How is phishing possible?

Question

I'm not a windows user nor do I use outlook, but apparently windows users need to be careful about clicking on suspicious links.

The canonical example is a user in Windows using Outlook clicks on some link and is then infected with spyware.

Technically speaking, how is this possible? Is clicking a single link in an email all that has to happen? Does outlook allow arbitrary code execution allowing a link to install a binary? For the sake of discussion, assume windows 10.

Answer 1

What you are describing isn’t phishing at all.

According to Wikipedia,

Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication.

In other words, phishing is not an attempt to infect a user’s computer but rather an attempt to trick the user in to divulging sensitive information. It takes more than a click to have a successful phishing campaign.

What you are describing is commonly known as a zero-day exploit. It is a previously unknown, or unpatched, bug in an application or OS that allows an attacker to cause an application or OS to malfunction in a predictable way. In your example, the exploit happens by clicking a specially crafted link or by taking the user to a specially crafted website. In this case, it has nothing to do with Outlook or Windows, as most operating systems and moderately complex applications have undiscovered bugs. Some of them can be used in zero-day exploits that just haven’t been discovered yet. Some are actively being used right now against unsuspecting victims, and nobody knows the difference. That is the essence of a zero-day exploit and is the hacker’s equivalent of hitting the jackpot.

The well known Stuxnet malware that destroyed Iranian uranium enrichment centrifuges used 4 zero-day exploits amongst other techniques to find its target.