Spear Phishing

Spear phishing is a targeted form of phishing. Instead of sending the email out to everyone indiscriminately, a spear phishing attack attempts to target specific groups of users, or even a single user. Spear phishing attacks may target employees within a company or customers of a company.

As an example, an attacker might try to impersonate the CEO of an organization in an email. It’s relatively simple to change the header of an email so that the From field includes anything, including the CEO’s name and title. Attackers can send an email to all employees requesting that they reply with their password. Because the email looks like it’s coming from the CEO, these types of phishing emails fool uneducated users.

One solution that deters the success of these types of spear phishing attacks is to use digital signatures. The CEO and anyone else in the company can sign their emails with a digital signature. This provides a high level of certainty to personnel on who sent the email.

A digital signature provides authentication, non-repudiation, and integrity.

• Authentication validates an identity.
• Non-repudiation prevents a party from denying an action.
• Users sign emails with a digital signature, which is a hash of an email message encrypted with the sender’s private key.
• Only the sender’s public key can decrypt the hash, providing verification it was encrypted with the sender’s private key.

See also Phishing and Whaling.