How a Phishing Scam Works and What You Can Do to Protect Yourself
Most hacking attacks are the result of a flaw or vulnerability found within the code of a program or operating system, but we rarely take into account the ones that don’t. Hackers often take advantage of the human side of hacking as well, a process known as “social engineering.” This is usually the act of conning users into handing over personal information of their own free will, and it’s surprisingly effective.
As you can imagine, social engineering involves exploiting the people who work with the technology rather than the technology itself. This particular method allows those who might not be as tech-savvy (or those who aren’t particularly known for their common sense) to obtain important information, like passwords or dates of birth, from unsuspecting foes. Those who are more skilled with technology can perform more elaborate social engineering attacks, like replicating websites to infect systems with malware upon visitation, or download infected software.
The most well-known social engineering hacking attack comes in the form of a phishing attack. These are typically the type of emails which appear to be the genuine article from an institution you might have relations with, such as a bank. These emails request that you update or confirm your personal information. It can be difficult to discern these from the real deal at times.
Other, more focused attacks are called spear phishing attacks. These are designed to target a specific individual, or multiple specific targets. Sending emails personalized to get users to fork over financial information, or even going to lengths such as contacting your business posing as someone from a media outlet.
According to HowToGeek.com, this method isn’t limited to being used remotely. Social engineering hackers can also get up close and personal with their attempts:
An attacker could walk into a business, inform the secretary that they’re a repair person, new employee, or fire inspector in an authoritative and convincing tone, and then roam the halls and potentially steal confidential data or plant bugs to perform corporate espionage. This trick depends on the attacker presenting themselves as someone they’re not. If a secretary, doorman, or whoever else is in charge doesn’t ask too many questions or look too closely, the trick will be successful.
How To Prevent Social Engineering Attacks
In the end, keeping your business safe from social engineering attacks comes down to identifying them from the genuine article. In order to minimize the risk of falling prey to these hacks, keep these tips in mind.
- Some suspicion is better than none at all. If you’re receiving strange emails, messages, or phone calls from users you don’t recognize, it’s best to be on the safe side and not respond until you’re sure that you’re dealing with the real deal. It’s better to call the institution at the number you have on record before handing over any information you feel is suspicious. If something seems suspicious, such as poorly worded emails and strange links, it's best to question it.
- Avoid links in emails to websites which gather sensitive information. These websites could be fake phishing sites designed to look like the official institution website. For example, you receive an email asking to update your bank information, and the link leads to a sign-in form. This is a fake site designed to fool you into entering your credentials. In this case, it’s best to try logging into the official site rather than through the email. Look at the URL and scan it for subtle differences which might hint at trickery.
- Enable spam and phishing filters for your email and browser. Some browsers have built-in phishing and security filters, which should always be active. These can prevent your employees from accessing a known phishing site. One particularly powerful solution is White Mountain IT Services’s Unified Threat Manager (UTM). This solution equips your business with everything it needs to keep outside threats from getting into your network, including spam filtering and web content blocking.
Ultimately, the best defense against social engineering hacking attempts is to stay vigilant and educated about how to best approach suspicious situations on the web. White Mountain IT Services can equip your business with the tools it needs to stay safe and educate your staff on how to identify fraud when they see it. For more information about how White Mountain IT Services can keep your business safe, give us a call at 603-889-0800.
- Getting to Know Technology: Hackers It doesn’t matter how much of a technology novice someone is, chances are, they’ve heard the term “hacker” before. A favorite character trope of Hollywood films and television dramas, these cybercriminals have appeared in productions like Die Hard and Mr. Robot with varying degrees of accuracy. Belo...
- Could You Spot a Social Engineering Attack? As invaluable as the security solutions that protect a network are, they can be effectively rendered useless if a cybercriminal is skilled in social engineering. Social engineering is the practice of using manipulation to access protected resources, as we will review later. If your business and its ...
- Tip of the Week: Annoyed By Fake Friend Requests on Facebook... Have you ever gotten Facebook requests from strange people who you don’t know? While it might be tempting to give them the benefit of the doubt--after all, maybe they know a friend of yours--it’s best to keep strangers off of your page when you can. In order to give your page, the flexibility to acc...
- Virginia To Upgrade Voting Machines. Hopefully Other States ... The 2016 United States presidential election was an ugly one for multiple reasons--chief among them the accusation that hacked voting machines could have altered the outcome of the election significantly. Thankfully, there are steps being taken to alleviate the worries that third parties might alter...
- NATO Officially Declares Cyberspace a Battlefield Security professionals have been at war with hackers ever since the Internet was created, but a recent NATO decision has affirmed the fact that cybersecurity is a real-world problem, and one that needs to be fixed. Just like land, air, and sea, cyberspace has become a battlefield, albeit a very diff...
- Do not Let Hollywood Fool You Into Thinking Hackers are the ... There’s no question about it; hackers make things difficult for businesses of all industries and sizes. They go out of their way to steal data and turn a profit off of it, as well as misrepresent organizations and individuals. The business environment is chaotic enough without hackers mucking everyt...