Phishing attacks: Why is email still such an easy target for hackers?\u00a0The majority of cyber attacks begin with one simple phishing email. So will it ever be possible to close this door to hackers, once and for all?<\/p>\n
Email is incredibly useful, which is why we all still use it. But chief among its downsides (along with getting caught in a group-cc\u2019d message hell) is that email remains one of the most common routes for hackers to attack businesses.<\/p>\n
Around\u00a0one in every hundred messages sent is a malicious hacking attempt.\u00a0That might not seem like a large figure, but when millions of messages are sent every day, it adds up \u2014 especially when it just takes one employee to fall victim to a phishing message and potentially lead to a whole organisation being compromised.<\/p>\n
For example,\u00a0the cyber attack against the Democratic National Committee\u00a0that led to thousands of private emails being exposed in the run up to the US Presidential election started with just one successful phishing email, while countless\u00a0espionage and malware campaigns\u00a0have also gained entry to organisations via an email-based attack.<\/p>\n
But if email leaves us so vulnerable to attempts at hacking, why do we stick with it?<\/p>\n
\u201cEmail is still the main way that two entities who may not have a relationship get together and communicate. Whether it\u2019s a law firm communicating with a business or a candidate applying for a job, email is still the bridge to getting these entities communicating. It\u2019s not going away,\u201d says Aaron Higbee, co-founder and CTO at anti-phishing company Cofense.<\/p>\n
As long as email is here, phishing will also remain a problem \u2014 and while some phishing campaigns are really sophisticated and based around cyber criminals performing deep reconnaissance on targets, other email-based attacks aren\u2019t so sophisticated \u2014 and yet are still worryingly successful.<\/p>\n
Locky ransomware was often delivered to targets in blank phishing messages\u00a0containing just an attachment. In the vast majority of cases, people didn\u2019t open this, but given how Locky was successful, it\u2019s evident that a number of people did. Why did they click the attachment in a blank message?<\/p>\n
\u201cAt the end of the day, we\u2019re people and sometimes we make mistakes. Even careful and aware people could and would click on malicious attachments. Why is that? Because education isn\u2019t enough; people will continue to click on things that look suspicious,\u201d said Liron Barak, CEO and co-founder at security company Bitdam.<\/p>\n
\u201cWe can definitely see there\u2019s been a rise in email attacks in the last year. And something that I believe is that attackers are becoming more and more sophisticated \u2014 attacks are bypassing Microsoft, Gmail and other channels,\u201d she adds.<\/p>\n
Many phishing and spam messages do get blocked by mail providers but there are those that continue to sneak through \u2014 especially into consumer mailboxes, despite the efforts of email providers.<\/p>\n
While enterprises might not think too seriously about the actions their employees take using their personal inboxes, it could have serious consequences; not only is it likely that employees will examine their own emails at the office, many people use their personal email addresses to conduct business activity \u2014 and that\u2019s a security risk.<\/p>\n
\u201cOne of the lessons that comes up very regularly is that one thing people often do wrong is when they conduct official business out of a consumer mailbox as they often don\u2019t understand there\u2019s no defence there,\u201d says Matthew Gardiner, director of product at email security company Mimecast.<\/p>\n
\u201cThe lesson is to have good security defences on your business email and then use your business email for business, not your consumer email. Because once they\u2019re into your personal account, they could be\u00a0loading malware\u00a0onto the machine you use for both,\u201d he says.<\/p>\n
So, when this provides a potential risk to businesses, why is the security of some consumer mailboxes still so relatively poor compared with their enterprise cousins?<\/p>\n
\u201cOne of the sadder situations is here we are protecting the enterprise and they\u2019re getting the full focus and top knowledge to protect them \u2014 but then when you go down to consumers and even small businesses, they\u2019re not really looked after by the security industry,\u201d says Ken Bagnall VP of email security at FireEye.<\/p>\n
There\u2019s also the fundamental problem around email that it\u2019s relatively simple to spoof names and addresses, allowing attackers to claim to be anyone \u2014 perhaps celebrities offering prizes or\u00a0your boss asking you to look at a document or to make a transfer.<\/p>\n
\u201cThere\u2019s really no embedded security in the basic internet for email. So you can claim to be anyone and send an email and the average person will probably trust that,\u201d says Gardiner.<\/p>\n
Add to that how the make-up of phishing messages is changing all the time and you have an evolving problem.<\/p>\n
\u201cWhile we continually evaluate and improve our automated screening protocols to help protect users, spam is an industry-wide ongoing challenge. Bad actors and opportunistic promoters quickly alter their approaches, which makes it difficult for any vendor to address 100 percent of spam,\u201d says Jeff Jones, senior director at Microsoft.<\/p>\n
There\u2019s even\u00a0whole underground marketplaces\u00a0dedicated to conducting phishing attacks, with professional hackers offering their services to crack specific inboxes.<\/p>\n
\u201cTrying to guess what the next step of the attackers will be will always leave us behind, because there\u2019s someone else controlling the landscape and trying to evade us and thinking strategically about bypassing security,\u201d says Bitdam\u2019s Barak.<\/p>\n
Much of the issue lies with the fundamental way in which email works and how this method of communication has become so pervasive in our everyday lives.<\/p>\n
\u201cFor email based phishing to really go away, we\u2019re going to have to come together as a world and say this email protocol that was designed decades ago, it just isn\u2019t working anymore,\u201d says Higbee.<\/p>\n
There is one system that could help and it\u2019s called DMARC \u2014 short for \u201cDomain-based Message Authentication, Reporting & Conformance.\u00a0It\u2019s an email authentication protocol\u00a0that enables users to determine what a legitimate email is and what\u2019s spam, complete with a reporting function for ongoing improvement and protection.<\/p>\n
Many have argued that it would massively release spam, but\u00a0it still isn\u2019t widely used in industry\u00a0as it can be tricky to implement, actually blocking all messages if set up incorrectly.<\/p>\n
Another solution to this could be a reputation score system \u2014 something that Dr Ian Levy, technical director at the UK\u2019s National Cyber Security Agency (NCSC) wants to encourage the industry to pick up. He argues that it could make differentiating between trusted sources and malicious sources much easier for users \u2014 therefore reducing the risk of phishing attacks.<\/p>\n
\u201cWe\u2019re trying to get the industry to do a reputation score,\u201d he says. For example, if an email address has been in use for years, has never sent a bad message that\u2019s one thing; an email address registered today via a Tor node sending its first email may be something that should be treated with a little more caution, he argues.<\/p>\n
\u201cWe want to give people that reputation information about email accounts so they can make decisions.\u201d<\/p>\n
But for now, this is just an idea and phishing attacks against email users are as successful as they ever were \u2014 and some are resigned to this continuing to be a problem for a long time to come.<\/p>\n
\u201cI saw my first phishing email professionally in 1998 \u2014 and if I thought I\u2019d still be working on this phishing problem in 2018, it would\u2019ve seemed unimaginable,\u201d says Cofense\u2019s Higbee. \u201cIt\u2019s such a huge challenge that in five or ten years from now, the email phishing problem will be the same as it is today.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Phishing attacks: Why is email still such an easy target for hackers?\u00a0The majority of cyber attacks begin with one simple phishing email. So will it ever be possible to close this door to hackers, once and for all? Email is incredibly useful, which is why we all still use it. But chief among its downsides […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-42","post","type-post","status-publish","format-standard","hentry","category-tech-news"],"yoast_head":"\n