1 00:00:00,05 --> 00:00:01,08 - [Instructor] Phishing and smishing 2 00:00:01,08 --> 00:00:03,06 are social engineering attacks 3 00:00:03,06 --> 00:00:05,03 designed to trick users 4 00:00:05,03 --> 00:00:08,00 into sharing sensitive personal information, 5 00:00:08,00 --> 00:00:09,08 like usernames, passwords, 6 00:00:09,08 --> 00:00:12,06 and credit card details with attackers. 7 00:00:12,06 --> 00:00:13,06 Let's take a look 8 00:00:13,06 --> 00:00:16,06 at what these threats are and how they work. 9 00:00:16,06 --> 00:00:19,03 Phishing has been around since the 1990s, 10 00:00:19,03 --> 00:00:21,04 but it's still going strong. 11 00:00:21,04 --> 00:00:23,04 IBM Security X-Force reported 12 00:00:23,04 --> 00:00:27,07 that phishing was the top method of compromise in 2021. 13 00:00:27,07 --> 00:00:29,03 The most common phishing technique 14 00:00:29,03 --> 00:00:33,00 is to send a fraudulent email to a targeted user. 15 00:00:33,00 --> 00:00:34,06 The email is designed to look 16 00:00:34,06 --> 00:00:36,06 like it came from a trusted entity 17 00:00:36,06 --> 00:00:38,02 and it will often appear urgent, 18 00:00:38,02 --> 00:00:40,06 so the recipient will quickly open it. 19 00:00:40,06 --> 00:00:43,05 Typically, the email will contain a manipulated link 20 00:00:43,05 --> 00:00:46,06 that looks like it goes to a real website. 21 00:00:46,06 --> 00:00:48,05 If the user clicks the link, though, 22 00:00:48,05 --> 00:00:50,02 it goes to a forged website 23 00:00:50,02 --> 00:00:52,08 designed to look like the real thing. 24 00:00:52,08 --> 00:00:55,02 Once there, the target will usually be prompted 25 00:00:55,02 --> 00:00:58,02 to enter their username and password for the site. 26 00:00:58,02 --> 00:01:01,02 If they do, the attacker will now have their credentials 27 00:01:01,02 --> 00:01:02,05 for the real site. 28 00:01:02,05 --> 00:01:03,05 Depending on the site, 29 00:01:03,05 --> 00:01:06,03 this can turn into an immediate loss of information 30 00:01:06,03 --> 00:01:08,05 or money for the victim. 31 00:01:08,05 --> 00:01:11,03 In some cases, the phishing email won't have a link. 32 00:01:11,03 --> 00:01:13,08 It will have a malicious attachment. 33 00:01:13,08 --> 00:01:16,01 If the recipient clicks on the attachment, 34 00:01:16,01 --> 00:01:18,05 it will often attempt to install ransomware, 35 00:01:18,05 --> 00:01:21,04 which is another threat I cover in this course. 36 00:01:21,04 --> 00:01:23,08 One of the keys to a successful phishing attack 37 00:01:23,08 --> 00:01:25,03 is making the emails look like 38 00:01:25,03 --> 00:01:27,06 they came from trusted sources. 39 00:01:27,06 --> 00:01:30,07 So phishing attackers frequently co-op trusted brands 40 00:01:30,07 --> 00:01:36,07 like Microsoft, Apple, Google, Chase, and Amazon. 41 00:01:36,07 --> 00:01:40,00 Phishing email subject lines often have a certain style. 42 00:01:40,00 --> 00:01:42,03 Here are examples of typical subject lines 43 00:01:42,03 --> 00:01:44,04 used in phishing emails. 44 00:01:44,04 --> 00:01:46,01 "Your account will be locked." 45 00:01:46,01 --> 00:01:48,08 "Important: Please log into your account 46 00:01:48,08 --> 00:01:50,08 to verify your info." 47 00:01:50,08 --> 00:01:52,05 And "Invoice due." 48 00:01:52,05 --> 00:01:53,09 Note, how they sound urgent 49 00:01:53,09 --> 00:01:57,00 or at least important enough to not ignore. 50 00:01:57,00 --> 00:01:59,03 Spear phishing is a variety of phishing 51 00:01:59,03 --> 00:02:02,09 that customizes email attacks to specific users, 52 00:02:02,09 --> 00:02:07,02 hoping the illusion of familiarity will create more trust. 53 00:02:07,02 --> 00:02:10,03 Smishing has many of the same characteristics of phishing, 54 00:02:10,03 --> 00:02:12,09 but instead of sending fraudulent emails, 55 00:02:12,09 --> 00:02:16,05 the attackers send SMS texts to the victim's phone. 56 00:02:16,05 --> 00:02:19,08 Common smishing text messages often impersonate a bank 57 00:02:19,08 --> 00:02:20,09 with an urgent message 58 00:02:20,09 --> 00:02:22,06 about how your account has been locked 59 00:02:22,06 --> 00:02:24,06 due to suspicious activity, 60 00:02:24,06 --> 00:02:26,01 or a recent payment was made 61 00:02:26,01 --> 00:02:28,07 and the bank needs your confirmation. 62 00:02:28,07 --> 00:02:31,00 Then there's usually a link to a malicious site 63 00:02:31,00 --> 00:02:34,05 designed to steal your online banking credentials. 64 00:02:34,05 --> 00:02:37,02 Smishing scams can also include text messages 65 00:02:37,02 --> 00:02:38,04 about winning a prize 66 00:02:38,04 --> 00:02:40,08 that you have to redeem through a website. 67 00:02:40,08 --> 00:02:42,05 You should immediately be suspicious 68 00:02:42,05 --> 00:02:46,01 of getting anything for free through a text message. 69 00:02:46,01 --> 00:02:48,09 Another form of smishing includes text messages 70 00:02:48,09 --> 00:02:50,07 impersonating someone you work with, 71 00:02:50,07 --> 00:02:53,09 like your boss or the CEO of your company. 72 00:02:53,09 --> 00:02:57,00 Threat actors can easily find the company you work for 73 00:02:57,00 --> 00:03:00,00 and get your cellphone number to pull off this attack. 74 00:03:00,00 --> 00:03:01,03 They'll send a text message, 75 00:03:01,03 --> 00:03:03,03 pretending to be your boss or CEO, 76 00:03:03,03 --> 00:03:05,07 and ask you to help them with a task. 77 00:03:05,07 --> 00:03:08,07 The task often requires you to buy gift cards 78 00:03:08,07 --> 00:03:11,01 to give to employees or clients. 79 00:03:11,01 --> 00:03:12,02 If you buy the cards, 80 00:03:12,02 --> 00:03:15,01 the attackers will ask you to send them the codes, 81 00:03:15,01 --> 00:03:16,02 which will allow them 82 00:03:16,02 --> 00:03:19,05 to instantly extract the money off the cards. 83 00:03:19,05 --> 00:03:21,05 Because both phishing and smishing attacks 84 00:03:21,05 --> 00:03:23,09 are cheap, simple, and effective, 85 00:03:23,09 --> 00:03:25,08 we can expect that they will continue to be 86 00:03:25,08 --> 00:03:27,04 among the most common attacks 87 00:03:27,04 --> 00:03:30,00 on the cybersecurity threat landscape.