The results are in for the first half of 2012, and once again, phishing attack numbers mark a notable increase on the global scale.
Compared with H2 2011, end of June numbers show a 19% increase as phishers heavily target the UK, U.S. and Canada ? and their associated brands ? with?the same old online trickery that continues to plague the world.
Why is this older, well-known, and rather simplistic threat still so prevalent today? Read on about the numbers, the attacked countries and the reasons why phishing remains successful still.
A Numbers Game
1H2012 phishing attack numbers mark the fourth increase recorded since 2H2010, this time jumping 19% compared with 2H2011. Through the first half of the year, attack numbers averaged monthly at 32,581.
As for monetary losses, 1H2012 statistics released by RSA in July, show that estimated worldwide losses from phishing attacks alone amounted to over US$687 million. This number was calculated using a lower attack uptime median and yet, it marks a 32% increase in losses when compared with last year?s equivalent (1H2011), and a slight decrease when compared with 2H2011.?
The interesting part this time was the fact that the industry?s attack duration median (uptime), according to the Anti-Phishing Working Group,?went down from 15.3 hours per attack to 11.72 hours per attack, thus somewhat curbing the monetary impact of each attack, even though attack numbers keep climbing.??Had attack medians remained the same, the monetary losses to phishing in 1H2012 would have exceeded US$897 million. Statistically speaking, this saved the world close to an additional 31% in money that could have been lost to phishing attackers.
The roster of top countries most attacked by phishing in the first half of the year did not present any surprises; the same shortlist displayed the countries most attacked on a monthly basis, with the top?five constituents being the UK, U.S., Canada, Brazil and South Africa.
There have been major increases in phishing attack volume in some countries, while slight declines were recorded for others. One of the most significant increases was seen in Canada, where phishing increased nearly 400% in the first half of 2012. There have been many speculations as to why the sharp increase, but the main reason is simply economics ? fraudsters follow the money. With the Canadian and U.S. dollar being exchanged at nearly a 1:1 ratio, Canada has become a lucrative target for cybercrime.
The Prevalence of an Old Threat
Phishing has been around for over 16 years now, and yet, the world has not been able to rid itself of this phenomenon. Phishing is still one of the top threats on the Internet today; but what makes phishing remain such a successful threat in spite of the industry?s experience with this online menace?
At the core of this seemingly simple threat lies a powerful force? human emotion. Although phishing is a 21st century crime, manipulation, deceit and persuasion are not.? What makes phishing so successful is its social engineering component which drives the schemes used by cybercriminals today to manipulate online users into disclosing private information.?
In social psychology, one of the routes to persuasion is designed to get a person to purposefully not think ? but rather react emotionally and react immediately. Again, not new. Persuasion schemes have always been and still are, vastly used in confidence scams and in telemarketing fraud.
Because persuasion is such a pervasive component in our lives, it is easy to overlook the external influences affecting us. When it comes to phishing, cybercriminals rely on persuasion in getting a victim to act on emotions such as anxiety or excitement.
Every phishing attack is built with emotional triggers. Intended readers have to be convinced that they need to visit the URL for a reason valid and credible enough to cause them to impart their credentials and personal information.
The better ploys add these common human motivators and emotions to the mix:
- Rightful Rewards: Tax refunds, prizes
- Greed: Unwarranted lottery winnings and 419-type scam deals
- False accusations: Tax Fraud report from the authorities
- Curiosity: ?Look who has been searching for you?
- Right the wrong: Fake order confirmations from known online merchants or shopping sites citing alleged purchases the person made
- Trust: Fake emails from banks, service providers, investment houses, social networking friends or professional network colleagues/ business associates.
In terms of numbers and effectiveness of attack ploys, it appears that the most successful campaigns rely on trust.? This explains?a current and prominent trend of phishing via social networking sites.??
Creating that rush of strong emotion within a potential victim repeatedly enables cybercriminals to elicit an immediate response as the victim?s ability to think logically will likely be hindered.
Crime in the cyber arena is a big threat to the exponentially growing online population which loses billions to online fraud every year. Quarter by quarter we see that phishing is only picking up more speed; attacks are qualitatively better than ever and numbers are still on the rise.? The RSA FraudAction Anti Fraud Command Center has shut down over 660,000 phishing attacks to date, having handled a myriad attacks against its customers every month.
To get the full details on phishing globally, visit the RSA Global Phishing Map.
**The content for this blog was provided by Limor Kessem.**
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.