2. Phishing

Question 1

What is the purpose of phishing attacks?

Answer 1

To provoke people into actions that compromise information security or get them to either reconfigure access control mechanisms or to install malware

Question 2

What is the difference between phishing, spear phishing and whaling?

Answer 2

Phishing → Mass messaging , most often via e mail, to many regular users in order to harvest access credentials , privileges , information

Spear phishing → Phishing against interesting individuals that are selected due to their position , knowledge or status. Attacks often designed based on observational knowledge

Whaling → Spearfishing against very important key personal (CEOs, generals, top politicians and other key figures)

Question 3

What is the difference between smishing and vishing?

Answer 3

Smishing → Phishing through various electronic messenger services (SMS, WhatsApp, Telegram, Skype etc).

Vishing → Voice calling with deep faked synthetic ‘real’ voice of a person in order to persuade victim

Question 4

After successfully sending phishing messages to the victim - how does the phishing attack compromise the victim’s information security? How does the attacker gain access to the target systems?

Answer 4

• Victim clicks the phishing link
• Phishing website opens
• Victim submits information

Question 5

Name the principles of influence that get exploited in phishing messages.

Answer 5

SiSo CARS

● Authority - People’s tendency to comply with requests from figures perceived as knowledgeable or in positions of authority. Phishing messages may impersonate trusted organizations or individuals to gain credibility and trust.
● Liking/Similarity - The tendency to comply with requests from individuals who are liked, admired, or considered similar. Phishing messages may try to establish a personal connection, use friendly language, or mimic the communication style of the target’s acquaintances.
● Scarcity - The perception that limited availability or scarcity of something increases its value. Phishing messages may create a sense of urgency or scarcity to prompt immediate action, such as claiming limited-time offers or account closures.
● Reciprocation - The tendency for individuals to feel obligated to give back or repay a favor. Phishing messages may promise a reward or offer something of value in exchange for personal information.
● Commitment/Consistency - People’s desire to be consistent with their previous beliefs, commitments, or actions. Phishing messages may exploit this principle by referencing previous interactions, pretending to follow up on past requests, or mimicking familiar communication styles.
● Social proof - The influence of others’ actions or opinions on an individual’s behavior. Phishing messages may use fake testimonials, social media references, or references to popular trends to convince individuals to take action.

Question 6

What are the technological causes that enable phishing attacks in messaging and communication?

Answer 6

● Unauthenticated messaging
● Use of passwords without second authentication factor
● Lack of hardware supported or biometric supported authentication
● Poor identity management concepts based on transferable and remotely usable credentials and identity attributes
● Mass distribution services that send poorly authenticated attack messages to a large audiences in very short time
● No message spam filtering with anti phishing technology
● Poor computer security against malware , exploit or automated attacks

Cheap automation also

Question 7

Factors enabling phishing

Answer 7

• Poor security technology
• Cheap automation
• Poor user awareness
• Lack of training

Question 8

How will artificial intelligence support phishing?

Answer 8

• to generate Phishing URLs that bypass intrusion detection .
• to generate Phishing content that is automatically personalized to the target.
• to adapt topics in Phishing mail to current viral topics on social media.
• to fake persons used in Phishing contexts

Question 9

Name four countermeasures that when deployed in an organization are effective against phishing attacks.

Answer 9

• Message spam filtering
• Training of users
• Web filtering
• Website take-downs

Deployment of hard authentication & malware prevention

Question 10

How does a phishing training platform get used for raising employee awareness in an organization?

Answer 10

• Used to run controlled assessment or awareness phishing campaigns
• Tools generate e-mails and landing web pages , collect click rates, generate statistics about success
• OSINT
• Email customization
• Domain selection
• Click events
• Evaluation