Phishing Simulation Debriefing

About Phishing

What is Phishing?

Phishing stands for password fishing and is an attack in which cyber criminals try to trick their victims into revealing sensitive data, for example passwords or credit card numbers.

In most cases, the attackers impersonate a trusted individual or institution by sending a phishing email on their behalf (in our case it was ETH 2024Å·ÖÞ±­¿ª»§_Å·ÖÞ±­APPÏÂÔØ-Ͷע|¹ÙÍø Services). The email usually contains a link to a phishing website, which resembles a login the victim is familiar with. When the victim tries to log in, they hand over their credentials to the attackers.

To improve the deception, phishers often use email and website addresses resembling the originals. For example, an address ending with "elhz.ch" or "eth-z.ch" might easily be mistaken for "ethz.ch", the official domain of ETH Zurich.

Cyber criminals use phishing attacks, for example, to enrich themselves (e.g., by obtaining access to e-banking accounts) or to break into companies (e.g, by phishing corporate passwords), causing billions in damages worldwide every year.

What is the purpose of a phishing simulation?

Phishing simulations can help prepare organizations and individuals for actual phishing attacks and are common practice among companies and organizations.

They have several benefits:

1. Testing and raising phishing awareness: A phishing simulation shows how participants (i.e., students and employees) react to phishing, and it helps build awareness; malicious emails can appear realistic, so we should be cautious, especially when they make enticing promises.
2. Testing incident response: For organizations, it is essential to deal with phishing attacks swiftly to minimize damages. Phishing simulations make it possible to assess the reaction of the staff responsible (e.g., how early they detect the attack, delete phishing emails, isolate compromised accounts, etc.).
3. Research: The data obtained in a phishing simulation can be used to answer specific questions, e.g., how users react to certain types of emails or how effective awareness training was.

The goals of our simulation was to raise awareness for phishing among the ETH population and to collect non-sensitive data for a research project. However, it did not test the readiness of ETH IT Services, which helped us set up and run this experiment.

How can I detect Phishing?

This following ETH website explains how phishing emails can be detected:

/staffnet/en/news-and-events/internal-news/archive/2022/12/how-to-recognise-phishing-emails.html.

About Password Managers

What is a password manager?

A password manager is a program that helps create, store, and use passwords in a secure and user-friendly manner. To unlock the passwords, one only has to provide a single master password (and, ideally, a second factor). Most password managers can be integrated into web browsers via browser extensions.

The main advantage of a password manager is that it makes it easy to use strong, unique passwords for many services and accounts. The main drawback is that a passord manager puts all eggs into one basket: If an attacker manages to compromise the password manager, they get access to all accounts.

Does a password manager protect against phishing?

The short answer is "Yes, if you use it correctly".

Most password managers provide auto-completion that only suggests a password on websites it is associated with, meaning they won't suggest the password on a phishing website. Hence, if you visit a familiar website and your password manager's auto-completion is "not working" as expected, you should verify if the website is indeed genuine. On the other hand, if you override the manager by copying and pasting passwords manually into login forms, your password manager cannot protect you.

Finally, password managers can be the target of phishing attacks too, and one should be cautious when asked for the master password (or similar credentials).

Should I use a password manager or not?

Yes, we still recommend that you use a password manager, but you should keep the following points in mind:

• Beware of password manager phishing: Whenever you log in to your password manager (or receive an email from the corresponding company), be careful to check for signs of phishing, as any phishing website could show a user interface that looks almost like your password manager.
  If you are unsure, open your password manager manually by clicking the icon in your browser¡¯s toolbar. This always opens the real password manager, since this button is part of your web browser and out of reach of the phishing website.
• Use trusted devices only: Don¡¯t access your password manager on public or untrustworthy devices (such as a laptop of a person you barely know).
• Heed warnings: Password managers usually inform you if they detect unexpected behavior, such as a login from a new device. Take these emails seriously.