Phishing for Apples

By Richard Arneson

It’s impossible to know what fish will bite on, which is probably why people are drawn to fishing. Sure, it seems a little odd that human beings take pleasure in outwitting something with a pea-sized, waterlogged brain, but, yes, it’s fun. One (1) day fish like cheese, the next day, salmon eggs. Sometimes they like to bite in the morning, then, the next day, they collectively decide that it’s better to nosh on worms at dusk. Phishing, like fishing, is no different. It’s about changing bait. When emails aren’t producing the desired results, scammers dangle something else from the hook. And in one (1) of the more recent phishing scams, that’s exactly what they did. Their new bait is phone calls, and the targets are iPhone users.

If you have a cell phone, you’ve no doubt been inundated with a staggering number of spam calls of late, which dodge call blocking by displaying different phone numbers each time they’re placed. Also, along those lines, they’re impervious to the Do Not Call Registry. And by fooling recipients with the use of local area codes (known as “Neighborhood Spoofing”), the calls get picked up more readily. Don’t be ashamed if you’ve answered, or been fooled by, one (1). During an NPR interview, FCC chairman Ajit Pai stated that “every now and then, even on my work Blackberry, I’ll see a call that seems to be coming from the 202 area code, which is here in Washington. And I know for a fact that, you know, it’s probably not someone calling from the office. Sometimes, I answer just for the heck of it. And, lo and behold, I’ve won a vacation.”

That’s not to suggest, however, that all spam calls exist to phish. Sure, they’re annoying as mosquitoes at a concert in the park, but most aren’t designed with evil intentions. However, this one (1) is. And what has made it especially deceptive is that the number revealed to the recipient contains the Apple logo, including its correct address and corporate phone number. It looks like the real deal.

The scam was revealed last week after an IT security firm reported that they’d received an automated call stating multiple Apple servers maintaining Apple IDs had been compromised. They were directed to contact a supplied toll-free number immediately to clear up the matter (there’s your red flag). But what’s more disconcerting is that when the security firm contacted Apple’s support number to report the scam (using the same number that the scammers presented), neither AT&T, its wireless provider, nor Apple could differentiate between the two (2) numbers. In other words, the fake call was indexed in their “Recent Call(s)” list as Apple’s legitimate customer support number.

If you’re sick of spam calls, this may make you seriously ill

First Orion, an Arkansas-based company that provides caller ID and call blocking solutions, recently published a report that predicts almost half of all mobile phone calls in 2019 will be spam. Ouch. They claim to have analyzed over 50 billion calls that were placed over the past eighteen (18) months. By combining call patterns and behaviors with other attributes, First Orion arrived at this startling, but hopefully errant, prediction.

Security Concerns?

To find out how to secure your organization’s network and mission critical data, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.

If you want more information about network security, check out the following articles:

This isn’t fake news

Don’t get blinded by binge-watching

Mo Money, Mo Technology―Taylor Swift uses facial recognition at concerts

Step aside all ye crimes—there’s a new king in town

Q & A for a Q & A website: Quora, what happened?

They were discovered on Google Play, but this is no game

And in this corner…

Elections are in, but there’s one (1) tally that remains to be counted

Hiring A Hacker Probably Shouldn’t Be Part of Your Business Plan

Gen V

Sexy, yes, but potentially dangerous

Tetration—you should know its meaning

It’s in their DNA

When SOC plays second fiddle to NOC, you could be in for an expensive tune

How to protect against Ransomware