If it looks phishy…It probably is

A lot of phishing emails never get past their initial recipients because they’re so poorly worded, fraught with grammatical errors or transparently constructed. Most overseas hackers don’t quite have the native language command and fluency to really sound like the sender they’re impersonating. That said, their thinking seems to be that if they can’t make a good phishing campaign, they’ll make a bad one and send it out to a ton of targets and, as in sales, if you’ve got a low rate of return on a massive number of contacts, you’re still going to make some money on that campaign.

Now those phishing scams that are more successful (and there have been many in the last few months that have accomplished their malevolent goals, and with devastating effects), work precisely because they’re able to mimic the look, feel and tone of actual emails or messaging from the individuals they’re impersonating in a reasonably believable manner. It doesn’t hurt their cause that we, the potential victims are a) usually overworked and overwhelmed with too much to do in too little time, and b) not in the habit of thinking every email from HR or Finance is a potential ‘scam in sheep’s clothing.’

Sometimes the scammers are pretending to be a company (as in the recent FedEx scam), often a senior individual in your organization (as has been the case in many of the successful W-2 phishing scams we’ve seen this tax season) or someone from your personal contact list or social media who’s been hacked.

So to protect yourself from phishing attacks, the first action item is to educate yourself on the various types of attacks, and then to add layers of defense to your organization’s security, if you haven’t already.

Layer up, people!

As with all areas of both physical and cyber security, a layered approach is the most effective to successfully mitigate phishing (and other malware) attacks. It may appear at first glance that a phishing attack is purely email based, like the ones mentioned above. However, they can also (and often do) stem from social media, counterfeit or compromised legitimate web sites, or mobile device applications. To achieve the best possible defense, you and your organization require a cohesive solution that has at least the following components:

• Email filter – Configured to block phishing attacks, spoofed senders, malicious file types, and known bad files etc.
• Web filter – Updated in near real time for phishing emails, malicious URL’s, and known bad files that have been identified in recent emails
• Containerization – Configured to intercept unknown files and to place a containment wrapper around them before they are delivered to end points
• Malware sandbox – Configured to scan and analyze unknown files for malicious activity
• SIEM – Configured and tuned to provide alerts on suspicious activity
• End user training and awareness so that phishing emails can be identified and deleted even if they have made it through each of these layers of defense

Some common tips for you to avoid becoming a victim of phishing emails:

• Don’t reply directly to any suspicious emails that ask you to confirm or update any information about your account whether they be from a coworker, superior, bank, credit card company, etc.
• Don’t follow any links contained in suspicious emails, as they will most likely lead you to malicious websites that ask you to confirm your account information.
• Just as the IRS will never call you directly (they’ll send letters), legitimate businesses will never send you an email to ask for your login information or sensitive personal information
• Be on the look out for emails that try to convey a sense of urgency and are requesting you to “Verify your account” right away due to ‘suspicious activity’ or ‘reported fraud’ or the like.
• Never copy URL links from suspicious emails and paste them into your web browser.
• Be extremely careful about opening or saving any documents or attachments that come from possible spam mails.
• Never ever send your confidential information about any of your account in an email.
• If you’re unsure or suspicious about an email from a ‘friend’ or ‘colleague,’ roll over their email address.  Often this simple act will reveal some odd and unlikely root address.
• If you’re still unsure, call, text or email them from your contacts (in other words don’t respond to the suspicious email) to see if that really was a legitimate message.

Why are these phishing attacks so successful?

Phishing emails are one of the biggest threats contemporary technology users face, and are successful because they are leveraging the trust that commonly exists between friends and colleagues, or between consumers and recognized and trusted brands and companies. We the end users are relatively soft targets and can often be tricked by emails that mimic reputable sources like banks, retailers, social media contacts and credit card companies.

Another important issue helping allow successful phishing attacks to happen is the fact that traditional Security approaches are generally more reactive rather than proactive by design. Signature based detection is very easily bypassed even with the most recent updates thanks to minute changes to malware, and even with a malware sandboxing solution in place it is usually configured to allow files through to the end user before analyzing them. Patient zero is still infected before a malicious file has been identified and as we have seen over and over again it only takes a single point of entry to become totally breached.

How do you (the recipient of the email) as well as the IT department avoid becoming the next victim of a phishing attack?

All of the above listed technologies and precautions are needed to avoid becoming the next victim or conduit to a hugely damaging attack. The stakes are quite high and it only takes one or two users in an organization to be tricked into inadvertently downloading malware, or divulging their login credentials, financial and personal information — or a swath of employee or customer data, to put an entire enterprise at risk.

And the next time you see an electronic hook in your inbox, think before you bite.