Phishing: A Blot on the Infinite Possibilities of Digital Space

What is Phishing?

Phishing is a deceptive attempt made to extract sensitive and confidential information of the victim, such as username, passwords, and credit card details, by misrepresenting oneself as an authoritative entity in the digital conversation. These conversations can take many forms, such as e-mails, phone calls, texts, and others.

Why attackers use Phishing?

The hackers use this technique to access the confidential data by sending Spoofing E-mails and SMS that lure the user into entering his/her private information so that the adversary can use it to breach the account or the system. Apart from cyber warfare, phishing can also be used to inject a malicious virus into the system, to cause actual physical damage. For example: Although denied by both countries, The US forces, in collaboration with Israel, injected Iran’s Nuclear Enrichment facility with a virus called Stuxnet. This operation was undertaken to curtail the nuclear enrichment program of the Iranian regime. Stuxnet, by breaching the system’s code, destroyed nuclear centrifuges, thus crippling Iran’s nuclear enrichment.

The first Phishing accusation was recorded in 2004 against a teenager in California for creating a replica of a website named “America Online”. With the help of this forged website, he was able to extract credit card details of the users, to do online transactions.

Steps for Executing a Phishing Attack

1. A replica of the website is created.
2. The login page is modified, and a digital information stealing script is injected into the code.
3. All the files that are modified are zipped in a folder.
4. The folder is then uploaded to the hacked website and unzipped.
5. The victims are sent e-mails that contain links redirecting to the newly spoofed website.

Types of Phishing

The various types of Phishing methods have been discussed below.

Vishing

Vishing is a combination of voice and phishing. This type of attack is generally done via a phone call, and sound is the primary weapon of this threat. In this, the attackers call the victim and communicate with them confidently, as an entity of an authoritative organization, thus gaining their trust. After this, they try to acquire sensitive data from them.

Smishing

This is the simplest type of attack as the hacker sends a fake text message to the victim that contains a link for cancellation of an individual subscription or a similar lure that can help him gather the personal details of the victim.

Search Engine Phishing

In this phishing attack, a fake web page is created and is targeted by some keywords, so that the victim visits that phony webpage. As soon as he/she clicks the link, he/she is asked to enter their credentials to avail the offer, and they don’t even know that they are putting themselves in grave risk by sharing such information.

Spear Phishing

This attack is very harmful as the malicious e-mails are not sent in bulk, but to particular users only. The hackers do a complete research of the organization or a person, through their social media profile and company website and then only send e-mails, making them appear genuine and coming from a credible source.

E-mail Spoofing

It is the most natural type of carrying out phishing attack where the e-mails are sent to the victim from a sender, which appears to be genuine. It is a fraudulent activity undertaken by cybercriminals, to hide the origins of the e-mail. There is a call to action mentioned in the e-mail that makes the user click the link to view the document.

URL Phishing

In this type of attack, the victim is targeted to a specific page and is forced to share their details indirectly. The examples of this type are ‘Download now button,’ ‘click here link’ and ‘Subscriber Button’ as these contain the hidden links, and it becomes easy to trick the victim. The hackers even use tiny URL and also misspelled URLs that redirect the users to the attacker’s page.

How To Be Safe From Phishing And What Are Some Anti-Phishing Measures?

1. Be aware of all the emerging hacking techniques.
2. Think wisely before clicking on any links. These may lead you to malicious websites.
3. Check the security of the website before submitting any confidential data or while doing transactions.
4. Install a toolbar on the browser that alerts you if you come across any such website.
5. Check all your accounts regularly and keep the habit of changing the passwords.
6. Awareness is the key when it comes to preparing your organization for any phishing attack. The employees need to be trained to recognize and report all types of phishing attacks. They should be appropriately guided to follow the right approach when they receive a phishing message.
7. Be aware of the pop-ups as these can redirect you to another landing page. So instead of clicking cancel, you can click on small x button on the top of the pop-up.

Conclusion

With the advancement of technology and design of new security methods to prevent phishing attacks, the hackers are also improvising and finding new ways to trick the victims or, to break the vulnerable system. To prevent your confidential data from being misused, be aware of all the digital attacks, and be extra alert while sharing personal data with anyone.