If you’re planning to take the SY0-401 or the SY0-501 Security+ exam, you should have a basic understanding of various types of attacks. This includes attacks such as phishing, spear phishing, whaling, and vishing.
For example, can you answer this question?
Q. A recent spear phishing attack that appeared to come from your organization’s CEO resulted in several employees revealing their passwords to attackers. Management wants to implement a security control to provide assurances to employees that email that appears to come from the CEO actually came from the CEO. Which of the following should be implemented?
A. Digital signatures
B. Spam filter
C. Training
D. Metrics
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Spear Phishing
Spear phishing is a targeted form of phishing. Instead of sending the email out to everyone indiscriminately, a spear phishing attack attempts to target specific groups of users, or even a single user. Spear phishing attacks may target employees within a company or customers of a company.
As an example, an attacker might try to impersonate the CEO of an organization in an email. It’s relatively simple to change the header of an email so that the From field includes anything, including the CEO’s name and title. Attackers can send an email to all employees requesting that they reply with their password. Because the email looks like it’s coming from the CEO, these types of phishing emails fool many users.
One solution that deters the success of these types of spear phishing attacks is to use digital signatures. The CEO and anyone else in the company can sign their emails with a digital signature. This provides a high level of certainty to personnel on who sent the email.
Phishing From APTs
Advanced persistent threats (APTs) often gain a foothold in a target’s network after a successful spear phishing or whaling attack. These two blog posts discuss these attacks in more detail:
Russian Malicious Cyber Activity
Beware of Email from Friends
Criminals have become adept at impersonating your friends. They scan social media sites and identify your friends and family. They then send emails to you that look like they are from your friends or family members, but they really aren’t.
As an example, imagine you’re friends with Lisa Simpson. You might receive an email that includes “Lisa Simpson” in the From block. However, if you look at the actual email address, you’d find it is something different, such as xyz@yahoo.com. Many times, the owner of the email account (xyz@yahoo.com in this example) is unaware that criminals are using it to send malicious email. A common scenario is that the email account owner’s computer is part of a botnet, and the bot herder is sending spam and other malicious email to people via this email account.
Phishing to Validate Email Addresses
A simple method used to validate email addresses is the use of beacons. A beacon is a link included in the email that links to an image stored on an Internet server. The link includes unique code that identifies the receiver’s email address.
For the email application to display the image, it must retrieve the image from the Internet server. When the server hosting the image receives the request, it logs the user’s email address, indicating it’s valid. This is one of the reasons that most email programs won’t display images by default.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Phishing to Get Money
The classic Nigerian scam (also called a 419 scam) is alive and well. You receive an email from someone claiming a relative or someone else has millions of dollars. Unfortunately, the sender can’t get the money without your help. The email says that if you help retrieve the money, you’ll get a substantial portion of the money for your troubles.
This scam often requires the victim to pay a small sum of money with the promise of a large sum of money. However, the large sum never appears. Instead, the attackers come up with reasons why they need just a little more money. In many cases, the scammers request access to your bank account to deposit your share, but instead they use it to empty your bank account.
There are countless variations. Lottery scams inform email recipients they won. Victims sometimes have to pay small fees to release the funds or provide bank information to get the money deposited. They soon learn there is no prize.
In the past, criminals and criminal organizations were behind these frauds. However, many terrorist organizations have been using these types of frauds to raise money. For example, Ultrascan Advanced Global Investigations reports that these types of frauds are the primary funding vehicle for African-based terror groups such as Boko Haram. Boko Haram kidnapped more than 200 schoolgirls from a dormitory in April 2014, and kidnapped 60 more women and children in June 2014.
Q. A recent spear phishing attack that appeared to come from your organization’s CEO resulted in several employees revealing their passwords to attackers. Management wants to implement a security control to provide assurances to employees that email that appears to come from the CEO actually came from the CEO. Which of the following should be implemented?
A. Digital signatures
B. Spam filter
C. Training
D. Metrics
Answer is A. A digital signature provides assurances of who sent an email and meets the goal of this scenario.
Although a spam filter might filter a spear phishing attack, it does not provide assurances about who sent an email.
A training program would help educate employees about attacks and would help prevent the success of these attacks, but it doesn’t provide assurances about who sent an email.
Metrics can measure the success of a training program.
