3 Page Outline - Business Major

PHISHING ATTACKS PROPOSAL 6

Phishing Attacks Proposal

Introduction and Problem Statement

Over the past years, one of the most challenging crimes that have been a serious threat to the internet security of all computer users has been identity theft. This is a lucrative crime whose roots spread across the world and are perpetrated by different individuals using sophisticated technology. Identity theft entails the act of stealing as well as utilizing the identity information of another person to commit crimes such as steal money, crucial personal information, or even destroy confidential data and information (Psannis & Gamagedara, 2017). One of the techniques that have been used to perpetrate identity theft is a phishing attack. A phishing attack refers to a type of crime associated with social engineering whose emergence, occurrence, and advancements are proving to be an enormous challenge for both key industry players as well as academic researchers (Lyashenko, 2015).

The main aim of carrying out phishing attacks is to steal crucial information that is sensitive to users such as online banking details, usernames, and even passwords. According to researchers, the number of phishing attacks is becoming a serious threat, and in other cases, phishing reports indicate that it is not only the organizations that are becoming victims of the phishing attacks but the number of attacks is on the rise, and the level of sophistication is also advancing day in day out (Doupe & Warner, 2018). Of importance is that the phishing attacks have evolved in terms of the approaches that are followed in penetrating computer users and violating their privacy.

Objectives

This research aims at studying the level of sophistication in which phishing attacks has advanced. In this regard, it seeks to determine how modern methods of phishing attacks are different from the traditional ones. Secondly, this research aims to explain the different current methods of carrying out phishing attacks. Thirdly, this research study aims at determining how these sophisticated methods of carrying out phishing attacks can be controlled.

Literature Review

Different researchers and professionals have explored the issue of modern phishing attacks and presented their work in the form of journals and articles of research. One amongst the journals is “Defending against phishing attacks: Taxonomy of methods, current issues, and future directions,” authored by Kostas Psannis, and Nalin Asanka Gamagedara (2017). In their research, they noted that phishing statistics indicate that there is a rise in the number of successful attacks that are being carried out against industries and critical institutions. Psannis and Gamagedara (2017) present this statistical information in the form of a pie chart showing the various domains that exist and how each one of them has been affected. Based on a report presented in the form of a pie chart by the team, domains that are worst hit by the crime include; retail, financial service sector, payment services, multimedia domains, and social media domains.

Other researchers who have explored the issue are Ike Vayansky and Sathish Kumar (2018) through their study, “Phishing- Challenges and Solutions.” Relative to the others, they examine the issue of modern phishing attacks from an entirely different perspective. In their case, they evaluate some of the methods that are being used in contemporary penetration courtesy of phishing expeditions. Some of the methods that they outline as having been used in the past include spoofed emails. According to them, these emails are sent to the victim with convincing message them to compel them to send their useful information over the internet or email.

Biju Isaac, Raymond Chiong, and Seibu Mary (2014) are other researchers who explored the issue of modern phishing attacks. In their studies, they examined some of the types of recent phishing attacks. Among them were the creation of the rogue access point and the image-only attack which use the alternating images such as GIF to confuse the spam filters. Just like Psannis, and Gamagedara (2017), Isaac, Chiong, and Mary (2014) have also presented some vital statistics on how modern phishing attacks have wreaked havoc in the industrial world.

Modern Phishing Attacks

This is a section that will contain information regarding some of the modern methods of carrying out phishing attacks. Additionally, this section of the research will aim at distinguishing between social engineering and other forms of attacks. Below is an outline of how the sections will be organized.

Social Engineering versus other Computer Attacks

This section will begin by first defining social engineering and providing details of the examples of social engineering approaches that exist. One amongst the elements of social engineering that will be discussed here includes phishing attacks. Other forms of social engineering will be discussed but briefly. Among them are; baiting, pretexting, tailgating, and quid pro quo among others.

Other than the discussion of the various forms of social engineering approaches, it is essential to maintain the focus of the paper. Therefore, the paper will focus entirely on the approaches that are followed in carrying out phishing attacks in the modern world. One of the approaches to phishing attacks that will be discussed here is the redirection attack also known as the misdirection attack. The second attack that will be discussed in this section will be the pop-up window attacks which are being used extensively by some of the prominent and sophisticated attackers.

The third type of attack that will be explored here is the email with an image-only attack which to a greater extent employs the aspect of images in emails. The fourth type of attack that will be discussed in this section will be the email field manipulation attack, a form of attack that is carried out on the side of the client as opposed to being carried out from the remote server.

In terms of technical approaches to phishing attacks, different forms of attacks will be explored. Some of them will include’ cross-site scripting, screen, and key loggers, DNS poisoning, malware phishing, and session hijacking. With the key or the screen loggers, they are programs that are installed on the target’s system where they enable the attacker to take screenshots as well as movements of the mouse while at the same time sending these resources to the attacker in a different remote location. With DNS Poisoning, it will entail a discussion of how the fake DNS server is created as well as how the target is convinced to proceed with the utilization of this DNA server.

With the malware phishing, this research will explore how malware is planted in a computer and used in the storage of the victim’s credentials as well as transmitting the credentials to the attacker. With the session hijacking, this paper will explore how a DoS (Denial of Service Attack) is carried out and how identities are stolen during the denial of service attack which later facilitates illegal access to resources. Finally, under cross-site scripting, this study will explore how validation of input and dynamic contents of a web page are used to carry out cross-site scripting attack which also facilitates phishing on the victim.

Taxonomy of Defense against Attacks

This section will look at the right solutions to the attacks that will be discussed in the previous section. Although the approaches to solutions can be the same, this section will seek to provide a solution to every approach of phishing attack discussed in the previous section. The first approach in the taxonomy will be the network level protection which will entail other aspects such as the utilization of anti-spam filters as well as DNS based blacklists. The second approach will involve the use of authentication both on the client side and on the server side. The third approach in the taxonomy will entail email classification based on features to minimize the impact of links being embedded on mails which upon clicking lead the user to a different site. The fourth approach in the taxonomy will entail blacklisting as well a whitelisting for websites that are known to be sources of phishing expeditions and those that are not. A differentiation approach to minimize the impacts of phishing activities. The final method or approach will entail the use of heuristic solutions which operate by rule sets solving both the learning process as well as problems.

Conclusion

This will be the final section of the research document. It will provide an overview of the findings that the document will come up with. With all the previous parts addressing unique and differentiated issues, this section will sum up the problems addressed while at the same time providing the best way forward.

References Doupe, A., & Warner, G. (2018). Inside a phisher's mind: Understanding the anti-phishing ecosystem through pgishing kit analysis. Conference Paper, 1-10. Isaac, B., Chiong, R., & Mary, S. (2014). Analysis of phishing attacs and countermeasures. Information Security Research Lab, 1-6. Lyashenko, V. (2015). Methodology of the chaos theory in research of phishing attacks. International Journal of Academic Research, 12-19. Psannis, K., & Gamagedara, A. (2017). Defending against phishing attacks: Taonomy of methods, current issues, and future directions. International Journal of Telecommunication Systems, 2-19. Vayansky, I., & Kumar, S. (2018). Phishing- Challenges and solutions. Computer Fraud and Security, 14-20.