What is Phishing ? | Phishing Attack | Countermeasure — Exploitbyte

7 min readMar 24, 2020

Phishing Process is a technique in which Fake Email which looks like legitimate email is sent to target host.

When the receipent opens the link, he is enticed for providing information. Typically, readers are redirected to the fake webpage that resembles an official website. The user provides all sensitive information to a fake website believing as an official website because of its resemblance.

Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information.

Phishing Attack Example :-

The following illustrates a common phishing scam attempt:

A spoofed email ostensibly from myuniversity.edu is mass-distributed to as many faculty members as possible.
The email claims that the user’s password is about to expire. Instructions are given to go to myuniversity.edu/renewal to renew their password within 24 hours.

Several things can occur by clicking the link. For example:

The user is redirected to myuniversity.edurenewal.com, a bogus page appearing exactly like the real renewal page, where both new and existing passwords are requested. The attacker, monitoring the page, hijacks the original password to gain access to secured areas on the university network.
The user is sent to the actual password renewal page. However, while being redirected, a malicious script activates in the background to hijack the user’s session cookie. This results in a reflected XSS attack, giving the perpetrator privileged access to the university network.

Phishing is the simplest kind of cyberattack and, at the same time, the most dangerous and effective.

Phishing Techniques

Email Phishing scams

Email phishing is a numbers game. An attacker sending out thousands of fraudulent messages can net significant information and sums of money, even if only a small percentage of recipients fall for the scam. As seen above, there are some techniques attackers use to increase their success rates.

For one, they will go to great lengths in designing phishing messages to mimic actual emails from a spoofed organization. Using the same phrasing, typefaces, logos, and signatures makes the messages appear legitimate.

In addition, attackers will usually try to push users into action by creating a sense of urgency. For example, as previously shown, an email could threaten account expiration and place the recipient on a timer. Applying such pressure causes the user to be less diligent and more prone to error.

Lastly, links inside messages resemble their legitimate counterparts, but typically have a misspelled domain name or extra subdomains. In the above example, the myuniversity.edu/renewal URL was changed to myuniversity.edurenewal.com. Similarities between the two addresses offer the impression of a secure link, making the recipient less aware that an attack is taking place.

Spear Phishing

Spear Phishing targets a specific person or enterprise, as opposed to random application users. It’s a more in-depth version of phishing that requires special knowledge about an organization, including its power structure.

An attack might play out as follows:

A perpetrator researches names of employees within an organization’s marketing department and gains access to the latest project invoices.
Posing as the marketing director, the attacker emails a departmental project manager (PM) using a subject line that reads, Updated invoice for Q3 campaigns. The text, style, and included logo duplicate the organization’s standard email template.
A link in the email redirects to a password-protected internal document, which is in actuality a spoofed version of a stolen invoice.
The PM is requested to log in to view the document. The attacker steals his credentials, gaining full access to sensitive areas within the organization’s network.

Clone Phishing

In this attack, criminals make a copy-or clone-of previously delivered but legitimate emails that contain either a link or an attachment. Then, the phisher replaces the links or attached files with malicious substitutions disguised as the real thing. Unsuspecting users either click the link or open the attachment, which often allows their systems to be commandeered. Then the phisher can counterfeit the victim’s identity in order to masquerade as a trusted sender to other victims in the same organization.

You Miss To Read :- How to Hack Wifi

419/Nigerian scams

A verbose Phishing email from someone claiming to be a Nigerian prince is one of the Internet’s earliest and longest-running scams. According to Wendy Zamora, Head of Content at Malwarebytes Labs, “The Nigerian prince phish comes from a person claiming to be a government official or member of a royal family who needs help transferring millions of dollars out of Nigeria. The email is marked as ‘urgent’ or ‘private,’ and its sender asks the recipient to provide a bank account number for safekeeping the funds.”

In a hilarious update of the classic Nigerian phishing template, British news website Anorak reported in 2016 that it received an email from a certain Dr. Bakare Tunde, who claimed to be the project manager of astronautics for Nigeria’s National Space Research and Development Agency. Dr. Tunde alleged that his cousin, Air Force Major Abacha Tunde, had been stranded on an old Soviet space station for more than 25 years. But for only $3 million, Russian space authorities could mount a flight to bring him home. All the recipients had to do was send in their bank account information in order to transfer the needed amount, for which Dr. Tunde will pay a $600,000 fee.

Phone Phishing

With phone-based phishing attempts, sometimes called voice phishing or “vishing,” the phisher calls claiming to represent your local bank, the police, or even the IRS. Next, they scare you with some sort of problem and insist you clear it up immediately by sharing your account information or paying a fine. They usually ask that you pay with a wire transfer or with prepaid cards, so they are impossible to track.

SMS Phishing, or “smishing,” is vishing’s evil twin, carrying out the same kind of scam (sometimes with an embedded malicious link to click) by means of SMS texting.

Countermeasures Of Phishing

How do I protect myself against phishing?

As stated previously, phishing is an equal opportunity threat, capable of showing up on desktops, laptops, tablets, and smartphones. Most Internet browsers have ways to check if a link is safe, but the first line of defense against phishing is your judgement. Train yourself to recognize the signs of phishing and try to practice safe computing whenever you check your email, read Facebook posts, or play your favorite online game.

Once again from our own Adam Kujawa, here are a few of the most important practices to keep you safe:

Don’t open e-mails from senders you are not familiar with.
Don’t ever click on a link inside of an e-mail unless you know exactly where it is going.
To layer that protection, if you get an e-mail from a source you are unsure of, navigate to the provided link manually by entering the legitimate website address into your browser.
Lookout for the digital certificate of a website.
If you are asked to provide sensitive information, check that the URL of the page starts with “HTTPS” instead of just “HTTP.” The “S” stands for “secure.”It’s not a guarantee that a site is legitimate, but most legitimate sites use HTTPS because it’s more secure. HTTP sites, even legitimate ones, are vulnerable to hackers.
If you suspect an e-mail isn’t legitimate, take a name or some text from the message and put it into a search engine to see if any known phishing attacks exist using the same methods.
Mouseover the link to see if it’s a legitimate link.

As always, we recommend using some sort of anti-malware security software. Most cybersecurity tools have the ability to detect when a link or an attachment isn’t what it seems, so even if you fall for a clever phishing attempt, you won’t end up sharing your info with the wrong people.

How To Detect Phishing Emails?

seem to be from a bank, company, or social networking site and have a generic greeting.
Seem to be from a person listed in your email address book.
Gives a sense of urgency or a velled threat.
May contain grammatically/spelling mistakes.
Includes links to spoofed websites.
May contain offers that seem to be too good to believe.
Includes official-looking logos and other information taken from legitimate websites.
May contain a malicious attachment.

Anti-Phishing Tool

Netcraft

The Netcraft Anti-Phishing community is effectively a giant neighborhood watch scheme, empowering the most alert and most expert members to defend everyone within the community against Phishing attacks.

PhishTank

Phishtank is a collaborative clearing house for data and information about Phishing on the Internet.

It provides an Open API for developers and researches to Integrate Anti-Phishing Data into their applications.