Information Security Tips (September 2023) – Beware of Spear Phishing
jovitatou2023-10-21T00:00:08+08:00
To: All Users
- What is Spear Phishing Attack?
Spear Phishing is a specific type of Phishing Attack that targets individuals or organizations with the intention of deceiving them and gaining unauthorized access to sensitive information. Unlike regular phishing attacks, spear phishing is more personalized and involves tactics such as impersonation, enticing bait, and finding ways to bypass security measures like email filters and antivirus software.
Although general Phishing and Spear Phishing employ similar techniques, there are distinctions between them. General Phishing attacks are typically straightforward, aiming to acquire the victim’s information, such as online banking credentials, to fulfill their objectives. In contrast, spear phishing attacks go beyond simply obtaining login details or personal data. They serve as a gateway for attackers to gain initial entry into the targeted network and act as a stepping stone for subsequent Targeted Attacks
- How does Spear Phishing Work?
Spear phishing attacks specifically aim at targeting individuals within an organization or institution, including their social media accounts like the organization’s website, Twitter, Facebook, and LinkedIn. The attackers invest time in creating persuasive email content and may include harmful attachments or links in the emails. When the recipient opens such attachments or clicks on the links, it can trigger the execution of malicious code or redirect the user to a compromised website. This provides an opportunity for the attacker to establish a hidden communication network and advance to the next stage of the attack.
- How to Prevent Spear Phishing?
To thwart spear phishing attacks, UM employs several layers of protection, empowering system administrators with enhanced visibility and control over the network. This approach minimizes the risk of targeted attacks and mitigates various attack vectors.
Nonetheless, the most pivotal factor in defense lies in the information security awareness of employees and students. By diligently observing spelling mistakes, peculiar language, and other suspicious indicators in emails, individuals can partially shield themselves against spear phishing attacks.
Reference
- Important Notice: Beware of phishing emails sent by UM members
- Don’t Let a Phishing Scam Reel You In
- How can I identify a phishing, fake email and websites?
- Beware of Phishing Trap
Should you have any enquiries, please feel free to contact ICTO Help Desk.
ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo
Information and Communication Technology Office
各位用戶：
- 何謂魚叉式網路釣魚攻擊?
魚叉式網路釣魚（Spear Phishing）是專門針對特定對象的網路釣魚（Phishing），其對象通常是某個機構，其最終目標是取得機密資訊，其技巧則包括：假冒他人名義、使用迷人的誘餌、避開安全機制 (如電子郵件過濾及防毒) 等等。
雖然一般的網路釣魚（Phishing）和魚叉式網路釣魚所使用的技巧類似，但兩者之間還是有所差別。兩者的差異在於，一般的網路釣魚（Phishing）相對單純，歹徒一旦偷到受害人的資料 (如網路銀行登入資訊)，就算達到目的。但對於魚叉式網路釣魚來說，取得登入資訊或個人資訊通常只是攻擊的開端，這是歹徒進入目標網路的手段，只能算是的跳板而已，實質是針對性攻擊/鎖定目標攻擊(Targeted attack ) 。
- 魚叉式網路釣魚如何運作?
魚叉式網路釣魚通常鎖定特定個人或某機構的特定員工及其社群媒體帳號 (如機構網站、 Twitter、Facebook 和 LinkedIn)，它們會精心製作出很有說服力的電子郵件內容，並且可能在電子郵件當中挾帶可造成感染的附件檔案和連結。一旦開啟檔案或連結，就會執行惡意程式或將使用者導向某個網站。接下來，駭客就能建立其秘密通訊網路，然後朝攻擊的下一階段邁進。
- 如何防範魚叉式網路釣魚?
為防範網路釣魚，學校已設置了多層次防護，來讓系統管理員確切掌握及掌控網路的狀況，進而降低針對性攻擊的風險，防範各種攻擊途徑。除此之外，更重要的是依賴員工及學生的資訊安全意識，懂得觀察郵件內的拼字錯誤、奇怪用詞，以及其他可疑的徵兆，就能預防一定程度的魚叉式網路釣魚。
參考資料
如有任何疑問，請聯絡資訊及通訊科技部服務中心。
服 務 中 心
位置 : 中央教學樓東5座（E5）二樓2085室 (電子地圖)
電話 : 8822 8600
電郵 : icto.helpdesk@um.edu.mo
資訊及通訊科技部
