ANALYSIS OF THE USE OF CLOUD SERVICES FOR FISHING ATTACKS

Abstract

Phishing, as a type of information attack, has been used by intruders for selfish purposes for quite some time. They are very popular in the criminal world because it is much easier for a person to make certain profitable actions than a program. With the advent of new technologies, this type of attack has gradually adapted to the new conditions of engagement with its victim. Cloud services have become a great modern and widespread tool for phishing campaigns. The use of such services has given to malicious actors a number of significant advantages over the use of their own computing resources. The relative cheapness and ease of exploitation of these technologies has played an important role. The problem of information security with using cloud technologies is that this type of attack is difficult to detect, even more to prevent, without significantly affecting the comfort of using end users of information systems. The article analyzes the relevance of this type of attacks based on real data. We considered the algorithm of their work during a life cycle and analyzes the use of the basic available security methods of protection, their feasibility and problems of use. The analysis showed that not all modern security methods are capable of detecting and preventing phishing attacks, which use public cloud services. Even a combination of several or all methods cannot guarantee high protection for users against phishing threats. In the article were mentioned some examples of phishing campaigns that took place during 2019 and used such popular public cloud services as Azure Blob storage created by Microsoft and Google Drive developed by Google. A basic list of tips was also provided that would increase the level of security for internet users in order to reduce the risk of potential data compromise or its consequences.