In the past few days reports are coming in indicating that specific high profile Gmail accounts were targeted for attack. These attacks seemed to focus on top officials in US government.
How were these attacks carried out?
According to reports they were “phishing” attacks. A phishing attack is perpetrated by someone who sets up a phony web site (in this case Gmail’s) that looks very much like the official site. The attack victims are sent emails directing them to this site in hopes that they will enter their user ID and associated passwords.
What makes these attacks unique is that they weren’t random attacks designed to compromise the accounts of every day users of Gmail, but specifically targeted government officials in the US (and South Korea). This is called “spear phishing”.
Who is behind these attacks?
Preliminary reports seem to indicate China.
What also makes these attacks unique is that they appear to be originating from nation states instead of lone individuals or groups.
I’ve written several articles about the Stuxnet virus and how it may have been the first cyber weapon designed by a nation(s) state to actually destroy machinery (the Iranian nuclear centrifuge program).
While these types of attacks above constitute very specific threats to governments and targeted individuals, phishing has been around for quite a while and is, in fact, a common means used to compromise accounts for identity theft and / or credit card fraud, etc.
How can you protect yourself against this type of threat?
Many types of anti-virus programs have anti-phishing features built into them. It would behoove you, however, to be cognizant of what sites you are actually going to before you click on a link.
How do you do that?
Hover over the link and (depending on your browser) the URL of the site should appear in an address bar. Then it’s up to you use your head and a little common sense. If you’re being directed to go a site like Google and yet the link reads as something different don’t click on it.
Also be aware that bona fide web sites rarely if ever request you to go to a site to confirm your account info. That’s a sure sign that something is amiss.
Relying on technology and anti-virus programs to catch every one of these threats is probably not something that is going to work all the time.
Be smart and use your head. Get in the habit of looking at the link you are about to go to before clicking on it. It only takes a second. While there are ways for hackers and bad guys to get around this and present what looks like a valid URL, this will go a long way towards helping prevent these types of attacks and getting you in what should be a good habit regardless.
Christopher Tippins for the Software Synergy Group