NESTA Crime Online - University of Brighton Repository

Phishing, now popularly labelled as a social engineering technique, 199 is a sophisticated
form of spam. Phishing involves attempts fraudulently to acquire sensitive information,
such as passwords and bank log-in details, by masquerading as a trustworthy person or
business, often from a bank. Bogus e-mails typically invite recipients to click on a link to
a fake bank website that has an authentic look. The aim is to lure the bank customers
into revealing their pin numbers and other bank account details. The stolen credentials
are usually directly sent to the phisher's e-mail address. Other organisations, such as
HM Revenue & Customs, are also impersonated in this manner with the same aim. Such
attacks have grown exponentially in the last three years.
Phishing attacks have become more sophisticated and daring as cybercriminals are
leveraging new technologies and inventing new forms of phishing. One example is
targeted spear phishing, which involves higher level skills than those required to send
bulk e-mails. Spear phishing is any highly targeted phishing attack in which a fake e-
mail is sent to all the employees or members within a certain company, government
agency, organisation or group. The message might look like it comes from an employer
or colleague who might routinely send an e-mail message to everyone in the company
(such as the IT administrator) and could include requests for user names or passwords.
Unlike traditional phishing scams which aim to steal information from individuals, spear
phishing scams are deadlier as they have the potential to gain access to a company's
entire computer system. It just takes one employee or group member to provide their
user name or password to open their employer or group to identity theft. Spear phishing
also describes scams that target people who use a certain product or website. 200
Another new form of phishing involves warning potential victims about phishing e-mails
as a way to legitimise that e-mail. They are then tricked into clicking on a link that leads
to a fraudulent site. Phishers continue to refresh and modernise their trade. For
example, over 400 phishing kits designed to generate phishing sites were targeting top
199 Social engineering is the practice of obtaining confidential information by manipulation of legitimate users.
Phishing is social engineering because it tricks people to divulge information, perform certain actions or
break security procedures. Trend Micro, (2008), Threat Roundup and Forecast—1H. London, p. 4. See also
David S. Wall (2007), Cybercrime, Polity Press, Cambridge. Social engineering is also explored in a
Whitepaper issued by ENISA (2008) “Social Engineering: Exploring the Weakest Link”, The European
Network and Information Security Agency.
200 Microsoft, www.microsoft.com/canada/athome/security/email/spear_phishing.mspx.
Page 66