フィッシング、スピアフィッシング、ホエーリング

メールを介したソーシャルエンジニアリング

大量フィッシング：精度より量

# Typical mass phishing email red flags:
# - Sender domain differs from claimed company (paypa1.com vs paypal.com)
# - Generic salutation ('Dear Customer' instead of name)
# - Urgency trigger ('Your account will be closed in 24 hours')
# - Mismatched URL (displayed text differs from actual hyperlink)
# - Poor grammar/spelling (though AI has reduced this indicator)
# - Unexpected attachment (.exe, .zip, .docm with macros)

スピアフィッシング：標的を絞った個人的な攻撃

# Spear phishing anatomy example:
# From: michael.johnson@financecompany.com (spoofed)
# To:   sarah.chen@targetorg.com
# Subject: Q3 Budget Review - Sarah please approve
#
# 'Hi Sarah,
# Following up on our meeting yesterday about the Q3 budget,
# please review the attached figures from Kevin's team.
# We need your sign-off by EOD. [malicious attachment]
# Thanks, Mike'
#
# Personalized, references real names, creates urgency

ホエーリング：経営幹部を標的とする攻撃

# Business Email Compromise (BEC) variants:
# CEO Fraud: attacker spoofs CEO email to CFO requesting wire transfer
# Vendor Impersonation: spoofs trusted supplier requesting updated bank details
# Attorney Impersonation: targets legal matters with fake attorney request
# Employee W-2 Scam: HR target asked to forward all employee W-2 forms
#
# Key indicator: request involves money, credentials, or sensitive data
# + urgency + instructions to bypass normal process

アングラーフィッシングとクローンフィッシング

ファーミング：クリックなしのリダイレクト

# Detecting pharming via hosts file manipulation:
# Attackers may modify: C:\Windows\System32\drivers\etc\hosts (Windows)
# Or: /etc/hosts (Linux/macOS)
#
# Malicious hosts file entry:
# 1.2.3.4  www.mybank.com  <- redirects to attacker's server
#
# Defense: monitor hosts file integrity with FIM tools (Tripwire, OSSEC)
# Defense: HTTPS certificate pinning detects IP mismatch

URL分析とリンクの偽装

# URL analysis techniques:
# Hovering: reveals real URL in browser status bar
# URL expanders: unshorten.me for bit.ly/tinyurl links
# VirusTotal URL scan: virustotal.com/gui/url
# WHOIS lookup: check domain registration date (new domain = suspicious)

# Subdomain trick:
# paypal.com.malicious-site.xyz/login
# Read right-to-left from first '/': domain is malicious-site.xyz

フィッシングメールの兆候

# Email header analysis (look for spoofing indicators):
# View raw headers in email client (Ctrl+U in Thunderbird)
#
# Check these fields:
# From:        Displayed sender address
# Reply-To:    Where replies go (may differ from From)
# Return-Path: Bounce address (should match From domain)
# Received:    Server hops (trace origin)
# SPF result:  PASS/FAIL in Authentication-Results header
# DKIM result: pass/fail signature verification

認証情報窃取サイト

# Detecting phishing infrastructure:
# Certificate Transparency: crt.sh (search for look-alike certs)
# VirusTotal domain scan
# PhishTank database lookup
# Google Safe Browsing API
#
# Browser-side defense:
# FIDO2/WebAuthn (hardware security keys) are phishing-resistant
# because the key's response is bound to the specific origin URL

添付ファイルを利用したフィッシング

# Group Policy: disable macros in Office
# User Configuration -> Administrative Templates ->
#   Microsoft Office -> Security Settings
#   'Block macros from running in Office files from the Internet'

# Email gateway: block dangerous attachments
# Block extensions: .exe, .bat, .ps1, .vbs, .hta, .iso
# Sandbox: detonate .docm, .xlsm, .pdf in sandbox before delivery

ホエーリングから経営幹部を守る

# DMARC policy to prevent domain spoofing:
# DNS TXT record: _dmarc.company.com
# v=DMARC1; p=reject; rua=mailto:dmarc@company.com;
#   ruf=mailto:forensics@company.com; adkim=s; aspf=s;
#
# p=reject: emails failing SPF+DKIM alignment are rejected
# rua: aggregate reports
# ruf: forensic failure reports
#
# This blocks attackers from spoofing @company.com in From: header

理解度チェック

レッスンのまとめ