Ahmedabad: Spear phishing is hackers' new weapon

Cybercriminals are digging deep to research their potential victims by noting their preference of connectivity over security. And they are succeeding in it by playing on consumer emotions using advanced techniques such as spear phishing, states a report.

This technique of using personalised information has claimed victims in Gujarat as well, say cybercrime experts. According to the ‘2013 Report – India’ released by security solutions provider Norton on Tuesday, 55% of the respondents admitted that the convenience of being constantly connected far outweighed any security risks. Adding to this, 66% of Indian consumers use their mobile device for both work and play, giving cybercriminals the chance to access more valuable information.

And hackers are tapping this snag like never before. “Unlike earlier, it is no longer the corporate companies and websites that the hackers are directly targeting, but individual users. To target them hackers are using sophisticated means like spear-phishing,” Norton country manager Ritesh Chopra told dna over the telephone. 60% of cyber threats in the country are targeted attacks at victims, as per the report.

Explaining spear phishing, Chopra said: “Hackers target individuals by accessing their personal information and then send them phishing mails assuming the identity of a friend or accomplice.

Appealing to their emotional ties with someone, hackers launch a phishing attack customised to lure a particular individual. Hence, it is not just phishing, but also an identity theft that they employ to their advantage,” he explained.

A similar type of identity theft and phishing has been noticed in Gujarat this year too, say cybercrime experts.

“There are instances where the email of an executive from an import-export firm is hacked and kept an eye on it till a major payment order is received. On receiving the order, the hacker changes the email ID’s password and contacts the paying company under the guise of the export firm. He claims that the payment was not received and gives them his own bank account number to receive the ‘missing payment’,” said Kiran Patel, police inspector DCB cyber crime cell.

This year, an executive from a Junagadh-based company fell victim to such a case, added Patel.

In addition, four such cases were averted in Ahmedabad at the last moment, due to timely communication between the potential victim and the paying firm. Such identity thefts have gone up with an increase in misuse of data collected by malware apps using synchronisation, he added.

63% of smartphone users became victims of mobile cybercrime, the report stated.

Another new trend noted by the report is that of ransomware. In this technique, a file is downloaded into the victim’s device without their notice. When triggered this file locks up the device and asks for a monetary payoff to unlock it, explained Chopra.

India ranks among the top-five of the 24 countries covered in the international version of the report in terms of ransomware, identity theft and spear-phishing, he added.

The report also states that 11% each of all ransomware and identity theft as well as 9% of all phishing attacks target Indian users.

What is Spear PhisHing?
It’s a variation on phishing where hackers send emails to people with specific common characteristics or other identifiers. The emails may appear to come from a trusted person, but are designed to help hackers obtain classified information or other trade secrets.