COVID-19 Fake Websites and Phishing Scams

A brief overview of COVID-19 Fake Websites and Phishing Scams

Transcript

1. COVID-19 Fake Websites and Phishing Scams
2. Purpose The purpose of this training is to educate users about social engineering with a focus on phishing. ▸ After this training, you will be able to identify and report phishing attacks. ▸ How to protect yourself from potential phishing scams and websites 2
3. Fake COVID-19 Corona virus related domains 1
4. According to GOOGLE 2.02 million phishing websites have been registered since the start of 2020 4 www.forbes.com February 02-FEB-20 March 01-MAR-20 April 19-APR-20 May 10-MAY-20 41,320 53,731 55,008 58,538
5. 5 60,000 phishing websites were reported in May 2020 alone!
6. 6 Fraudsters are exploiting the opportunity to steal the Personally Identifiable Information (PII), financial information, and even medical information, of those looking for knowledge, protection, and treatment for the viral infection. “
7. coincides with the increasing prominence of coronavirus as a global problem 7
8. 8 More than 700 fake websites mimicking Netflix and Disney+ signup pages have been created seeking to harvest personal information from consumers during the coronavirus lockdown streaming boom. “ www.theguardian.com
9. ▸ Cybercriminals are also impersonating official bodies such as HMRC and the World Health Organization in scam text messages and emails in an attempt to exploit the coronavirus outbreak. 9 www.theguardian.com
10. Deceptive Websites – Fake Site 10 ▸ This fake website url is “uk-covid-19-relieve.com.” www.fullfact.org EXAMPLE
11. Deceptive Websites – Real Site 11 ▸ The real government’s website has a “gov.uk” URL, not a “.com” url. www.fullfact.org EXAMPLE
12. Social Engineering Don’t get hooked 2
13. Top 10 Social Engineering Techniques ▸ Pretexting ▸ Quid Pro Quo ▸ Honeytrap ▸ Baiting ▸ Phishing ▸ Water-Holing ▸ Tailgating ▸ Spear Phishing 13
14. 14 “Hi there, regarding my purchase, I have to go to California, my sister has mental health issues so I'll be there for couple of days, It will be very helpful if you send this item to new address (See attachment). Kind regards.” “
15. PreTexting Pretexting is a type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information, specifically information that the victim would typically not give outside the context of the pretext. 15 www.wikipedia.org
16. Examples of PreTexting ▸Pretexting is a form of social engineering used to manipulate victims into divulging sensitive information. Pay attention to generic greetings. 16 www.wikipedia.org
17. How to avoid Pretexting ▸ Avoid sharing personal information on social media. If you have already shared out this information, request to have it pulled down. ▸ Use authorized and trusted channels to verify your email address and phone number in case you receive a suspicious message. ▸ Do not click on links sent via emails, instead use trustworthy websites. ▸ Do not disclose your personal information and passwords to anyone if you are uncertain. ▸ Cancel requests for help from a company if you have not requested assistance. ▸ Find out who has access to your data at work and ensure that it is secure. ▸ Do not open emails from an unknown source. ▸ Secure your computer by installing anti-virus software, email spam filters, firewalls, and always keep them updated. 17 Tip 1 www.osgusa.com
18. Quid Pro Quo Quid pro quo attacks promise a benefit in exchange for information. This benefit usually assumes the form of a service. 18 www.wikipedia.org
19. Examples of a Quid Pro Quo ▸Fraudsters contact random individuals, inform them that there’s been a computer problem on their end and ask that those individuals confirm their personal information, all for the purpose of committing identity theft. 19 www.tripwire.com
20. How to avoid Quid Pro Quo ▸ Invest in modern antivirus and antimalware software that will help prevent and manage potential intrusions. ▸ Evaluate email filtering software that can identify and remove phishing attacks before they make it to an employee’s inbox. ▸ Social engineering attacks rely on either the naivete or gullibility of staff. Provide regular security awareness training that outlines common tactics and strategies that criminals will use. ▸ Conduct frequent penetration tests to gauge how well your employees are prepared to handle these various attacks. ▸ Shred company records or any documentation that includes names or employee information. Consider using trash receptacles or dumpsters with locking mechanisms. 20 Tip 2 www.everfi.com
21. Honeytrap An investigative practice involving the use of romantic or sexual relationships for interpersonal, political (including state espionage), or monetary purpose. The honey pot or trap involves making contact with an individual who has information or resources required by a group or individual. 21 www.wikipedia.org
22. Example of a Honeytrap The trapper will seek to entice a target into a false relationship (which may or may not include actual physical involvement) in which they can glean information or influence over the target. 22 www.wikipedia.org | www.independent.co.uk ▸ Sarah Cook was overjoyed when she met someone she thought was special on an dating site. Mrs Cook (not her real name), 52, felt she had developed a genuine connection with a US soldier serving in Iraq and was only too happy to help him out when he needed money. But her dreams were shattered when Ghanaian police arrested 31-year-old Maurice Asola Fadola, who they suspected of posing as the soldier and conning Mrs Cook out of £271,000. www.thispersondoesnotexist.com
23. How to avoid a Honeytrap ▸ You need to have the patience and ability to question yourself. Often scams create a sense of urgency, which tests your ability to take a quick decision and portrays itself as scenario that there may be huge loss of opportunity. ▸ These are sure shot signs of scam in motion, which tempts to in making a wrong decision. ▸ Any offer that sounds too good to be true, but which comes with a sense of urgency is usually a scam. 23 Tip 3 www.opiniown.com
24. Baiting Baiting attacks use a false promise to pique a victim's greed or curiosity. They lure users into a trap that steals their personal information or inflicts their systems with malware. 24
25. Baiting The most reviled form of baiting uses physical media to disperse malware. 25 www.imperva.com ▸ Attackers leave the bait—typically malware-infected flash drives—in conspicuous areas where potential victims are certain to see them (e.g., bathrooms, elevators, the parking lot of a targeted company).
26. How to avoid Baiting ▸ Alertness and awareness will serve you well and protect you against baiting and other social engineering attacks. ▸ Keep your antivirus and antimalware security settings up-to-date so they flag potentially harmful and malicious cyber threats ▸ Can that URL really be trusted and is it secure and have an up-to-date, valid security certificate? For example when you use Google Chrome, check that there is a lock sign in the browser search window. This will allow you to see if your connection is secure, can be trusted and has a valid certificate. ▸ Scan your computer regularly to further protect yourself against these cyber threats and help improve your cybersecurity hygiene. 26 Tip 4 www.keepnetlabs.com
27. Phishing! A social engineering attack using a fake e-mail, often with a theme, to elicit interaction (clicking a link or opening an attachment) to deposit malware on the target system. 27 www.hhs.gov
28. Example of Phishing Phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims. It then prods them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware. 28 www.imperva.com ▸ An email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. ▸ It includes a link to an illegitimate website—nearly identical in appearance to its legitimate version— prompting the unsuspecting user to enter their current credentials and new password. Upon form submittal the information is sent to the attacker.
29. How to avoid be Phished ▸ Know what a phishing scam looks like ▸ Don’t click on that link ▸ Get free anti-phishing add-ons ▸ Don’t give your information to an unsecured site ▸ Rotate passwords regularly ▸ Don’t ignore those updates ▸ Install firewalls ▸ Don’t be tempted by those pop-ups ▸ Don’t give out important information unless you must ▸ Have a Data Security Platform to spot signs of an attack 29 Tip 5 www.lepide.com
30. Water Holing is a targeted social engineering strategy that capitalizes on the trust users have in websites they regularly visit. ... This strategy has been successfully used to gain access to some (supposedly) very secure systems. The attacker may set out by identifying a group or individuals to target. 30 www.wikipedia.org
31. Water Holing This is a social engineering attack that takes advantage of the amount of trust that users give to websites they regularly visit, such as interactive chat forums and exchange boards. 31 www.imperva.com ▸ Users on these websites are more likely to act in abnormally careless manners. ▸ These websites are referred to as watering holes because hackers trap their victims there just as predators wait to catch their prey at watering holes. ▸ Hackers exploit any vulnerabilities on the website, attack them, take charge, and then inject code that infects visitors with malware or that leads clicks to malicious pages. www.ncsc.gov.uk
32. Water Holing – OceanLotus Example A watering hole campaign targeting several websites in Southeast Asia occurred in 2018 and 2019. This campaign, believed to have been run by the OceanLotus group, was very large in scale and over 20 compromised websites were found, including the Ministry of Defense of Cambodia, the Ministry of Foreign Affairs and International Cooperation of Cambodia, and several Vietnamese news and blog outlets. Attackers added a small piece of malicious code to the compromised websites, which checked visitors’ locations and only visitors from Vietnam and Cambodia received the malware. 32 www.securitytrails.com
33. How to avoid Water Holing ▸ Keep all your systems, software and OS’s updated to the latest version with all patches offered by vendors applied. ▸ Invest in advanced network security tools, such as solutions that leverage network traffic analysis and perform inspection of suspicious websites in order to spot attackers attempting to move laterally across the network and exfiltrate data. ▸ Practice makes everything perfect — so make sure that security awareness training includes all current threats to your organization, which should definitely include watering hole attacks. 33 Tip 6 www.securitytrails.com
34. Tailgating Attack is a social engineering attempt by cyber threat actors in which they trick employees into helping them gain unauthorized access into the company premises. 34
35. Tailgating Attack The attacker seeks entry into a restricted area where access is controlled by software- based electronic devices. 35 www.kratikal.medium.com ▸ A social engineer can pretend to be a delivery agent from an e-commerce company or someone from a food delivery service, holding boxes as an excuse to ask employees to open the door. ▸ The social engineer would pretend to make it look uneasy for him to open the door and would ask any authorized person to help him as a courtesy to get entry to the restricted premises.
36. How to avoid Tailgating Attacks ▸ Make sure to lock your system and other devices while leaving the work station. ▸ In order to avoid tailgating attacks, do not let unknown people enter restricted premises of office unless they have appropriate credentials or authority of access. ▸ Never help strangers to access a secured location when they ask to open the door or are from delivery services unless they are permitted. ▸ Always keep your access identity card with you while you are on the premises and make sure to keep it secure from being misused by unauthorized employees. ▸ Never insert stray or idle external devices like USB or memory cards in your system before getting them verified by the security administrator. ▸ Implement cybersecurity practices in your organization to prevent potential cyber risks. ▸ Provide cybersecurity awareness training to employees to make them understand about cyberattacks and how to recognize them. 36 Tip 7 www.kratikal.medium.com
37. Spear Phishing Spear phishing is a phishing method that targets specific individuals or groups within an organization. 37 www.trendmicro.com
38. Spear Phishing It is a potent variant of phishing, a malicious tactic which uses emails, social media, instant messaging, and other platforms to get users to divulge personal information or perform actions that cause network compromise, data loss, or financial loss. 38 www.trendmicro.com ▸ Spear phishing attackers perform reconnaissance methods before launching their attacks. One way to do this is to gather multiple out-of-office notifications from a company to determine how they format their email addresses and find opportunities for targeted attack campaigns. ▸ Other attackers use social media and other publicly available sources to gather information.
39. How to avoid Spear Phishing ▸ Educate your employees and conduct training sessions with mock phishing scenarios. ▸ Deploy a SPAM filter that detects viruses, blank senders, etc. ▸ Keep all systems current with the latest security patches and updates. ▸ Install an antivirus solution, schedule signature updates, and monitor the antivirus status on all equipment. ▸ Develop a security policy that includes but isn't limited to password expiration and complexity. ▸ Deploy a web filter to block malicious websites. ▸ Encrypt all sensitive company information. ▸ Convert HTML email into text only email messages or disable HTML email messages. ▸ Require encryption for employees that are telecommuting. 39 Tip 8 www.kratikal.medium.com
40. Knowledge Checking Abbreviated Key takeaways 3
41. a) 1.12 Million b) 2.02 Million c) 5.9 Million d) 10 Million e) None of the above ______ million phishing websites have been registered since the start of 2020 ✓
42. a) Fox News b) Disney c) Amazon d) Netflix e) None of the above More than 700 fake websites mimicked the following companies ✓ ✓
43. a) a form of social engineering used to manipulate victims into divulging sensitive information. b) a new way to text. c) a pre-filled form. d) all of the above. Pretexting is… ✓
44. a) a promise or a benefit in exchange for information. b) a new way to text. c) a French desert. d) Latin for hello. e) None of the above Quid Pro Quo is… ✓
45. a) a way to catch bee honey b) a trap that involves making contact with an individual who has information or resources required by a group or individual. c) A new web app. d) None of the above A Honeytrap is… ✓
46. Resources www.forbes.com www.trendmicro.com www.kratikal.medium.com www.imperva.com www.thispersondoesnotexist.com www.hhs.gov www.theguardian.com www.osgusa.com www.lepide.com www.wikipedia.org
47. Thank you Any questions? You can find me at: multimedia.web@outlook.com 47