Spear phishing: How the non-nerds hack into you

Interestingly enough, launching an unsophisticated cyber strike on a potential target does not require a PhD from MIT or even decades of experience coding malware or viruses.

One popular method that I am sure many have experienced is the concept of a “spear phishing” attack. Such an attack is straightforward and presumably easier than a direct attack against a computer network that would require greater knowledge, sophistication or risk. The basic idea is this: the hackers author emails that look extremely similar to a group or organisation you are a part of, and ask you to divulge personal information, click on something or download a file. One recent report noted that the US State Department received 27,000 spear phishing emails in 2012, up an amazing 42 per cent from 2011. The same report also noted the White House was subject to a spear phishing attack against one of its unclassified networks.

A 2012 report from TrendMicro provides some interesting perspective:

“Coined as a direct analogue to spearfishing, spear phishing makes the use of information about a target to make attacks more specific and ‘personal’ to the target. Spear-phishing emails, for instance, may refer to their targets by their specific name, rank or position instead of using generic titles as in broader phishing campaigns.”

Advanced persistent threat (APT) campaigns frequently make use of spear-phishing tactics because these are essential to get high-ranking targets to open phishing emails. These targets may either be sufficiently aware of security best practices to avoid ordinary phishing emails or may not have the time to read generic-sounding messages. Spear phishing significantly raises the chances that targets will read a message that will allow attackers to compromise their networks. In many cases, spear-phishing emails use attachments made to appear as legitimate documents because sharing via email is a common practice among large enterprises and government organisations – the usual targets of APT campaigns.

I myself have received many of these types of emails that attempt to deceive the end user into opening malicious files or hyperlinks. Many are poorly done and end up in spam boxes around the globe. However, some are very crafty. In one email, which I came very close to opening, the message was spoofed to look like an exact copy of a budget request from my then employer. The email address was exactly the same, the file attachment name almost exactly the same, and the type of file was what we used at the time for budget documents. I literally had my cursor over the document and was about to open it when I paused: it was sent three weeks too early. Upon further investigation, I discovered the original IP address of where the email was sent from was Argentina, and not from my employer. Nice try, hacker.

Considering the nature of such a threat, there is a lot that organisations can do protect themselves from such attacks. Depending on how the organisation functions, some that could be targets of such strikes should limit some forms of information that a would-be spear phisher could use to craft his or her attack. Email addresses of high-profile corporate employees or government officials should in some cases not be freely available on the Internet. If necessary, important officials who must have their email posted for marketing or PR reasons could utilise a separate email address for the general public, while utilising another that is given privately and harder to track down.

Organisations must also ensure that the latest software patches are applied quickly after they are available. Hackers many times will craft their tools based on vulnerabilities that have been recently announced, knowing many organisations take weeks or months to patch their software, if they do at all. One may also utilise the latest anti-virus programs that update themselves automatically every day.

But in the end, the best defence of all might just be common sense. If you receive an email from someone you don’t know asking you for personal information, delete it. If your employer is asking you in an email to reset your password by clicking on a certain link, give them a call – make sure it’s legitimate.

Also, keep in mind such attacks are not limited to email. They can come through social media networks as well, and attempt to hijack your social media account. One should also consider limiting the amount of personal or employment information posted to social media. All of this might help to dull the spear of such hackers, making their personal attempts at gaining access to the most private of information a failure.