Recently we have had several customers contact us because they thought that their email accounts had been compromised. They thought that emails were being sent from their email address but it only ‘looked’ that way. As this type of email is increasingly common and causes a lot of concern, we thought we would do a couple of blogs explaining how it is done and how to protect yourself. Today we are going to explain spear phishing.
How do people get details of your correct email address?
This is a question we often get asked. It’s often easy. Imagine PersonA at CompanyA has their email system breached. Criminals often then target all their email contacts.
Another way is via company websites. These often list the email addresses for all staff, or at least key contact people. So just looking at your website might be sufficient to enable someone to send an email from EmployeeA to EmployeeB.
You can even guess. Most email addresses are FirstnameSurname@companyname or a variance of this.
How do they send email from your email address?
Well often they don’t – it just looks as though they have. This is the case with spear phishing.
They might go to a company that lets them set up free email accounts (gmail for example) and create a new email address. They will then set the display name of this to be the same as the person’s name. So, in the example shown, I have just set up an email address thisisanyname@gmail.com and changed the display name to EmployeeA.
I then sent an email from this account. Note that in my Outlook list of emails received today only the Display name is shown.
It’s as easy as that.
They Purchase Domains
Note that, if the criminal thinks there is the potential for a big financial gain, they may purchase a similar domain. So imagine the domain is @rebeccajmansbridge.co.uk. They may purchase rebeccamansbridge.co.uk or rebeccajmansbridge.com or rebeccajmansbridge.co. Then they can send emails from that address – you need to be very vigilant to spot the difference.
What Happens Next?
Now imagine that on your website there was reference to three people ABody, ANother, AThird. Also, on the website you did a blog about a current project that the company is very proud of and that is nearing completion ProjectAlpha. It would only take a few minutes for someone to find these details. A few more minutes to send a general enquiry to you. Replies to this email would give me your standard email template, font, logo, etc. Then I can set up an email account with the title name ABody and send it to ANother and AThird with the subject Updated invoice for ProjectAlpha, with your logo at the bottom of it!
When the criminals go to this level of effort is called Spear Phishing and it is becoming increasingly common. Criminals can get details they can use from a variety of sources. The one we are seeing a lot of is a breached account – so for example a person you send emails to may have had their account breached. Their contact lists are then sold on. With this, criminals also get details of whatever you are communicating with them about, your email template, etc, etc.
Other sources are social media
Maybe someone in your company has just landed a big deal with a new company that you posted about on LinkedIn. If they are targeting one person in a company they may go to Facebook and get information about them, their family and friends. See that they were about to be involved in a golf tournament for example and send them an email about that event, with an attachment or link.
You can understand why when this happens people often think that their email account has been compromised but, in this case, it is not so.
You may be interested to know that it was a spear phishing attack that enabled criminals to steal the usernames and passwords of individuals involved in the Hilary Clinton campaign.
How To Protect Yourself From This Type Of Email Attack
Confirm by phone. We have seen really, really good phishing emails that are really difficult to spot. So make it a habit to pick up the phone and confirm with the sender that it’s genuine before you click on a link or make a payment. (Not using the phone number listed in the email of course).
Be cautious sending sensitive data by email, such as bank account details, logons, passwords, etc.
Understanding
I am a great believer that the first line of protection is understanding. So share this email with everyone you think needs to know about it. Explain to people how it is done. We are happy to provide help with this.
Check the full email address: Get into the habit of glancing at the full email address when you click on a message to read it. It takes less than a second. This is particularly important on mobile devices which often do not display the full information by default because of screen size.
Check images
Often logos and other images are copied and so may be fuzzy and unclear.
Language: As well as the obvious tells such as poor spelling and grammar, if you know the person does it read right? Some people are always very short and precise in their emails, others more effusive. Some always sign off with a smiley face. If you know the person and it all feels a little ‘off’ take the little extra time to check.
Good internal communication
Spear phishing often involves emails between the boss and other people in the company – hoping that communication between the two is poor and that neither will query the contents of the email as a result. Phishing also taps into fears – so may say your email has been hacked and you need to change it immediately, for example.
Nurture a company atmosphere that is always positive when people check with each other if something is genuine. A company atmosphere that enables the less confident to always ask when they are unsure.
Checking Your Internet Security Software
Good Internet security software includes some protection against spam and malicious emails. We can help you check that everything is up-to-date.
I hope this helps you to not get caught in one of these attacks and to understand it better if you do.
Rebecca Mansbridge
August 2020