Types of Email Attacks and Ways to Prevent Them
Introduction
Since the first cyber virus, Creeper, infected the TENEX operating systems, no efficient preventive solution has been found to combat malware attacks. Cyber viruses have consequently evolved to infect PCs, mobile devices, and systems connected over broadband networks.
The current growth of cyber attacks is unprecedented. Although it is attested to the pandemic, technological advancement is the main reason. Malware attacks are not as complex as shown in the movies. Targeting the victims has become easier for the hackers due to increased and affordable technological access.
Malware attacks rose to 812.67 million in 2018 from a mere 12.4 million in 2009, with 92% of the attacks targeted towards emails. According to the recent FBI’s Internet Crime Report 2020, business e-mail compromise led to a reported loss of $1.8 billion, out of which phishing attacks accounted for $54 million in business losses.
Cyber security and data breach are the most significant threats even big tech companies like Amazon AWS, Adobe, Google, and Weebly face. In an IRONSCALES survey, 81% of organizations surveyed acknowledged the increased email phishing attacks over 18 months since March 2020. Symantec Internet Security Report 2019 reveals that the share of office emails in the email attacks rose from 5% in 2017 to 48% in 2019.
Despite the potential threat Business E-mail Compromise (BEC) poses, cybersecurity complacency is the primary reason behind increased and uncontrolled email attacks. This article explains different types of email attacks and effective ways to prevent them.
Types of email attacks
1. Phishing
Phishing is a cybercrime technique that impersonates text messages, emails, websites, and URLs from legitimate organizations or sources. Email phishing has been in existence since the 1990s. Cybercriminals use email phishing to target employees and manipulate them into providing their personal information. Once you provide your credentials, the hackers gain access to your system and steal your company’s confidential information or install malware into your system.
(a) Spear Phishing
Spear Phishing is the fraudulent practice of sending spoofed messages or emails to target victims to obtain their personal data. According to a SANS whitepaper report, Spear Phishing accounted for over 95% of cyber attacks on companies.
The attackers stalk individuals who put their contact details, job location, frequent location visits, and employer details online and target them. The spear phishers contact the victims through social media messages, direct messages, or targeted emails to acquire their personal data. They use the obtained data to steal the victim’s other sensitive information like bank details or gain access to their company’s system.
(b)Clone Phishing
Email clone phishing creates cloned versions of original emails from authorized sources. Cyber hackers replace the links or attachments in the emails with malware. The spoofed emails are engineered to look like the original ones. Cloners send these cloned emails to numerous recipients and wait for them to click on the links. Once the victim does so, the cloner re-sends the same email to all the contacts in the victim’s list. This chain continues, and not many realize that these are cloned emails. Cloners obtain sensitive information each time a new recipient clicks on the malicious link.
(c)Domain spoofing
Domain spoofing is a social engineering technique used to impersonate employees or companies. Cyber hackers use this technique to spoof URLs or email addresses with slight differences that are hard to detect. Victims are tricked into interacting with these fake sources and providing their sensitive information.
2. Vishing
Vishing is a psychological tactic used to target the victims over the phone. Hackers send a text message or call the victims under the disguise of trusted sources to acquire their details. For example, hackers call victims and ask for their bank details by telling them that their bank account has been hacked. They gain access to your bank account once you provide your account credentials.
3. Smishing
Smishing is a social engineering technique that uses mobile phones as attacking platforms. Cybercriminals send ‘urgent’ or ‘warning’ text messages or emails with malware or malicious links to fake websites. They dupe you into providing your personal information. Top Smishing messages include bank warnings and exclusive discounts.
4. Whaling
In Whaling, attackers target high-profile individuals in your organization. Hackers initially obtain your CEO’s email address and communicate with you through the same mail id. They masquerade as your CEO and trick you into sending the company’s confidential information or transferring money.
5. Pharming
Pharming is a cyber fraud strategy used to manipulate people into entering their information on a fake site. There are two ways of pharming. First, Pharming malware infects your host files with malware, which redirects you to fake and malicious websites without your knowledge and consent. Second, DNS poisoning uses email spoofing to take you to mimicked websites to deceive and trick you into providing your personal information.
6. Spyware
Spyware is the malicious software that invades your system or device, monitors your behavior, gathers your information, and relays it to third parties without your consent. Spywares are difficult to identify because they enter the device without your knowledge or consent. Downloading something from unreliable sources or clicking on pop-ups or links can infect your system.
7. Scareware
Scareware is a social engineering-cum-psychological tactic used to redirect users to malicious or fake websites. Attackers create invading pop-ups or trigger warnings that manipulate users to click unauthenticated links. It may infect your system and monitor the keystrokes to relay confidential information like bank details to third parties. They also deceive the victims into transferring money to third parties for fake apps or software.
8. Adware
Adware automatically displays and downloads unwanted ads or bombards your device with pop-ups. Although adware is not as malicious, it can deteriorate the health of your device in the long run. Adware can also be used to infect your device with malicious adware or software. It is difficult to find the location of the downloaded software because it sits invisibly on your device. The functioning of your mobile phone is disturbed until and unless you remove the malicious software.
9. Spam
Spam messages are unsolicited bulk messages sent via email or text messages. Spam messages are considered harmless, but they do spread malware sometimes. Although email filters catch these emails, they manage to escape and trick you into furnishing your private information.
Safety practices to avoid email attacks
Staff training
The first line of defense against these email attacks is training your staff. Phishing awareness training equips your team with enough knowledge to distinguish between authentic and phished sources. As the cybercrime rate is constantly growing, make sure your employees stay ahead of the challenges. Imparting knowledge about newer methodologies beyond phishing helps you build resilient teams.
Email filters
Email filters enable you to organize your emails into different folders such as work, personal, promotions, and spam. They automatically analyze and crawl through the emails for any red flags. Suspicious emails are automatically moved into junk, spam, or unwanted folder.
Email security solutions
Email security solutions offer additional features to protect your systems and devices from email attacks. They also prevent unauthorized access to your email and monitor outbound emails to protect your mailbox. Data leak prevention, threat protection, and blocking unwanted incoming emails are other features of email security solutions.
BEC controls
Email security gateways help detect automated, impersonated and spoofed emails. BEC controls crawl through your mails to assess the authenticity of the source and the potential threat of phishing. It drastically reduces the employees' workload and protects your company’s data.
Encryption
Email encryption is one way to keep your confidential data safe. It blocks unauthorized access from third parties and protects all your encrypted messages, documents, links, and your company’s email address too. Some email security solutions also provide email encryption services.
Conclusion
Phishing attacks were easier to identify a while ago. But the attackers are finding new ways and techniques to design efficient and robust malware. Yet, it is imperative to learn about different email attacks to avoid heavy losses and data leaks.
Phishing, whaling, advanced persistent threats, and zero-day attacks are a few common email attack threats. Battling these threats requires sophisticated email security mechanisms because attackers constantly search for vulnerabilities to attain unauthorized access to your systems. An integrated, comprehensive, and multi-layer approach can help you stop these targeted email attacks. BEC controls, email encryption, email filters, and email security solutions are a few steps in the right direction.