1. 2014 From Phish to Phraud Kat Seymour October 10, 2014 #GHC14 2014

2. 2 * http://www.sec.gov/investor/pubs/phishing.htm http://www.sec.gov/investor/pubs/phishing.htm ** http://www.emc.com/collateral/fraud-report/rsa-online-fraud-report-012014.pdf http://www.emc.com/collateral/fraud-report/rsa-online-fraud-report-012014.pdf 2013 phishing statistics: Approximately 450,000 incidents recorded** Over $5.9 billion in losses** The United States government describes phishing as the use of fraudulent e-mails and copy-cat websites to try and convince you to reveal valuable personal information, such as account numbers, login credentials or your Social Security number, to be used to try and take your money, your identity or both.* What is Phishing

3. 2014 Social engineering tactics & risks 3 Use publicly available information to deploy social engineering tools Vishing Phishing Account take over Initiates malicious action (Trojan, Key Logger) What are the risks? Personal and/or enterprise risk Fraud and identity theft Business disruption Home burglary Reputational damage Theft of confidential documents and/or equipment Financial losses

4. 2014 4 Weak Phishing e-mail Unrecognizable senders Generic salutations Misspellings Check the URL

5. 2014 5 Use of company brands Use of company words to make the phish look more authentic Generic salutations Check the URL Urgency Unrecognizable senders Strong Phishing e-mail

6. 2014 Referers 6

7. 2014 Find IP and check sites using URLQuery 7

8. 2014 Suspicious IP indicators 8 Click Delta Velocity Score

9. 2014 Device Fingerprinting 9 The New Endpoint Desktop Computers Laptops Tablets Mobile phones Internet TV Refrigerators Environment Control Systems Portal Devices

10. 2014 Challenges and opportunities 10 Working with ISPs to remove phishing websites Active monitoring of logs, traffic, websites and registered domain names Work with email providers to help authenticate senders and prevent phishing e-mails from ever reaching customer in-boxes What is the industry doing to protect you? Spread out across many countries and ISPs Phishing has been around a long time and new types of attempts are constantly evolving Happens on the client/customer side Systems are outside of our space Challenges of defense

11. 2014 Got Feedback? Rate and Review the session using the GHC Mobile App To download visit www.gracehopper.org