Your Voter Registration Needs ‘Extra Details’ – The Latest Phishing Lure

Today is election day, and 100 Million people have already voted. In all probability, this year’s total number of voters is on pace to exceed 2016 elections. While the voting is on, there is a real concern over disinformation campaigns that might affect the outcome. Recently, Trustwave published an article stating that 186 million voters’ information had been posted online. Over 400 potential data points are provided about each individual.

With all of this information out there, cybercriminals are using it, and are tapping into political frenzy with a new phishing lure. This cyber-attack starts with a message that warns U.S. targets that their voter registration data needs extra details. The message purport to come from the U.S. Election Assistance Commission, an independent agency of the United States government that serves as a national resource of information regarding election administration. The message contains a URL, which leads to a spoofed web page that steals a variety of targets’ personal data, including name, date of birth, mailing address, email address, Social Security number and driver’s license data.

If someone were to complete the above form and submit, they could face a litany of issues and problems down the road:

• Stolen personal information can be used to harm companies
• Stolen personal data is used for future target phishing attacks and extortion
• Stolen personal information is fuel for identity theft
• Hackers can sell personal data to other criminals
• impact of corporate security, impact on remote users, and on and on

Limiting lateral movement after a compromise

Elisity delivers identity-based microsegmentation through supported network infrastructure. Teams use asset identity and security context to define the communication each device or workload needs, simulate policy against observed traffic, and approve enforcement. Limiting that communication helps contain lateral movement if an attacker gains access.

Microsegmentation does not prevent the phishing message or the theft of information entered on a fraudulent website. For the current platform overview, read the Elisity solution brief.