Phishing Schemes Are Using Encrypted Sites To Seem Legit

WIRED wrote: "A MASSIVE EFFORT to encrypt web traffic over the last few years has made green padlocks and "https" addresses increasingly common; more than half the web now uses internet encryption protocols to keep data protected from prying eyes as it travels back and forth between sites and browsers. But as with any sweeping reform, the progress also comes with some new opportunities for fraud.

And phishers are loving HTTPS...

"On Tuesday, the phishing research and defense firm PhishLabs published new analysis showing that phishers have been adopting HTTPS more and more often on their sites. When you get a phishing email or text, the sites they lead to—that try to trick you into entering credentials, personal information, and so on—implement web encryption about 24 percent of the time now, PhishLabs found. That's up from less than three percent at this time last year, and less than one percent two years ago."

"PhishLabs' Hassold notes also that the real problem anyway isn't phishers getting a certificate and implementing HTTPS; it's the green padlock they gain that then gives consumers a false sense of security. Where the padlock simply indicates that traffic between the server and the user's browser is encrypted and protected against interception, consumers often assume that a green padlock means that the site is more generally secure.

"For the average internet user, the important thing is still following the basic steps to avoid being drawn in by phishing schemes. And don't assume that any page that has HTTPS contains legitimate and authentic content. It's a green padlock, not a silver bullet." Read the whole article at WIRED.

Clear as daylight that you still need to step your users through new-school security awareness training to make sure they do not get tricked by social engineering tactics like this.