SoylentNews is people
SoylentNews
from the do-you-have-a-phishing-license? dept.
Phishing is still the most common way for cyber attackers to gain entry into networks. Whether it's crooks looking for financial gain or state-backed hacking operations engaging in cyber espionage, it almost always starts with a message designed to make someone click a link or give away sensitive information. Just one person falling victim can be enough to provide hackers with the foothold they need to gain access to the whole corporate network and the confidential information stored within.
But blaming the victim rarely solves anything – especially given how phishing emails can be so highly tailored towards victims, meaning it can be almost impossible to distinguish a real message from a spoofed one created as part of an attack.
"It's fairly easy for an attacker to get hold of an email address and pretend to be somebody," says Amanda Widdowson, cybersecurity champion for the Chartered Institute of Ergonomics & Human Factors and human factors capability lead for Thales Cyber & Consulting.
[...] "There's a power play going on in a lot of these emails. There's somebody impersonating a position of authority, of seniority, effectively saying don't ask questions, just get it done, which is effective," says Tim Sadler, CEO of email security provider Tessian.
"When people send spear-phishing emails, they're taking on the persona or identity of a trusted person. That personalisation makes it highly effective in terms of getting the target to comply with the request, pay the invoice, do what they need to do," he adds.
[...] "There's very little to let the person receiving the email know the person they're receiving it from is who they say they are. It's a little asymmetric, asking a person to do the hard bit, then making not life easy for them," says James Hatch, director of cyber services at BAE Systems.
This behavior isn't restricted to email either; there are times when banks, utilities, telecommunications and other service providers will call customers out of the blue, and then ask the customer to provide their personal security details to verify it's them, yet the customer has no way of identifying if the call is a hoax or not.
(Score: 2) by Thexalon on Wednesday August 21 2019, @01:51AM (1 child)
There are other forms of 2FA (or 3FA if need be), and they aren't perfect, and aren't necessarily easy, but are needed if you're trying to protect a high-value target like, say, a prominent politician.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by edIII on Wednesday August 21 2019, @03:11AM
Ohh, I didn't imply 2FA wasn't worth it. I actually see properly implemented 2FA with a hardware key as a serious solution.
What I was saying is that it is an unacceptable risk to allow the user to visit the attacker web page. You were saying that we needed to nullify any advantages that receiving security credentials would provide, and I'm just pointing out that is only one form that the attack may take.
I think you mean MFA (MultiFactorAuth) when you say 3FA, but the same problem exists if the attacker's web page can initiate the 2FA process client side to receive the codes. It's a very tight and difficult attack window, but not something beyond nation state level resources attacking, say, a prominent politician.
On the whole though it's a much better idea to prevent the user from ever visiting the phishing page in the first place, because that can result in compromising a whole machine.... which usually resides on the inside of a protected network.
Technically, lunchtime is at any moment. It's just a wave function.