{"id":2350,"date":"2019-01-21T14:39:15","date_gmt":"2019-01-21T14:39:15","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=1859"},"modified":"2022-12-02T15:25:25","modified_gmt":"2022-12-02T09:55:25","slug":"security-advisory-email-phishing","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/security-advisory-email-phishing\/","title":{"rendered":"Security Advisory – Email Phishing"},"content":{"rendered":"


\nIn today\u2019s era, email is still used as one of the primary ways to communicate, which is not only restricted to our everyday work but also to stay in touch with our near and dear ones. Additionally, email is also used by companies to provide their services like to help a user to get online banking statements, online software updates etc. With all the benefits it provides, let us not forget the security risk it brings in. Email Phishing scams have become one of the prime attack methods used to trick a user into giving their personal information such as credit card numbers, passwords etc by performing phishing email campaign.<\/p>\n

In mid-January 2018, security researchers reported phishing activity in which the attackers compromised MailChimp<\/strong> accounts to send out fake invoice notifications. At the time of discovery, security experts concluded that criminals abused weak, breached and reused credentials to hack users\u2019 MailChimp<\/strong> accounts. In 2017, the same case happened with NETFLIX<\/strong> members. They got phishing mail asking them to restart their membership. According to a survey of Symantec 2018 Internet Security Threat Report<\/strong> (ISTR), by the end of 2017, the average users would have received 16 malicious emails per month.<\/p>\n

Phishing is constantly evolving and is due to users\u2019 unawareness and lack of knowledge about malicious URL links, attachments. This article is going to help you understand how phishing scam happens, how to identify them and protect yourself.<\/p>\n

 <\/p>\n

How attackers perform malicious activity? <\/strong><\/h3>\n

The following example illustrates a phishing scam attempt<\/p>\n

1. Attacker Creates a Phishing Page:<\/strong><\/p>\n

An attacker creates a phishing page (malicious page) which looks like a legitimate page using different framework techniques. An attacker then hosts that phishing URL by using free or paid web hosting server. This malicious link is attached to the fake email generator tool which sends fake mail to victim asking about their personal information.<\/p>\n

 <\/p>\n

\"PoC:<\/a>PoC: Phishing page<\/strong><\/h6>\n

2. Victim\u00a0Enters Credentials:<\/strong><\/p>\n

Without verifying if the link belongs to an original domain, the victim unknowingly clicks on a malicious link. This link is connected with the phishing page created by the attacker. As phishing page looks exactly like the legitimate page .He\/she enters their personal sensitive information e.g. user credentials, banking information, personal information etc.<\/p>\n

\"PoC:<\/a><\/p>\n

 <\/p>\n

<\/h6>\n
<\/h6>\n
<\/h6>\n
<\/h6>\n
<\/h6>\n
PoC: User Credentials<\/strong><\/h6>\n

3. Information Captured by Attacker:<\/strong><\/p>\n

As phishing page is linked with the attacker database server, any data fed by the victim to the malicious page is accessible by the attacker. By using this information, an attacker can carry out further malicious activities.<\/p>\n

\"PoC:<\/a><\/p>\n

PoC: Credentials captured by the attacker<\/strong><\/h6>\n

 <\/p>\n

\u00a0<\/strong>How to identify a phishing email?<\/strong><\/h3>\n

1. Always be suspicious:<\/strong><\/p>\n

Phishing emails try to freak you out with warnings of stolen information and then offer an easy fix if you just “click here”. When you are in doubt open your browser, go to the company’s website, then sign in normally to see if there are any signs of strange activity. If you’re concerned, change your password.<\/p>\n

2. Detect a fake link<\/strong>:<\/p>\n

To find a fake mail, you can move your mouse on the link. You will see the real link pop up after a few seconds. You could right-click on the link, copy it and then paste it into a text document to see where it would really redirect you to the original website. When you are looking at the URL look for any spelling mistakes in domain name. A fraudulent email might link to http:\/\/www.ex@null<\/span>mple.com instead of http:\/\/www.example.com<\/p>\n

3. Check the instruction:<\/strong><\/p>\n

Any legitimate company that’s sending a security notification will never ask you to click a button or link or download an attachment. The attacker will tell you to go to its website home page and log in to your account from there. Also, an attacker might tell you to call customer service with any questions.<\/p>\n

\"PoC:<\/a><\/p>\n

PoC: How to identify phishing email<\/strong><\/h6>\n

 <\/p>\n

How to avoid email phishing scams?<\/strong><\/h3>\n

1. Implement strong authentication<\/strong>:<\/p>\n

Use two-way verification method. Even though your account credentials were stolen attacker will not be used that account for doing any criminal activity.<\/p>\n

2. Do not click on attachments:<\/strong><\/p>\n

You should not click on the attachments sent by any anonymous email id. It might contain malware that can damage files on a victim\u2019s computer, steal passwords or spy online activity without their knowledge.<\/p>\n

3. Deploy a SPAM filter:<\/strong><\/p>\n

Downloading a good spam filter is essential to catch phishing emails before they end up in an inbox and to prevent accidental opening of malicious attachments through an unwary user.<\/p>\n

4. Deploy a web filter to block malicious web applications:<\/strong><\/p>\n

A browser-integrated anti-phishing solution, such as SpoofGuard<\/strong> and PwdHash<\/strong>, could provide effective help by protecting against unauthorized IP and MAC addresses to prevent and mitigate online scams.<\/p>\n

5. Conduct training sessions with mock phishing scenarios:<\/strong><\/p>\n

In most cases, phishing attack requires user action to succeed so it is obvious to make the employee aware.<\/p>\n

 <\/p>\n

Conclusion<\/strong><\/h3>\n

Phishing is a form of social engineering attack used to collect personal, banking information etc. from the affected victim.\u00a0It is important to stay aware of the different phishing techniques and to keep your computer and internet browsers up to date with current antivirus and security patches. Be Safe!<\/p>\n

Author,<\/p>\n

Aniket Shinde<\/em><\/strong><\/p>\n

Attack & PenTest Team<\/em><\/p>\n

Varutra Consulting<\/em><\/p>","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":2966,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[140,270,277,293,266,273,271,294],"tags":[201,202,203,204,205,206,207,208,209,210,211],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t