicious site, the toolbar will alert you about it. This is just one more layer of protection against phishing scams, and it is completely free.
4. Verify a Site's Security
It's natural to be a little wary about supplying sensitive financial information online. As long as you are on a secure website, however, you shouldn't run into any trouble. It may seem obvious, but before submitting any information, make sure the site's URL begins with "https", and there should be a closed lock icon near the address bar. Check for the site's security certificate as well. If you get a message stating a certain website may contain malicious files, do not open the website. Never download files from suspicious emails or websites. Even search engines may show certain links which may lead users to a phishing webpage which offers low-cost products. If the user makes purchases at such a website, the credit card details will be accessed by cybercriminals.
5. Check Your Online Accounts Regularly and set up spending alerts.
Even if you don't technically need to, check in with each of your online accounts on a regular basis. Get into the habit of changing your passwords regularly, too. To prevent bank phishing and credit card phishing scams, you should personally check your statements regularly. Get monthly statements for your financial accounts and check each entry carefully to ensure no fraudulent transactions have been made without your knowledge.
6. Keep Your Browser Up to Date
Security patches are released for popular browsers all the time. They are released in response to the security loopholes that phishers and other hackers inevitably discover and exploit. If you typically ignore messages about updating your browsers, stop. The minute an update is available, download and install it.
7. Use Firewalls
High-quality firewalls act as buffers between you, your computer and outside intruders. You should use two different kinds: a desktop firewall and a network firewall. The first option is a type of software, and the second option is a type of hardware. When used together, they drastically reduce the odds of hackers and phishers infiltrating your computer or your network.
8. Be Wary of Pop-Ups
Pop-up windows often masquerade as legitimate components of a website. All too often, though, they are phishing attempts. Many popular browsers allow you to block pop-ups; you can allow them on a case-by-case basis. If one manages to slip through the cracks, don't click on the "cancel" button; such buttons often lead to phishing sites. Instead, click the small "x" in the upper corner of the window.
9. Never Give Out Personal Information
As a general rule, you should never share personal or financially sensitive information over the Internet. When in doubt, go visit the main website of the company in question, get their number and give them a call. Most of the phishing emails will direct you to pages where entries for financial or personal information are required. An Internet user should never make confidential entries through the links provided in the emails. Never send an email with sensitive information to anyone. Make it a habit to check the address of the website. A secure website always starts with "https".
10. Use Antivirus Software
There are plenty of reasons to use antivirus software. Special signatures that are included with antivirus software guard against known technology workarounds and loopholes. Just be sure to keep your software up to date. New definitions are added all the time because new scams are also being dreamed up all the time. Anti-spyware and firewall settings should be used to prevent phishing attacks, and users should update the programs regularly. Firewall protection prevents access to malicious files by blocking the attacks. Antivirus software scans every file which comes through the Internet to your computer. It helps to prevent damage to your system.
You don't have to live in fear of phishing scams. By keeping the preceding tips in mind, you should be able to enjoy a worry-free online experience. If you need any help or support with your ICT support or data protection, contact us, and we can talk through how we can help.
