2.2 Phishing

Question 1

Phishing (see video examples).

Answer 1

Social Engineering with a touch of spoofing. Often delivered by email, text, ETC. Remarkable when done well.

Don’t be fooled. Check the URL. There is usually something not quite right such as spelling, fonts, or graphics.

Question 2

Buisness email compromise traits

Answer 2

We trust email sources. Attackers take advantage of this.

Spoofed email addresses. Not really a legitimate email address.

Financial fraud. Sends emails with updated bank information. Modify wire transfer details.

The recipient clicks the links. The attachments have malware.

Question 3

Tricks and misdirection of phishing

Answer 3

How are they so sucessful?

Typosquatting. A type of URL hijacking. (see slide example).

Pretexting. Lying to get information. Attacker is a character in a situation they create. “Hi were calling from Visa regarding an automated payment to your utility service”.

Question 4

Two different types of Phishing (see video example.

Answer 4

Vishing- (Voice phishing) is done over the phone or voicemail. Caller ID spoofing is common. Fake security checks or bank updates.

Smishing -(SMS phishing) is done by text message. Spoofing is a problem here as well. Forwards links or asks for personal information.

Variations on a theme. Fake check scam, phone verification code scam, boss/ceo scam, advance fee scam.