Skip to main content

Phishing Protection

Phishing attacks are a critical cybersecurity issue in every industry vertical and poses significant risks to both individuals and organizations. This document provides a comprehensive understanding of phishing attacks and the protections offered by Keep Aware's browser security solution. This includes breaking down phishing into its first principles, explaining its relevance, and detailing how our technology mitigates this threat.

Fundamentals of Phishing Attacks​

Phishing is a cyber attack technique where attackers impersonate legitimate entities to deceive individuals into revealing sensitive information, such as login credentials. To trick an unsuspecting victim into revealing credentials to a specific site, phishing attacks often involve a fake login page impersonating that specific site.

Basic Principles​

  • Impersonation: Attackers impersonate trusted entities to gain the victim's trust.
  • Sensitive Information: The most common goal is to extract sensitive information.
  • Communication Channels: Commonly executed via email (or other messaging mediums) and fraudulent websites.

Common Scenario​

  1. An employee clicks a link, in an email, that eventually directs their browser to a malicious login page.
  2. The webpage is impersonating Microsoft's login page, and the employee types in their Microsoft credentials.
  3. The malicious webpage may then redirect the employee to the legitimate Microsoft page, making the employee none the wiser that they fell for a phishing attack.
  4. The attacker now has the employee's legitimate credentials and can use them to access organizational data and/or to further penetrate your organization's security defenses.

Variations​

Additional types of phishing attacks include:

  • Spear-Phishing: Highly targeted phishing attacks aimed at specific individuals or at specific organizations.
  • Whaling: A specific form of spear-phishing that targets high-profile executives or "big fish" in organizations.
  • Vishing and Smishing: Voice and SMS phishing, respectively.

Context and Background​

The term "phishing" is derived from "fishing," indicating the use of bait to lure victims into a trap. According to this Verizon article, the first phish occurred in the mid-1990s and involved hackers posing as AOL employees over instant message to steal users' passwords and ultimately control their accounts.

Current Landscape​

Today, phishing attacks are more sophisticated and widespread. Cybercriminals use advanced techniques, including spear-phishing (targeted attacks) and vishing (voice phishing) (refer to Variations for more information), making phishing a pervasive threat over many communication channels and across industries.

The 2024 Verizon DBIR report emphasizes that the human element continues to play a crucial role in data breaches, with 68% of breaches involving human error, such as falling victim to phishing attacks or other social engineering tactics.

Moreover, the United States Cyber Security and Infrastructure Agency (CISA) reports, "more than 90% of all cyber attacks begin with phishing".

Concurring with the above findings, the Data-Driven Defense Evangelist at KnowBe4 has held firm for years that organizations would reduce 70% to 90% of all cybersecurity risk by fixing just one thing: solving for social engineering and phishing.

Real-World Examples​

  • 2016 Democratic National Committee (DNC) Hack: Attackers used spear-phishing emails to compromise email accounts, leading to a significant data breach.

Advancements in artificial intelligence (AI) and machine learning (ML) and their ease of access and use have led to more convincing and personalized phishing attacks created in less time.

Therefore, expect an increase in personalized phishing attacks against your organization that are more likely to dupe employees and bypass traditional security defenses.

Detailed Explanation of Phishing Attacks​

Components​

Phishing involves creating convincing bait (e.g., emails, messages), distributing it to targets, and capturing sensitive information through fake websites or malicious attachments.

  • Bait: The lure, often in the form of an email or message, designed to attract the victim to take an action, such as clicking a link.
  • Hook: The mechanism used to capture information, such as a fake login page.
  • Catch: The end result, which is often stolen data or installed malware.

Techniques​

Attackers use various techniques to bypass security measures and appear legitimate, including:

  • Scraping and using web code from legitimate brands to visually appear the same and thus more successfully dupe users into providing sensitive information.
  • Obfuscating and breaking up HTML elements to bypass detections using simple string matching.
  • Leveraging open redirect flaws in legitimate, third-party websites to bypass email security and DNS filtering.
  • Creating a multi-step phishing attack that chains legitimate domain visits and social engineering prompts to bypass email security and DNS filtering and ultimately deliver the user to a malicious site.
  • Malintent web event handlers, such as those that update a URL from a benign link to a malicious link only upon click.
  • Combining phishing attacks with browser-in-the-browser (BitB) attacks to ultimately deceive the user into believing they were on the legitimate site.
  • Redirecting malformed or unexpected web requests to a legitimate domain or a benign webpage; when organizations lack the visibility and the context of web content, this technique hinders security investigations or can resolve them incorrectly as False Positives.
  • Forcing web page mutations and manipulating the DOM tree via malicious scripts to bypass simple detection technology that neither inspects subsequent page mutations nor analyzes scripts.

Challenges and Considerations​

Common Issues​

  • Sophistication of Attacks: Increasingly complex phishing techniques, such as multi-step phishing attacks that bypass layered defenses that lack context-aware and content-aware visibility into the browser.
  • Human Error: Often considered the weakest link in cybersecurity, users still fall for both simple and sophisticated social engineering and phishing attacks.
  • Resource Constraints: Smaller organizations or those with resource constraints may struggle to implement comprehensive defenses for the pervasive and evolving phishing threat landscape.

Solutions and Mitigation​

  • Advanced Detection Tools: Utilizing tools with deep visibility to detect and block phishing attempts.
  • User Education: Regular training and awareness programs.
  • Multi-Factor Authentication (MFA): Adding multiple layers of security to verify users' identities across internal and third-party business applications.

The Keep Aware Advantage​

Though phishing attacks generally begin via email, they often are only successful because traditional cyber security stacks lack tools to directly secure the browser. The browser—where modern workforces perform upwards of 90% of their work—is where phishing and social engineering thrive. By deploying lightweight detection and protection technology with unique employee feedback capabilities, Keep Aware supports safe cybersecurity habits and mitigates the substantial browser risk.

High Level​

Keep Aware offers robust browser security protections to secure the browser and combat phishing. Our solution includes:

  • Deep Visibility, Real-Time Detection: With a deep level of visibility into browser activities, it identifies and blocks phishing attempts in the browser in real-time.
  • User Training: Customizable notices to educate users on phishing awareness and to report suspicious sites.
  • Authentication Visibility: Insight into authentication methods across your application ecosystem and where strong authentication mechanisms, such as multi-factor authentication (MFA), are missing.

Technical Level​

Additional technical capabilities include:

  • Identifying malicious login pages impersonating popular brands.
  • Identifying malintent characteristics and behaviors of a webpage, including suspicious event handlers and other social engineering tactics.
  • Ability to distinguish malintent on legitimate sites abused in multi-step phishing attacks.
  • Inspecting for browser-in-the-browser (BitB) attacks.
  • Inspecting DOM tree elements on a webpage and its mutations.
  • Out-of-the-box detections for and protections against phishing trends and campaigns.
  • Safeguards—or, user and browser protections—that are customizable to your unique organizational risk appetite.
  • A best practices patterns feed with foundational and high-fidelity detections to rapidly protect your employees and reduce organizational risk.

Summary​

Phishing is a pervasive cybersecurity threat that exploits human vulnerabilities. Understanding its principles, components, techniques, and common issues is crucial for defense. Keep Aware provides comprehensive and out-of-box capabilities to mitigate this risk effectively.

To enhance your organization's phishing defenses, apply Policies of category "phishing" to user and browser Profiles and/or subscribe Profiles to the Best Practices Feed.

References​

Further Reading​

Additional resources for readers who want to delve deeper into the topic.

Table of Contents