Story image

Can you spot the phish? Google's quiz puts you to the test

24 Jan 2019

There’s an old adage that humans are the weakest link in cybersecurity – but they can also be one of the strongest links if they’re able to identify security risks.

Google’s parent firm Jigsaw has come up with one way of helping people hone their phishing skills. It devised an eight-question quiz in which people must differentiate genuine emails from fake ones.

It may not be as easy as many people think – after the participant selects an answer, the quiz then offers a ‘show me’ option that explains exactly why the example would be genuine or fake.

The examples include document shares appearing to be through Google Drive, links to downloads from fax machines, Dropbox notifications, Google logins, permissions requests, and more.

According to Jigsaw, “We created this quiz based on the security trainings we’ve held with nearly 10,000 journalists, activists, and political leaders around the world from Ukraine to Syria to Ecuador. We’ve studied the latest techniques attackers use, and designed the quiz to teach people how to spot them.”

There’s undoubtedly a need for more training simulations like this one – Symantec’s 2018 Internet Security Threat Report found that 71% of all targeted attacks started with spear phishing to infect victims’ systems. 

F5 Networks’ 2018 Phishing and Fraud Report presented similar findings – 71% of phishing attacks between September 1 2018 and October 31 2018 impersonated 10 high-profile organisations. The report also said that phishing was the root cause in almost half of the breach cases F5 investigated.

No matter which statistics you dig up, the message is almost the same: phishing emails are still sent by the masses, and they’re still tricking people.

“Some of the most famous examples of hacking and cyber-theft began with phishing. In 2016 hackers affiliated with the Russian intelligence services sent a carefully crafted spear-phishing email to John Podesta, Hillary Clinton’s campaign manager, and (because he didn’t have two-factor authentication enabled) they gained access to his email account,” says Jigsaw.

At the end of the quiz, Jigsaw helpfully redirects participants to a page that encourages people to turn on two-factor authentication (it’s a genuine request).

“When you have two-factor authentication enabled, even if an attacker successfully steals your password they won’t be able to access your account. We also offer a Chrome extension called Password Alert that protects you from entering your Google password in a fake login page,” says Jigsaw.

Try the quiz at https://phishingquiz.withgoogle.com/.

GoCardless to double A/NZ team by end of year
With a successful E round of investment and continuing organic growth globally, the debit network platform company aims to expand its local presence.
NZ’s Maori innovators are on the rise
“More iwi investors need to recognise that these sectors will provide the high-value jobs our children need."
Phone ringing? This biohack wants you to bite down and ChewIt
So your phone’s ringing, but instead of swiping right or pushing a Bluetooth button you bite down on a tiny piece of tech that sits in your mouth.
How big data can revolutionise NZ’s hospitals
Miya Precision is being used across 17 wards and the emergency department at Palmerston North Hospital.
Time's up, tax dodgers: Multinational tech firms may soon pay their dues
Multinational tech and digital services firms may no longer have a free tax pass to operate in New Zealand. 
Spark’s new IoT network reaches 98% of New Zealand
Spark is the first company to confirm the nationwide completion of a Cat-M1 network in New Zealand.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Robots to the fore – Key insights for New Zealand Business into RPA in 2019
From making artificial intelligence a business reality to closer ties to human colleagues, robotic process automation is gearing up for a strong 2019.