Phishing Email

WHAT IS A PHISHING ATTACK

Phishing is a type of social engineering attack often used to

gain access; steal user data, including login credentials and
credit card numbers. It occurs when an attacker, masquerading
as a trusted entity, dupes a victim into opening an email,
instant message, or text message. The recipient is then tricked
into clicking a malicious link, which can lead to the installation
of malware, the freezing of the system as part of a
ransomware attack or the revealing of sensitive information.
 Social Engineering

is an attack vector that relies heavily on human interaction

and often involves manipulating people into breaking
normal security procedures and best practices in order to
gain access to systems, networks or physical locations; or
for financial gain.
Why Phishing?

• Gain Sensitive Information.

• Gain Access

Effects for:

For Individuals – Unauthorized purchases, the stealing of funds, or identify theft.

For Corporate or Governmental networks - employees are compromised in order to bypass security
perimeters, distribute malware inside a closed environment, or gain privileged access to secured
data.

Major Effects in Organization

• Financial losses in addition to declining market share
• Reputation
• Consumer Trust.
• Might escalate into a security incident from which a business will have a difficult time recovering.
• Lawsuit
How Phishing Works
Phishing Statistics :

• 76% of organizations say they experienced phishing attacks in 2017.

• the average user was receiving 16 malicious emails per month. (Symantec)
• Email is still the #1 delivery vehicle for malware
• 92.4% of malware is delivered via email.
• 91% of cyberattacks begin with phishing email.
• Fake invoices are the #1 disguise for distributing malware.
• Business email compromise (BEC) scams cost organizations $676 million in 2017.

Most Common Disguises Used:

• Bill / invoice (15.9%)

• Email delivery failure (15.3%)
• Legal / law enforcement (13.2%)
• Scanned document (11.5%)
• Package delivery (3.9%)
Top 10 Most-Clicked General Email Subject Lines Globally in 2Q17:

• Security Alert (21 percent).

• Revised Vacation & Sick Time Policy (14 percent).
• UPS Label Delivery 1ZBE312TNY00015011 (10 percent).
• BREAKING: United Airlines Passenger Dies from Brain Haemorrhage –
VIDEO (10 percent).
• A Delivery Attempt was made (10 percent).
• All Employees: Update your Healthcare Info (9 percent).
• Change of Password Required Immediately (8 percent).
• Password Check Required Immediately (7 percent).
• Unusual sign-in activity (6 percent).
• Urgent Action Required (6 percent).
10 Most-Clicked General Email Subject Lines Globally (2nd quarter 2018).

• Password Check Required Immediately (15 percent).

• Security Alert (12 percent).
• Change of Password Required Immediately (11 percent).
• A Delivery Attempt was made (10 percent).
• Urgent press release to all employees (10 percent).
• De-activation of [[email]] in Process (10 percent).
• Revised Vacation & Sick Time Policy (9 percent).
• UPS Label Delivery, 1ZBE312TNY00015011 (9 percent).
• Staff Review 2017 (7 percent).
• Company Policies-Updates to our Fraternization Policy (7 percent).
* Capitalization and spelling are as they were in the phishing test subject line.
*Hackers frequently use email subject lines and messages that play into the human psyche of being popular or wanted
Phishing Related Notable Cyber-Attacks:

• 2014 Sony Pictures Attack

• 2016 $81 Million Bangladesh Attack ($1 Billion supposed to be)
• 2018 Sex Scammer Phishing Email

Notable Phishing attack on 2018.

GDPR-related phishing scams surface
“Leading up to the date the European Union’s General Data Protection Regulation (GDPR) came
into effect, the world inevitably saw the emergence of phishing scams attempting to exploit
confusion surrounding the Standard. As one example, researchers at Redscan detected an
operation which leveraged emails claiming to have originated from Airbnb. The messages
presumed the recipient was an Airbnb host and told them they could not accept any more
guests or send messages until they had accepted a new privacy policy that “is mandatory
because of the new changes in the EU Digital privacy legislation that acts upon United-States-
based companies, like Airbnb in order to protect European citizens and companies.”

Clicking on the acceptance link, however, led the recipients to a page that asked them to submit
their personal data including their financial details and account credentials.”
Tips to Avoid Phishing

Protect your Personal Information:

• To protect yourself from falling victim to a phishing scam, it's important to be very cautious with your
personal information including your usernames and passwords.
• Some phishing scams divert you to a fraudulent website designed to look like your bank's website or a
similar trusted source.
• When you enter your username/password and other information, that information is transmitted to
the attacker/hacker, who can abuse it later on.

Beware of Suspicious Emails and Do Not Click Suspicious Links:

• Be very suspicious of any emails you receive from trusted entities like your bank.
• If the email contains a link, don't click on it.
• Deceptive links that mimic legitimate URL addresses are a common tools con artists use in phishing
scams.
• While these addresses may look official, they usually contain inconspicuous differences that redirect
you to a fraudulent site.
• Instead of clicking on the link, type in the web address of the institution into the browser to access
the website.
• Be wary of pop-ups
Know the Common Phishing Language:

• Look out for common phishing language in emails like "Verify your account."
• Legitimate businesses will not send you an email to ask for your login information or sensitive
personal information.
• Also, look out for emails that try to convey a sense of urgency. Always be suspicious. Phishing emails
will try to freak you out with warnings of stolen information or worse, and then offer an easy fix if you
just "click here." When in doubt, don't click.
• Warnings that your account has been compromised, for example, are a common way to lure victims.
Again, contact the company directly to inquire about such emails rather than using any link or other
contact information provided in the email.
• Finally, be wary of any email that does not address you directly.
• While some phishing scams will use your name in the email, many are sent out as spam messages to
thousands at a time.
• Most legitimate businesses will use your first and/or last name in all communication. Check for poor
spelling and grammar. Big companies hire professionals to make sure their emails contain perfect
prose. If you're looking at one that doesn't, it's almost certainly a fake.
Tips on what to do if you suspect an email is a phishing email

• Don't panic or click on anything until you know it's legit.

• Notify the company that's being impersonated
• Share on your social media channels
• Call your friends and family
• Inform IT of your Organization

Tips on what to do if you suspect an email is a phishing email or have clicked/downloaded

url/attachment?
• Don’t Panic
• Disconnect device
• Inform IT/Immediate Superior
• Change password
• Scan computer for viruses
• Forward the phishing email to IT
• Contact Credit Card/Financial Companies
• Check accounts regularly
Thank You