Things You Didn’t Know About Phishing

The most known thing about phishing is that it is the name given to those who hack people’s bank, credit card, or virtual accounts and defraud them. Phishing is a form of cybercrime. Phishing attacks pose a great threat individually and institutionally, as they prepare the infrastructure for other cyber-attacks.

How Does the System Work in Phishing?

 Fraudsters direct you to a normal-looking site via email, instant messaging, and text messaging. In fact, you are directed not to that legal site, but to a fake website that matches the style of that site, and when you are directed to enter personal information on that site, your information is now in the hands of virtual fraudsters. The trick here is that the phishing e-mail is viewed as coming from an official institution or as a real e-mail. In this way, the attacker captures your passwords and empties your bank accounts with the information obtained. Even worse, by running the files attached to these e-mails, your computers can fall into the hands of the attacker and come under the control of the attacker.

Baits Used in Phishing

They use social engineering techniques such as phone, gift, free vacation, cash prize, discount, health insurance, terrorist organization connection, covid test warning. Phishing is done not only by e-mail but also by phone calls and social media messaging applications. These attacks are called “vishing” if they are made by phone, and “smishing” if they are made by messaging.

Who are phishing attacks against?

Phishing attacks are sent to a large number of randomly selected recipients. Sending it to many people increases the success rate. While it threatens to be defrauded for individual users, it can lead to bigger threats such as ransomware attacks for companies.

When Did Phishing Attacks Begin?

The Phishing Attacks mentioned in the statement submitted to Interex, the 1987 International HP Users Group, are said to have been invented by Khan C. Smith. Hackers and pirate software dealers established a community called warez in America Online (AOL), which they use as a communication network. This community, which uses algorithms to steal users’ passwords and generate random credit card numbers, made a hit profit in the first place.

They were baited those who entered their account information to open their AOL accounts through special programs. This phishing continued until security measures were taken by AOL in 1995.

In 2001, online payment systems were targeted. The first attack was on the E-Gold2. In 2003, eBay and PayPal accounts were imitated, and e-mail worm programs were asked to update information from customers, which was the beginning of new phishing.

In 2004, banking sites and their customers were attacked. The release of Bitcoin and other cryptocurrencies in late 2008 made cyber fraudsters safe and anonymous. While Cryptolocker ransomware infected 250,000 computers in 2013, the seller email security breach emerged as a new type of attack in 2019.

Malicious attachments and links to malicious websites are tools that attackers use in attacks.

What Information Is Stolen with Phishing?

Bank account numbers, credit card number (expiration date and CVV code), username and password, social security number, phone number, e-mail, social media passwords and usernames, confidential question answers, data of an institution.

The Importance of Phishing Attacks

Parallel to the widespread use of the Internet, the circulating of all information on the Internet has caused cyber attackers to set their sights on targeted attacks.

The target is to bait unaware users through phishing methods because when these attacks are targeted, the success rates increase. Phishing attacks, which are the oldest and most effective cyber-attack method throughout the history of the Internet, threaten individuals and institutions as cyber weapons.

The importance of phishing attacks, which reach large masses with the popularization of social networks, comes from the fact that they are very dangerous.

Types and Methods of Phishing Attack

Phishing is not an attack on its own but turns into a terrible weapon with social engineering methods and other attack techniques. The attack methods vary according to the techniques used in these attacks.

1) Spear Phishing

Spear phishing is a type of attack that focuses on well-known people or institutions. It is prepared individually or for an institution. The attacker gathers information about the victim and persuades him to visit a malicious website or download a malicious file and it usually does this with a message.

2) Whaling

It is an attack that targets high-profile employees of institutions such as CEOs or CFOs.

3) Catphishing / Catfishing:

 These are phishing attacks on social media. An attacker creates a false identity and targets a victim. Its purpose may be to provide financial gain, or it may have other purposes.

4) Clone Phishing

Clone phishing is a type of attack with a cloned email. The attachment or link inside the email has been replaced with a malicious version and appears to be from the original sender. This attack is most common on audit firms and accountants.

5) Voice Phishing

Users are asked to dial a phone number by messages without a fake website. When this phone, which belongs to the phisher, is called, the information from the users is passed to the attacker. The target is clearly determined, and the victim is reached directly. It is an attack using emotional triggers. Fear and curiosity are triggered.

 Today, phishing attacks have evolved into a highly automated process involving multiple people with well-defined roles, and attacks have increased. 

6) SMS Phishing

It is an attack using mobile phone text messages. Smishing attacks invite the user to click on a link, call a phone number, or refer to an email address provided by the attacker via SMS message. These messages may come from a strange phone number.

7) Watering hole attack

In a watering hole attack, attackers identify the websites that users frequently use, find their weaknesses, and place harmful codes on those sites.

7) Phishing with Fake Mail

It is a type of attack that impersonates legitimate companies or individuals and offers links in emails that direct victims to harmful sites. Attackers flood pages with trojan horses, keyloggers, and other malicious code that steals personal information. Some sites can send fake mail even over the Internet. 

8) Phishing with Domain Name Similarity

 It is a type of attack by redirecting traffic to fake websites by using domain names that are spelled in a foreign language, have spelling mistakes, or are written with slight differences in domain names.

9) Pharming

It is an attack based on poisoning a DNS record and redirecting visitors of a legitimate website to a fake website. The user is vulnerable because they are not in control of their DNS records. It is the most dangerous type of attack.

Although it is a type of phishing, its mechanism is different. In phishing, the user makes a mistake, while in pharming, the attacker directs.

10) Website Redirects

It is based on the principle that users are directed to a different site from the site they want to visit.

11) Phishing with Link Manipulation

Link manipulation is the technique where an attacker sends a link to a malicious website. When the target clicks on this link, it opens the phisher’s website instead of the website specified in the link. Hovering the mouse over the link can work in this attack.

12) Imitation and Gift Sweepstakes

It is another phishing method applied by imitating celebrities on social media. The attacker can advertise sweepstakes to followers. Platforms like Slack, Discord and Telegram are the best targets for this attack.

13) Advertisements

It is an attack made through fake advertisements. It is used to steal sensitive information such as login information to your exchange account.

14) Malware

It is the type of attack in which phishing attackers infect you with malicious software with malicious applications. These applications, which seem like crypto-related tools, can easily infect your computer if it is not protected well enough. Through malicious software that descends on your computer without your being aware of it, pop-up screens begin to appear on your computer all the time.

15) Phishing with Click Jacking

Click Jacking is a method that directs people to different places with other pages embedded under the website that was clicked. Malicious software that hides in game sites, music streaming sites and directs you to click are examples of this.

16) Phishing with the Hosts File

The hosts file is the file that controls the internet traffic on the computer. With this method, the attacker can redirect you to different sites.

17) Phishing by Changing System Settings

It is a phishing attack made by changing the saved information and settings on your computer.

18) Phishing with Session Hijacking

The moment you log in to a website with your username and password, your information is saved in cookies. This is a phishing attack by the method of hijacking and replacing cookies.

19) Phishing with Man-in-the-Middle Attack (mitm)

It is an attack that transfers from the HTTPS site to the HTTP site. In this way, it is ensured that information such as username and password are entered over an insecure connection.

20) Phishing with Session Riding

It is similar to the “Session Hijacking” attack. The difference is, no information belonging to the victim, such as cookies, is stolen here. The attacker has a link prepared for the victim. The action takes place when that link is clicked.

21) Phishing with JavaScript

There are a lot of phishing methods using JavaScript. Usually, a pop-up window opens, and you click on it with a moment of carelessness.

22) Phishing with XSS

On a website with XSS vulnerability in this phishing type, a text can be shot on the screen, a picture or web page can be opened, or your cookies can be stolen.

23) Phishing with XSS Tunneling

It is a phishing method in which the attacker can dominate the victim’s browser.

24) Phishing with Visual Methods

When you click on the images and texts in the pop-up window placed on the websites by the attacker, you activate the malicious software. Embedding a Trojan on Facebook is one such attack.

25)Phishing with Tabnabbing

It is the newest method. The attacker lures you into the trap first. Then it gets all your information while you run your business in different windows.

Common Features of Phishing E-mails

1) They give the impression of an emergency and make it panic.

2) Traps are set up with bridges.

3) Attachments are used in the attack.

4) They are too well designed to be true.

5) Comes from unknown sources. 

How to Detect Phishing Attacks?

• Be sure of the incoming address.
• The display URL and the URL of the legal company must be the same.
• Check before clicking on the redirects in the mail
• Spelling rules and other language rules are generally not seen in attacks. That way you can tell if they’re not real.

HOW SHOULD WE PROTECT FROM PHISHING ATTACKS?

• Individuals and institutions can be trained to recognize attempts at phishing attacks.
• Special spam filters can be used.
• Browsers can be used to warn users of fake accounts.
• Do not save your bank and institution passwords on your computer and do not use the same password.
• Notify browsers of web pages and emails that you suspect of phishing attacks.
• Use a multi-factor authentication system.
• Be sure to use an up-to-date antivirus program on your computer.
• Delete e-mail messages from people you don’t know
• Never make electronic transactions on networks that you do not trust.

You can contact us 24/7 for any PHISHING ATTACKS issue.