Phishing Attacks | Research Report

Contents
Executive Summary.....................................................................................................................................2
Task 1..........................................................................................................................................................2
Introduction.................................................................................................................................................2
Preventive approach....................................................................................................................................2
User Education........................................................................................................................................2
Network Level Protection........................................................................................................................3
Link-based Protection..............................................................................................................................3
Blocking of Phishing Websites................................................................................................................4
Reactive Measures.......................................................................................................................................4
Policy Oriented Measures............................................................................................................................5
Email Policy............................................................................................................................................5
Security Awareness Training Policy........................................................................................................6
Acceptable Use Policy.............................................................................................................................6
Conclusion...................................................................................................................................................6
Task 2..........................................................................................................................................................7
Recovering deleted files..............................................................................................................................7
Recovering passwords.................................................................................................................................9
References.................................................................................................................................................11
1

Executive Summary
Phishing attacks are the security attacks that have become a common occurrence in the presence
times and have become a major cause of concern for the individual users and the business firms.
The attack has impacted a major section of the users in the cyber community and has caused
adverse implications as well. The business firms have lost millions of dollars due to these attacks
and there has been damage done in the brand value and reputation. The paper covers the brief on
the phishing attacks and provides the primary achievements and challenges associated with the
control measures that are present. The goal of the paper is to list out the updated techniques and
measures that can be used to deal with the issue of phishing attacks.
Task 1
Introduction
Phishing can be defined as a web-based criminal activity that makes use of the social engineering
techniques and deceits the users to obtain sensitive and personal information from them. Under
the social engineering techniques, the spoofing technique is often used to trick the users so that
they may share some of the extremely sensitive information, such as the financial details or
passwords to the attackers (Suganya, 2016). There are phishing toolkits that are also available
which can be used to create a phishing page in a very short timeframe. In order to deal with such
security risks and issues, there are numerous anti-phishing techniques that have been developed.
These techniques can be further classified as technical and non-technical approaches (Hong,
2012).
Preventive approach
User Education
There are many different preventive approaches, but perhaps most of them would be rendered
ineffective unless the user’s themselves are not educated. The user awareness and perception of
the phishing threats may lead to the avoidance of a number of security vulnerabilities (Patel,
2012). Following constitutes an effective user-training or awareness program and if applied, can
help mitigate phishing based attacks significantly:
2

 The employees shall be provided with the education and knowledge on the different
attack methods that are used and the various defense strategies that can be applied.
 The employees shall be regularly updated about the latest modes of attacks that may be
used through the emails (Baiomy, Mostafa and Youssif, 2019).
 The employees shall be provided knowledge on the differentiation between the legitimate
mails and the ones that may be suspicious.
 The employees shall be having the understanding on the response and communication
techniques that shall be used when a phishing email is shared.
 The links that are included in the mails have specific characteristics that may alert the
user on the non-authenticity of the link. The employees shall be aware of such
characteristics (May, 2013).
 The employees shall know that the response to the suspicious emails shall not be
provided and the critical information must never be shared.
Network Level Protection
The utilization of the network security tools and the implementation of the network-level
protection provide the ability to restrict specific IP addresses to obtain the network access. The
access to such users and addresses is blocked and the chances of the phishing and other forms of
network security attacks may be brought down as a result. The communication from the entities
that are marked as spammers is blocked (Forte, 2009). This form of protection is also termed as
the blacklist filters. These filters can be further classified in two types as anti-spam and DNS-
based blacklist filters. The anti-spam filters are the ones that determine the origin of the mails
and prevent the access in case of the suspicious mail origin. In the DNS-based technique, the
blacklist is developed by the service providers and is updated at regular intervals to prevent the
unauthorized access. Authentication also plays a significant role in the network security and
protection. With proper authentication measures, the security at the user and the server level can
be enhanced (Naidu, 2016).
Link-based Protection
The most common technique that is used to give shape to the security attack is the embedding of
the link in the mails which is clicked upon by the users to redirect them to the fake web pages.
The URLs are incorporated in the phishing mails and the users are asked to share the personal
3

and sensitive information on the page. The phishing mails are extracted with the use of certain
features that are easy to identify (Christy, Merlin and D. C., 2019). The protection techniques
that can be used in this regard include link guard and the use of the support vector machines
(SVM).
Blocking of Phishing Websites
There is a very minute difference between the fake website and the original website in terms of
the look and design of the site. The pattern used in the URL is also very similar that may make it
difficult to spot the fake site. The phishers make sure that the difference is very minute so that it
may become difficult for the user to identify the same.
 Blacklist and Whitelist
The use of these lists can be done to block the phishing website. The URLs included
under the blacklists shall be the ones that may have suspicious history or may have been
involved in any of the phishing attacks in the past. Whitelist, on the other hand, shall
include the list of the legitimate sites and sources. Google safe browsing API is the
service that provides the ability to verify a URL if it is blacklisted or not. The issue of
exact matching can be resolved using PhishNet (Ahmed and Naaz, 2019).
 Heuristics-based blocking
Heuristics include the protocols and the rules that may have been determined on the basis
of the past results. The detection of the phishing attacks may be done using the heuristics-
based blocking and it has been found to be quite effective as well (Babu, 2016).
 Visual Similarities
There are visual similarities that are usually focused upon by the attackers so that the
difference between the fake and the legitimate site is not easy to determine. There are
techniques and tools that have been developed to spot such visual differences. For
example, the visual similarity-based phishing detection can be used along with the use of
TrustBar (Fatima et al., 2019).
Reactive Measures
There are some of the reactive measures that may be followed towards the security.
4

 Security Incident: In case of a security incident, such as malware attack or identity theft,
the reactive measure that may be adopted is to disinfect the system or the file from the
malware and block further access to the same. In the case of identity theft, access control
and blockage shall be applied. The security incident may have further impacted or
occurred through network, host, or user.
 Network: In case of the network-based security attack, the reactive techniques
towards security will filter the source address from the router and disable the network
connection for a while so that the network access may not be obtained (O'Leary,
2019).
 Host: In the case of attack on the host, the reactive measures that may be adopted may
include the memory reboot, formatting of the storage areas, and operating system
reloads (Sari and Karay, 2015).
 User: If the attack comes from the user, then the user passwords may be changed or
the accounts may be suspended (Pripas, 2014).
In the reactive security architecture that is developed, there are several modules that are
developed to provide the reaction to a security incident. In the case of failure of a particular
module, another module shall be ready to enhance the fault tolerance of the overall measure
(Zhurin and Komarkov, 2018). There is a lot of research that has been done to determine the
reactive security measures that shall be followed for the wireless networks (Gandhi and Kumar,
2012). The reactive data security techniques for the wireless networks are becoming popular so
that the availability is always maintained.
Policy Oriented Measures
Apart from the technological and logical measures, it is also necessary that the organizational
policies and human resources involved also contribute towards the security. There are a few
policy measures that shall also be adopted to deal with the phishing attacks (Shashidhar, 2017).
The combination of the best practices and policies shall be used so that the standard security plan
and policy can be developed. There are some of the policies that are listed below.
Email Policy
There shall be a secure email policy that shall be present which shall comprise of the
characteristics of secure email, best practices for reporting, forwarding, etc. to prevent the
5

security loopholes and phishing attacks. The proper communication will lead to better security
(Ji, 2013).
Security Awareness Training Policy
The policy shall include the awareness and training mechanisms that shall be followed to train
the resources and the stakeholders on the security standards and protocols. With proper training,
the employees will be able to be in line with the required security norms and practices (Renaud,
2018).
Acceptable Use Policy
There are different computing tools and equipment used in the organization. The policy shall list
out the acceptable use of every form of tool and equipment to avoid the associated security
attacks. There are legal obligations that may also occur due to inadequate use of the computing
tools and the policy will make sure that any of such risks and issues does not occur in the
organization (Siau, Nah and Teng, 2016).
Conclusion
Phishing attacks have become extremely common in the present times due to the ease of attack
platforms and measures that are associated with it. There are some of the protection measures
that may be used to prevent and avoid these attacks. The network-level protection, user
education, and link-based protection can be used in terms of the technical and logical measures.
There are policy changes and implementations that shall also be done to make sure that the
phishing attacks do not take place.
6

Task 2
Recovering deleted files
1. Accessdata FTK Imager was used to capture Windows swap file that involved:
Hiberfil.sys, Pagefile.sys and memdump.mem.
2. The same process is followed for all three Windows swap files.
3. Finally, after the Windows Swap file has been generated, Belkasoft Evidence Centre
which is a forensic analysis software will be used to attempt to extract deleted files from
the same.
4. The evidence centre software allows not only allows for file carving, but allows selecting
of specific file-type carving beforehand.
7

5. The file carving process takes time depending upon the file size and can carve whatever
files were present or deleted in the swap file.
6. The recovered files are displayed in the case-explorer section of the application and can
be saved to a location of choice. In this case, it recovered two documents that were
present at one point in the hibernation swap file.
8

7. The same process has to be repeated for all the Swap files.
Recovering passwords
1. In this case, the memdump.mem which is he live memory dump of Windows, captured
by FTK Imager mentioned earlier will be used.
2. The live memory dump is loaded into WinHex software.
9

3. Simultaneously, multiple search strings with keywords: ‘Pass’, ‘pass=’, @xyzmail,
‘password’ etc. were used to recover passwords that were stored within the browsers of
the live memory swap file.
4. The following passwords were retrieved.
Also, a credit card details along with it’s security code and expiry date was also revealed.
10

References
Ahmed, kahkasha and Naaz, S. (2019). Detection of Phishing Websites Using Machine Learning
Approach. SSRN Electronic Journal.
Babu, S. (2016). Phishing Detection in Websites Using Neural Networks and Firefly.
International Journal Of Engineering And Computer Science.
Baiomy, A., Mostafa, M. and Youssif, A. (2019). Anti-Phishing Game Framework to Educate
Arabic Users: Avoidance of URLs Phishing Attacks. Indian Journal of Science and Technology,
12(44), pp.01–10.
Christy, P.P., Merlin, P. and D. C., J.J. (2019). Protection System against Phishing Attack. SSRN
Electronic Journal.
Fatima, R., Yasin, A., Liu, L. and Wang, J. (2019). How persuasive is a phishing email?
A phishing game for phishing awareness. Journal of Computer Security, 27(6), pp.581–612.
Forte, D. (2009). Anatomy of a phishing attack: A high-level overview. Network Security,
2009(4), pp.17–19.
Gandhi, V.K. and Kumar, P.R.S. (2012). A Study on Phishing: Preventions and Anti-Phishing
Solutions. International Journal of Scientific Research, 1(2), pp.68–69.
Hong, J. (2012). The state of phishing attacks. Communications of the ACM, 55(1), p.74.
Ji, H. (2013). Research on Email Security Policy Based on Network Technology. Applied
Mechanics and Materials, 339, pp.292–296.
May, C. (2013). Approaches to user education. Network Security, 2008(9), pp.15–17.
Naidu, P.G. (2016). A Survey On Various Phishing Detection And Prevention Techniques.
International Journal Of Engineering And Computer Science.
O’Leary, D.E. (2019). What Phishing E-mails Reveal: An Exploratory Analysis of Phishing
11

Attempts Using Text Analyzes. SSRN Electronic Journal.
Patel, D.K. (2012). Phishing in Mobile Devices: Survey and Prevention Mechanism.
International Journal of Scientific Research, 2(3), pp.86–88.
Pripas, M.-I. (2014). Phishing Attack – Detection and Removal. International Journal of
Information Security and Cybercrime, 3(1), pp.59–64.
Renaud, K. (2018). Cooking up security awareness & training. Network Security, 2018(5), p.20.
Sari, A. and Karay, M. (2015). Reactive Data Security Approach and Review of Data Security
Techniques in Wireless Networks. International Journal of Communications, Network and
System Sciences, 08(13), pp.567–577.
Shashidhar, S.K. (2017). Spear Phishing - The New Face of Phishing. SSRN Electronic Journal.
Siau, K., Nah, F.F.-H. and Teng, L. (2016). Acceptable internet use policy. Communications of
the ACM, 45(1).
Suganya, V. (2016). A Review on Phishing Attacks and Various Anti Phishing Techniques.
International Journal of Computer Applications, 139(1), pp.20–23.
Zhurin, S.I. and Komarkov, D.E. (2018). Protection of external information perimeter of
organization from spear phishing. Bezopasnost informacionnyh tehnology, 25(4), pp.96–108.
12