{"id":3418,"date":"2017-01-25T00:01:51","date_gmt":"2017-01-25T05:01:51","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=3418"},"modified":"2017-07-08T12:54:20","modified_gmt":"2017-07-08T16:54:20","slug":"2017-year-of-the-phish","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/2017-year-of-the-phish\/","title":{"rendered":"Here’s Why 2017 Will be the Year of the Phish"},"content":{"rendered":"

Phishing attacks will become more prevalent than ever in 2017!<\/h2>\n

January 28th<\/sup> marks the Chinese New Year. It will be another ‘Year of the Rooster’ per the traditional Chinese lunisolar calendar. Here\u2019s wishing everyone a Happy Chinese New Year!<\/p>\n

Respectfully, we at The SSL Store\u2122 have decided to dub 2017 as \u2018The Year of the Phish.\u2019<\/p>\n

That\u2019s because with all the industry changes that this year has in store, along with the rapid proliferation of free DV SSL, phishing attacks are going to increase exponentially in the coming months.<\/p>\n

So let\u2019s talk about phishing\u2014what it is and why it\u2019s about to become a much bigger problem. Then we\u2019ll talk about ways to protect yourself and your business.<\/p>\n

What is Phishing?<\/h2>\n

Vince has discussed phishing in previous blog posts<\/a>. But if you\u2019re just looking for the abridged version, here\u2019s a quick summary:<\/p>\n

\"year<\/p>\n

As the definition states, phishing is an attempt to obtain sensitive information such as usernames, passwords, and credit card details, often for malicious reasons, by disguising as a trustworthy entity. Many times you see phishing defined in a way that makes it seem like the threat is entirely email-based.<\/p>\n

This is inaccurate.<\/p>\n

While many phishing attacks do involve the use of email, the practice itself is much more complicated and oftentimes involves the creation of fake websites, fake social accounts and lots of social engineering<\/strong>. Without going too deep into the weeds, social engineering involves creating a believable scenario by which to deceive someone into divulging sensitive or personal information.<\/p>\n

So now let\u2019s look at how it all fits together.<\/p>\n

How a Phishing Attack Works<\/h2>\n

As we\u2019ve covered, the whole point of phishing is to trick someone into handing over desirable information \u2013 personal info, banking data, login credentials \u2013 that can then be used for personal gain.<\/p>\n

But, there are two kinds of phishing. There\u2019s the type where a cybercriminal attacks with a specific outcome in mind. This is called spear-phishing<\/strong> and it typically affects larger companies or organizations (though it can still be used against SMBs and private citizens as well). If a group of cybercriminals were to attack a specific company for the purpose of gaining access to its internal network, that would be an example of spear-phishing.<\/p>\n

[su_pullquote]”We\u2019ve come a long way since those Nigerian Prince emails.”[\/su_pullquote]<\/p>\n

Then there\u2019s the type of phishing where cybercriminals are just looking to steal as much information as possible, from as many people as possible. It\u2019s not unlike when you cast a net off a boat while fishing in real life, you\u2019re just looking to pull up whatever the net grabs. There really is no agreed-upon name for this type of phishing, but it\u2019s the variety which is about to see the greatest increase in the next year.<\/p>\n

Let\u2019s look at an example of how a well-executed phishing attack might work.<\/p>\n

It starts with the cybercriminal contriving a way to contact you that seems believable enough to get you to take the desired action. This is the social engineering element at work and cybercriminals have gotten extremely sophisticated in the ways that they try to trick you. If it\u2019s a spear-phishing attack they could attempt to impersonate your boss or co-worker via email or a messenger service. If the cybercriminals are trying to cast a wider net, they may disguise themselves as an entity, such as a company or organization, that is widely trusted. We\u2019ve come a long way since those Nigerian Prince emails. Nowadays, a phishing email may look more like this:<\/p>\n

\"year<\/p>\n

This is a screenshot of the email that was used to successfully phish John Podesta<\/a>, the chairman of Hillary Clinton\u2019s presidential campaign. It looks authentic. It worked. And keep in mind, the first contact is not limited to emails, it could come in any number of other forms.<\/p>\n

Usually, the first contact isn\u2019t what steals the information, though. It can be, but typically it includes a link to a website that is designed to trick you. Once again, cybercriminals have gotten very sophisticated and are capable of creating fake websites that look like carbon copies of the real thing.<\/p>\n

Here\u2019s a real example of a phishing website, in this case, the cybercriminals are attempting to trick you into believing they\u2019re PayPal:<\/p>\n

\"year<\/p>\n

And here\u2019s what the real PayPal login screen looks like:<\/p>\n

\"year<\/p>\n

Could you tell the difference? If you know about Extended Validation SSL and the green address bar, then maybe you could. But that\u2019s assuming that you remember PayPal even has EV SSL in the first place. If you don\u2019t, you\u2019ll notice the fake website does have encryption.<\/p>\n

By the point this screenshot was taken, Google had flagged the site as malicious and was issuing an interstitial warning as well as marking the site “Dangerous” in Chrome’s address bar.<\/p>\n

But here\u2019s the problem. <\/strong>Google didn\u2019t catch that website right away. That means that for a period of time \u2013 in this case a few days \u2013 people came to this fake website, saw it was being served over HTTPS and had a green padlock, assumed it was safe\u00a0and had their information stolen.<\/p>\n

Here\u2019s a breakdown of the traffic that went to this website, courtesy of bit.ly:<\/p>\n

\"year<\/p>\n

When we say that cybercriminals cast a wide net when phishing this way\u2014we mean it. These sites are a dime a dozen (more on that later). It\u2019s now easier than ever to slap a Domain Validated SSL Certificate on them and make them appear safe (we’ll get to that later too). And then, it\u2019s just a matter of how many people they can dupe before Google flags the domain and they have to move on to the next one. This one got at least 180 clicks, and that’s just from one shortened link. There could be dozens of others.<\/p>\n

Now let\u2019s look at why phishing attacks are about to increase exponentially.<\/p>\n

The Browser Community is Mandating Encryption<\/h2>\n

This is a good thing, right? Of course! In 2017, the browser community, led by Google and Mozilla, will make a number of moves that all but mandate SSL encryption<\/a>. Now, Google isn\u2019t going to put a gun to anyone\u2019s head and force them to migrate to HTTPS, but it will penalize websites that don\u2019t encrypt in a severe enough way that it will tip the scales of competitive balance and put them at a severe disadvantage.<\/p>\n

Here are some of the ways the browsers are pushing you to encrypt:<\/p>\n

    \n
  • Advanced browser features are exclusive to sites served over HTTPS<\/li>\n
  • Only encrypted websites can use HTTP\/2<\/li>\n
  • Pages served over HTTPS receive up to a 5% SEO boost<\/li>\n
  • Emails sent from unencrypted servers will be flagged<\/li>\n
  • Websites served over unencrypted HTTP will be marked \u201cNot Secure\u201d<\/strong>\u00a0<\/strong><\/li>\n<\/ul>\n

    It\u2019s that last bullet-point, that unencrypted websites will be marked \u201cNot Secure,\u201d that is going to be the most disruptive. That\u2019s what\u2019s going to more or less force a lot of site-owners to purchase SSL.<\/p>\n

    \"yearAs you could probably imagine, having a browser drop \u201cNot Secure\u201d next to your URL in the address bar is hardly the best way for a website to ingratiate itself to its visitors. For any e-commerce website, that kind of negative visual indicator is inevitably going to hurt the bottom line and ultimately the health of the business.<\/p>\n

    In this day and age, where people are hyper-aware of online threats and ultra-vigilant about avoiding them, having Google declare your site \u201cNot Secure\u201d is akin to a death sentence.<\/p>\n

    Here\u2019s what Google\u2019s \u201cNot Secure\u201d indicator looks:<\/p>\n

    \"year<\/p>\n

    In a few more updates, that indicator will turn red. Mozilla has already announced plans to make similar changes to its security indicators in Firefox, and it’s likely that Apple\u2019s Safari and Microsoft\u2019s Edge browsers will also follow suit.<\/p>\n

    So here\u2019s the million dollar question<\/strong>: why would this contribute to an increase in phishing?<\/p>\n

    We\u2019ll get to that in a moment, but first, we need to discuss the other way the browsers\u2019 security indicators are changing.<\/p>\n

    Sites Served Over HTTPS Will Be Marked \u201cSecure\u201d<\/h2>\n

    On the opposite side of the \u201cNot Secure\u201d indicator, will be the \u201cSecure\u201d label that the browsers will place on sites with encryption. The \u201cSecure\u201d indicator will look like this:<\/p>\n

    \"year<\/p>\n

    The logic behind this change is debatable because this indicator could actually create a lot of problems. That\u2019s because people tend to associate the word \u201csecure\u201d with safety. And safety is not what the \u201cSecure\u201d indicator is supposed to connote. In the mind of the browser community, it simply indicates that your connection with this site is secure \u2013 that it is encrypted and nobody can eavesdrop on it \u2013 not that a website is indeed safe.<\/p>\n

    [su_pullquote align=”right”]”But, what the indicator intends to communicate and how it is perceived differ wildly.”[\/su_pullquote]<\/p>\n

    But, what the indicator intends to communicate and how it is perceived differ wildly<\/a>. The vast majority of people don\u2019t know to click the security indicator and look at the SSL certificate details, they will simply see the word \u201cSecure\u201d and make the risky assumption that they\u2019re safe. Now, let\u2019s go back to the previous point. More sites than ever will be encrypted, and all of those encrypted sites will be labeled \u201cSecure\u201d by the browsers. This is going to desensitize a lot of people to potential threats.<\/p>\n

    When every site says either \u201cSecure\u201d or \u201cNot Secure,\u201d many people will function by a simple binary. Sites are either \u201cSecure\u201d and by extension safe, or \u201cNot Secure.\u201d It becomes a quick eye check of the security indicator and then it\u2019s business as usual.<\/p>\n

    This is dangerous, because it\u2019s now easier than ever to obtain a DV SSL certificate.<\/p>\n

    Cybercriminals Encrypt Too<\/h2>\n

    Universal encryption is a truly noble initiative, but some of the free SSL services that the initiative has given birth to are creating some unintended outcomes. One of which, is that cybercriminals can now make their phishing websites look even more convincing by adding Domain Validated SSL encryption and turning on the visual indicators that come along with them.<\/p>\n

    \n

    I’m heartened to see a huge increase in adoption of HTTPS by phishermen. pic.twitter.com\/DEiAUTDlAA<\/a><\/p>\n

    \u2014 Eric Lawrence (@ericlaw) January 23, 2017<\/a><\/p><\/blockquote>\n