Phishing attacks are among the growing threats gaining popularity and creating havoc in the Internet world. In the previous blog, Phishing Attacks Part 1: Major History Moments to Learn From, 5 major attacks in history were detailed. As these type of attacks increase in diversity and complexity, it becomes increasingly important to minimize the chances of becoming a victim of a phishing attack.
Phishing Techniques
- Email Phishing Scams
Email phishing is basically a game of numbers. A cybercriminal sends out hundreds of thousands of fraudulent messages mimicking to actual emails from a fake organization. He uses the same phrasing, signatures, logos, and typefaces to make the messages look legitimate.
Also, the cyberattacker will try to lure users by creating a sense of urgent dealing and pressurize him so that the user becomes less diligent and more prone towards the scam.
Mostly links inside the messages, although they resemble their legitimate counterparts, have a misspelled domain name or some extra subdomains. Like changing the URL from example.edu/renewal to example.edurenewal.com, both of them look similar enough, thus the recipient is less aware of the phishing attack.
- Spear Phishing
Spear phishing does not target random application users, but it targets a specific enterprise or a person. This phishing technique requires a more in-depth and sophisticated version of phishing and requires special knowledge about an organization also including its power structure.
A cyberattacker might follow these steps to lure a person:
- A miscreant researchers the organizations’ marketing department, withdraws the names of employees in it and tries to become accessible to the latest project invoices.
- He disguises as the marketing director and emails a departmental Project Manager (PM) using a subject line ‘Updated invoice for Q3 campaigns’. The text, logo, and style mimic the organization’s standard email template.
- The email contains a link that redirects to a password-protected internal document that is actually a fake version of a stolen invoice.
- The PM is thus lured into logging in to view the document. The cyber attacker then steals his credentials and gain a complete access to sensitive areas within the organization.
Spear phishing is a sophisticated phishing technique for launching the first stage of an Advanced Persistent Threat – APT.
Preventive Measures against Phishing Attacks
By using these simple and proactive preventive measures of phishing attacks you can avoid its consequences:
- Avoid sending out your email address
Publicly accessible websites are the main horde from where cybercriminals gather email addresses. Once the email addresses are collected, phishing emails are sent out in huge numbers to spread virulent codes, or to work out the malicious activities such as sending uninvited messages like spam, launching phishing assaults, or sending out advertising pop-ups.
So when sending out emails to more than one address it is crucial that the sender must use bcc – blind carbon copy – or else the messages accumulate the valid email addresses and allow cybercriminals to discover such information easily. Resending those email chains make it much easier for cybercriminals to gather email address for awicked purpose. Rechecking the recipient whom you are sending the email is also important to avoid disposing of your sensitive information to the wrong recipient.
- Inspect the content of the messages
Inspecting the content of the messages a person receives or sends via email, should be the priority of every Netizen. The content must be analyzed carefully, because phishing emails often send attachments through which a phishing attack might initiate.
Therefore, checking the sender of any email you receive and then the contents of the message should be made an instant habit. Cybercriminals lure you into their phishing scams through their irresistible offers, skeptical links or pop-ups, which you should handle with care and avoid getting trapped in the attacker’s trap.
The major advice to be implemented here is that you must at all cost avoid clicking haphazardly and pay attention to even the minor clicking.
- Security tools must be used
Antivirus must be installed and put to work 24/7 on your computer. This security tool protects both your information and your device from the continuously growing malicious software that are spreading via phishing emails.
But even if mistakenly a malicious file gets downloaded or clicked on, the antivirus will protect your system from being infected with the malicious software. For this purpose, it is important that you keep your antivirus up-to-date and configured with appropriate and correct settings.
This preventive measure can be even applied to your mobile phones for their protection as well. This enhanced security was put into effect after the first ransomware by the name of Simplocker, originated for encrypting files on Android devices.
- Keep your system up-to-date
To fight off the phishing attacks, one must keep his system and software up-to-date. As we are aware that the major source of phishing attacks are the phishing emails, but it should also be kept in mind that it is equally important to check the authentication of the software that you are downloading and installing on your system.
A cybercriminal is not dumb enough to simply launch his attacks through the same route only thus he devises other plans than just the usual phishing emails. Therefore, malicious websites, programs, and apps that you wish to download must be first thoroughly checked for authentication.
- Backup your data
Backing up your data on some external storage devices is the best protective measure. This will ensure data protection even if your system gets hit by a phishing attack, because the cybercriminal will gain nothing of interest if there was no important data stored in the system.
Conclusion
Minimize your chances of becoming a victim of a phishing attack. Implement the aforementioned good practices, stay aware and updated on the risks associated with a phishing attack, and you can protect yourself, not just against the phishing attacks but also from other malware.
Author Bio: Peter Buttler is a Professional Security Expert and Journalist contributing to digital privacy and cybersecurity publications for six years. He conducts interviews with security authorities to present expert opinions on the latest security affairs. While writing, Peter emphasizes on latest security and technology trends that are directly related to individuals’ privacy. You can follow him on Twitter @peter_buttlr.
Peter Buttler is a guest blogger, all opinions are his own.
