Recent press reports tell us that Google has solved the phishing problem. These stories trace their source back to a posting on KrebsonSecurity dated July 23, 2018, entitled Google: Security Keys Neutralized Employee Phishing.  Krebs summarizes the solution: The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor. This is clearly an important protection against a particular subset of the phishing problem -- use of stolen credentials. But it hardly neutralizes phishing. The day after describing [...]

On July 13, 2018, the Special Counsel indicted 12 Russian GRU agents for interfering in the 2016 U.S. presidential election. The indictment provides a detailed description of how spearphishing works. For example, paragraph 21 of the indictment states, ANTONOV, BADIN, YERMAKOV, LUKASHEV, and their co-conspirators targeted victims using a technique known as spearphishing to steal victims’ passwords or otherwise gain access to their computers. Beginning by at least March 2016, the Conspirators targeted over 300 individuals affiliated with the Clinton Campaign, DCCC, and DNC. Spearphishing attacks systems by attacking the users.  SP Guard provides users with defenses against these attacks.

Today the House Permanent Select Committee on Intelligence released its Report on Russian Active Measures. This report describes the measures the Russians took to interfere in elections in the United States and Europe. Starting on page 22 and ending on page 28 the Committee explains in detail how the Russians conducted their cyberattacks. With the exception of the introductory and concluding text, the only unredacted materials are this box on page 23: And the caption "Attribution is a Bear" on page 26.  A discussion of Guccifer, a Russian hacking persona, follows the redacted discussion of how the Russians conducted their [...]

The business email compromise (BEC) is a phishing scam in which the bad guy uses deceptive emails to trick accounting personnel into misdirecting money.  The FBI calls BEC a $5 Billion scam. It is now being reported that  Lazio, an Italian professional soccer club, lost €2 million to phishers. The phishers sent an email to Lazio which demanded payment of a player transfer fee to Feyenoord, another professional soccer club.  Unknown to the victims, the bank to which they sent the money was not Feyenoord's bank account.