SoylentNews is people
SoylentNews
from the do-you-have-a-phishing-license? dept.
Phishing is still the most common way for cyber attackers to gain entry into networks. Whether it's crooks looking for financial gain or state-backed hacking operations engaging in cyber espionage, it almost always starts with a message designed to make someone click a link or give away sensitive information. Just one person falling victim can be enough to provide hackers with the foothold they need to gain access to the whole corporate network and the confidential information stored within.
But blaming the victim rarely solves anything – especially given how phishing emails can be so highly tailored towards victims, meaning it can be almost impossible to distinguish a real message from a spoofed one created as part of an attack.
"It's fairly easy for an attacker to get hold of an email address and pretend to be somebody," says Amanda Widdowson, cybersecurity champion for the Chartered Institute of Ergonomics & Human Factors and human factors capability lead for Thales Cyber & Consulting.
[...] "There's a power play going on in a lot of these emails. There's somebody impersonating a position of authority, of seniority, effectively saying don't ask questions, just get it done, which is effective," says Tim Sadler, CEO of email security provider Tessian.
"When people send spear-phishing emails, they're taking on the persona or identity of a trusted person. That personalisation makes it highly effective in terms of getting the target to comply with the request, pay the invoice, do what they need to do," he adds.
[...] "There's very little to let the person receiving the email know the person they're receiving it from is who they say they are. It's a little asymmetric, asking a person to do the hard bit, then making not life easy for them," says James Hatch, director of cyber services at BAE Systems.
This behavior isn't restricted to email either; there are times when banks, utilities, telecommunications and other service providers will call customers out of the blue, and then ask the customer to provide their personal security details to verify it's them, yet the customer has no way of identifying if the call is a hoax or not.
(Score: 4, Insightful) by bobmorning on Tuesday August 20 2019, @07:19PM (2 children)
If organizations really want to avoid phishing, then configure your mail clients to convert HTML email to text. Yes it's a pain to cut n paste URLs into a browser, but not only does it prevent the casual click, it also displays exactly what the URL is that the "link" points you to.
It won't prevent the careless user from still shooting themselves in the foot, but it certainly will make them work harder to do so.
(Score: 2) by hendrikboom on Wednesday August 21 2019, @02:56AM
I use mutt in an xterm. I get to see *everything* as text. I've gradually acquired an ability to read raw HTML. I've noticed that the harder to read HTML is, the more likely it is to be spam. There is thus a natural threshold beyond which there's no point even trying to read it.
(Score: 2) by DannyB on Wednesday August 21 2019, @03:08PM
I don't really think that will fix it.
Phishing is NOT a technical problem. Technical fixes can be effective band-aid mitigations. But are not cures.
Even Html to Text will let the text get through. The point of phishing is that the TEXT convinces some clueless market droid or sales droid to escort some malware right into the company network.
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.