NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
NESTA Crime Online - University of Brighton Repository
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Phishing, now popularly labelled as a social engineering technique, 199 is a sophisticated<br />
form <strong>of</strong> spam. Phishing involves attempts fraudulently to acquire sensitive information,<br />
such as passwords and bank log-in details, by masquerading as a trustworthy person or<br />
business, <strong>of</strong>ten from a bank. Bogus e-mails typically invite recipients to click on a link to<br />
a fake bank website that has an authentic look. The aim is to lure the bank customers<br />
into revealing their pin numbers and other bank account details. The stolen credentials<br />
are usually directly sent to the phisher's e-mail address. Other organisations, such as<br />
HM Revenue & Customs, are also impersonated in this manner with the same aim. Such<br />
attacks have grown exponentially in the last three years.<br />
Phishing attacks have become more sophisticated and daring as cybercriminals are<br />
leveraging new technologies and inventing new forms <strong>of</strong> phishing. One example is<br />
targeted spear phishing, which involves higher level skills than those required to send<br />
bulk e-mails. Spear phishing is any highly targeted phishing attack in which a fake e-<br />
mail is sent to all the employees or members within a certain company, government<br />
agency, organisation or group. The message might look like it comes from an employer<br />
or colleague who might routinely send an e-mail message to everyone in the company<br />
(such as the IT administrator) and could include requests for user names or passwords.<br />
Unlike traditional phishing scams which aim to steal information from individuals, spear<br />
phishing scams are deadlier as they have the potential to gain access to a company's<br />
entire computer system. It just takes one employee or group member to provide their<br />
user name or password to open their employer or group to identity theft. Spear phishing<br />
also describes scams that target people who use a certain product or website. 200<br />
Another new form <strong>of</strong> phishing involves warning potential victims about phishing e-mails<br />
as a way to legitimise that e-mail. They are then tricked into clicking on a link that leads<br />
to a fraudulent site. Phishers continue to refresh and modernise their trade. For<br />
example, over 400 phishing kits designed to generate phishing sites were targeting top<br />
199 Social engineering is the practice <strong>of</strong> obtaining confidential information by manipulation <strong>of</strong> legitimate users.<br />
Phishing is social engineering because it tricks people to divulge information, perform certain actions or<br />
break security procedures. Trend Micro, (2008), Threat Roundup and Forecast—1H. London, p. 4. See also<br />
David S. Wall (2007), Cybercrime, Polity Press, Cambridge. Social engineering is also explored in a<br />
Whitepaper issued by ENISA (2008) “Social Engineering: Exploring the Weakest Link”, The European<br />
Network and Information Security Agency.<br />
200 Micros<strong>of</strong>t, www.micros<strong>of</strong>t.com/canada/athome/security/email/spear_phishing.mspx.<br />
Page 66