-: Phishing.
Now, I know you know what phishing is
and I know we've talked about it before.
I even gave you a demonstration of phishing.
But we're going to cover it again really quickly
so we can talk about the different types of phishing
and how to sort them out on the exam.
The first one is phishing.
Phishing has become very commonplace.
Basically, a victim is contacted by email,
telephone, text message, or some other method posing
as a legitimate organization.
Now, when you see the word phishing on the exam,
I want you to think of email
because they have a distinct difference
for telephone and text messages.
Telephones are called vishing
and text messages are called smishing.
We'll cover those in a few moments.
Now, with a phishing email,
what they're trying to do is social engineer
and lure somebody into providing sensitive information.
Things like personal identifiable information,
their first name, their last name, their job title,
their phone number, maybe their social security number,
or their date of birth.
We might be trying to get things
like their banking information,
have them enter their credit card number
or their bank account number or their password.
All of this is stuff that can be gained
through a phishing attack.
Now, phishing is extremely popular
because it works and it works often.
So it's something that attackers use a lot
and it can be a great entry point into the organization
when you can't find other technical exploits.
Now, what does phishing look like when you get these emails?
Well, look at these two emails.
How do you know which one is the real one
and which one's the phish?
Well, the one on the left is the phish
and the way I know that
is because the wording is a little bit off.
They're trying to use scare tactics.
Notice they say "we've noticed a huge debit has been taken
"from your account over the weekend."
And so you might go, oh, no, quick!
I have to click on this link
and look at my Bank of America account,
put in my username and password, and guess what?
You just gave them your username and password
to your bank account.
Now, in my case,
I know the one on the left is a fake
because I don't use Bank of America,
so there's no way that my Bank of America account
could have had a large debit,
'cause I don't have one of those accounts.
Now, the one on the right,
this is a real email that I came from Bank of America.
You'll notice that it came from a trusted sender.
It was actually digitally signed by the corporation.
The English is very fluid and very natural.
But, again, I wouldn't necessarily want to click
that online verification button
because how do you really, really know
that the organization itself hasn't been attacked.
So the best practice to prevent phishing
is simply don't click on any links in emails.
If Bank of America has an issue
and I get one of these emails,
what I would do is go directly to Bank of America's website
and log into my account to see it directly.
I'm not going to click on one of these links in the email.
So that's the idea of phishing.
Now, spear phishing takes that and individualizes it.
So with the last example, they use Bank of America.
Why?
Because millions and millions of Americans
use Bank of America as their bank
and so if I send that out to just random email addresses,
chances are some of those people
are Bank of America customers.
Well, with spear phishing,
I really want to focus on creating a message tailored
to a specific person.
So, for example, if somebody was targeting me,
they may want to send me an email
asking if I wanted to do some sort of a business deal
that has to do with online training,
'cause that's the business I'm in.
Or maybe if I'm dealing with a CEO or a secretary
or a business manager,
I can craft an email that looks specific
to that organization
and something that they're going to want to open
or something they're going to want to click on.
It's very, very accurately targeted.
It's laser-focused.
Just like when you go spear fishing,
you're trying to take your spear and get through one fish.
With phishing, we're trying to cast a wide net
with the hopes that if we drag an area,
we catch a lot of fish or, in our case, a lot on victims.
So spear phishing, going after one
or just a couple of people.
Phishing, you're going after huge amounts of people.
Now, whaling. What does wailing do?
Well, whaling is focused on spear phishing,
but specifically at a high-level executive.
So these are your CEOs, your CFOs,
your CIOs, your CSOs, or other chief-level executives.
Why do they go after whaling?
Because they're big targets.
Just like if I wanted to go after somebody
and I'm trying to do some kind of a financial scam,
I would look for somebody who's got a big bank account.
Well, the CEO probably has a big bank account.
The other thing is a lot of these senior executives
tend to be a little bit lax on security
because they tend to be older
and not as comfortable with technology.
And so if you're going after some of these people,
it may be easier to get them to click on a link
or do something that is just not intelligent
when it comes to computer security.
And so this is another way
and another thing that you can do as part of your attacks
is going after those high-value people.
So, again, phishing, very large.
Spear phishing, one or two people.
Whaling, spear phishing directed at senior executives.
Now, the next thing we want to look at is smishing,
or SMS phishing.
This is short message service.
It's text messages.
People have left the email world
and they live on their phones,
so you may get a phish that comes over a text message,
something like this:
"Hey Paul, this is what I was mentioning when we met"
and they send you some sort of a Bitly link
or, in this case, the tapr.ml link.
And when you click on that,
it takes you to a website that may look legitimate
and you start putting in username, password,
or other information.
So, again, because smartphones are so ubiquitous in society
that everybody has one in their pocket,
you can get this text, you click the link,
it opens up a web browser on your smartphone,
and now you're entering data that you shouldn't be.
So this is another way
that you can start targeting the organization.
And this goes back to our information gathering earlier.
If we know people's cell phones
and we know who their name is and their position,
we can start targeting them
and even do spear phishing through text messages.
Now vishing, this is voice phishing.
Voice phishing is phishing that occurs over a telephone.
So this would involve calling somebody up
and pretending you're somebody else.
If we try to do it,
we're trying to trick somebody to go to a different website.
That's known as pharming.
All of these are underneath the big category
of social engineering,
because we're trying to trick a user
into doing something for us,
clicking on that link or giving us some information.
Now, when you're looking at it on the exam,
if they ask what is the act of tricking somebody
or deceiving them, that would be social engineering.
If they say tricking them through email,
that would be phishing.
Tricking them through text message, that would be smishing.
Tricking them through voice messages, that would be vishing.
Tricking them into going to bad websites,
that would be pharming.
And so if you keep those different categories straight
in your head, you're going to do great on the exam.