SoylentNews is people
SoylentNews
If you work in finance or accounting and receive an email from your boss asking you to transfer some funds to an external account, you might want to think twice.
That's because so-called "whaling" attacks -- a refined kind of phishing in which hackers use spoofed or similar-sounding domain names to make it look like the emails they send are from your CFO or CEO -- are on the rise, according to security firm Mimecast.
If fact, 55 percent of the 442 IT professionals Mimecast surveyed this month said their organizations have seen an increase in the volume of whaling attacks over the past three months, the firm reported on Wednesday.
Those organizations spanned the U.S., U.K., South Africa and Australia.
Domain-spoofing is the most popular strategy, accounting for 70 percent of such attacks, Mimecast said; the majority pretend to be the CEO, but some 35 percent of organizations had seen whaling emails attributed to the CFO.
"Whaling emails can be more difficult to detect because they don't contain a hyperlink or malicious attachment, and rely solely on social engineering to trick their targets," said Orlando Scott-Cowley, a cybersecurity strategist with Mimecast.
(Score: 0) by Anonymous Coward on Saturday December 26 2015, @09:55PM
If pisses me off every time I sign up for a bank account, the user agreement says something to the effect:
Why the hell not?
There is even more [openpgp.org] than one [office.com] standard for signing or encrypting e-mail (SHA-1 weakness asside).
(Score: 1, Insightful) by Anonymous Coward on Saturday December 26 2015, @10:09PM
I suppose S/MIME may not mitigate close domain attacks. If you know an organization using it internally, you can make your phishing message even more convincing by signing it with a similar-looking domain. That may produce a paper trail though.
(Score: 2) by wonkey_monkey on Saturday December 26 2015, @10:13PM
There is [...] more than one standard
Well, there's the first problem...
systemd is Roko's Basilisk
(Score: 2) by AndyTheAbsurd on Saturday December 26 2015, @10:24PM
Because a very large proportion of the population is either unable or unwilling to use secure e-mail. (I could even argue that a considerable proportion of them are incapable of understanding what "secure" means in this sort of technical context.)
Please note my username before responding. You may have been trolled.
(Score: 0) by Anonymous Coward on Saturday December 26 2015, @11:28PM
Maybe the banks should just provide an email service to all customers, with enforced PGP. All bank statements and online bills get sent there. Have to login to bank's website to use it. Etc.
(Score: 3, Insightful) by Anonymous Coward on Saturday December 26 2015, @11:53PM
> Because a very large proportion of the population is either unable or unwilling to use secure e-mail.
And that is not their fault at all. The user experience for all of these implementations is shit. It's like trying to drive a car with reins instead of a steering wheel - it can be done at very low speed, but trying to use it as your primary mode of transport and it quickly moves beyond the ability of a mortal human to use safely. Wide-spread adoption of secure messaging absolutely requires a comfortable user interface.