Phishing

Phishing, one of the most common virtual attacks, a term that varies from English “fishing”, is the act of sending an email to a recipient, falsely claiming to be a credible source, like a company, in an attempt to get personal and important information, which will be used subsequently for undesirable purposes.

Thus, if users “take” the bait and click on the link, they are sent to another page where access credentials are requested. By providing this information, you are giving all your details to the attackers. Likewise, you can infect your device with a virus.

The concept under study arises from the combination of Phreaking + fishing = Phishing.

This type of attack consists of three phases:

1. The attack comes via electronic communication, such as email or phone;
2. The hacker pretends to be his identity, posing as a credible organization;
3. The objective is, then, to obtain personal and confidential information.

In this way, the method of operation is identical, a text is sent via email, social networks, sms or another vector, the purpose of which is to open a link, download the attachment, send confidential information, or even update information. personal information such as passwords, credit card numbers, bank accounts, among others, and sometimes payment is incited.

Phishing, for the most part, has the main purpose of stealing identity, data or money. There are still cases, usually more common on social networks, in which the hacker creates a false profile, creates a relationship with the victim and, after reaching the point he needs, attacks and obtains everything he wants. In this case, in addition to the financial and personal damage, there are psychological damages that lead to the victim’s lack of confidence.

Types of Phishing:

The most common method, usually containing links that lead to malicious websites or to download attachments that contain malware.

Also known as fake sites, as they are fake copies of real sites and are recognized as trustworthy. Thus, on these new sites, victims are coerced into entering their login credentials so that they can access their account.

It is the audio version of voice. Here, the hacker tries to convince the victim over the phone to disclose his personal information, believing that he is an accredited entity, so that he can later steal the individual’s identity. They can also make threats, scaring the victim, insisting on the sharing of data, not only personal, but banking.

Version via sms, where the victim receives a text message that requests the click on a link or the download of an application. However, when you take one of these steps, your personal information is diverted.

Phishing that corrupts the DNS (system that translates IP numbers into domain names), thus being users directed to a fake page, inducing the provision of confidential information.

Some hackers try their luck via social networks, creating chains for their network to continue sharing. Also, and as previously mentioned, fake profiles are created to be able to put the Phishing method into practice. It can also take the form of unmissable campaigns.

Phishing attack range:

It occurs when hackers disguise themselves as legitimate companies or individuals to gain their trust.

Attack without previous study, where a generic email is sent with a striking title, waiting for someone to open the email and / or click on the link.

Personalized Phishing Attacks for the purpose of targeting a specific individual or entity. This type of assault requires pre-existing knowledge, so that later on, they can combine all the information they have in order to create a credible email.

Phishing attack that targets a certain individual but that has a certain monetary value and in society, being considered of a high level.

Popular cloud services for this type of attacks. In this case, hackers activate fake versions of the login screens, stealing the victims’ identities when they enter their access information, thus having direct entry to all of their personal information.

Attackers duplicate a legitimate email, sending it as if it were a secure email. However, the links that came from the email were changed to malicious links, being disguised by real elements. Then, the individuals return to the original page without realizing anything. Thus, the phisher disguises himself as the victim in order to get more information from other people.

The links are changed, giving the impression that they will have a place when, in fact, they will have a questionable one. This trick is visible by including not only spelling errors, but also the display of the name of a trusted website.

Difficult to detect since it gives the illusion of being credible in all physical aspects. However, hackers exploit weaknesses in a website’s scripts in order to hijack it.

Someone claims to be a Nigerian prince or a member of the government, who needs help to transfer a large amount of money outside Nigeria. The email is marked as urgent or private and the sender asks the recipient to provide the account numbers so that they can save the funds. 419 suggests this type of attack as it refers to the Nigerian penal code for fraud.

How to detect a Phishing email:

• Grammatical or spelling errors;
• Strange links or suspicious attachments;
• Arguments that are alarming or that instigate curiosity;
• Messages that claim to come from banks, government entities, referring to credit cards, involving recent news or events, promises of revelations, prizes, rewards and inheritances, messages sent by mistake and involving social networks.

ActiveSys can help with security solutions so that Phishing is not a problem for you, through Information Protection and Management | ActiveSys – Consulting and Services, Lda and Security | ActiveSys – Consulting and Services, Lda.

ActiveSys keeps you informed and safe.

ActiveSys, we activate your business.