Big Phish
Hackers use spear phishing tactics to bait employees.
November 30, 2008 at 07:00 PM
6 minute read
In October, 10,000 users of the professional social-networking site LinkedIn.com received what appeared to be a legitimate e-mail from a member of LinkedIn's technical support team. The e-mail claimed to include an attachment containing a “list of business contacts” and enticed recipients to open it. Despite its official appearance, however, the attachment actually contained a piece of malware.
The incident was one of the most prominent spear phishing attempts to date. Unlike phishing, where a hacker SPAMs thousands of recipients with a generic, fraudulent e-mail to trick users into divulging personally identifiable information, spear phishing is much more ingenious. These types of attacks target a specific group of people, often employees at a company, with malicious e-mails that appear to be sent from an authority or company executive.
Although specific numbers are difficult to pinpoint because few companies openly report such attacks, there have been at least 66 reported spear phishing attacks within the past year and a half, according iDefense Labs, a provider of security intelligence. These spear phishing attempts have affected roughly 15,000 employees, with the majority of attacks striking Fortune 500 companies, government agencies, financial institutions and law firms.
Because these types of attacks are so targeted, SPAM filters do little to stop them. Instead, in-house counsel must work with IT security and HR to educate employees about this new threat.
“If there is a reason to break into your organization, hackers will use spear phishing because it has a high success rate,” says Rohyt Belani, managing partner and co-founder of Intrepidus Group Inc., a provider of security consulting services. “You could have millions of dollars of technology to protect your systems, but once one of these e-mails hits someone's inbox, that is all thrown out the window.”
Baiting the Hook
According to MarkMonitor Inc., an enterprise brand protection company, there was a 20 percent increase in the number of organizations phished in the second quarter of 2008, compared to the first quarter (see “Phish Facts”). According to MarkMonitor, this signals that hackers are increasing their level of sophistication.
“The criminals are going after customer data, trade secrets and sales projections,” says Frederick Felman, chief marketing officer at MarkMonitor. “Oftentimes they're not only going after personal employee data, but also personnel data, so they can access administrative capabilities to compromise servers and install software to steal this internal information.”
And spear phishing attacks are quickly replacing the old model of phishing. The way a spear phishing attack works is fairly simple. Hackers will choose a company to target and begin researching its key executives, oftentimes collecting their e-mail addresses from the company Web site. The hackers will then test the e-mail addresses to ensure they're active by sending out a test e-mail to see whether it bounces back. Then attackers begin scouring the corporate Web site for press releases and company news. They incorporate this information into the subject line and body of an e-mail, pose as an executive and send the message to employees. Because the e-mail appears to be from an executive and cites recent, relevant information, the likelihood that someone opens it is much greater.
“Oftentimes once you click on a link, or sometimes as soon as you open the message, a piece of malware, such as a keystroke logger or a Trojan, will automatically install on your machine,” says Brian Dykstra, senior partner at Jones Dykstra & Associates, a consulting firm specializing in computer security training.
Once the malware is on the system, hackers can gain access within 15 minutes and steal corporate information, virtually undetected.
Cutting the Line
Because spear phishing e-mails don't look like SPAM, security software does little to prevent these attacks. IT should continually update anti-SPAM and phishing software on mail servers as a preventive measure. In addition, experts recommend that in-house counsel, IT security and HR band together to educate employees.
“You can tell your employees this is real, it happens and that people can lose money out of their bank accounts, but nothing works as well as running an actual phishing exercise,” Dykstra says.
Companies may implement a service that allows them to run spear phishing exercises on their employees. These services create customizable, prepopulated e-mail content and fake phishing sites. When the test attack is launched, in-house counsel can track key metrics to benchmark the effectiveness of a real attack.
“It will give you the percentage of people who opened the e-mail, who entered data and the timeframe it would take for people to fall for a real phishing attack,” says Belani, whose company provides this type of service.
None of the data entered into the forms is actually collected. At the end of such an exercise, in-house counsel may provide educational materials on spear phishing to employees who fell for the attack.
Plugging Holes
Yet even in companies that install anti-phishing software, run phishing exercises and educate employees, phishing attacks can still be successful. If IT detects that the corporate network has been compromised and can pinpoint the e-mail, in-house counsel need to work fast to mitigate any risk to the company and ensure no further damage is done.
“One of the best things you can do is check to see if anyone else got the e-mail because there could be other copies,” Dykstra says. “Phishing attacks most often strike multiple users.”
It is also important to inform employees that a phishing attack has been detected so that if such an e-mail is lying dormant in someone's inbox, they won't open it.
Finally, IT and in-house counsel should work together to gauge what damage has been done. This could entail contracting specialized forensic experts to weed through the IT system and sniff out any malware that may have been installed on the network.
“The sophistication of the malware is getting better all the time as is the process of delivery and target selection,” Dykstra says. “However, some are set up so you can't reverse engineer and figure out what the software was even doing.”
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllAI Adoption, Data Center Building Boom Opening More Doors for Cybercriminals, Many of Them Teenagers
Trending Stories
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250