Spear phishing: researchers work to counter email attacks that gain recipients’ trust

The email resembled the organisation's own employee e-newsletter and asked recipients to visit a website to confirm that they wanted to continue receiving the newsletter. Another email carried an attachment it said contained the marketing plan the recipient had requested at a recent conference. A third email bearing a colleague's name suggested a useful website to visit.

None of these emails were what they pretended to be. The first directed victims to a website that asked for personal information, including the user's password. The second included a virus launched when the ''marketing plan'' was opened. The third directed users to a website that attempted to install a malicious program.

All three are examples of what information security experts at the Georgia Tech Research Institute (GTRI) say is the most challenging threat facing corporate networks today: ''spear phishing.''

Generic emails asking employees to open malicious attachments, provide confidential information or follow links to infected websites have been around for a long time. What's new today is that the authors of these emails are now targeting their attacks using specific knowledge about employees and the organizations they work for. The inside knowledge used in these spear phishing attacks gains the trust of recipients.

''Spear phishing is the most popular way to get into a corporate network these days,'' said Andrew Howard, a GTRI research scientist who heads up the organisation's malware unit. ''Because the malware authors now have some information about the people they are sending these to, they are more likely to get a response. When they know something about you, they can dramatically increase their odds.''

The success of spear phishing attacks depends on finding the weakest link in a corporate network. That weakest link can be just one person who falls for an authentic-looking email.