Phishing first came to light more than a decade ago – and really took hold 2001 – 2003. After the world dealt with the Y2K mania – phishing was the new super bug.
Banks took out adverts in newspapers and other print media to warn their customers of phishing attacks. This endeavor was to try and educate their customer base to this new and emerging risk. These days, banks would hardly advertise the fact that they are the target of phishing. Though, last year in one of our emerging markets we surprisingly saw the same strategy of a local bank warning their customers against phishing in print media.
We are not actually sold on this idea of educating the customer as a fool proof method of phishing protection.
Cybercriminals still use emails to launch the social engineering component of a phishing or malware attack. Email content uses a ‘call to action’ such as a security update, web payment or refund to lure victims into clicking on the embedded link. Users are routed to fake web content or to download malicious attachment and executables.
Criminals can easily send such emails using a spoofed ‘from’ address to mask the spamming source. The spoofed source address adds to the legitimacy of the sender’s credentials and garners the required trust to trick the victim to act upon the social subterfuge. Spear phishing attacks can disguise email requests such as executive staff or a trusted trading partner. If a user receives an email from a known trusted or senior source, the user is much more likely to take immediate action.
All business networks will have some gateway and endpoint email security such as spam filtering and anti-malware protection, however, such emails can often bypass such controls, especially if the spam run is discreet, smart or launching a zero-day attack. It is well known and documented that such anti-virus and anti-malware products struggle to combat emerging threats.
Other messaging platforms such as SMS, online messaging services on social networks, instant messaging, whatsapp and skype can also be exploited to spread phishing attacks. Although other platforms are increasing in popularity, email still remains the primary vector to distribute phishing and malware content.
SMiShing attacks often leverage a trusted brand to route the victim to a phishing site. An alternative variant of SMiShing is where the spam message contains only a call back number. The message maybe as simple as ‘Please urgently call back xxxx xxxx xxxx to update your account details’ and there is no mention of a brand’s name. This type of SMiShing can easily reach a broad audience. The number may direct to a human voice – where our friendly criminal will answer the call, or it may often lead to an automated system where the victim is prompted to enter in credentials.
This type of SMiShing, where a brand is not leveraged, is harder for the business to monitor and detect as their brand is not mentioned in the message or attack. However, the bank may still end up with their access credentials / credit card details compromised.
SMiShing is prevalent in some countries where a new mobile phone number can be readily obtained, often with a lack of verification, or where mobile pay-as-go accounts are common. The use of fake IDs, credit card details can also be used by the criminal to obtain a mobile number. The portability of mobile numbers to alternative carriers may also assist the criminal in their efforts. In some countries, the telecommunication regulator mandates the ease of obtaining mobile accounts and the portability of those accounts which further assists the criminal in launching their attacks.
The source of SMiShing originates from the telco network but the outcome deeply affects other industries such as finance and banking. As the victim is often a non-telco business the motivation to help prevent this kind of SMiShing may be a little disparate. Often the real solution may take a coordination between the telco/bank with the involvement of the respective regulators.
