Victor Font Consulting Group, LLC

The DEX Intranet Specialists

Cybersecurity

The Shadowy Case of Lucas Casimir

By

Lucas Casimir appropriated my bank account! I don't know him. I don't know if this is his real name, or even if he is a male. But whomever he/she is, I'll never forget the name of Cybercriminal Lucas Casimir. The best part is, I don't even know how the account was hijacked.

How would you feel if you woke up one morning and received a message that your checking account was overdrawn by more than $1,700?

Not knowing if this was a scam phishing attempt or a legitimate message, I logged into the account to discover two eCheck transfers to PayPal accounts for fraudulent purchases totaling over $2,800.

Navigating through the bank’s convoluted IVR system was daunting, but I finally reached a live person who helped freeze the account. Within an hour, a temporary credit was applied to the account effectively counteracting the cleared transaction. The bank promised to make me whole if the second transaction cleared.

Checking PayPal, there was no evidence that these transactions originated from my accounts.

Reaching a live person at PayPal is an unbelievably difficult task. An automated message said there would be at least a 3-hour wait before a real person is available. I followed the prompts to request a call back when someone breathing could talk to me.

PayPal's fraud investigator searched their database by bank account number. The investigation revealed that someone by the name of Lucas Casimir was using my bank account to make these transactions through his PayPal account. It's unknown if this is a real person, a false identity, or a stolen identity.

A deep scan of my laptop uncovered no malware, keyloggers, any other kind of suspicious software. How Lucas got my bank account details remains a mystery although he may have purchased it on the dark web from either the JP Morgan Chase or OPM breaches.

What to if your account is hijacked

  • First, contact your bank or credit card company
  • File a complaint with the FBI's Internet Crime Complaint Center
  • Contact the company or companies from whom the fraudulent purchases were made
  • If the fraud was perpetrated through an online service like PayPal, contact the service and do what you can to have the transaction stopped
  • Check haveibeenpwned.com to determine if your account has been compromised through a known breach
  • Close the compromised account
  • Enroll with a credit monitoring service

If it happens to someone who is highly Cybersecurity aware, it can happen to anyone. Be careful and learn everything you can to protect yourself, your business, and your loved ones.

To  learn more, download our free Cybersecurity eBook.

Cyber-MAD and WWIII

By

The proliferation of Stuxnet adds a new threat to the world stage. During the cold war, the Governments of East vs. West kept each other at bay with a nuclear race that promised a Mutually Assured Destruction (MAD) for any nation launching the first strike. Because of cold war propaganda, the worst fear for many people is the idea of a nuclear or electromagnetic pulse (EMP) attack that takes out a country’s infrastructure or worse. Today, a greater threat exists then even nuclear annihilation. It's the modern equivalent of the cold war’s MAD. It is Cyber-MAD, and there's no way of stopping it.

If or when there is a WWIII, it may very well begin with a Stuxnet attack on our power grid and infrastructure. When Stuxnet was released into the wild, it accidentally targeted and crippled critical infrastructure and industrial controls systems worldwide. In the consumer electronics world, it is the killer app. Everything in the modern world—kitchen appliances, ATMs, e-mail, home automation systems, electric grids, water infrastructure, oil and gas controls, communications and transportation systems—are all managed by industrial control systems.

Lights Out by Ted Koppel cover image

For his book Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath, author Ted Koppel interviewed the nation’s top security experts. Koppel concluded:

Top intelligence experts believe the Russians, Chinese, and Iranians are already “inside the (U.S.) grid” with their versions of Stuxnet, and the only thing keeping them from destroying our systems is that the U.S. has cyberweapons in those nations’ industrial control systems, too.

Koppel further asserts that the federal government, while well prepared for natural disasters, has no plan for the aftermath of an attack on the power grid. A well-designed attack on just one of the nation’s three electric power grids could cripple much of our infrastructure. It would create a blackout that lasts for weeks or months. Tens of millions of people across the United States are affected.

Without access to a generator and the fuel to run it, there is no running water, no sewage, no refrigeration or light. No fuel because pumps don’t work. Food and medical supplies dwindle. The consumer electronic devices we rely on are dark. Banks no longer function, looting is widespread. The rule of law and order are challenged and stretched as never before.

Martial law is imposed. The military directly controls the normal civilian functions of government. And the best the current Secretary of Homeland Security can suggest is keeping a battery-powered radio. One can only wonder what we’ll be listening to if the radio stations are off the air because there’s no power for their transmitters.

To  learn more, download our free Cybersecurity eBook.

Anatomy of a Cyberattack

By

A cyberattack is any attempt to expose, alter, disable, destroy, steal or gain unauthorized access to or make unauthorized use of an asset by hacking into a susceptible system.

Cyberattacks are offensive maneuvers that target computer information systems, infrastructures, computer networks, or personal computer devices. They could be prosecuted by nation-states, individuals, groups, society, or organizations. They may originate from anonymous sources.

Cyberattacks are conducted as cybercampaigns, cyberwarfare, or cyberterrorism depending on the context. Cyberattacks can vary in scope and range from installing spyware on a single personal computer to attempting to destroy the infrastructure of an entire nation. Cyberattacks have become increasingly sophisticated and dangerous.

Cyberwarfare utilizes techniques of defending and attacking information and computer networks that inhabit cyberspace, often through a prolonged cybercampaign or series of related campaigns. It denies an opponent’s ability to do the same, while employing technological instruments of war to attack an opponent's critical computer systems.

Cyberterrorism is “the use of computer network tools to shut down critical national infrastructures (such as energy, transportation, government operations) or to coerce or intimidate a government or civilian population”.1

The end result of both cyberwarfare and cyberterrorism is the same—to damage critical infrastructures and computer systems linked together within the confines of cyberspace.

Battle Maneuvers

Just as soldiers conduct certain strategies during a conflict, cybercriminals employ battle tactics and stratagems as well. They will do anything necessary to gain tactical or strategic advantage by accessing a system once they decide it will be profitable, challenging, or fun for them to do so. Battle tactics include:

Soldier reconnoitering the enemy. CC0 license, pixabay.com
Soldier reconnoitering the enemy

  1. Reconnaissance: Cybercriminals reconnoiter their victims and plan their attacks. They research, identify, and select targets by phishing, harvesting email addresses, engaging in social engineering, and other sneaky tactics. They also use various tools to scan and exploit network vulnerabilities, services, and applications.

  2. Weaponization and Payload Delivery: Next, the attackers choose their weapon (malware payload) and the delivery vehicle:

    1. A drive-by download delivers an exploit or advanced malware covertly, usually by taking advantage of a vulnerability in a web browser, operating system, or third-party application

  3. Exploitation: An attacker generally has two options for exploitation:

    1. Social engineering (as previously discussed), and

    2. Software exploits—a more sophisticated technique that essentially tricks the web browser, operating system, or other third-party software into executing an attacker's code.

    Exploits have become an efficient and stealthy method to deliver advanced malware to infiltrate a network or system because they can be hidden in legitimate files. Once the exploitation has succeeded, an advanced malware payload can be installed.

  4. Installation: After a targeted endpoint is infiltrated, the attacker needs to ensure survivability. Various types of advanced malware are used for resilience or persistence, including:

    1. Rootkits provide privileged root-level access to a computer

    2. Bootkits are kernel mode variants of rootkits ordinarily used to attack computers that are protected by full-disk encryption

    3. Backdoors are often installed as a failover to enable an attacker to bypass normal authentication procedures in order to gain access to a compromised system in case the primary payload is detected and removed from the system.

    4. Anti-AV software disables any legitimately installed antivirus software on the compromised endpoint. This prevents the automatic detection and removal of malware. Many anti-AV programs infect the master boot record (MBR) of the target endpoint.

  5. Command and Control (CnC): Communication is the lifeblood of a successful attack. Attackers must maintain communications with infected systems to effectuate command and control, and to retrieve data stolen from a target system or network.

    CnC communications are clandestine. They can't raise any suspicion on the network. Such traffic is usually silenced through obfuscation or hidden through techniques that include:

    1. Encryption with SSL, SSH, some other custom application, or proprietary encryption. BitTorrent is known for its proprietary encryption. It’s a favorite tool both for injecting infections and CnC.

    2. Circumvention via proxies, remote access tools, or by tunneling, which is a communications protocol that allows for the secure movement of data from one network to another through a process called encapsulation.

    3. Port evasion using network anonymizers or port hopping to tunnel over open or nonstandard ports.

    4. Fast flux (dynamic DNS) to proxy through multiple infected hosts, reroute traffic, and make it extremely difficult for forensic teams to figure out where traffic is really going.

  6. Playing the Long Game: As we previously learned, attackers have many different motives for their actions. Attacks can often last months or even years, particularly when the objective is data theft, where the attacker plays the long game and uses a low, slow, fly under the radar attack strategy to avoid detection.

To  learn more, download our free Cybersecurity eBook.

1 Lewis, James. United States. Center for Strategic and International Studies. Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats. Washington, D.C., 2002.

The Role of Malicious Code in Cyberattacks

By

Malicious code refers to viruses, Trojan horses, worms, logic bombs, and any other software created for the purpose of attacking a platform.

Virus: A code segment that replicates by attaching copies of itself to existing executables. The new copy of the virus is executed when a user executes the new host program. The virus may include an additional “payload” that triggers when specific conditions are met.

Trojan Horse: A program that performs a desired task, but that also includes unexpected and undesirable functions. For example, consider an editing program for a multiuser system. This program could be modified to randomly and unexpectedly delete a user’s files each time they perform a useful function (e.g., editing).

Worm: A self-replicating program that is self-contained and does not require a host program or user intervention. Worms commonly use network services to propagate to other host systems.

Logic Bomb: This type of malicious code is a set of instructions secretly and intentionally inserted into a program or software system to carry out a malicious function at a predisposed time and date or when a specific condition is met.

Ransomware: Is a type of malicious code that blocks or limits access to a system by locking the entire screen or by locking down or encrypting specific files until a ransom is paid. There are two different types of ransomware attacks—encryptors and lockers:

  • Encryptors block (encrypt) system files and demand a payment to unblock (or decrypt) those files. Encryptors, or crypto-ransomware, are the most common and most worrisome (e.g., WannaCry).
  • Lockers are designed to lock users out of operating systems. The user still has access to the device and other files, but in order to unlock the infected computer, the user is asked to pay a ransom. To make matters worse, even if the user pays the ransom, there is no guarantee that the attacker will actually provide the decryption key or unlock the infected system.

To  learn more, download our free Cybersecurity eBook.

Top 4 Cybersecurity Threats and Vulnerabilities

By

A vulnerability is a weakness in a system, system security procedure, internal controls, or implementation that could be exploited by a threat source. Vulnerabilities leave systems susceptible to a multitude of activities that can result in significant and sometimes irreversible losses to an individual, group, or organization. These losses can range from a single damaged file on a laptop computer or mobile device to entire databases being compromised at an operations center. With the right tools and knowledge, an adversary can exploit system vulnerabilities and gain access to the information stored on them. The damage inflicted on compromised systems can vary depending on the threat source.

A threat source can be adversarial or non-adversarial. Adversarial threat sources are individuals, groups, organizations, or entities that seek to exploit an organization’s dependence on cyber resources. Even employees, privileged users, and trusted users have been known to defraud organizational systems. Non-adversarial threat sources refer to natural disasters or erroneous actions taken by individuals in the course of executing their everyday responsibilities.

Fraud and Theft

Systems can be exploited for fraud and theft by “automating” traditional methods of fraud or by introducing new methods. System fraud and theft can be committed by insiders (i.e. authorized users) and outsiders. Authorized system administrators and users with access to and familiarity with the system (e.g., resources it controls, flaws) are often responsible for fraud. Former employees also pose a threat given their knowledge of the organization’s operations, particularly if access is not terminated promptly.

Financial gain is one of the chief motivators behind fraud and theft, but financial systems are not the only systems at risk. There are several techniques that cybercriminals use to gather information they would otherwise not have had access to. Some of these techniques include:

Social Media: Social media (e.g., Facebook, Twitter, LinkedIn) has allowed cybercriminals to exploit the platform to conduct targeted attacks. Using easily-made, fake, and unverified social media accounts, cybercriminals can impersonate co-workers, customer service representatives, or other trusted individuals in order to send links to malicious code that steal personal or sensitive organizational information.

Social Engineering: In the context of Information Security, social engineering is a technique that relies heavily on human interaction to influence an individual to violate security protocol and encourages the individual to divulge confidential information. These types of attacks are commonly committed via phone or online. Attacks perpetrated over the phone are the most basic social engineering attacks being committed. For example, an attacker may mislead a company into believing the attacker is an existing customer and have that company divulge information about that customer.

Advanced Persistent Threat (APT): A set of stealthy and continuous computer hacking processes, often orchestrated by a person or persons targeting a specific entity. APTs generally target private organizations, states, or both for business or political motives. APT processes require a high degree of covertness over a long period of time. “Advanced” signifies sophisticated techniques using malware to exploit vulnerabilities in systems. “Persistent” suggests an external command and control system is continuously monitoring and extracting data from a specific target. “Threat” indicates human involvement in orchestrating the attack.

Insider Threat

Employees can represent an insider threat to an organization given their familiarity with the employer’s systems and applications as well as what actions may cause the most damage, mischief, or disorder. Employee sabotage—often instigated by knowledge or threat of termination—is a critical issue for organizations and their systems. In an effort to mitigate the potential damage caused by employee sabotage, the terminated employee’s access to IT infrastructure should be immediately disabled, and the individual should be escorted off company premises.

Examples of system-related employee sabotage include, but are not limited to:

  • Destroying hardware or facilities;
  • Planting malicious code that destroys programs or data;
  • Entering data incorrectly, holding data, or deleting data;
  • Crashing systems; and
  • Changing administrative passwords to prevent system access.

Malicious Hackers and Their Motivations

Malicious hacker is a term used to describe an individual or group who use an understanding of systems, networking, and programming to illegally access systems, cause damage, or steal information. Understanding the motivation that drives a malicious hacker can help an organization implement the proper security controls to prevent the likelihood of a system breach.

Attackers: Attackers break into networks for the thrill and challenge or for bragging rights in the attacker community. While remote hacking once required considerable skills or computer knowledge, attackers can now download attack scripts and protocols from the Internet and launch them against victim sites.

Bot-Network Operators: Bot-network operators assume control of multiple systems to coordinate attacks and distribute phishing schemes, spam, and malicious code. The services of compromised systems and networks can be found in underground markets online (e.g., purchasing a denial of service attack, using servers to relay spam, or phishing attacks).

Criminal Groups: Criminal groups seek to attack systems for monetary gain. Specifically, organized crime groups use spam, phishing, and spyware/malicious code to commit identity theft and online fraud. International corporate spies and organized crime organizations also pose threats to the Nation based on their ability to conduct industrial espionage, large-scale monetary theft, and the recruitment of new attackers. Some criminal groups may try to extort money from an organization by threatening a cyberattack or by encrypting and disrupting its systems for ransom.

Foreign Intelligence Services: Foreign intelligence services use cyber tools as part of their information gathering and espionage activities. In addition, several nations are aggressively working to develop information warfare doctrines, programs, and capabilities. Such capabilities enable a single entity to have a significant and serious impact by disrupting the supply, communications, and economic infrastructures that support military power—impacts that could affect the daily lives of U.S. citizens.

Phishers: Phishers are individuals or small groups that execute phishing schemes to steal identities or information for monetary gain. Phishers may also use spam and spyware/malicious code to accomplish their objectives.

Spammers: Spammers are individuals or organizations that distribute unsolicited e-mail with hidden or false information to sell products, conduct phishing schemes, distribute spyware/malicious code, or attack organizations (e.g., DoS).

Spyware/Malicious Code Authors: Individuals or organizations who maliciously carry out attacks against users by producing and distributing spyware and malicious code. Destructive computer viruses and worms that have harmed files and hard drives include the Melissa Macro Virus, the Explore.Zip worm, the CIH (Chernobyl) Virus, Nimda, Code Red, Slammer, and Blaster.

Terrorists: Terrorists seek to destroy, incapacitate, or exploit critical infrastructures to threaten national security, cause mass casualties, weaken the U.S. economy, and damage public morale and confidence. Terrorists may use phishing schemes or spyware/malicious code to generate funds or gather sensitive information. They may also attack one target to divert attention or resources from other targets.

Industrial Spies: Industrial espionage seeks to acquire intellectual property and know-how using clandestine methods.

Non-Adversarial Threat Sources and Events

Errors and Omissions: Errors and omissions can be inadvertently caused by system operators who process hundreds of transactions daily or by users who create and edit data on organizational systems. Errors by users, system operators, or programmers may occur throughout the life cycle of a system and may directly or indirectly contribute to security problems, degrade data and system integrity. Software applications, regardless of the level of sophistication, are not capable of detecting all types of input errors and omissions. Therefore, it is the responsibility of the organization to establish a sound awareness and training program to reduce the number and severity of errors and omissions.

Loss of Physical and Infrastructure Support: The loss of supporting infrastructure includes power failures (e.g., outages, spikes, brownouts), loss of communications, water outages and leaks, sewer malfunctions, disruption of transportation services, fire, flood, civil unrest, and strikes. A loss of supporting infrastructure often results in system downtime in unexpected ways. For example, employees may not be able to get to work during a winter storm, although the systems at the work site may be functioning as normal.

Information Sharing and the Impacts to Personal Privacy: The accumulation of vast amounts of personally identifiable information by government and private organizations has created numerous opportunities for individuals to experience privacy problems as a byproduct or unintended consequence of a breach in security.

Individuals’ voluntarily sharing PII through social media has also contributed to new threats that allow malicious hackers to use that information for social engineering or to bypass common authentication measures.

Organizations may share information about cyber threats that includes PII. These disclosures could lead to unanticipated uses of such information, including surveillance or other law enforcement actions.

To  learn more, download our free Cybersecurity eBook.

The Cybersecurity Ecosystem

By

Data breaches occur virtually on a daily basis. Cybercriminals are making enormous sums of money by selling breached data, information, or intellectual property on the dark web or in the gray or black markets. It’s a multi-billion-dollar industry run by hacking operations often sponsored by nation-states, criminal organizations, or radical political groups.

Nation-state sponsored cyber-spies make it their full-time job to penetrate government, corporate, and infrastructure systems to gain control over those systems or collect intelligence to progress their own agendas. It’s modern day espionage, but instead of inserting agents on the ground, intelligence and technology are compromised and accessed remotely from anywhere in the world.

Malware secretly installed on your computer can surreptitiously monitor your activity and steal your keystrokes, sending criminals your bank account and credit card login credentials, account numbers, social security number, or any other kind of sensitive information you might otherwise transmit to an online destination.

Another type of malware can hijack your computer’s CPU time and internet bandwidth to add your machine to a huge network of data mining systems that generate bitcoins and other cyber-currency variants. The only ones making money off of this is the criminals—and you’re paying for it!

If you or your company has a website or online business, statistics show that more than half of the traffic hitting your server is probably coming from some sort of cyber-bot or hack attempt. WordPress is a popular web application platform. Wordfence™, a premium security firewall for WordPress, is active on over 2-million WordPress powered sites and stops over 3.5M cyberattacks daily world-wide. Wordfence™ blocks over 1,500 attacks every month on this author’s online business site.

The chances are good that if you’ve ever had an online account with any major retailer, credit card company, business, etc., there is some bit of information about you that can be found circulating on the dark web.

Top 10 Data Breaches of the 21st Century

Here is a list of the top 10 data breaches of the 21st century as compiled by CSOonline:

Breach
Impact
Details

Yahoo

3 billion user accounts
Assumption: a state-sponsored actor hacked system. Compromised data includes names, dates of birth, email addresses, passwords, and security questions and answers.

Adult Friend Finder

More than 412.2 million accounts
Hackers collected 20 years of data on six databases that included names, email addresses and passwords.

eBay

145 million users compromised
Using the credentials of three corporate employees, hackers had full access for 229 days. Compromised data included names, addresses, dates of birth and encrypted passwords.

Equifax

143 million consumers
Social Security Numbers, birth dates, addresses, and in some cases drivers' license numbers; 209,000 consumers also had their credit card data exposed.

Heartland Payment Systems

134 million credit cards
Exposed through SQL injection used to install spyware on Heartland's data systems

Target

Credit/debit card information and/or contact information of up to 110 million people compromised
Hackers gained access through a third-party HVAC vender to its point-of-sale (POS) payment card readers. The company estimated the cost of the breach at $162 million.

TJX Companies, Inc.

94 million credit cards exposed
Unknown how hackers compromised system. Two theories: breached wireless transfer between two Marshall's stores in Miami, Fla, or breaking into the TJX network through in-store kiosks that allow people to apply for jobs electronically

Uber

Personal information of 57 million Uber users and 600,000 drivers exposed
Two hackers were able to access Uber’s GitHub account, where they found username and password credentials to Uber’s Amazon Web Services account. Uber paid the hackers $100,000 to destroy the data with no way to verify that they did.

JP Morgan Chase

76 million households and 7 million small businesses
Data included contact information—names, addresses, phone numbers and email addresses—as well as internal information about the users, according to a filing with the Securities and Exchange Commission

US Office of Personnel Management (OPM)

Personal information of 22 million current and former federal employees and contractors

Hackers, said to be from China, were inside the OPM system starting in 2012, but were not detected until March 20, 2014. A second hacker, or group, gained access to OPM through a third-party contractor in May 2014, but was not discovered until nearly a year later. The intruders exfiltrated personal data—including in many cases detailed security clearance information and fingerprint data.

For details, see the House Committee on Oversight and Government Reform report: “The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation.”

According to the United Nations, the world population as of July 2018 stands at 7.6 billion. These 10 breaches represent over 4.2 billion compromised accounts. I know we’re comparing apples and oranges right now, but if we could correlate a one-to-one relationship between breached accounts and an individual, 56% of all people have had their online identities compromised. That’s a whole lot of cybercrime!

And these are just a handful of the breaches we know about so far. The breach list goes on and on and includes some major players like Sony's PlayStation Network, Anthem Blue Cross, RSA Security, Stuxnet, Verisign, Home Depot, Adobe, Experian, and many, many others. Some of these companies actually provide components for Cybersecurity implementations and they couldn’t even protect themselves. Think about how many breaches there may be that haven’t been discovered yet.

Stuxnet is a little different. It is not a company, but is in fact malware in and of itself. Discovered in 2010, it is a computer worm capable of transferring itself from device to device once it has penetrated a network. As far as can be determined, it was meant to attack Iran's nuclear power program, but it also serves as a template for real-world intrusion and service disruption of power grids, water supplies, or public transportation systems—aka the Internet of Things (IoT).

Iranian President Mahmoud Ahmadinejad during a tour of uranium enrichment centrifuges at Natanz in 2008. Source: Office of the Presidency of the Islamic Republic of Iran
Iranian President Mahmoud Ahmadinejad during a tour of uranium enrichment centrifuges at Natanz in 2008.
Source: Office of the Presidency of the Islamic Republic of Iran

Stuxnet only targets Siemens S7-300 Supervisory Control and Data Acquisition (SCADA) systems. It damaged Iran’s nuclear program by destroying an estimated 984 uranium enrichment centrifuges that were controlled by Siemens SCADA devices. Stuxnet spread quickly to Indonesia, India, Azerbaijan, United States, Pakistan, and other countries. The attack has been attributed to a joint effort by the US and Israel, although never officially acknowledged as such. If true, it means the worm couldn’t be controlled and ironically turned on its own creators.

Siemens Simatic S7-300 PLC CPU with three I/O modules attached, Image By Ulli1105 - Own work, CC BY-SA 2.5, https://commons.wikimedia.org/w/index.php?curid=1623227
Siemens Simatic S7-300 PLC CPU with three I/O modules attached
Image By Ulli1105 - Own work, CC BY-SA 2.5, https://commons.wikimedia.org/w/index.php?curid=1623227

Intrusions by Any Other Name

Intrusions come in all sizes and shapes. We already discussed the Stuxnet computer worm, but intrusions go far beyond malware.

Intrusions are often targeted to compromise specific information. For example, customer information from Target and Anthem Blue Cross, intellectual property from Sony Pictures, and employee information from the OPM.

Another type of targeted attack is hacktivism. In February 2015, a hacktivist group calling themselves Lizard Squad hijacked Lenovo’s website redirecting customers to a site that displayed selfie slideshows. It was an embarrassment for Lenovo and the resulting loss of revenue and remediation costs hurt their bottom line.

Intrusion Types/Vehicles

Phishing: A fraudulent attempt to obtain sensitive information such as usernames, passwords, credit card details, and money, often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.

Phishing is typically carried out by email spoofing or instant messaging, directing users to enter personal information at a fake website, the look and feel of which are identical to the legitimate site. The only difference is the URL of the website in concern. An example might be an email reportedly from your credit card company announcing that your account has been locked. You are directed to login and correct the problem. Spoofing emails are often sent to distribution lists where the recipient names have been hidden. Hovering your mouse over the link without clicking it will reveal the link’s destination.

Spear Phishing: A targeted phishing attempt directed at specific individuals or companies. Attackers may gather personal information about their target to increase their probability of success. This technique is by far the most successful on the Internet today, accounting for 91% of attacks1.

Spear phishing is not always conducted through electronic communications. All that’s required is for someone to click on a link. The link may even be on a social networking site like Facebook or Twitter.

Clone Phishing: A type of phishing attack where a legitimate and previously delivered email containing an attachment or link has had its content and recipient addresses hijacked and used to create an almost identical or cloned email. The attachment or link is replaced with a malicious version and sent from a spoofed email address to appear as though it came from the original sender.

Whaling: Phishing attacks directed specifically at senior executives and other high-profile targets.2 Whaling scam emails masquerade as critical business communications, sent from a legitimate business authority. The content is often written as a legal subpoena, customer complaint, or executive issue.

DoS, DDoS: A denial-of-service attack (DoS) is a cyberattack in which the criminal seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting the services of a host connected to the Internet. In a distributed denial-of-service attack (DDoS), the incoming traffic flooding the victim website originates from many different sources, effectively making it impossible to stop the attack by blocking a single source.

Botnet, Bots: A portmanteau of “robot” and “network”, a botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets are used to perform DDoS attacks, steal data, send spam, and allow the attacker to access the target device and its connection.

To  learn more, download our free Cybersecurity eBook.

1 “Fake subpoenas harpoon 2,100 corporate fat cats“. The Register. Archived from the original on January 31, 2011. Retrieved July 31, 2018.
2 Stephenson, Debbie. “Spear Phishing: Who's Getting Caught?“. Firmex. Retrieved July 31, 2018.