They Know Who You Are

March 15, 2019

Nearly every week, we see cyber attackers target specific Biola employees using personal information they find online.

Check out this video to see how a sophisticated attacker could attack an organization by targeting one employee:

Targeted Attacks

While some attackers send out large-scale phishing attacks, hoping that random, unsuspecting people will take the bait, other attackers make it more personal by targeting a specific individual or organization. We call these targeted attacks, or "spear phishing."

To target a specific person, attackers need to collect enough detailed information to either pose as or trick that person. They search the Internet for any information that you or your employer have made publicly available.

Here are some examples of personal information that attackers can find with enough research:

• Full name
• Email address
• Location
• Employer
• Job title
• Friends
• Interests
• Communication style

Targeting Biola Employees

The most common targeted attack we see at Biola is executive fraud, where the imposter poses as a trusted authority, and tries to trick someone into sending money.

Imagine getting this email from director at Biola:

This is a real email from an imposter impersonating a Biola director. Abbie knew this director well, and the message seemed legitimate.

She immediately replied and asked for the payment information. Note the imposter’s response:

If you’re being asked to send money or buy something, you should always confirm with the requester over the phone, or in person. By saying she was busy in meetings all day, the imposter created a sense of urgency, hoping that Abbie would neglect to follow best practice and confirm the request.

It worked. Abbie submitted the wire transfer.

Thankfully, the bank rejected the request, so no money was lost. It wasn’t until Abbie spoke with the actual Biola director about the banking issue that we discovered the scam.

In this example, an attacker researched a Biola employee online: her position (a director) and the contact information for someone who worked with that director. The attacker researched their business relationship (handling money transfers), and afterward the director reported that the email was written in her communication style, and sounded like something she would say. During our investigation, we identified the website the attacker had used to gather information about Abbie and the director.

What were the clues that flagged this as a scam?

1. The initial request was vague and unprompted.
2. The urgent “Get back to me!" subject line was intended to cause alarm.
3. The communication has a number of grammatical errors.
4. The attacker tried to get Abbie to act without further discussion.

Note: You may have noticed that the email came from an @biola.edu address. It looks like phishing, but in this case the attacker spoofed the email address. Email address spoofing is uncommon, but possible.

Your Best Defenses

Here’s how you can defend yourself against targeted attacks:

1. Scrutinize email messages carefully. If anything about the message seems weird, it probably is.
2. Pause before opening any unsolicited attachment or clicking a link to a website.
3. When a trusted person emails you asking for money or information, contact them through a known phone number or in person to verify that their request was real.