We all know we shouldn’t click on suspicious links, because it could cost us dearly…
But do we really know it? Time to check, with the latest Digital Stories experiment—and this time with impressive partners. The result is definitely worth a scare. Worth making us think. Worth giving us that healthy dose of doubt that can, quite literally, save us.
A Hunter and a Fisher…
How could anyone resist? An email lands in your inbox from a big chain of gas stations, offering a special discount. You click, you save a fair bit on your next fill-up… And if this weren’t an experiment but a real cyberattack, it could all end with a hacker gaining access to your personal data—and why not your bank account too.
Phishing—spelled differently in English, but derived from “fishing.” That is the name of one of the most popular cyberattacks of recent years, one that relies not on technological loopholes but on what may be the weakest link in the chain of information: common sense.
Hackers sometimes craft virtuoso emails, almost impossible to tell apart from the real thing, and use them to get the victim to click a malicious link. And then to regret it—phishing costs billions of dollars. Last year, it is estimated, nearly 900 million such attacks were attempted worldwide, and over 90 percent of organizations were targeted.
But maybe the problem doesn’t exist here in Bulgaria? Perhaps the Bulgarian online user will turn out to be well prepared enough to spot fake emails without fail, and would never, for anything in the world, fall for something like this?
Evening Roll Call
“Trust, but verify,” Mr. Reagan used to say, and as you know, verifying is what I love most here on Digital Stories. Checking how far both people and algorithms have come.
This time I’m not alone: we are running the experiment together with a leading Bulgarian cybersecurity company, for which checks like this are a profession. Very often, part of their job is to test the employees of companies and institutions—to see whether they are prone to fall for a fake email—so that training can then help them avoid the real attack.
Tellingly, the person running the experiment has no experience as a programmer, and yet will create a page made to look like that of a popular gas station chain. The attempt is especially revealing because it shows how much easier today’s technology makes it to mount such a cyberattack, with no particular preparation.
You’ve Got Mail
Who are we going to test? The goal isn’t, say, the employees of a particular institution, or a specific sample, demographic or otherwise. We decide to go with a list of randomly chosen emails that have surfaced online. We limit ourselves to people in Bulgaria with public addresses, with no restrictions on age or gender.
So the question is simple but vital: how easily would people hand over sensitive information, lured by an attractive but fake offer?
No sooner said than done. With basic software, we build a fake web page that quite successfully mimics the look of the official website of a popular gas station chain.
A curious detail: with today’s technology, this can be done without writing a single line of computer code. (And yes, in this case not even artificial intelligence was used!)
“The messages were worded to create a sense of a lucrative and urgent opportunity, prompting users to click a link that took them to our pre-prepared phishing page. There they were asked to enter their details in order to get their ‘discount,’” says the specialist who ran the experiment.
Of course, in the spirit of real phishing attacks, the email was sent from a domain that very closely resembles the genuine one.
In Their Image and Likeness
The results… frankly, they impressed us. We used emails we weren’t even sure were still active, and yet an astonishingly high percentage of people took the bait!
Our email reached 393 users. A full 69 of them (or 17.5 percent) followed the link. Clearly, the content of the email was convincing enough, and the users careless enough.
And now for the cherry on top. As many as 19 people (or 4.8 percent) uncritically entered their personal data into the fake form!
Does that seem like a small number? Think again.
Imagine you are a real hacker: you send a phishing email to thousands of users, and almost 5 percent of them are fooled to the point of entering sensitive data. It doesn’t take much imagination to picture the scale of the damage and the consequences… Especially if these are people using their work email. Having someone’s personal bank account drained is a nightmare and a real life drama, but the problems would become even bigger if this were how the security of an institution or a large company got compromised.
Bad Boys
19 stolen accounts.
If it hadn’t been me and my cybersecurity colleagues but real hackers, we would most likely be quite a bit richer by now…
Our goal, though, is even more important. For more of us to realize how fragile security online is. Over 27 percent of the people who landed on the site entered their personal data. That’s how effective a well-made phishing site can be.
And the other statistic points in the exact opposite direction. Emails reported: 0
You know you can always flag an email that is obviously trying to trick you. Not one of the owners of those 393 virtual mailboxes did.
I think it’s time for all of us to get a little scared…
“The data show a worrying reality: Bulgarian users are highly susceptible to phishing attacks, and the combination of a tempting offer and a convincing execution gives attackers a high success rate,” the cybersecurity specialist adds.
Click to Hell
So: are 69 people who clicked the link and 19 who entered sensitive data a lot or a little?
In the world of cybersecurity, even a single successful breach is too many.
The experiment clearly showed that there is a large, vulnerable group of people who can be misled by a well-crafted scenario.
What’s more, some users made repeated attempts to enter their data on our fake platform. This shows how convincing the scenario can be—people were so sure of the offer that they kept insisting on getting in, handing over their sensitive information again and again.
Abandon All Hope
Each of these 19 cases represents a huge risk. “Compromised passwords and usernames are often reused to access other services,” says the specialist. “Personal email, social media profiles, sometimes even online banking. That way a single incident can put the victim’s entire digital identity, financial stability and personal reputation at risk.
“This social engineering simulation unambiguously underlines the need for a constant, targeted improvement in cyber hygiene. It has to become second nature to us. It’s important for all of us to build a culture of vigilance that helps us stand up effectively to ever-evolving online threats.”
Truly, it is more important than ever to be vigilant. Here’s how.
Warning!
Before we part, here are the key elements of the “attack” that made it successful. These are exactly the things to watch out for if you want to avoid real trouble.
Until then, watch out for:
1. The Look-Alike Domain
A key step was buying an internet domain resembling that of the real company. The technique is called “typosquatting”—you register a name containing a deliberate misspelling or a visual resemblance to the original (for example, “oilc0mpany.com” instead of “oilcompany.bg”). That way, even if users glance at their browser’s address bar, there’s a good chance they won’t notice the tiny difference and will accept the site as legitimate.
2. The Fake Promotional Page
The next step was to recreate a page that looked like part of the gas station chain’s official website. We copied the logo, the colors, the fonts and the overall design to build a sense of authenticity. We added a form for users to enter their information. Since the campaign wasn’t aimed at collecting sensitive data (and yes, we’ve deleted the rest too!), we limited ourselves to four fields: first name, last name, phone number and address.
3. The Tempting Email
The phishing message itself was the heart of the operation. We sent the emails from a mail server set up specifically for the purpose, to improve the chances of getting past spam filters. We altered the sender so that it matched the gas station chain’s real domain. The content was short, clear and extremely tempting:
Offer:
“Take advantage of an extra 20 STOTINKI” (stotinki being the hundredths of a Bulgarian lev)
Call to action:
A clearly visible button and a link reading “ACTIVATE THE DISCOUNT.”
Creating a sense of urgency:
To make recipients act on impulse, we added an element of urgency—phrases like “Don’t miss this opportunity!” This psychological trick is extremely effective, because it cuts down the time for critical thinking.
