SSL Certificates No Longer Guarantees Safe Browsing

That advice about looking for a valid digital certificate as an indicator that a website is not malicious just got debunked for real. A report by security company, PhishLabs found that phishers are using fake digital certificates on malicious websites so that we have even less chance of figuring out if a website is phishing or if it’s safe to visit. Websites that provide free SSL certificates aren’t helping either. These companies provide legitimate ones at no charge, regardless of who is asking for them or what the intended use may be.

First, let’s discuss SSL (Secure Sockets Layer). According to the SSL website, it is “the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral.” To create this link, an SSL certificate is needed. To apply it, it requires a few steps to activate it on your site. At that point, whenever the site is visited, the user sees the padlock or some other indication that a valid certificate is applied, giving the user a sense of security about that particular site.

However, phishers are taking advantage of that security and getting these digital certificates because they know that is an important indicator to end users of a safe site. As a result, they are stepping up phishing attacks using these.

These digital certificates (SSL certificates) used for phishing can be attributed to a rise in attacks targeting just two companies: PayPal and Apple. More than 70% of the phishing attacks they tracked targeted one or the other of these two companies.

PhishLabs has access to a lot of data that transverses through its products. It found that of that data, the total number of phishing attacks against financial services organizations in the first quarter of 2017 increased by 76% over the same quarter of last year. This surge, researchers determined, is due to a significant uptick in attacks targeting the payment service, PayPal. This increase hit 93% of all volume within PhishLabs’ data in the payment services industry.

Within those figures, more than 25% of the PayPal phishing attempts and 18% of the Apple related ones used SSL certificates in Q1 of 2017. Overall, the total volume of phishing increased 20% from Q4 of 2016.

Just remember that even if the connection appears to be safe, it isn’t necessarily the case. Pay attention to other signs such as the sender, whether or not any links or attachments were expected, and/or if the greetings are generic in order to make a determination as to the risk of taking further action. If in doubt, don’t.