Spear Phishers Know Your Name

“Spear phishing” refers to phishing scams that are directed at a specific target. Like when Tom Hanks was stranded on the island in the movie Cast Away. He whittled a spear and targeted specific fish, rather than dropping a line with bait and catching whatever came by. When phishing attacks are directed at company officers or senior executives, it’s called “whaling,” appropriately enough. I don’t know who sits around and coins this stuff but it makes analogical sense.

Spear phishers target their victims in a number of ways.

They may select a specific industry, target specific employees with a specific rank, and pull a ruse that has been successful in the past. For example, a spear phisher might choose a human resources employee whose information is available on the company website. The phisher could then create an email that seems to come from the company’s favorite charity, assuming this information is also available online, requesting that the targeted employee post a donation link on the company’s intranet. If the target falls for the scam, the scammer has now bypassed the company’s firewall. When employees click on the malicious link, the company’s servers will be infected and antivirus software may be overridden.

Lawyers are popular targets, since they are often responsible for holding funds in escrow. A spear phisher might contact a lawyer by name, leading him or her to believe that the scammer is an American businessperson who needs help moving money while overseas.

I was recently targeted in a spear phishing scam, one aimed specifically at professional speakers. The scammers requested that I present a program in England, and once my fee was agreed upon, I was asked to get a “work permit,” which costs $850.

People who are not be targeted based on their professions may be targeted based on their use of social media. Facebook, Twitter and LinkedIn are known playgrounds for spear phishers, who obtain users’ email addresses and create email templates that mimic those sent by the social networking website. Scammers may even weave in names of your contacts, making the ruse appear that much more legitimate.

Knowing how spear phishers operate allows you to understand how to avoid being phished. Never click on links within the body of an email, for any reason. Bypass the links and go directly to the website responsible for the message. Any unsolicited email should be suspect. If you manage employees, test their ability to recognize a phishing email, show them how they got hooked, and then test them again.

Robert Siciliano, personal security expert contributor to Just Ask Gemalto, discusses phishing on NBC Boston. Disclosures