Phishing is a very specific kind of social engineering that
takes advantage of misdirection.
It makes us appear that we are logging
into our Paypal account, that we're were logging
into our bank account, that we're
logging into our email account.
But, in reality, we're logging into a page
that has nothing to do with PayPal.
It has nothing to do with our bank.
And it has nothing to do with our email.
You'll usually get a message in your email that says,
we've detected some unusual things
happening on your PayPal account.
You should log in right now.
Click this link.
And let's make sure you're adding in information
and confirming the information that's in your account
is correct.
But the reality is, when you click that link,
you're actually brought to a page that looks exactly
like PayPal.
But the reality is, it's on another site.
I blurred it out, so you would not see what the site is.
But you can see this is definitely not a Paypal.com
address that you can see here.
It does have the word Paypal.com in it, though.
So if you aren't familiar with this,
you might be taken aback a little bit,
initially, for seeing this message that
pops up, warning you.
But you may want to go right to this site and log in.
And it says Paypal right there.
So let's go log in and make sure everything
is OK with our account.
But don't be fooled by this.
Usually the URL is going to tell you
that this is definitely not Paypal.
You should look for that Paypal.com or your website.com.
In fact, what you should do is never
click a link inside of an email, never
click a link inside of an instant message.
If you get a message that says, we
think there's a problem with your account,
open up a browser window, type the name of your bank
into that browser window, and go there directly.
That way you can be sure you are going to the right site.
In fact, with this particular site,
you'll notice that this looks very similar to Paypal.
Everything is almost exactly the way it should be.
But notice there is something that is a little bit off.
You may find that certain images don't load.
Or you may find that, say, there's
a misspelling on the page.
That's very, very common for some reason,
to find misspellings in the email that's sent to you
and to find misspellings in the page.
This one does not have any misspellings, I don't think.
This one is very, very well done.
It looks just like PayPal.
More and more, though, this is done over the phone.
People will call you and say, we understand
there's a problem in your account.
We've been looking at your purchases and your credit card.
We think there are problems with that.
Let's confirm this.
Can you give me your credit card number?
Thank you very much.
Now, can you give me the last four digits
of your social security number?
Why, thank you so much.
Now, tell me more about your family life
and what your mother's maiden name might be.
So the vishers, we call them, which is phishing over voice,
over the phone, have gotten very, very good
at the social engineering aspect.
And we trust the phone a lot more
than we trust what's on the web sometimes.
But don't be fooled.
These people are really out to get your personal information.
Here's the same Paypal page, blown up,
so you can really see it.
And, boy, it looks really legitimate.
It looks exactly like my Paypal site.
There's nothing about this that would
make me think that this is unusual,
except for the URL that's up here.
And that's really the thing you should be looking for,
is to determine, is this really a legitimate site?
Or is this something that's trying
to fool me into typing this in?
And that's the reason you'd never
a click a link in an email and never click
a link in instant messaging, even
if it is a legitimate message from Paypal.
I don't click those links.
I make sure I go directly to the site, by opening my browser
and typing Paypal.com right here on the top.
Traditional phishing just throws a net out there
and tries to catch whatever it can.
Sometimes you're catching a big fish, but more often than not,
you're pulling up the tiny little fishes.
You're pulling up an old tire or a rusty can.
And if somebody was to get my Paypal information,
they would find, this wasn't really worth my time.
So what the bad guys are doing is
something called spear phishing.
They're going after the really big gets.
They're really focusing their efforts
on getting a particular amount of information,
particular logins to financial sites,
or something that really, really interests them.
And by doing this and getting a little bit of background
information, they can make their emails more believable.
They can add real-world information into them,
add friend's names to the list, and be
able to make you think that this really came from a friend,
therefore, you should trust it.
If you were to spear fish the CEO, you'd call that whaling.
You're going after a really big fish
and trying to get something good out of that.
Some examples of this, in April 2011,
there was a company named Epsilon.
They handle emails, sending out a lot
of emails for third parties.
They had less than 3,000 email addresses directly
attacked inside of their organizations.
So somebody knew the internal email addresses for Epsilon
and started sending a bunch of emails internally.
They really hit 100% of the operation staff.
Because they knew if they got access to the operations
logins, they would have access to the entire database of email
addresses and, in fact, they absolutely did.
And they were able to get millions ' of email addresses.
Now, initially, you think, big deal,
they've got millions of email addresses.
But, the reality is, they're now going
to use those to send additional phishing attacks
and try to get additional information from there.
When they send a message into a particular group of people that
had them click a link and that link
downloaded anti-virus disabler.
It loaded a key logger.
It loaded a back door that got a remote administration
tool on it.
And then they started gathering a lot more information.
It seemed like a legitimate login page.
They logged in and, ultimately, they were infected.
But what if it isn't emails?
In also April 2011, Oak Ridge National Laboratory
was hit as well with a phishing attack,
a spear phishing attack.
It was an email that was sent.
And the From came from the Human Resources Department.
Boy, if I saw an email from the Human Resources Department,
I'd want to open that up.
And it said, you need to log into your HR account.
You need to make sure that your benefits, or something
of that sort, were available.
You can send all kinds of interesting things
in an email from the HR department.
It targeted only 530 employees.
And there were 57 people that clicked on the link.
There's probably another story here about why
all of these other people didn't read the emails from the HR
department or didn't feel that they needed to click,
maybe they were trained very well,
not to click links inside of their email, but 57 people did.
And, of those 57 people, two machines
were not updated with malware protection.
They were infected.
They went to the site.
They logged in and immediately were infected.
Data was downloaded.
Servers were infected with malware from there.
This was a big problem, because the Oak Ridge National
Laboratory performs research on nuclear testing and other types
of research for the federal government.
So once you get those two machines infected
inside that organization, now it can
start hopping around and doing other things,
because the security on the inside of the network,
generally, is much more open than the security
from the outside.
So you get that malware inside the organization
and, in this particular case, information was stolen.
This becomes a big issue for organizations
that want to be sure none of their internal information
gets out.
And, from the point of a spear phisher,
they're going to focus on those particular users,
make it very, very believable, in the efforts
that they can get inside, get infected on those machines.
And now they have access to a lot more information.