Targeted Attacks and Phishing Scams

Social engineering (ソーシャルエンジニアリング) is the umbrella term for obtaining passwords and other secret information without computer techniques, by exploiting people's carelessness and assumptions.

Because the target is people rather than a weakness in the system, technical measures such as encrypting communications or antivirus software cannot stop it on their own. It also covers acts that need no computer at all, such as shoulder hacking (ショルダーハック), peeking at a screen from behind, and trashing (トラッシング), picking clues out of paper and media thrown out as garbage. Measures aimed at human behavior, such as training employees and agreeing on procedures for passing on information, are therefore essential too.

AnalogyIt is like a burglar who leaves the lock alone and instead poses as a delivery driver so the resident opens the door. What the burglar targets is not the lock but the resident's assumptions.

How to rememberRead it as "engineering" done through the "social" side of life, and it is clear that the one being worked on is a person, not a machine.

3 past questions on this term ソーシャルエンジニアリング →

A targeted attack (標的型攻撃) singles out a specific organization or person, delivers malware through email or other messages crafted for that target, and steals information.

The message is dressed up as coming from a business partner or as routine work correspondence, so the recipient opens it without suspicion. Once inside through the opened attachment or URL, the attacker uses tools such as a remote-control program (RAT) that operates the PC from outside to carry off important information. Depending on how it approaches the target and how long it keeps going, it splits into types such as APT and the watering-hole attack.

AnalogyIt is like finding out the name of a department head at a company and then delivering a convincing fake internal memo to one of their subordinates to open.

2 past questions on this term 標的型攻撃 →

APT (Advanced Persistent Threat) is a targeted attack that keeps going over a long period against a specific organization or person, combining several methods.

It does not stop after one break-in: it lies low inside the organization, widens what it controls little by little, and may keep carrying off confidential information for months. Because it moves quietly, defenses must watch for suspicious outbound traffic as well as block intrusion. The model that shows an attack advancing in stages from reconnaissance to achieving its goal is called the cyber kill chain (サイバーキルチェーン).

AnalogyIt is less like a thief who grabs everything in one night and flees, and more like a spy who moves in posing as a housemate and slips valuables out bit by bit over a long time.

How to rememberOf the three letters, P (Persistent: keeps at it) is what sets it apart from other targeted attacks.

2 past questions on this term APT →

A watering-hole attack (水飲み場型攻撃) first tampers with a website the target often views, so that the target's PC is infected with malware when it visits.

The attacker sets a trap where the target will come on its own and waits. Because the tampered site is a legitimate one the target already trusts, users have little reason to be on guard. Some attacks infect only visitors coming from the target organization, so that other visitors are less likely to notice.

AnalogyIt is like secretly rigging the entrance of a shop that only regulars visit. The customers think it is their usual shop and walk in without a second thought.

How to rememberThe name comes from predators lying in wait at a watering hole where their prey gathers.

An interactive (correspondence-type) attack (やり取り型攻撃) is a targeted attack that first poses as a harmless inquiry and trades several emails, then sends a virus-laden file or similar once the other side has come to trust the sender.

The first email contains nothing malicious, so the staff member who receives it has no reason to be wary. After replying a few times, they take the sender for an ordinary inquirer and open the later attachment without suspicion. Contact-desk staff, whose job is to answer outside inquiries, are frequent targets.

AnalogyIt is like a con artist who does not push for a contract right away but chats a few times until you think "what a nice person", then brings up the real, crooked deal.

1 past questions on this term やり取り型攻撃 →

Phishing (フィッシング) is a scam that poses as a real organization such as a bank, lures people by email or similar to a fake site identical to the genuine one, and tricks them out of IDs, passwords, card numbers and other information.

The typical pattern is a message that makes users panic as if trouble will follow unless they act quickly, then gets them to open the fake site through a link. Since it is the user who types in the information, the safeguard is to ignore the link received and open the official site from a bookmark saved in advance.

AnalogyIt is like a letter scam that mails an envelope identical to a real bank's, containing a fake form that says "Please write your PIN and return it for verification", and steals what people write.

How to rememberIt is spelled phishing but sounds like fishing, which fits the picture of baiting a hook to reel in information.

3 past questions on this term フィッシング →

Smishing (スミッシング) is a kind of phishing that uses short messages sent to a mobile phone number (SMS) as the way in to a fake site.

For example, an SMS posing as a missed-delivery notice or an unpaid bill gets people to open a fake site through the link in the text and enter their ID or other details. In another form, the fake site has people install a malicious app that then steals their information. Short notifications on a smartphone make the sender hard to judge, so people tend to assume they are genuine and open them.

AnalogyIt is like dropping a slip that looks exactly like a courier's missed-delivery notice into a mailbox, so people call the fake contact on it and give away information.

How to rememberThe word is built from SMS and phishing.

One-click fraud (ワンクリック詐欺) is a scam that shows a message such as "Registration complete" after a single click on a link in a web page or email, and one-sidedly demands a fee.

Because the user never checked what was being ordered or how much it cost, a click alone does not form a contract, and there is no need to pay. The screen may show an IP address or device details and threaten "We have identified you", but that alone does not reveal a name or home address. Contacting them in a panic only hands over your own phone number or email address.

AnalogyIt is like touching the sign outside a shop and having a clerk rush up saying "The contract is made, please pay". Touching it does not mean you bought anything.