Page 13 - Cyber Warnings

In the last year we observed significant phishing activity targeting a handful of Cloud Storage
and Software as a Service companies and this idea of email address and password
authentication is the reason why.

We expect to see more attacks targeting those types of sites than financial sites this year.
Threat actors are refocusing.

It has become common practice for online sites to rely on email addresses instead of unique
usernames, and people tend to reuse passwords – especially the passwords usually paired with
email addresses.

All the phisher needs to do is compromise an email address and password pair one time in
order to access a wide range of accounts like email, shopping, communications, social
networking, and entertainment; literally “insert account type here.”

When these threat actors decide whom to target, it’s a question of which online sites have the
largest user bases and therefore the biggest collections of these email address and password
pairs; this is the primary reason why these sites are getting phished at unprecedented rates.
The cybercriminals target them to mass harvest credentials that they ultimately use for other
sites.

It’s why phishers are multiplying their profits at the expense of companies they are not even
attacking directly. They focus on mass harvesting credentials by phishing a handful of sites with
a ton of users but not actually looking to compromise the accounts at that site.

To compound this idea of threat actors shifting focus, most people don’t fully realize how
complex the phishing threat vector has become. Phishers are using automated tools to test the
stolen credentials across hundreds of sites, testing the validity of the credential. They can sell
the good ones for profit or use them themselves.

Think about some of the credential dumps last year, it’s likely this trend played a role, especially
where there was no evidence of a direct breach.

So now I know what you’re thinking. Phishing is a problem, so now what? Well, protecting
against phishing needs to be a top priority to your business, for your employees, and even for
you as an individual.

Billions are invested in technologies to try to stop cyber attacks, but phishing is still the trump
card for cybercriminals because phishing is directly attacking you, the end user, the person
sitting behind the keyboard. People need to be aware of these attacks and how to spot them,
and that’s not as easy as it sounds.

Most people have gone through some basic security awareness training at some point in their
life, and in any case, most people tend to overestimate their own ability to spot phishing attacks.
There is a basic psychological want to believe information that is presented.

13 Cyber Warnings E-Magazine February 2017 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide