Spear phishing attacks-by-hari_krishna

12
May 17, 2014 Spear Phishing Attack -Hari V

Transcript of Spear phishing attacks-by-hari_krishna

Page 1: Spear phishing attacks-by-hari_krishna

May 17, 2014

Spear Phishing Attack

-Hari V

Page 2: Spear phishing attacks-by-hari_krishna

Phishing is a social engineering tactic where the attacker attempts to get a user to divulge sensitive

information (like username/password, bank account number, personal information, etc.) or go to a

malicious website where such information can be harvested. It uses "bait" such as telling the user that they

are their bank asking for the information or posing as some other authority like the system administrator.

Usually it is delivered by email or Instant Messenger.

Spear phishing is a subset of phishing. Whereas general phishing targets a wide range of people trying to

get some of them to divulge general information, spear phishing targets key individuals who are expected

to have very special access or information that the attacker wants. It could be a company executive or a

military officer. Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization,

seeking unauthorized access to confidential data.

Topics

Covered

5/13/2014

Page 3: Spear phishing attacks-by-hari_krishna

Spear Phishing is easiest and direct method to breach highly secured networks.

Phishing attacks are very common in nature and many of systems and networks has

enabled defense mechanism.

Success rate is very high as user knows about the phishing attacks and unaware of

spear phishing attacks.

Spear Phishing is part of social engineering.

No Cost at all, No tracking back.

Increased usage of social networking made it very easy and reliable to hackers

- Personal data, co- employees, locations, phone numbers , email ids.

5/13/2014

Page 4: Spear phishing attacks-by-hari_krishna

Performing Reconnaissance

Scanning and enumeration

Gaining access

Escalation of privilege

Maintaining access

Covering tracks and placing backdoors

5/13/2014

Page 5: Spear phishing attacks-by-hari_krishna

It by passes all the traditional attack methodology .

Gets direct front door entrance access.

=

There is no patch for human Mistakes.

5/17/2014

Page 6: Spear phishing attacks-by-hari_krishna

It just by Email /link/attachment same as Phishing, the only difference is , this attack is

specific to targeted domains and targets victims.

Targeted Email

From some you trust (Patient attacker)

About something your interest, like, trust.

5/13/2014

Page 7: Spear phishing attacks-by-hari_krishna

Attacker gains all the knowledge about victim (user/company) , this knowledge

includes his/her likes, dislikes, Interests, Favorites, Hobbies ,Personal information,

Address etc.

Where does attacker gets all this info from ?

Well, every one knows this answer.

1) Social networking sites

2) Blog

3) Job Portals

4) Matrimonial sites

5) Social engineering

5/13/2014

Page 8: Spear phishing attacks-by-hari_krishna

Now attacker creates email similar to victims team mate/supervisor/MD of company

etc. email in different domains. Below are few examples.

1) [email protected]

2) [email protected]

3) [email protected]

4) [email protected]

Real time example :-

5/13/2014

Page 9: Spear phishing attacks-by-hari_krishna

Attackers send the email to which phishing link using all the social engineering

knowledge gained.

Most of the common scenarios, victim thinks that email is from his

friends/teammates/boss.

This is how attacker gains the trust of victim.

5/13/2014

Page 10: Spear phishing attacks-by-hari_krishna

Never use your personal email for work purpose.

Add Spear Phishing as part of your regular VAPT activity.

Establish Policy and best practices for email usage.

Block all the emails other than self domains ??

5/13/2014

Page 11: Spear phishing attacks-by-hari_krishna

http://wiki.answers.com/Q/What_is_the_difference_between_phishing_and_spear_fishing

Page 12: Spear phishing attacks-by-hari_krishna

Thank you

Impossible is later called as miracle, its all about how you look at it. – Hari