Chapter 1 Spotlight on Cyber Threats Featured Topic Phishing URLs The Psychology Behind the Persistence of Phishing Phishing continues to be one of the most popular — and effective — methods of social engineering, where threat actors impersonate trusted organisations and individuals to steal sensitive data from unsuspecting victims. To further Ms Teo Yi-Ling, Senior Fellow, Centre of Excellence for National Security, S. Rajaratnam School of International Studies their malicious objectives, threat actors are constantly refining their phishing tactics, which have grown in sophistication over the years. The Pervasiveness of Phishing Commonly Spoofed Organisations in 2019 Phishing continues to pose a key risk to organisations of all sizes. A recent estimate saw 3.4 billion malicious e-mails being In 2019, CSA detected 47,500 disseminated every day.13 The sheer volume of scam e-mails is phishing URLs with a Singapore- just one aspect of the threat: it is important to realise that when link, an increase of about 200 it concerns phishing, scammers are not focused on exploiting per cent from 2018. This is in systemic or technological vulnerabilities — they are exploiting line with global observations, vulnerabilities in human nature.14 This other aspect of the phishing which saw 2019 record the threat is using the tactic of social engineering, where people are highest level of phishing attacks manipulated into carrying out certain behaviours. In the context of since 2016. More than 90 per 8 cybersecurity or information security, social engineering is about cent of the spoofed companies getting people to disclose sensitive information and be exposed were largely based in the USA, and included technology firms, organisations from the banking and financial sector, and e-mail service providers. These are popular and global companies whose branding resonate well not just with users in Singapore but also those worldwide. Hence, threat actors commonly spoofed them to improve their chances of success in phishing attacks. Separately, the most commonly spoofed websites of Government organisations in Singapore included the Immigration & Checkpoints Authority (ICA), Ministry of Manpower (MOM), and Singapore Police Force (SPF). 8 9 10 11 12 9 to malware. Phishing is a key example of social engineering, as the Phishing-as-a-Service (PHaaS) — Fuelling Phishing Attacks The rise of Phishing-as-a-Service (PHaaS) likely fuelled the increase in phishing attacks in 2019, with over 5,300 phishing kits detected for sale on the Dark Web.10 PHaaS provides professional phishing templates spoofing a range of popular brands and well-known companies from various sectors, as well as web-hosting services.11 The accessibility to these capabilities gives cybercriminals an easier start for their phishing campaigns in stealing online credentials and sensitive information, without the need for in-depth technical knowledge to develop their own phishing tools. get the recipients of phishing e-mails to comply with requests. Despite the fact that scam awareness is high due to ongoing public education campaigns in Singapore (including how to spot the DigitalOcean and GoDaddy were the most commonly abused web-hosting providers, having hosted more than one-third of total phishing URLs detected in 2019. The one-stop and hasslefree nature of setting up websites through these web-hosting providers serve as low barriers to entry for threat actors, making them popular choices for hosting malicious websites. “Phishing Attacks Reach Highest Level in Three Years,” Anti-Phishing Working Group (APWG) Phishing Activity Trends Report 3rd Quarter 2019, 4 November 2019, https://docs.apwg.org/reports/apwg_trends_report_q3_2019.pdf. Services offered by these Government organisations typically involve personally identifiable information, such as NRIC numbers, passport information and credit card numbers, which could have been stolen and used for malicious purposes, such as identity theft. Sigurdardottir, Tinna Thuridur and Sigurdsson, Magni. “Evasive Phishing Driven by Phishing-as-a-Service,” Cyren Security Blog, 1 July 2019, https://www.cyren.com/blog/articles/evasive-phishing-driven-by-phishing-as-a-service. Akamai 2019 State of the Internet / Security Phishing: Baiting the Hook Report, Akamai Technologies, Inc., 30 October 2019, https://www.akamai.com/us/en/multimedia/ documents/state-of-the-internet/soti-security-phishing-baiting-the-hook-report-2019.pdf. SINGAPORE CYBER LANDSCAPE 2019 scams involve impersonating legitimate organisations to attempt to DigitalOcean and GoDaddy — Most Commonly Abused WebHosting Providers signs of phishing e-mails) and frequent reporting in the media, the phenomenon of phishing persists — people still fall prey to phishing scams. In trying to devise more effective countermeasures to phishing, it is necessary to understand the psychology underscoring this tactic, and the strategy of the scammer. The endgame of phishing is persuading the recipient to behave in a way desired by the scammer. Cybercriminals are quick to take advantage of strong consumer interest during the release of highly anticipated products. Between September and October 2019, there was a surge in phishing attempts spoofing Apple, which coincided with the company’s release of new products. These phishing links made up more than 60 per cent of all phishing URLs with known targets in 2019, and were usually disguised within e-mails seeking bill payments for purported purchases of the new products, or e-mails requesting verification of Apple ID authentication data belonging to victims. Notably, this wave of Apple phishing scams appeared to largely target Yahoo! e-mail addresses, suggesting that cybercriminals were possibly utilising compromised e-mail accounts from Yahoo!’s data breach in 2013.12 There are two paths that lead to persuasion — one appeals to logic, and the other, to emotions.15 Putting the factor of relative credulity of human beings to one side, as logic requires thinking objectively through action and consequence, it is highly unlikely that a scammer would use logic to persuade. However, it appears that in appealing to emotions to persuade, the stronger the emotional response (positive or negative) induced in the recipient, the greater the probability is for the recipient to not think clearly and carefully.16 Scammers could prey on fear, greed, curiosity and outrage. Read more about The Psychology Behind the Persistence of Phishing on Page 50 12 13 14 15 16 Irwin, Luke. “Catches of the month: Phishing scams for September 2019 — Yahoo Mail customers targeted by Apple scam,” IT Governance Blog, 11 September 2019, https://itgovernance.co.uk/blog/catches-of-the-month-phishing-scams-for-september-2019. Valimail E-mail Fraud Landscape / Spring 2019, https://valimail.docsend.com/view/qndhuhn. Irwin, Luke, “The psychology behind phishing attacks”, IT Governance Blog, 1 August 2019, https://www.itgovernance.co.uk/blog/the-psychology-behind-phishing-attacks. Rusch, Jonathan J, “The Social Engineering of Internet Fraud”, 1999 (Retrieved 1 February 2020), http://www.isoc.org/isoc/conferences/inet/99/proceedings/3g/3g_2.htm. Irwin, Luke, “The psychology behind phishing attacks”, IT Governance Blog, 1 August 2019, https://www.itgovernance.co.uk/blog/the-psychology-behind-phishing-attacks. 13