Longlining: the new phishing attack targeting businesses
Posted on 8 Jul 2013 at 10:00
Davey Winder reveals the latest style of phishing attack, "longlining"
Targeted spear-phishing and traditional mail-bombing attacks are merging to create yet another new genre in the email scam game – longlining.
This name isn’t simply another fishing pun, but rather a literal description of how this technique works.
Longline fishing is a commercial practice that employs a single line several miles long, baited with thousands of individual hooks. Longline phishing gets around traditional security systems by a process of "mass customisation", employing a rapid bombardment of thousands of uniquely targeted messages.
Find out moreProtecting your business from phishing attacks
Many security gateway filters will be looking for identical or similar messages from a single source, so they won’t detect a longline attack, the messages of which have widely differing subject lines, content and, most importantly, originating IP addresses.
This multiple-hook analogy applies to the body content of the messages themselves, which will contain multiple variations of the embedded malware target URL, the ultimate destination of which will almost always be a trusted site that’s been compromised in some way (which helps evade reputational filtering on the URL).
Think of longlining as a parallel phishing delivery system and you’re in the right ballpark.
Armed with the capability to send hundreds of thousands of these malicious URL hooks in a matter of hours, plus the ability to bypass many corporate gateway filtering systems, the bad guys increase their chance of exploiting a zero-day vulnerability before the IT department has been able to patch it.
I’ve heard longlining described as "combining the effectiveness of spear-phishing with the speed and scale of a virus attack" – and that scares me, even if it doesn’t scare you.
It would certainly encourage me to make sure my IT security education programme was up to date.
Did you mean "longlining".
That's the term used in this article by Proofpoint.
By simnfs on 9 Jul 2013
Typo in the headline?
By Pantagoon on 9 Jul 2013
Davey is a contributing editor to PC Pro, having covered the internet as a topic since the magazine started in 1994. Since that time he's won numerous awards for his journalism, but remains a small-business consultant specialising in privacy, security and usability issues.
- Small steps into handling Big Data
- Nexus 5: does it really run stock Android?
- How to get broadband to a garden office
- How to write your company's IT security policy
- Raspberry Pi and Wolfram: a must-have for every child
- Could you get by with Office Web Apps?
- The best Android antivirus apps for 2014
- Headings vs headers: how to use both in Word
- Windows Server 2012 R2: how the Datacenter edition could change SMBs
- Invoices and VAT: how to set up your documents correctly
- Windows 8.1 Update: an abject surrender
- The insane economics of Sky Now TV
- No such thing as a free app... so pay up if you want quality
- Time to outlaw crapware-laden installers
- Windows Phone 8.1 video: hands-on
- Office for iPad: key information
- Why every PC buyer owes Richard Durkin a debt of gratitude
- HTC One M8 vs Samsung Galaxy S5: 2014's big-hitters compared
- Windows XP end of life: key information
- Cut out the broadband jargon? What jargon?
- Ubuntu LTS Server 14.04 extends cloud support
- Intel: PC sales are "encouraging"
- Google to rank encrypted pages higher
- Heartbleed: the race to reissue security certificates
- Dropbox boosts app line-up with Carousel and Mailbox for Android
- BlackBerry CEO says not selling off phones "any time soon"
- Microsoft halts business downloads of Windows 8.1 Update
- Raspberry Pi targets business with Compute Module
- Microsoft releases final patches for Windows XP
- Windows Phone 8.1 gets its own PA: Cortana