untangling_the_web

DID: 4046925
UNCLASSIFIEDNFeR eFFIOIAL l:JSE ot.LY
. "Welcome to CitF' message will remain even if user enters new
I FAo Edit V_ FIMO~
I .,.. i , ...... '!i) Jl ~I ~~d opens new ~ebp~e._ _ _ _ ..
1A,gure-u I@J J;1tp::. I/web de-us cihh"nk C:r)m/~~rmkihh/SA;ripl':s.!"m')ILverify i&1J
:3 -..r?' Go
ci'ti"
Faked address is live JavaScript;
Note the "https:/I"
II by submlUng yo",.'og.ln Informallon.
ATMlD~b,t C~Hj
(ON) I Card II
PIN
r--
Note the use of Citi logos and copyright
Ame'11berof ~"':'
CltlgrouR Pll'iJiW Pt:Ofni£il
r.lITiS&' Conditions
. p d, t'l '" -r.'1:'" t' 'i~,l;
cffi
CJILto",
Note absence of SSL (locked padlock)
l
" Internet
There is a worrisome refinement of the traditional phishing attack that gained a lot of
attention beginning in 2005. Spear phishing is exactly what it sounds like: precisely
targeted phishing attacks that try to lure users to provide personal data by cleverly
conceived social engineering strategies. Instead of the blanket approach of sending
thousands (millions) of emails blindly, spear phishing carefully selects its audience
and targets these users with very legitimate-sounding emails. For example, one
spear phishing attack targeted students and faculty at the University of Kentucky.
Spear phishing emails typically appear to be coming from a trusted source: your
company's HR or IT department or your own little credit union. Also, a spear
phishing attack may try to sound as if your security is at stake, e.g., you have been
locked out of your account because of unsuccessful attempts to break into it, and in
order to unlock your account you will need to reenter your personal information.
Fake spear phishing emails have even been used to educate people about the
dangers of spear phishing. "In June 2004, more than 500 cadets at West Point
received an email from Col. Robert Melville notifying them of a problem with their
grade report and ordering them to click on a link to verify that the grades were
correct. More than 80% of the students dutifully followed the instructions. But there is
552 UNCLASSIFIEDhTeR eFFIelAL USE eNL\'