Beyond social engineering, users should know about many common attacks such as spear phishing and whaling. Do you know the differences between these two attacks? You should if you plan to take the Security+ exam. This post should help.
Here’s a sample question:
Q. Attackers are targeting C-level executives in your organization. Which type of attack is this?
A. Phishing
B. Spear phishing
C. Vishing
D. Whaling
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Spear Phishing
Spear phishing is a targeted form of phishing. Instead of sending the email out to everyone indiscriminately, a spear phishing attack attempts to target specific groups of users, or even a single user. Spear phishing attacks may target employees within a company or customers of a company.
As an example, an attacker might try to impersonate the CEO of an organization in an email. It’s relatively simple to change the header of an email so that the From field includes anything, including the CEO’s name and title. Attackers can send an email to all employees requesting that they reply with their password. Because the email looks like it’s coming from the CEO, these types of phishing emails fool many users.
One solution that deters the success of these types of spear phishing attacks is to use digital signatures. The CEO and anyone else in the company can sign their emails with a digital signature. This provides a high level of certainty to personnel on who sent the email. Chapter 10, “Understanding Cryptography,” of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide covers digital signatures in great depth.
Whaling
Whaling is a form of spear phishing that attempts to target high-level executives. Las Vegas casinos refer to the big spenders as whales, and casino managers are willing to spend extra time and effort to bring them into their casinos. Similarly, attackers consider high-level executives the whales, and attackers are willing to put in some extra effort to catch a whale because the payoff can be so great. When successful, attackers gain confidential company information that they might not be able to get anywhere else.
As an example, attackers singled out as many as 20,000 senior corporate executives in a fine-tuned phishing attack. The emails looked like official subpoenas requiring the recipient to appear before a federal grand jury and included the executive’s full name and other details, such as their company name and phone number. The emails also included a link for more details about the subpoena. If the executives clicked the link, it took them to a web site that indicated they needed a browser add-on to read the document. If they approved this install, they actually installed a keylogger and malware. The keylogger recorded all their keystrokes to a file, and the malware gave the attackers remote access to the executives’ systems.
Similar whaling attacks have masqueraded as complaints from the Better Business Bureau or the Justice Department. Executives are sensitive to issues that may affect the company’s profit, and these attacks get their attention. Although not as common, some whaling attacks attempt to reach the executive via phone to get the data. However, many executives have assistants who screen calls to prevent attackers from reaching the executive via phone.
Remember this
A spear phishing attack targets specific groups of users. It could target employees within a company or customers of a company. Digital signatures provide assurances to recipients about who sent an email, and can reduce the success of spear phishing. Whaling targets high-level executives.
Q. Attackers are targeting C-level executives in your organization. Which type of attack is this?
A. Phishing
B. Spear phishing
C. Vishing
D. Whaling
Answer is D.Whaling is a type of phishing that targets high-level executives, such as CEOs, CIOs, and CFOs. Because whaling is more specific than phishing, phishing isn’t the best answer.
Phishing is email sent to a wide variety of people hoping to trick them into clicking a link or giving up personal information. Phishing is less specific than whaling, so it isn’t the best answer.
Spear phishing is a targeted phishing attack, such as targeting a group of users within a single organization. While whaling is a form of spear phishing because it targets executives, all spear phishing does not target executives so whaling is a better answer.
Vishing is similar to phishing, but it uses the phone instead.