Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
What is spear phishing, you ask? Long story short, it’s a phishing technique that plays on the victim’s trust or, rather his gullibility. Spear phishing attacks are surgical, while general phishing attacks are more like “let’s cast this lure in the puddle and see what bites.” So, without further ado, let’s dig right into it. FYI: in this article, I’ll be covering the difference between spear and whale phishing and how to protect your company’s digital assets against them.
What is Spear Phishing?
Spear phishing can be defined as an email spoofing attack that targets very specific and very ‘employed’ individuals. As Aaron Ferguson, an NSA agent and West Point Professor, noted, spear phishing attacks are directed against an employee or an organization.
What makes them so successful? Spoofed emails used in the attack look like they’ve been sent by well-known market actors such as PayPal, Google, Spotify, Netflix, and even Apple Pay.
How Does Spear Phishing Work?
Spear phishing usually takes the guise of in-house emails, asking employees to fill in credential requests. Why would someone be willing to share his/her credentials via email? Well, think of it this way: how likely are you to nix an email from your CEO, asking you to share your password and user because you’re far behind on your deadlines?
To further enforce the illusion, these spoofed emails use the moniker of an authoritarian figure (CEO, CTO).
And yes; the unaware user will click on any link, share any details, no matter how private they are, and will go on thinking that he dodged another bullet. Unfortunately, that reply will never reach your boss; it will only end up in some hacker’s database who will have complete access to the company’s records.
Still, why is spear phishing so successful?
Because the ‘spoofer’ really does his homework. Before launching the spear, the attacker will try to gather as much info as he can about his victim: name, work address, company’s profile, position, phone numbers, emails. When he has enough info, he will dispatch a cleverly penned email to the victim.
To show you just how effective these attacks (which are also called the ‘colonel effect’) are, I’m going to quote Ferguson’s example.
Ferguson, who’s also a West Pointer, wanted to find out just how knowledgeable the cadets are when it comes to cybersecurity. The teacher sent out some 500 emails to his students, but they appeared to have been sent by a certain Colonel Robert Melville from the same academy. In these emails, the ‘colonel’ wrote that the cadets can peek at their exam results by clicking on the enclosed link.
Naturally, nothing happened if they clicked the link. Instead, they would receive a follow-up message reading: “you have been spoofed. During this time, your computer could have been infected with trojans, viruses, or ransomware.” Seems like a harmless enough experiment, but the numbers paint an entirely different picture: 80% of cadets clicked on the bogus link.
Spear Phishing and Whaling vs. Phishing
Source: IT-seal
There’s a huge difference between spear and whale phishing. While the first targets the ‘weakest link’, the latter is aimed at the big chief himself. Whale phishing attacks are designed to siphon confidential info from high-profile individuals such as chiefs of staff, C-level executives, celebrities, politicians, senior officers etc.
The technique’s more or less the same – spoofed emails sent from trusted sources. Still, compromising a high-profile target isn’t as easy as stealing data from a gullible employee. In this case, the attacker will also employ some social engineering tricks in an attempt to gather intel on his target.
Probably the best whale phishing example is the 2016 Seagate affair. Yes, the very same company that’s ‘responsible’ for your Barracuda hard drive had a major data breach three years ago after an HR officer sent out copies of employees’ 2015 W-2 tax forms, as requested via email by CEO Stephen Luczo.
Thinking that the email came straight from the “horse’s mouth”, HR sent out the tax records copies. You can very well imagine what happens when someone shares very sensitive financial info on some 10,000 employees. Once upper management got wind of this data leak, they notified the authorities. No word so far on what became of the stolen data or the person(s) behind this attack.
Whale phishing attacks are more common than you think. During the same year, two other whaling attacks occurred – one of them involved Evan Spiegel, Snapchat’s CEO, and the other FACC, a plane manufacturing company that ‘incidentally’ works for Airbus and Boeing.
What about phishing, then?
Phishing is the generic term used for the attacks that imply cybercriminals trying to gather sensitive information (credit card data, usernames and passwords, etc.) from users.
Apart from spear phishing and whaling, another interesting phishing approach is the… rose phishing, although it’s not as common as regular or spear phishing. It may sound rather outré, but this type of scam has been around since like forever. Remember the ploy with the sickly father/uncle/brother and someone reaching out for cash? It’s basically the same thing; the only difference being that everything’s done online.
So, how does this work exactly? Well, let’s assume for a moment that a hacker wants access to your PayPal account. Bear in mind that rose phishing is taking the high road, lots of cloak-and-dagger stuff.
Now, the hacker will first attempt to gather as much info as possible about you: tastes in music, clothing, favorite hangout places, and, most importantly, friends. After the ‘recon’ phase, the hacker will then try to get in touch with your close friends, posing as a distant relative, high school crush, or whatever. Of course, he’s not even remotely interested in establishing a rapport with any of them; he’s just looking for a way to reach you.
What does happen once the scammer gets in touch with you? Well, he will do everything to earn your trust. And when I say “everything”, I mean just that. Some are pretty good – sharing their sob life experiences, others may even say they fell in love. Once they gain your trust, they will ask for some sort of favor – like their Facebook page (which is obviously spoofed), ask for a small loan, donation, and so on. We both know how this story ends, don’t we?
Think about it this way: phishing is like throwing a net, hoping to catch something; spear phishing’s like using a rod, and whale phishing is, well, like going full Ahab on someone.
Let’s elaborate: phishing is when you send out hundreds or thousands of spoofed emails, hoping that some unfortunate soul will open them, follow the link to the credential-grabbing website. Spear phishing, on the other hand, is where you add a dash of finesse to the whole scamming gig – no more flying in blind; you hit, grab, and scoot.
Spear phishing attacks take some time to prepare and deploy, but they’re not that uncommon as one might think. Anyway, my giveaway to you is this: if it’s generic, then it’s simple phishing.
If you one day fire up the work email and see an email from your boss telling you to transfer money to some off-shore gig, then it’s spear phishing. Last but not least, if you’re part of the upper-class and you receive a message begging you to give, submit, or remit, then it’s whale phishing at its finest.
Spear Phishing Examples
Alcoa
For those of you unfamiliar with the name, Alcoa is one of the world’s biggest producers of aluminum. With a business that spans 10 countries, the company makes for one tantalizing trophy. And, as fate would have it, the one who cracked open Alcoa’s treasure trove of industrial secrets was…the Chinese military.
Yes, I know that it sounds like something out of a James Bond movie, but the facts stand true. In 2008, a group of hackers hired by the Chinese military send out some 5,000 spoofed emails to various Alcoa employees. Without even flinching, all employees opened the email.
They didn’t even have to click on any links – once the recipient opened the email, the malware was installed on the computer. A couple of seconds later, the company’s closely-guarded secrets fell into the hands of the Chinese military.
PayPal’s Locky wacky ransomware attack
This wouldn’t be the first time PayPal customers are duped into opening spoofed emails. In an article I wrote a while back, I pointed out that it’s a very common scamming tactic to send out bogus emails to PayPal account holders; usually, the buyers take the bite, but it can happen to sellers as well.
Anyway, as for the Locky ransomware email campaign, back in 2016, around 100 million Amazon customers woke up with their PayPal accounts hacked after opening an email that was reportedly sent by Amazon.
If you’re wondering about the email’s content, well, apparently, it had a generic, ‘Amazonesque’ text like “Your Amazon.com order has dispatched” followed by a random code. However, if one was to scroll down a bit, he would have found that the email had a peculiar attachment: a word document. Sure, the attachments won’t bat an eye, since it’s only natural for an email to contain a doc detailing the transaction. Guess what happened if someone attempted to download and open the document?
RSA
This one’s a little ironic since it happened to a company that provides online security services. In 2011, a scammer sent forged emails to all employees. Of course, the spam filter identified and flagged the message and sent it to where it belongs.
However, one overzealous employee stumbled upon the scam mail while searching through the spam folder. Unfortunately, that brief moment of weakness took a great toll on the company’s reputation.
Ubiquiti Networks Inc
Around 2015, several Ubiquiti Networks employees received emails from what appeared to be senior execs. As the story goes, the persons posing as managers asked their employees to funnel funds to a Hong Kong subsidiary, which was supposed to have been managed by a third party. Of course, the money never reached the subsidiary’s account since the emails were spoofed. An incident report indicates that the company lost about $40 million.
Epsilon
In 2011, Epsilon, one of the world’s leading data-driven marketing platforms, had to face its “mid-life crisis”. Thousands of customers were tricked into opening spoofed emails linking to bogus websites, all of them laden with malware. At that time, reports revealed that the Epsilon spear phishing campaign might have been a diversion for a much larger operation. Subsequent analysis revealed that the malicious website downloaded malware in the background that could do anything from providing remote access to disabling antivirus software.
5 tips to avoid spear phishing attempts
Source: Mozilla
CONTINUOUS CYBERSECURITY EDUCATION
Remember that scene from the Conjuring movie where Lorraine says that knowing what evil is called gives you power over it? It’s the same with phishing. Nowadays, it’s really not enough to hire an entire IT department to take care of your company’s cybersecurity. There’s not much anyone can do if, say, one of your employees decides to pop open a suspicious email.
So, if you’re a business owner, turn cybersecurity ‘awareness’ into a routine; it doesn’t even need to be that frequent. Once or twice per month is more than enough. Try using some printed handouts, perhaps even short video presentations. What’s the purpose of all of this? To teach your employees that opening suspicious email attachments is really not okay. You should also let them know the difference between regular phishing, rose phishing, and spear/whale phishing.
Don’t forget about the most important cybersecurity lesson: it only takes one weak link to make the entire chain break apart. Recall the Seagate affair? One misinformed HR officer sent the entire company in a downward spiral.
If you’re a home user, you can always look out for new resources on how to better protect your devices. Check out our educational section for antimalware tips and tricks.
DEPLOY A PROFESSIONAL ANTIMALWARE/ANTI-FRAUD NETWORK. AI FOR THE WIN.
I really don’t think there’s anyone out there who would risk losing everything just because he doesn’t want to spend a couple of bucks on an antimalware solution. With companies, it’s also a matter of upscaling and going pro all the way.
Most AM/AV suppliers offer tailored enterprise services. When choosing something from the market, you should keep in mind that signature-based antimalware solutions are obsolete, since they’re unable to compete with malicious loads backed up by rogue AIs.
So, if you’re looking to bolster your company’s cybersecurity, be sure to choose an AI-powered one. It’s even better if it employs heuristics search engines based on machine learning techniques. Remember that only a well-balanced AM/AV solution can protect you against online fraud attempts, spear phishing included.
STAY ON TOP OF YOUR EMAIL ACCOUNTS
Probably the best way to safeguard your endpoints is to continuously monitor your accounts’ activity. Look if the spam filters are up and running and doing their job properly. If you see anything suspicious, don’t think twice before deleting or sending it to the spam folder. Doesn’t matter if you have a personal, business, work, or work email account; any one of them can be hit by malware.
FULL-THROTTLE YOUR DMARC
DMARC, which stands for Domain-based Message Authentication, Reporting, and Conformance is a sender/receiver protocol capable of figuring out if a message comes from a legit source or not. To deploy DMARC, you will need the Sender Policy Framework (the protocol that checks out email servers) and DomainKeys Identified Email (checks if the email has an embedded encryption key). Check with your AV/AM provider to see if your cybersecurity solution also covers DMARC standards.
MULTI-FACTOR AUTH WHENEVER POSSIBLE
If your company’s using several accounts, you should think about deploying multi-factor authentication solutions. Think Gmail’s 2FA. Yes, it may not be that Fort Knox-like security you were looking for, but an extra layer of protection doesn’t hurt. As for multi-factor auth, you can either go with digital tokenization or stick with physical keys just like Google’s Titan. Also, if you’re going to use 2FA from now on, you should definitely refrain from recycling passwords.
Heimdal® Email Security
Wrapping Up
Any takeaways? Don’t get hooked – I think that’s perhaps the most important lesson one needs to learn. Keep in mind that scammers are always looking for ways to get to you, whether it’s through phishing, whaling, or spear phishing.
Do you have any interesting spear phishing stories to share? I can’t wait to hear about them.
