Cyberstudy
PDF p.44 In progress

Phishing and Pharming

Open PDF at p.44 15 flashcards

Summary

PDF p.44

Phishing combines social engineering and spoofing to trick targets into interacting with malicious resources disguised as trusted ones. Pharming redirects users from legitimate websites to malicious ones by corrupting Internet name resolution.

In plain words

Supplementary — not from your PDF

Phishing tricks you into visiting a fake site or opening something malicious, usually by email. Vishing does it by voice and SMiShing by text. Pharming is sneakier: it tampers with name resolution so even typing the right address takes you to the fake site.

Detailed explanation

PDF p.44
  • Phishing
    • Definition: Persuades or tricks targets into interacting with malicious resources disguised as trusted ones.
    • Method: Traditionally uses email as the vector.
    • Actions: Convince users to install disguised malware or allow remote access.
  • Phishing Campaigns
    • Spoof Websites: Imitate trusted sites (e.g., banks, e-commerce).
    • Email Tactics: Inform users of account updates or hoax alerts, leading to spoofed sites.
    • Credential Capture: Users authenticate with spoofed sites, revealing login credentials.
  • Types of Phishing
    • Vishing
      • Definition: Phishing via voice channels (telephone, VoIP).
      • Example: Impersonating a bank to verify credit card transactions.
      • Future Trends: Deep fake technology increasing voice and video phishing.
    • SMiShing
      • Definition: Phishing via SMS text communications.
  • Pharming
    • Definition: Redirects users from legitimate websites to malicious ones.
    • Method: Corrupts Internet name resolution to redirect traffic.
    • Example: Redirecting mybank.foo from IP address 2.2.2.2 to 6.6.6.6.

Important terms

taken from the text above
Phishing
Persuades or tricks targets into interacting with malicious resources disguised as trusted ones.
Spoof Websites
Imitate trusted sites (e.g., banks, e-commerce).
Email Tactics
Inform users of account updates or hoax alerts, leading to spoofed sites.
Credential Capture
Users authenticate with spoofed sites, revealing login credentials.
Vishing
Phishing via voice channels (telephone, VoIP).
Future Trends
Deep fake technology increasing voice and video phishing.
SMiShing
Phishing via SMS text communications.
Pharming
Redirects users from legitimate websites to malicious ones.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Phishing: 'Your account is locked, sign in here' linking to a copy of the bank's site.
  • Vishing: a caller claiming to be the bank's fraud team.
  • Pharming: a tampered DNS record sending mybank.foo to the attacker's server.

Scenario

Several users report their bank's site looks odd, even though they typed the address themselves. That points to pharming (name resolution tampering), not an email link, so IT checks DNS settings and the network's resolvers.

Common mistakes

Supplementary — not from your PDF
  • Thinking pharming needs the user to click a link.
  • Mixing up vishing (voice) and SMiShing (SMS).

Practical skills

Supplementary — not from your PDF
  • Classify a phishing attempt by channel and technique.

What I should remember

Key Points PDF p.44
  • Phishing
    • Definition: Social engineering and spoofing.
    • Method: Email vector.
    • Actions: Install malware, allow remote access.
  • Phishing Campaigns
    • Spoof Websites: Imitate trusted sites.
    • Email Tactics: Account updates, hoax alerts.
    • Credential Capture: Spoofed site authentication.
  • Types of Phishing
    • Vishing: Voice channel phishing.
    • SMiShing: SMS text phishing.
  • Pharming
    • Definition: Redirects to malicious sites.
    • Method: Corrupts name resolution.
    • Example: IP address redirection.