Page 934 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Going Phishing?

Hyperlink spoofing is not limited to just DNS attacks. In fact, any
attack that attempts to misdirect legitimate users to malicious
websites through the abuse of URLs or hyperlinks could be

considered hyperlink spoofing. Spoofing is falsifying information,
which includes falsifying the relationship between a URL and its
trusted and original destination.

Phishing is another attack that commonly involves hyperlink
spoofing. The term means fishing for information. Phishing attacks
can take many forms, including the use of false URLs.

Be wary of any URL or hyperlink in an email, PDF file, or
productivity document. If you want to visit a site offered as such,

go to your web browser and manually type in the address, use your
own preexisting URL bookmark, or use a trusted search engine to
find the site. These methods do involve more work on your part,
but they will establish a pattern of safe behavior that will serve you
well. There are too many attackers in the world to be casual or lazy
about following proffered links and URLs.

An attack related to phishing is pretexting, which is the practice of

obtaining your personal information under false pretenses.
Pretexting is often used to obtain personal identity details that are
then sold to others who actually perform the abuse of your credit
and reputation.

Protections against hyperlink spoofing include the same precautions
used against DNS spoofing as well as keeping your system patched and
using the internet with caution.