Trending Articles
Trending Topics
Trending
I have spent most of my professional career fighting the scourge of tech jargon. Mea culpa: I did write an internet jargon dictionary 30 years ago that included acronyms that I had invented, such as IBM (I’m Buck Naked), but it’s probably best we forget that. I’d also like to suggest that we forget the current round of cybersecurity-focused jargon that, in my never humble opinion, does more harm than good. Jargon such as mishing.
What the chuffing heck is mishing? Or what is missing, as my spellcheck insisted on correcting me, quite logically as it turns out: what is missing is common sense. Have you worked it out yet?
The context is an email I received informing me of a new threat intelligence report from Zimperium which, in and of itself, is a worthy piece of analysis, looking at malware variants that target mobile credential theft through login and 2FA compromise. Things took a ridiculous turn when Zimperium told me that “these attacks are powered by mishing campaigns and sideloaded apps that silently harvest access keys from the very devices employees rely on every day”.
Mishing campaigns, it turns out, are mobile‑focused phishing campaigns. Or, as I prefer to call them, phishing campaigns.
What’s wrong with good old-fashioned plain English, for goodness’ sake? Mishing is as confusing as vishing (voice or video phishing, take your pick – see what I mean about confusing) or quishing (QR code phishing) or smishing (text message phishing, which begs the question why not tishing?) at the end of the day.
Sensational terms just add noise, said Paul Walsh, an internet security veteran who has been in the game as long as me. Walsh, CEO of MetaCert and Co-Founder of the W3C Mobile Web Initiative in 2004, told me that “Quishing is phishing. Smishing is phishing. PDF phishing is phishing. They all use the same trick. They impersonate something trusted, hide a link to a fake page or download and hope you tap it.”
And that’s the point. Introducing new jargon to describe old threats doesn’t somehow make them easier to deal with. I’d argue it makes it harder. Not least, as it is a distraction from the simple truth that, as Walsh said, all phishing is a one-trick pony.
“Massive breaches are no longer starting on desktops, they’re starting in your pocket,” said Nicolás Chiaraviglio, Chief Scientist at Zimperium. “Organisations must take mobile security seriously to stop credential‑stealing malware before it compromises enterprise resources.” That, I can’t argue with, but please, Nicolás, let’s keep the message clear and do away with unnecessary jargon.
Mic drop. Rant over. You’re welcome.
