In this lesson,
we're going to cover different types of phishing attacks.
Now, understanding these attack vectors
is really important for penetration testers
because phishing remains one
of the most effective methods used by threat actors
to gain unauthorized access to our systems and our data.
So in this lesson, we're going to talk about phishing,
spearphishing, whaling,
Business Email Compromise, or BEC,
vishing, and smishing.
Now, phishing is a technique
where attackers send fraudulent emails pretending
to be from reputable sources
to trick an individual into providing sensitive information,
such as a username, password,
or credit card details to the attacker.
These emails often contain malicious links
or attachments too.
For instance, you may receive an email that appears
to be from a well-known bank,
asking you to click on a link
to update your bank account information.
This would be a classic phishing attempt.
Now, the link actually doesn't go to the bank's website,
but instead it leads to a fake website designed
to capture your login credentials.
Now, spearphishing is a more targeted form of phishing.
While traditional phishing emails are sent
to a large number of recipients,
spearphishing emails are crafted
and sent to specific individuals or organizations.
Attackers often gather personal information
about their targets to make their emails more convincing.
For example, instead of going after millions of people
who may use a large well-known bank,
we might go after a couple of dozen people who work
for a certain company
by using well-crafted spearphishing emails.
Now, whaling, on the other hand,
is going to take spearphishing even a step further,
and we're only going to be targeting high-profile individuals
within an organization,
such as the executives or key decision-makers.
These attacks are meticulously planned and executed
because the stakes are much higher.
For example, a penetration tester might create an email
that looks like it's from a legal advisor
to the company's CEO,
and it contains urgent information about a pending lawsuit,
and asking for sensitive data
or access to financial accounts.
Similarly, we might be able to spoof the CEO's email
and send an email over to the CFO,
or the chief financial officer,
appearing to be that it's coming from the CEO,
and asking them to transfer money
from one account to another.
Both of these are examples of whaling attacks
because we're targeting these high-level
or executive-level positions inside of an organization.
Next, let's talk about a Business Email Compromise, or BEC.
Now, a business email compromise
involves an attacker gaining access
to a legitimate business email account,
and using it to conduct unauthorized transfers of funds
or sensitive information outside of the company.
This often happens through social engineering
or through the use of a spearphishing attack
as the initial intrusion vector.
For example, an attacker might compromise the email account
of a company's financial controller,
and then send fraudulent invoices to its customers,
instructing them to make payments
to a different bank account
that is controlled by the attacker.
In this case, because they've taken over
that person's email account within the company,
it is considered a business email compromise.
Next, we have vishing, also known as voice phishing.
Now, vishing involves an attacker using a phone call
to trick an individual into divulging personal information.
This method can involve an attacker pretending
to be from a trusted entity,
like a bank or a government agency,
or someplace else entirely.
For example, an attacker might call a target claiming
to be from the bank's fraud department,
and ask them to verify their account details
to prevent a supposed fraud.
But when they give those account details,
they have now just given up the keys to their bank account,
and that attacker will now take money from them.
Another one we have is what's known as smishing.
Smishing, or SMS phishing, uses text messages
to trick individuals
into providing their personal information
or to click a malicious link on their smartphone.
These messages often appear
to come from legitimate sources,
like banks or service providers,
like your bank or Amazon
if you get a lot of things delivered through Amazon.
For example, a smishing attack
might involve a text message claiming to be
from a mobile phone carrier,
urging the recipient to click on a link
to update their payment information
to avoid a service disruption.
And because people are worried
about losing their cell phone service,
they might click that link to avoid service disruption,
and instead, they've now infected their phone with malware.
So remember, phishing attacks come
in lots of different formats, each one tailored
to exploit different communication channels
and levels of trust.
By understanding these techniques,
you're going to be better prepared
to recognize and mitigate these threats,
and ensure the security of your organization's systems
and data.
When you talk about phishing,
remember that phishing is the most generic,
spearphishing is more targeted,
whaling targets executives.
business email compromise, or BEC,
goes after getting an actual email account from your company
and using that as part of an attack,
vishing is using a voice or phone call,
and smishing is using SMS
or text messages to conduct your exploitation.