Apple Tops Phishing List, Microsoft Conspicuous By Its Absence

APPLE SERVICES

The size of the Apple brand is pushing it front and center in the phishing scam stakes

© 2019 Bloomberg Finance LP


The "Cybersecurity in search" report from Redscan, published September 11, analyses Google trends through global search histories dating back to 2004. Amongst many surprising revelations to be found in this look at the most searched for people, businesses, scams and breaches in cybersecurity, is that Apple tops the list for phishing scams whereas Microsoft is conspicuous by its absence.

Phishing scams love the Apple brand

To dupe as many people as possible, social engineering scams leverage well-known brands. When it comes to the most searched for brands concerning phishing scams you might have imagined Microsoft would lead the way. However, according to the data for UK searches, at any rate, Apple tops this particular tree. Microsoft doesn't even make the top five, with PayPal, HMRC, Amazon and NatWest bank filing in behind Apple.

"We can’t say for sure why so many people are searching for Apple phishing scams," Andy Kays, technical director at Redscan says, "but Apple users are likely to be considered a high-value target for cybercriminals." Kays also says that it should be noted phishing is often a numbers game and Apple has an estimated 1.4bn active Apple devices globally. "So it’s hardly a surprise these scams are so popular," Kays says, "although we were surprised that searches for Microsoft or Outlook did not feature in the top five for the same reasons."

Security researcher and Open Web Application Security Project (OWASP) Scotland chapter leader, Sean Wright, says he isn't surprised that Apple features highly in these searches as they are such a big business and well-known brand. "Attackers will operate as a business," Wright says, "they will target victims who will provide the most value for them, with the least amount of effort." When there were fewer users, in overall market share terms, of Apple devices there would have been less interest from the social engineers. That has changed, and the threat landscape has shifted with it, which doesn't, of course, explain why Microsoft is less searched for in this context given the Windows user base and the press coverage of Windows threats that could be leveraged by the social engineer.

The decline of antivirus technology

Given the increase in awareness of cybersecurity in general, and the need to protect against threats in particular, it might come as a surprise to see that interest in the traditional antivirus (AV) vendors has tanked over the last 15 years if you use the Google search analysis as a metric. But this might not be as bad a trend as it first appears. "I think it’s a good thing that businesses are looking beyond prevention," Kays says, "and researching more proactive monitoring solutions." While AV remains a big part of the security industry overall, its share and influence do seem to be shrinking over time. "This reflects a different threat landscape in 2019," Kays says, "but also the fact that consumer devices often come with better antivirus solutions by default, hence fewer people searching for third party options."

Not everyone is surprised by this fall from grace, take Ian Thornton-Trump, head of cybersecurity for Amtrust International, who says, "the days of 'Desktop AV' are over because the traditional AV companies failed to execute a coordinated anti-trust effort against Microsoft." Thornton-Trump says that the mainstream AV outfits failed to realize that while it was fine to make fun of Windows Defender and Windows Security Essentials a few years ago, Microsoft was steadily improving the product to the point where it can now be more effective than many third-party solutions. "This happened while the traditional AV companies threw each other under the bus in legit and shady AV tests," Thornton-Trump says, "this is an amazing blindside attack that not only did traditional AV not see coming, but they gave up that market share without a fight."

Cybersecurity rock stars and gender imbalance

Every year there are stories that hit the headlines about the most searched for celebrities after Google releases the "Year in Search" report. In 2018, the most searched for term was "World Cup," the most searched for actor was Sylvester Stallone and the most searched for person was Meghan Markle. What you won't find, perhaps unsurprisingly, is a list of the most searched for people in cybersecurity. Redscan addressed this error and found that the most popular personality in infosec, despite his self-proclaimed "World's most famous hacker" status, was not Kevin Mitnick. Topping the poll was Shark Tank's Robert Herjavec, nearly four times more searched for than Mitnick. Behind Herjavec was the, erm, "unpredictable" John McAfee, and behind Mitnick was the renowned cryptographer Bruce Schneier and Troy Hunt of Have I Been Pwned fame. It didn't escape my attention that these are all white men, yet the infosec industry has plenty of inspiring and talented women and people of color despite the lack of visibility in Google searches. This gender imbalance is worrying, and I for one would like to see women role models get more recognition.

"On the topic of diversity," Wright says, "I've long thought we've been approaching it all wrong. If you want to see why we have an issue, walk into the computer science class in a university or school, and what do you see? Simply expecting it to happen is not going to make it happen."

That said, does the infosec industry actually need "rock stars" at all? Does the accounting industry have rock stars or the dental profession? Thornton-Trump says infosec needs to move away from this rock star mentality. "Information security is really about a broad spectrum of skills, abilities, research, and insight," Thornton-Trump says, "nobody has every skill at a world-class level, and in a lot of cases these rankings, awards and accolades are simply PR exercises." Arguing that the infosec profession often descends into in-fighting and narcissism, he says that popularity contests based upon a minimal metric like number of followers or search results are disingenuous. "This could be the very reason why women, the transgendered and other minorities don't make the count," Thornton-Trump says. As for his rock stars, they are the ones who support, listen to and enjoy his company. Ethical hacker John Opdenakker also applauds the "really awesome people in information security," and says, "we don't need a culture of idolizing where some people are considered rock stars or even worse consider themselves superior." When it comes to who he wants to know about, application security specialist Mike Thompson says there are "thousands of more innovative and clever people out there," rather than the "rock stars who self-style themselves as such." I'll leave the last word with Thornton-Trump though, who says that "it's terrible to see generous and kind individuals in the company of self-important, PR company backed megalomaniacs," while leaving the reader to decide who falls into which category.

The changing face of cybersecurity

I asked Andy Kays if he had to narrow it down to one thing, what would be the main takeaway from this analysis of Google cybersecurity searches?

"What’s clear from our search trends analysis is that the security industry is always changing," Kays says, "new threats are emerging all the time, as are ways to combat them; businesses face an uphill task keeping up. At a macro level, the report is a great demonstration of how cybersecurity has shifted from being prevention-focused to something a lot more multifaceted."

Oh, and a final word of advice from me: with the iPhone 11 launch announcement making headlines across the world, watch out for the phishing scams that will no doubt be leveraging this publicity around the Apple brand!

">


The "Cybersecurity in search" report from Redscan, published September 11, analyses Google trends through global search histories dating back to 2004. Amongst many surprising revelations to be found in this look at the most searched for people, businesses, scams and breaches in cybersecurity, is that Apple tops the list for phishing scams whereas Microsoft is conspicuous by its absence.

Phishing scams love the Apple brand

To dupe as many people as possible, social engineering scams leverage well-known brands. When it comes to the most searched for brands concerning phishing scams you might have imagined Microsoft would lead the way. However, according to the data for UK searches, at any rate, Apple tops this particular tree. Microsoft doesn't even make the top five, with PayPal, HMRC, Amazon and NatWest bank filing in behind Apple.

"We can’t say for sure why so many people are searching for Apple phishing scams," Andy Kays, technical director at Redscan says, "but Apple users are likely to be considered a high-value target for cybercriminals." Kays also says that it should be noted phishing is often a numbers game and Apple has an estimated 1.4bn active Apple devices globally. "So it’s hardly a surprise these scams are so popular," Kays says, "although we were surprised that searches for Microsoft or Outlook did not feature in the top five for the same reasons."

Security researcher and Open Web Application Security Project (OWASP) Scotland chapter leader, Sean Wright, says he isn't surprised that Apple features highly in these searches as they are such a big business and well-known brand. "Attackers will operate as a business," Wright says, "they will target victims who will provide the most value for them, with the least amount of effort." When there were fewer users, in overall market share terms, of Apple devices there would have been less interest from the social engineers. That has changed, and the threat landscape has shifted with it, which doesn't, of course, explain why Microsoft is less searched for in this context given the Windows user base and the press coverage of Windows threats that could be leveraged by the social engineer.

The decline of antivirus technology

Given the increase in awareness of cybersecurity in general, and the need to protect against threats in particular, it might come as a surprise to see that interest in the traditional antivirus (AV) vendors has tanked over the last 15 years if you use the Google search analysis as a metric. But this might not be as bad a trend as it first appears. "I think it’s a good thing that businesses are looking beyond prevention," Kays says, "and researching more proactive monitoring solutions." While AV remains a big part of the security industry overall, its share and influence do seem to be shrinking over time. "This reflects a different threat landscape in 2019," Kays says, "but also the fact that consumer devices often come with better antivirus solutions by default, hence fewer people searching for third party options."

Not everyone is surprised by this fall from grace, take Ian Thornton-Trump, head of cybersecurity for Amtrust International, who says, "the days of 'Desktop AV' are over because the traditional AV companies failed to execute a coordinated anti-trust effort against Microsoft." Thornton-Trump says that the mainstream AV outfits failed to realize that while it was fine to make fun of Windows Defender and Windows Security Essentials a few years ago, Microsoft was steadily improving the product to the point where it can now be more effective than many third-party solutions. "This happened while the traditional AV companies threw each other under the bus in legit and shady AV tests," Thornton-Trump says, "this is an amazing blindside attack that not only did traditional AV not see coming, but they gave up that market share without a fight."

Cybersecurity rock stars and gender imbalance

Every year there are stories that hit the headlines about the most searched for celebrities after Google releases the "Year in Search" report. In 2018, the most searched for term was "World Cup," the most searched for actor was Sylvester Stallone and the most searched for person was Meghan Markle. What you won't find, perhaps unsurprisingly, is a list of the most searched for people in cybersecurity. Redscan addressed this error and found that the most popular personality in infosec, despite his self-proclaimed "World's most famous hacker" status, was not Kevin Mitnick. Topping the poll was Shark Tank's Robert Herjavec, nearly four times more searched for than Mitnick. Behind Herjavec was the, erm, "unpredictable" John McAfee, and behind Mitnick was the renowned cryptographer Bruce Schneier and Troy Hunt of Have I Been Pwned fame. It didn't escape my attention that these are all white men, yet the infosec industry has plenty of inspiring and talented women and people of color despite the lack of visibility in Google searches. This gender imbalance is worrying, and I for one would like to see women role models get more recognition.

"On the topic of diversity," Wright says, "I've long thought we've been approaching it all wrong. If you want to see why we have an issue, walk into the computer science class in a university or school, and what do you see? Simply expecting it to happen is not going to make it happen."

That said, does the infosec industry actually need "rock stars" at all? Does the accounting industry have rock stars or the dental profession? Thornton-Trump says infosec needs to move away from this rock star mentality. "Information security is really about a broad spectrum of skills, abilities, research, and insight," Thornton-Trump says, "nobody has every skill at a world-class level, and in a lot of cases these rankings, awards and accolades are simply PR exercises." Arguing that the infosec profession often descends into in-fighting and narcissism, he says that popularity contests based upon a minimal metric like number of followers or search results are disingenuous. "This could be the very reason why women, the transgendered and other minorities don't make the count," Thornton-Trump says. As for his rock stars, they are the ones who support, listen to and enjoy his company. Ethical hacker John Opdenakker also applauds the "really awesome people in information security," and says, "we don't need a culture of idolizing where some people are considered rock stars or even worse consider themselves superior." When it comes to who he wants to know about, application security specialist Mike Thompson says there are "thousands of more innovative and clever people out there," rather than the "rock stars who self-style themselves as such." I'll leave the last word with Thornton-Trump though, who says that "it's terrible to see generous and kind individuals in the company of self-important, PR company backed megalomaniacs," while leaving the reader to decide who falls into which category.

The changing face of cybersecurity

I asked Andy Kays if he had to narrow it down to one thing, what would be the main takeaway from this analysis of Google cybersecurity searches?

"What’s clear from our search trends analysis is that the security industry is always changing," Kays says, "new threats are emerging all the time, as are ways to combat them; businesses face an uphill task keeping up. At a macro level, the report is a great demonstration of how cybersecurity has shifted from being prevention-focused to something a lot more multifaceted."

Oh, and a final word of advice from me: with the iPhone 11 launch announcement making headlines across the world, watch out for the phishing scams that will no doubt be leveraging this publicity around the Apple brand!

Follow me on Twitter or LinkedIn. Check out my website.

I'm a three-decade veteran technology journalist and have been a contributing editor at PC Pro magazine since the first issue in 1994. A three-time winner of the BT Sec

...