Combating Phishing Attacks


Published on

It seems like we've been hearing a lot about phishing in the news in recent years, and this threat hasn't abated yet. Why are attacks via phishing -and social engineering in general -so prevalent and so effective? This whitepaper examines the many different methods employed in phishing attacks and social engineering campaigns, and offers a solution-based approach to mitigating risk from these attack vectors.

Published in: Technology, News & Politics
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Combating Phishing Attacks

  1. 1. White Paper Combating Phishing Attacks How to Design an Effective Program to Protect Your Organization Against Social Engineering
  2. 2. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Most of today’s data breaches start with a phishing email, giving company-confidential data to malicious outsiders. This is a real problem that companies need to address. Phishing attacks are the most frequently used form of social engineering. They work because they take advantage of cognitive biases, or how people make decisions. These techniques prey on human emotion by appealing to greed, curiosity, anxiety or trust. Phishing means that attackers are fishing for your private information. Attackers attempt to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Many times this is done to steal a victim’s login credentials and other confidential information. Phishing continues to grow and become more widespread with attacks up 37% year over year, and 1 in every 300 emails on the web containing elements pointing to phishing.1 So, how can you combat phishing attacks and protect your company and its employees? This paper will discuss the problem of social engineering and phishing along with its consequences, and will outline approaches for solutions to safeguard your organization. Defining the Problem: Breaches Often Start With Phishing To demonstrate the seriousness of the problem, we will briefly present three examples of phishing and the damage they can cause within an organization. These examples range from politically-motivated to financially-motivated to healthcare data attacks. The New York Times, The Wall Street Journal, The Washington Post, Twitter and Apple were all attacked in early 2013 in what is seen as a wide-spread, potentially connected attack on high-value targets.2 In the case of The New York Times, the attackers stole the corporate passwords for every Times employee and used them to gain access to the personal computers of 53 employees. The attack is believed to be politically-motivated retaliation for a Times investigation on China’s prime minister, Wen Jiabao. Although China’s Ministry of National Defense denies the attacks, it appears to be part of a computer espionage campaign against American media that have reported on Chinese leaders and corporations.3 Although these are all high-profile organizations with sophisticated defenses in place, it appears that attackers may have used a targeted spearphishing attack to breach the Times, exploiting human vulnerabilities to click on a link that led to a malicious website. Many times cyberattacks are financially motivated. Attackers try to get customers’ credit card information, and if they are successful, it results in a breach of trust with the company that was attacked, as well as substantial costs of dealing with a breach. Barnes & Noble, the world’s largest bookseller, had credit card information stolen at 63 stores across the U.S.; this information was then used to make unauthorized purchases. In this case, a malware (or malicious software) attack targeted the keypad devices in stores. Security experts believe a company insider could have inserted malicious code, or criminals could have persuaded an unsuspecting employee to click on a malicious link that installed the malware, giving the perpetrators a foothold into Barnes & Noble’s point-of-sale systems.4 Healthcare data breaches have also been in the news recently. According to security expert Larry Ponemon, president of the Ponemon Institute, stolen healthcare records can be much more valuable that financial records because they can be used for financial ID theft crimes, medical ID theft or both, With medical records providing physical characteristic information, attackers can create false passports and visas.5 Over the past three years, about 21 million patients have had their medical records exposed in data security breaches that were big enough to require they be reported to the federal government. (As required by section 13402(e)(4) of the HITECH Act, breaches affecting 500 people or more need to be reported, if the data was not encrypted.) At present, physical theft – such as a stolen laptop from a car – made up 54% of the breaches, while hacking made up about 6% of the compromised data.6 And, although phishing attacks have not been the cause of the most significant data breaches to date, the healthcare industry is acutely aware of the threat and trying to protect against it.
  3. 3. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Consequences of Phishing Phishing attacks can result in compromised client systems. Here are some different consequences of phishing that can impact your network: • Browser exploitation - Browsers and their plug-ins contain vulnerabilities that can be exploited simply by visiting a malicious website. An attacker can send an email with a link, which brings the user to a malicious website (which is often designed to look like a legitimate site.) Just by visiting that site the user’s browser and machine would be compromised and the attacker would have full access to the user’s computer. In addition, a completely legitimate website can be attacked to become malicious. So a user could be browsing a legitimate website that’s been attacked on the back end and injected with malicious code, which then exploits their browser. • File format exploitation – Opening a malicious email attachment is another way to trick users. Attachments are typically PDFs or Office files because those applications are widely distributed and widely used across platforms, and the chance that the recipient can read that kind of file is higher. Once the malicious attachment is opened it exploits vulnerabilities in a given application. • Executable exploitation – This exploit uses another form of email attachment, an executable file (ending in .exe) that runs when the user clicks on it. It is programmed to operate without needing a vulnerability in the program. Although .exe files are quite often blocked by email security features, there are other types of executables. For example, JAR (Java Archive) files end in .jar, rather than .exe, but they can still execute a malicious file when you double click on them. How do attackers gain your passwords or other credentials? Here is an overview of some of the methods used: • Phishing form - This attack starts with a phishing email that includes a link to a website. When the user clicks on that link, it doesn’t start to exploit your browser but it just pretends to be a familiar website, such as the LinkedIn log in page or Outlook Web Access. When the user types in their user name and password, it captures that information and records it, and then typically forwards you to the real site and logs you in. But, in the meantime, it’s taking your information and storing it to further access your system in the future. The next two are a little bit different. These require that the user’s computer is already compromised, for example by one of the methods described above, and then they are used to gain additional information. • Passwords and password hashes - In that case, the attacker can copy cached passwords from your machine. Passwords are usually stored in the form of password hashes for security reasons. However, once a password hash has been compromised, attackers can either use cracking to obtain the password in the clear or use the password hash itself in a so-called pass-the-hash attack to gain access to network resources. If an administrator ever logged onto the user’s machine, their credentials are cached on that machine. The attacker could reuse those administrator credentials to access and start exploiting other machines on the network. • Key logging – Once an attacker has access to a user’s machine they can also install what’s called a key logger, which records every key that they press on the keyboard. This would allow the attacker to capture a user name and password when a user types it, and would also capture the text of an email or a document being typed and send it back to the attacker.
  4. 4. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 As a result of compromised credentials, the attacker can gain access to the local file system, file servers, email, the Customer Relationship Management (CRM) system to access customer information, the Enterprise Resource Planning (ERP) system to access corporate financial information, credit card data, healthcare information, and other Personally Identifiable Information (PII) such as Social Security Numbers. So, even if one person in an organization is a victim of a phishing attack, there are major implications for the entire organization and its data. The problems worsen with pivoting to other machines, where a compromised system is used to attack other systems on the same network in multi-layered attacks, bypassing the perimeter defenses. So, even if the user who was hacked does not have access to the ERP system, for example, the attacker now scan the entire internal network through the first user’s machine and see what other machines are out there and the vulnerabilities that exist. Limiting user privileges does not always protect companies from compromise either. Attackers often use privilege escalation, exploiting a bug in an operating system or software application, to gain administrator-level privileges. So, how do social engineering and phishing attacks happen? Email Phishing Techniques There are an estimated 8 million daily phishing attempts – close to 3 billion a year.7 The majority of phishing attacks come through email, where the user is either instructed to click on a link or open an attachment. This leads them to a malicious website or directly launches an attack on their computer. However, as email systems continue to get better and better at filtering out spam, attackers are getting more sophisticated with their types of attacks to avoid detection and gain a bigger payout. Within the realm of phishing emails, there are several different techniques, each with an increasing level of sophistication. Mass phishing is the most common phishing technique, sent out to an indiscriminate list of people, including both company employees and consumers. This technique uses a “hook” that is applicable to many people with the goal of getting anybody to click on it. An example would be emails concerning PayPal, since a huge amount of people have PayPal accounts. Emails disguised to look like they are coming from PayPal could warn you that your account has been closed or there was a problem with a payment. With such a broad audience, the attackers have a good chance of reaching somebody with a PayPal account who falls for the scam and clicks on the link. Statistics show that for 1 million targeted users in a mass phishing attack, anti-spam engines will correctly identify and block the vast majority of threat messages. But of the messages that make it past the spam filters, 3% will open the email and 5% will click through to the link, and then finally be converted, resulting in 8 victims. The average value of the attack per victim is about $2,000.8 Phishing attacks also tend to be more successful when a user checks email via a smart phone. Mobile users are often checking email quickly and are more likely to click on links and provide login info via their phone. In addition, links to phishing pages can also be sent via texts in SMS messages. Once the user lands on the phishing page, it may be hard to determine if the URL is genuine, and in the case of browser exploitation, it may already be too late. Spearphishing is a more specific, targeted attack that addresses several individuals in a specific company. For example, an email could look like it is coming from someone you know, perhaps from the personal account of your CEO or a manager at your company. If the email subject line says “Can you please review this spreadsheet by tomorrow?” and it looks like it is going to the executive team, many of those executives will click on the link because they want to be responsive and do the right thing, but it’s actually a phishing email. So, spearphishing emails can be very targeted to a specific company, or more generally targeted to an industry by offering an industry report or other relevant information.
  5. 5. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 With a targeted spearphishing attack, the attacker may target 1,000 users, but of the emails that make it past the spam filter, the open rate will be about 70%, with a click through and conversion rate of about 50%. The result is 2 victimized users, but the payout is a lot bigger – with a value of about $80,000 per victim.9 In The New York Times case, investigators suspect a spearphishing attack. With one click attackers can install “remote access tools” — or RATs. Those tools can siphon off data such as passwords, keystrokes, screen images, documents and, in some cases, recordings from computers’ microphones and Web cameras, and send the information back to the attackers’ Web servers. Instead of targeting firewalls, attackers are now targeting individuals. With one click on an email, that individual has inadvertently opened the network to attack.10 Clone phishing is another technique. With clone phishing, a legitimate and previously delivered email containing an attachment or link is used to create an almost identical or cloned email. The attachment or link within the email is replaced with a malicious version and sent from an email address spoofed to look like it is coming from the original sender. This technique could be used to pivot (indirectly) from a previously infected machine and gain a foothold on another machine, by exploiting the trust associated with familiar looking email. Whaling is the most sophisticated and most targeted form of phishing, tailored to a single individual. It is usually directed at senior executives or other high profile targets. For example, if attackers wanted to compromise the laptop of a CEO, they could look up that person’s social media accounts and find information about his or her hobbies and interests. Suppose the targeted CEO likes classic cars and is really into old Jaguars. The attacker could send the CEO an email referencing a friend’s name (also found through social media), saying that he wants to sell a classic Jaguar because he’s moving back to Europe. The email sounds like it is from a friend of a friend, and is specific and personal, so the CEO may not think twice before clicking on a link that claims to have photos of the car. And, thus, the whale – the most highly valued target – is harpooned. Another interesting point is that you no longer need to be a sophisticated hacker to commit fraud on the Internet. Off-the-shelf phishing kits are now available and cybercriminals are even migrating to a new business model known as Malware-as-a-Service (MaaS), where authors of phishing kits offer extra services to customers in addition to the phishing kit itself.”11 Social Engineering Attacks Beyond Phishing Emails Social engineering can also be used to launch other types of attacks as well. Some are web-based, others are more low-tech, but they are still quite effective because they take advantage of human nature. Drive-by attacks exploit vulnerabilities in web browsers or plug-ins. Often they use a popular topic, such as celebrity gossip, and optimize a malicious website to rank highly in search engines for that news. When the user finds the site and clicks on it, their machine gets compromised. This is an untargeted attack, but when it compromises employees, it can still put company data at risk. USB drives can be used by attackers to gain access into a network. The same file format exploit or executable exploit that is put into an email by an attacker can also put on a USB thumb drive or a CD ROM. A tactic would be to give the file an enticing name, such as “management salaries” or “layoff list” and then perhaps attach the USB drive to a couple of keys and drop it in the parking lot outside the company that the attackers want to intrude. Then, if an employee walks by and sees it, they would naturally pick this up. People want to be good citizens, return the key and the USB drive. To find the owner’s identity, they may plug the USB drive into their computer. When they see the enticing content, they double click on it, infecting their machine and opening up the corporate network to attackers. Physical or in-person attacks rely on someone walking into a building, under a false pretense such as a package delivery, to get access to the building. They can also use a “tailgating” strategy to follow an authorized person into an off-limits area. Once they have physical access, they can plug a little device into the network to compromise it by phoning home to an attacker’s server.
  6. 6. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Phone calls are another way that an attacker may trick users into handing over their credentials. They may use a ruse such as: “I’m Bob from the IT department; I’m seeing on our systems that your computer has been a little slow lately. Do you have time to sort that out right now?” They then walk you through a few steps, maybe they’ll send you to a malicious website, or maybe they will ask you to give them your credentials. Since the user believes it’s a helpful person from the IT department, many fall for this scam. QR codes, the square 2D barcodes, are being used in marketing campaigns and could also be used as an attack vector as well. When scanned with a smartphone, the QR code sends the user to a website which could be malicious. Social media including Facebook, LinkedIn, Twitter and other social media sites, can be used to send posts, updates, tweets or direct messages with URLs. When the link is clicked on, again victims are sent to malicious sites and their computers are compromised. With Facebook, user’s accounts can be attacked and then configured to send messages to their friends, which may entice people to click on something they normally wouldn’t. Typical Steps of a Phishing Attack In most phishing attacks, the user opens an email, and then clicks on a link in that email. This results in the user’s browser getting exploited. Maybe there is also a form on the web page that captures the users credentials as they are typed in. Alternately, the user could open an email attachment and their machine gets compromised that way. Links as bait in a phishing attack Email attachments as bait in a phishing attack
  7. 7. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Solution Approaches There are essentially two major ways to defend against social engineering scams, in order to protect your company and its employees. One is training your users, and the other is technical security controls. At Rapid7, we believe you have to implement a combination of both user training and technical controls to be successful. Relying on just one approach or the other will probably not decrease your risk to an acceptable level. Nearly 60% of employees receive phishing emails every day, so clearly technical controls are failing to stop many of these messages as they pass through the system. Often, the technical controls are working, but spearphishers continue to change their tactics to cope with the ever-improving technologies. Therefore, the user can be both the weakest point and the strongest resource in the defense of corporate networks.12 With the proper user training, you can turn the weak link into a protector of your organization. Security Awareness Training Security awareness training helps you educate your employees to stop risky activities such as clicking on a link in a questionable email, opening an attachment they are not expecting, or submitting something on a bogus forum. Here are 15 good defenses to teach your company’s employees13 : 1. Don’t trust links in an email 2. Never give out personal information upon email request 3. Look carefully at the web address; it could be a close approximation of the real URL 4. Type the real website address into a web browser 5. Don’t call company phone numbers listed in emails or instant messages; check a reliable source such as a phone book or credit card statement 6. Don’t open unexpected attachments or instant message download links 7. Be suspicious if emails says “do X or something bad will happen” 8. Be suspicious of any email with urgent requests for personal financial information 9. If the email sounds too good to be true, it probably is 10. Always ensure that you’re using a secure website when submitting credit card or other sensitive information via your web browser; look for the https:// and/or the security lock icon 11. Regularly log into your online accounts and check your bank, credit and debit card statements to ensure that all transactions are legitimate 12. Use a reputable anti-virus program 13. Enable two-factor authentication whenever possible. This combines something the user knows (such as a password or PIN) with something the user has (such as a smart card or token) or even something the user is (such as a biometric characteristic like a fingerprint).
  8. 8. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 14. Keep your operating system updated, ensure that your browser is up to date and security patches are applied 15. Always report “phishing” or “spoofed” e-mails to your IT department Once you’ve decided to implement security awareness training in your workplace, you can decide to conduct your training in live classroom sessions at your workplace, or via an online program. There are some good free online training programs available, including: • University of California, Santa Cruz Information Security Awareness training (1 hour or less online) • The Department of Defense Phishing Awareness •, Phishing (see Phishing Scams game on the right side of the web page) It’s important to emphasize this information when it is most needed. Use “teachable moments” to really make a point. For example, Rapid7 lets you safely simulate attacks on your network to uncover pressing security issues. If you send somebody a simulated phishing email and they click through, that’s the perfect time to teach them about phishing, because they’ve just done something that could put both their company and their own personal information at risk. What they’ve learned not only protects your organization, but it also protects that individual against identity theft and financial loss when they are using their own personal devices. Through this kind of security awareness training, you turn each one of your employees into security sensors in your organization. So, there are actually people who can now spot a phishing campaign and can alert security so that they can react. This type of threat might have otherwise have flown under the radar of security. Technical Security Controls Of course, training needs to be coupled with technical security controls. These technical controls will prevent or block many of the threats so that they never reach your users. We’ll take a look at some of the different types of controls and how they work. Vulnerability management is your number one defense against attackers. It identifies existing vulnerabilities in software programs, browsers and plug-ins and helps shield your organization from potential damage, as well as mitigate vulnerabilities through patching, changing configurations or making application updates to remove vulnerable code. Programs like Microsoft Office and Adobe Reader are the typical applications that get exploited through phishing, so it is important to stay on top of any vulnerabilities associated with these programs. You also need to make sure your vulnerability management program is maintained and monitored over time. The keys to vulnerability management are to get visibility on client-side vulnerabilities, focus on solutions that highlight vulnerabilities exploited by malware kits, as well as validate and prioritize vulnerabilities to identify high-risk issues that must be fixed immediately. Patch management is used to fix vulnerabilities based on input from vulnerability management. Some fixes are implemented through patching and some are through changing configurations. Software updates and security updates need to be done in a timely manner to keep up with patching vulnerabilities. Malicious URL and attachment blocking can be done with web filters and SPAM filters. Microsoft Outlook has incorporated a good filter that will put emails into the junk folder if they contain a suspicious link – for example, a link that doesn’t have a domain name but only an IP address. Outlook will automatically put that email into the junk folder or it won’t let you click on the link until you confirm that it’s okay. (Of course, you need to train employees that these emails have been placed in the junk folder for a reason!) There are also web filters that you install at the Internet gateway of your company that will block malicious URLs.
  9. 9. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Intrusion Prevention System (IPS) is another form of defense. If, for some reason, a user does click on a suspicious link, and a website is serving up a browser exploit, an IPS can detect that and block web-based exploitation. Data Loss Prevention (DLP) / Egress filtering is a system designed to detect a potential data breach and prevent it by monitoring, detecting and blocking sensitive data while in use, traveling over the network or in storage. Let’s assume that your network has been compromised and that somebody’s inside the organization to actually complete the action. They haven’t reached their goal until they’ve actually downloaded the sensitive information, so, DLP and egress filtering is all about stopping that sensitive data from getting out of the network. Disabling Java may be a drastic approach to security but Java has been a huge attack vector for compromising systems via malicious links in phishing emails. If you are using critical applications running on browser-based Java, or if your users need Java to get their jobs done, you may want to configure the browser to prompt and ask for permission before launching Java and educate your users to only allow Java on websites they trust. Measuring Exposure and Improvements In order to combat social engineering attacks, you need to know where to start, and then measure the progress you make. Here are some guidelines to do so. Get visibility into the problem as the first step in thwarting attacks against your network. If you’re running a program to reduce your phishing risk, then first of all, you need to know the size of that risk. How do you quantify that? Is your company currently doing well, or not so well? Where do you stand? Gaining visibility it is like putting a stake in the ground. By implementing a penetration testing solution you can answer questions such as: • How are you vulnerable? • Where you are the most vulnerable? • Do you know if the security investments you are making are worth it? • Are you making progress over time? Social engineering campaigns can be implemented inside your company as a test to measure how many people click on a phishing email and how many submit fake log in forms. You can also host your own malicious website to see if your browser is vulnerable and if your security controls are working. Your social engineering campaign will expose user susceptibility to scams and will also test browser security, web filtering and other security controls. Conduct a full penetration test from compromised machines to determine how far an attacker would get. You can even go full scale and hire a penetration testing expert to replicate a real scenario. You can tell this person to try to phish your employees and see how far they can get. Can you get to the credit card database or not? This is a typical goal that an attacker would try to attain, because it gives them access to valuable, financial information. How Rapid7 Can Help At Rapid7, our simple and innovative software solutions give you visibility into the risk associated with your information technology, your users and the real threats you face. Our software helps you quickly prioritize threats, manage risk, and take the right steps to improve your organization’s security. Specifically, Rapid7 solutions Metasploit and Nexpose are ideal complements to combat social engineering threats. Metasploit can be used to simulate phishing attacks and to conduct internal penetration tests, and Nexpose can help you scan the network for client-side vulnerabilities.
  10. 10. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Metasploit, our penetration testing solution, lets you to gauge the risk of a data breach. True to the mantra ‘an experiment is worth a thousand theories’, you can test your defense to see where they fall short – both on the technical and the human side. Our penetration testing software gives you a clear view as to what vulnerabilities can easily be exploited, which passwords are too weak, and how many employees fall prey to phishing emails. With Metasploit, you can: • Manage phishing exposure by simulating phishing attacks. • Safely simulate attacks on your network to uncover pressing security issues. • Audit password security. • Use with Nexpose to assess and validate security risks in your environment. • Verify your defenses, security controls and mitigation efforts. Metasploit Pro lets security professionals can gain visibility into their organization’s exposure to phishing attacks through user- based and technical threat vectors, and introduce the necessary controls to manage the risk. Many organizations already conduct end-user trainings and implement technical security controls to protect their data, but it’s hard to know how effective these measures are – or even if you’re focusing on the right things. Metasploit assesses the effectiveness of these measures, and provides metrics and management for each step in the chain of compromise to help you reduce your risk. In addition, Metasploit Pro’s social engineering reports go above and beyond alternative penetration testing solutions by providing conversion rates, such as how many people clicked through a phishing email, how many entered username and password on a fake website, and how many systems were compromised. It enables organizations to track and trend the effectiveness of their security programs and provides advice on how to address risk at each step in the social engineering funnel. Nexpose, our vulnerability management software, proactively scans your environment for misconfigurations, vulnerabilities, and malware and provides guidance for mitigating risks. With Nexpose vulnerability management solutions, you can: • Know the security risk of your entire IT environment including networks, operating systems, web applications and databases. • Expose security threats including vulnerabilities, misconfigurations and malware. • Prioritize threats and getting specific remediation guidance for each issue. • Integrate with Metasploit to validate security risk in your environment. Rapid7 also offers professional services to help with implementation, training for Rapid7 product solutions or outsourced security risk assessment services such as penetration testing. Our expert pen testers try to find weaknesses in your environment by performing network, application, wireless or other types of penetration testing. Simulating a real-world attack provides valuable insight into real-world risks to your organization And finally, to address the proliferation of mobile devices, Rapid7 offers mobile risk management through Mobilisafe. This manages your vulnerabilities on mobile devices because a lot of people are now reading emails on mobile devices, and as a result these mobile devices now have access to your corporate email. Therefore, mobile devices are a new attack vector that you should take into consideration.
  11. 11. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Conclusion Since 2005, when The Privacy Rights Clearinghouse started tracking its Chronology of Data Breaches, over 607 million records have been breached in over 3,600 publicly reported breaches. Malicious attacks or malware accounted for more than half of the records breached.14 How can you make sure that your company is not an easy target? By implementing both security awareness and technical controls, you can safeguard your company and its employees from the threat of social engineering and phishing attacks and their consequences. About Rapid7 Rapid7 is a leading provider of IT security risk management software. Its integrated vulnerability management and penetration testing products, Nexpose and Metasploit, and mobile risk management solution, Mobilisafe, enable defenders to gain contextual visibility and manage the risk associated with the IT infrastructure, users and threats relevant to their organization. Rapid7’s simple and innovative solutions are used by more than 2,250 enterprises and government agencies in more than 65 countries, while the Company’s free products are downloaded more than one million times per year and enhanced by more than 175,000 members of its open source security community. Rapid7 has been recognized as one of the fastest growing security companies by Inc. Magazine and as a “Top Place to Work” by the Boston Globe. Its products are top rated by Gartner®, Forrester® and SC Magazine. The Company is backed by Bain Capital Ventures and Technology Crossover Ventures. For more information about Rapid7, please visit
  12. 12. Rapid7 Corporate Headquarters 800 Boylston Street, Prudential Tower, 29th Floor, Boston, MA 02199-8095 617.247.1717 Sources and Endnotes 1. RSA, “The Year in Phishing” January 2012 Fraud_report_0112.pdf 2. All things D, “Twitter Got Hacked. Expect More Companies to Follow.” By Mike Isaac, February 2, 2013, http://allthingsd. com/20130202/twitter-got-hacked-expect-more-companies-to-follow/ 3. New York Times, “Hackers in China Attacked the Times for the Last 4 Months,” by Nicole Perlroth, January 30, 2013, http://www. 4. New York Times, “Credit Card Data Breach at Barnes & Noble Stores,” by Michael S Scmitdt and Nicole Perlroth, October 23, 2012, 5. Healthcare IT News, “Infographic: Biggest healthcare data breaches of 2012,” by Erin McCann, December 12, 2012, http://www. 6. Computerworld, “Wall of Shame exposes 21M medical record breaches,” by Lucas Mearian, August 7, 2012, http://www. 7., “Phishing Update: Key Trends and Warning Signs,” February 6, 2013, html 8. Cisco, “Email Attacks: This Time It’s Personal,” June 2011, ps10339/ps10354/targeted_attacks.pdf 9. Cisco, “Email Attacks: This Time It’s Personal,” June 2011, ps10339/ps10354/targeted_attacks.pdf 10. New York Times, “Hackers in China Attacked the Times for the Last 4 Months,” by Nicole Perlroth, January 30, 2013, http://www. 11., “Phishing Update: Key Trends and Warning Signs,” February 6, 2013 html 12. InfoSecurity, “Sixty percent will fall to a phishing attack that might herald an APT,” January 15, 2013, http://www.infosecurity- 13. APWG, and 14. The Privacy Rights Clearinghouse, Chronology of Data Breaches, Wikipedia was also used as a resource throughout this paper. Further Reading • Chris Hadnagy, Social Engineering: The Art of Human Hacking • Kevin D. Mitnick et al, The Art of Deception: Controlling the Human Element of Security