All language subtitles for 08. Phishing

Welcome to the lecture about fishing, so let's start fishing is a fraudulent attempt to obtain sensitive

information by impersonating a trustworthy entity.

The sensitive information can range from usernames and passwords to credit cards, details or other

confidential information.

You probably received emails upon emails telling you that you have won some big prize in a contest you

never enrol to, or that you have to give some money to a Nigerian prince and that he will pay you back

handsomely.

These are just a couple of examples of phishing.

Now that we know what phishing is, let's explore some techniques used for phishing.

First, we have spearfishing.

This type of phishing attack targets a specific person that was previously analyzed in detail.

Whaling is a very similar attack that usually targets C-level executives, senior managers or people

that have access to specific areas, such as, for example, people performing financial transactions.

Another type of attack is cat phishing, where in a deceptive person creates a fictional online persona

for the purpose of luring someone into a relationship with the intent of gaining access to confidential

information and or restricted resources.

Next, we have crawfishing, which is a type of attack in which a previously delivered email that contains

an attachment or a link is used to create a new, almost identical, malicious email.

The attachment or link within the cloned email is replaced with a malicious version, and that email

sent from a spoofed email address to appear as if it was sent by the original sender.

It may claim to be a recent or just an updated version of the original email.

Usually this type of phishing requires that either the sender or the recipient was previously hacked

so that the malicious third party can obtain the original version of the email after KLON phishing.

We'll talk about anglerfish.

This is this is a specific type of phishing attack that exists on social media.

Cyber criminals create fake social media accounts that try to mimic accounts of companies these fake

accounts can emulate, for example, the customer support of a company.

So, for example, when a customer would make a complaint about the service of the company, the fraudsters

could try to redirect him to a malicious website or try to obtain his credentials to, for example,

between Cote's solve the complaint.

Last but not least, we have search engine fishing, this method is using malicious websites which are

optimized for certain keywords so that they appear as one of the first results when searching for a

particular keyword, such as, for example, online shop on search engines, such as, let's say, Google

the user seeing the malicious website as one of the first results might open the website.

And Prosser's then might trick the user into giving confidential information such as credit card information

or credentials.

We've seen phishing types grouped by technique.

Now let's have a look at different phishing types grouped by the medium used.

First, the most common type of phishing is email phishing, you probably receive phishing emails almost

every day.

Another popular way is using fraudulent websites.

Those websites try to trick their users into giving confidential information.

Next type will talk about his evil twin, this phishing attack.

Target's Wi-Fi access points.

Basically, an evil twin is a fraudulent Wi-Fi access point that appears to be legitimate, but actually

is used to eavesdrop on communication similar to other phishing types.

It is used to obtain confidential information of users by either monitoring their connection or by alerting

them to fraudulent websites.

Yet another type is voice phishing, which refers to phishing done via audio calls such as normal phone

calls or WhatsApp, Skype or other calls.

Last type that were discussed today is mission smashing, or SMS.

Phishing refers to phishing attempts than using messaging systems such as the classic Esme's or newer

messaging systems such as WhatsApp or Skype.

Even though we already saw that phishing attacks can be quite varied, phishing usually share some common

features that we should look out for.

Be suspicious of any email, message, website or call that has any of the following features.

Phishing usually contains some too good to be true statements.

For example, many claim that you have won some big prize like a car or a smartphone or the lottery,

or that you can buy something expensive, like, for example, a house or both for a very cheap price.

Another tactic used is intimidation.

Many phishing scams make all kinds of unrealistic threats, such as saying that your account will close

soon and that you have to act quickly to stop that.

Other common statements are all kind of blackmail attempts, such as threatening to leak private information

such as pictures unless you react.

Next on our list, we have a sense of urgency.

Almost all phishing scams rely on a sense of urgency.

For example, a lot of them are saying that you can get the price or that unbelievable deal for a very

limited amount of time or that your account will be closed in a short period of time unless you react

whenever you receive such communication, be extra suspicious and never take decisions.

Another feature is that there is always a catch.

For example, you receive an email saying that you can get your awesome price or awesome offer if you

first send some money for expenses and fees.

This is usually a sign of phishing at that next.

We have deceptive links and attachments.

We have to pay extra attention to the emails that contain links or attachments from others, then to

use links that are either misspelled or dodgy in order to trick their victims into going on fraudulent

websites.

Also, be careful the hyperlink displayed in the email might not be the actual link that will be redirected

to the check.

The actual value of the hyperlink hover over the link whenever in doubt.

Just go manually on the website of the organization regarding attachments.

If you see an attachment that you weren't expecting or that doesn't make sense.

Don't open it.

Attachments can often contain malware.

Yet another common feature of phishing is having an unusual sender.

Always pay attention to the sender and do not trust the emails or messages sent from senders that look

dodgy or if anything, seems unusual.

Such as, for example, a character which is out of place in the sender's name and or address.

Next on our list, we have poor spelling.

Many phishing attacks usually impersonate well-known companies or organization, however many times

you can find multiple grammar mistakes and spelling errors.

This is a sign of phishing attempt as big organization would not distribute messages with such mistakes.

The last feature on our list is asking for sensitive information.

Fraudsters usually try to obtain personal information.

If you receive an email asking you to give credentials or other sensitive information, don't reply

to it.

Now let's test our knowledge and see how many phishing features we can find in these examples.

You can post the video here and look for clues.

Ready, let's start first, let's check the center, let's say that someone important looks like someone

we can trust, but if we check the organization, we see a typo.

Let's continue and have a look.

When it wasn't it was sent on a Saturday at four a.m. in the morning on Christmas night, to be precise.

This is also another thing that looks quite suspicious on its own.

OK, so let's continue.

Let's have a look at the subject.

Urgent action needed with three exclamation marks, which definitely shows urgency, which, as we remember,

is also a potential feature of fishing, especially when combined with the fact that the email was sent

on Christmas night.

Let's also have a look at the body.

Dear customer, your account will be deleted in 24 hours.

Please access the following link to reverse this action.

Then we have the actual link.

Your bank that, your bank dot com.

Again, we see the sense of urgency coming up, giving us only 24 hours to react.

We also have a URL here.

And that forsight, it seems that it's from our favorite bank.

But if we look a bit closer, we see something strange.

Your bank is just a subdomain of the actual domain, which is a misspelled version of your bank with

double B..

So another red flag.

Let's continue reading the body.

Also download the attachment learning how to reduce loan rate and loan amount by 75 percent.

We have three more signs that this is a phishing attack, first, spelling and grammar mistakes.

Second, there's an offer that is too good to be true.

Last but not least, we also have an attachment which if we have a closer look to, we see that it's

also an executable.

So yet another red flag.

Before we wrap up this lecture, let's see briefly how we can protect ourselves against phishing attacks.

First, always take your time and think before you click.

Look at features of phishing.

And if you find any, don't click on any link and do not download any attachment.

Second, never provide information such as credentials, personal data or credit card information.

Besides, that is antivirus software having antivirus software installed.

My protecting in case you get infected with malware in the unfortunate case that you open an attachment

from a phishing email.

Another thing that would help you protect yourself is keeping your software up to date.

This refers to your operating system browser application.

Basically everything after the malware sent by fraudsters takes advantage of abilities from other unpatched

versions of software.

So keeping your software up to date will make it harder for hackers to harm you.

Last but not least, check the website security.

If you click on a link from an email, always check that it is indeed the genuine website that you actually

wanted to use, especially if you want to provide credentials or credit card information, which says

that you should also check that the URL begins with https.

And if you have any doubt, check the security certificate as well.

You'll learn how to check the website certificate in the How to Protect Yourself lecture.

That being said, in this lecture, we learned what phishing is.

We explored different types of phishing, discussed some common features of phishing, and tested our

knowledge with an example.

Finally, we had a quick look at how to protect ourselves against phishing.

With that, we conclude this lecture.

As always, if you have any questions, don't hesitate to ask us.

See you soon in the next lecture.