If you are on this page that means you want to know What is phishing in information security and how this works, so keep reading this post till the end, and you will know all about phishing and how to protect yourself from this?
If you are new and you have never heard about phishing then you may be thinking that it is fish cathing(fishing) but we want to tell you one thing that phishing is related to hacking means how a hacker steals your Facebook, Gmail, or bank accounts ID and password.
So here we will talk about some questions as to What is phishing in information security? what are the types of phishing attacks? what are phishing techniques? what are the preventions of phishing attacks? so be with us till the end of this post, you will get answers to all these questions and many more.
What Is Phishing In Information Security?
What Is Phishing
Phishing meaning – Phishing is like as we do fish bait for catching fish, in the same way for getting our Facebook, Gmail, or bank account password hackers send us some links and with the help of those links they get our id and password and after getting id and password they can misuse them.
Definition Of Phishing
What is phishing in information security – Phishing is the act of attempting to acquire information such as username, password, and credit card details as a trustworthy entity in electronic communication.
Communication purporting to be from popular social web sites, auction sites, online payment processors, IT administrators are commonly used to lure the unsuspecting public. phishing emails may contain links to websites that are infected with malware.
How Does Phishing Work?
Most of the time, Hackers do phishing thru email or massage, means they send you a mail or message for phishing, they can do phishing thru email, message, or by any other social media, when you receive that email or message it looks like it is really sent by an official company or by the real bank but in reality, it was sent by hackers.
In those emails or messages, you also get a link, and they write mail or massage in a way that you must click on that link, as you click on the link then you will be redirected to an official site it maybe Facebook, Gmail, or any bank’s website, or any other website in which you have your id and password.
Hacker wants to steal your that id and password which you have in those accounts, so in this case, the website you see will look like the same as the original website but in reality, it will be a fake website, which was created by hackers to steal your password.
How To Identify a Phishing Email Or Messages
Now you may be thinking how can we identify that received mail or massage is from an official company or a fake person, so first of all, when you click on the link, you will be directed to a website or web page, there in the search bar you will find a URL, check that URL, if you find a different URL than the real one, like shown in the image, here both URLs and the interface are looking the same but both are not the same.
Carefully read the URL, you may get some spelling mistake in the URL, if you found any mistake then never enter your id, password in that, after checking all the things only if you find all well only then enter your id and password.
There is one another way to find that the mail you have received is from a real company or from phishing, when you receive any mail there will be the sender’s mail id and details, by checking those things we can find that this email is from a real company or hackers.
If you get any mail from Facebook, Gmail, or youtube then check the sender’s email ID and details, if it is from hackers then there will be some spelling mistakes like at the place of youtube there maybe youtoobe or something else. In this way, you can identify a phishing mail or message.
We assume that you have understood, what is phishing in information security, so now we will move to our next part what are the phishing techniques.
Phishing Techniques
Phishing techniques are the methods of phishing, hackers can use any technique to manipulate your data. Here we will learn some popular phishing techniques.
Link Manipulation
It is a well-known phishing technique in information security, in this technique hackers manipulate the link of the original website, and then send us that link thru email or msg, and ask us to click on that link. As we click on that link, we are redirected to their manipulated web page, where if we enter our details then they steal that information.
Filter Evasion
In filter evasion technique phishers use images instead of text or they manipulate code of the search results page, so the anti-phishing filters can’t detect them and phishers can easily serve their injected web page.
Cross-Site Request Forgery
In this technique hackers send a link for password change or fund transfer to the user, thru emails, or from other methods to unintentionally change their password or for fund transfer, and as users click on the link and change password or transfer fund that transferred to the hackers.
Phone Phishing
In phone phishing, hackers send you messages as an authorized company like a bank or any other, for submitting or updating your details, and will be guided to a link where you have to enter your details like ID, password, bank details so on. Once you entered your details then they will store it in their database.
These were some popular phishing techniques, now we will see some example of phishing attack.
Phishing Attack Examples
- In this example, they targeted south trust bank’s user, the phisher has used an image to make it harder for anti-phishing filters to detect by scanning for text commonly used in phishing emails.
- This is another example of a phishing attack, where phishers have created a similar account verification page of PayPal and send that to PayPal users as from PayPal and asked them to verify their account by filing their details again.
- This is a phishing email example, its a sample image, here you can see the phishers have sent a phishing email, and they are pretended to be from a university, and asking to reseat password, as the password is going to expire, they have also provided a link to update the password.
Here we have learned, what is phishing in information security, phishing techniques, and examples now we will discuss types of phishing attacks.
Types of Phishing Attacks
Here we are going to tell some most popular types of phishing attacks.
Deceptive Phishing
This is the most common phishing type, deceptive phishing occurs when an authorized or recognized source sends an email with a “call to action” that demands the recipient click on a link and update or verify their details or password. Most of the time, these emails request you to verify your account information, re-enter information, update your ID and password. Above we have discussed a phishing example of PayPal, it is a deceptive phishing example.
Malware Based Phishing
In malware-based phishing, hackers run some malicious software on the user’s machine to corrupt their data and machine, and hack the information of the users, various forms of malware-based phishing are:
- Key loggers&screen loggers
- Session hijackers
- Web trojans
- Data theft
Pharming or DNS-Based Phishing
In pharming or DNS-based phishing, hackers tamper with the company’s host files or domain name system, so when the user requests that URL or name, services return to a bug address. Phishing that interface with the integrity of the lookup process for a domain name is called pharming. Forms of DNS-based phishing are:
- Hosts file poisoning
- Polluting user’s DNS cache
- Proxy server compromise
Man In The Middle Phishing
In the MITM phishing attack, a hacker intercepts the communication between two parties either to secretly eavesdrop or modify traffic traveling between the two, phisher positions himself between the user and legitimate site to steal login credentials and personal information. It is like two persons are talking and someone is listening to all the things secretly.
IF you like our this post and want to know what is google dorks then click on the link to read that post
Content Injection Or Content Spoofing
Content injection is also referred to as content spoofing, content injection is inserting malicious content into a legitimate site, in this phishing, hackers replace the part of the content of the legitimate site with false content designed to mislead or misguide the user into giving up their confidential information to the hackers. There are three primary types of content injection phishing:
- Hackers can compromise a server through a security vulnerability and replace or augment the legitimate content with malicious content.
- Malicious content can be inserted into a site through a cross-site scripting vulnerability.
- Malicious actions can be performed on a site through a SQL injection vulnerability.
Spear Phishing Attack
“The fraudulent practice of sending emails ostensibly from a known or trusted sender in order to induce targeted individuals to reveal confidential information.”
Spear phishing is where hackers aim at any person they crack some information about that person thru social media or any other way, and as per that information they send him any fraud emails as being and known or trusted authorized sender to get his confidential information.
Whaling Phishing Attack
Whaling phishing is similar to spear phishing but in whaling phishing, hackers target high-profile employees as CEOs, CFO’s and other executives, as they have access to highly valuable information, including trade secrets and passwords. Hackers create a list of these persons and send them fraud emails in bulk to get their confidential information.
If you want to know best chrome extension to enhance productivity click on the link.
Causes of Phishing
- Misleading emails – Misleading emails are the major reason for phishing frauds.
- No check of source address – So many people don’t check the source address of incoming emails and messages and as the result, they face phishing attacks.
- Vulnerability in browsers – Using vulnerable and less secure browsers is also a reason for phishing attacks.
- No strong authentication at websites of banks and financial institutions – Not keeping a strong authentication and password banks and financial institutions also cause phishing.
- Limited use of digital signature – No or limited use of digital signature is also enhance phishing attacks.
- The non-availability of secure desktop tools is also a major cause of phishing attacks.
- Lack of user awareness is also a major factor of phishing
- Vulnerability in applications also gives a loop to enter phishers.
Anti Phishing Solutions
Anti-phishing solutions are known as tools or methods to help internet users to identify the phishing attack as email phishing detection, social media phishing detection, website phishing detection. Many anti-phishing solution and services are available on the internet, but there are some practices which we can do to mitigate phishing attacks:
Social Responses
We can create some social groups on social media platforms, and others, and can share information’s about phishing and its preventions, make people aware of these fraud activities to mitigate phishing attacks.
Technical Approaches
There are some technical approaches which we can do to mitigate phishing attacks:
- Helping to identify legitimate websites
- Browsers alerting users to fraudulent websites
- Eliminating phishing mails
- Monitoring and takedown
Legal Approaches
We can also make some legal approaches to reduce the numbers of phishing attacks as apply two-step authentication, changing passwords in a specific period, and so on.
If you want to learn all about web application click on the link to read our post.
Effects of Phishing
- Internet fraud
- Identity theft
- Financial loss to the original institutions
- Difficulties in law enforcement investigations
- Erosion of public trust in the internet.
Prevention of Phishing Attacks
- Preventing a phishing attack before it begins.
- Detecting a phishing attack.
- Preventing the delivery of phishing messages.
- Preventing deception in phishing messages and sites.
- Countermeasures
- Interfering with the use of compromised information.
Conclusion
No single technology will completely stop phishing however, a combination of good organization and practice, proper application of current technologies, and improvement in security technology have the potential to drastically reduce the prevalence of phishing and the losses suffered from it.