We've been getting more and more reports of data breaches resulting from email attacks. It's important to know how to identify when you’re being targeted and how to reduce the chances of becoming a target. Please read below for some helpful tips on what you should be looking for.
The number one threat right now is "spear-phishing" attacks. The term "phishing" refers to someone posing as a trustworthy entity in attempt to acquire sensitive information. Spear-phishing is the same thing but directed towards a specific target. In a spear-phishing attack, a hacker will decide what data they are after, then figure out who has access to that data and specifically target those people. For example, LinkedIn is a great source of information for hackers during the targeting step. Another source of useful information for hackers is public job postings. When job descriptions mention specific security systems it helps hackers to identify what they might be up against in their attack and plan around it.
Spear-phishing scenario
You get an email from the email address of your significant other that has in the subject line: "Honey, I had a little accident with the car, and in the body: I made some pictures with my smart phone, do you think this is going to be very expensive?" So, you click on what you thought was a picture of the damaged car but instead it installs a keylogger on your computer which then sends every keystroke back to the hacker every hour. Imagine the info they might collect in just one hour. . . usernames, passwords, credit card info, bank accounts, etc.
Recognize email threats
Email threats come in many forms. Here are some email characteristics to look out for:
- From an entity you are not familiar with.
- From an entity that you know but the email seems unusual or out of character.
- Email is a reply to a message that you never sent.
- Email is asking you to click on a link.
- Email contains bad grammar and spelling errors.
- You were CC'd on an email but don’t personally know the other people that it was sent to.
- Email was received at an unusual time of day, like 3 a.m.
- Email includes an attachment that isn’t related to the message.
- Email contains hyperlinks that, when hovering over them to see the URL, the URL is misspelled or is to a different website.
Limit your exposure
Limit your exposure online by using caution when adding your email address and/or job title to your social networking profiles. Also, remove references to any specific security systems you use in your organization.
Brian Brimm
Director of Support Services
Center for Computer Resources, LLC
