Social Engineering & Data Stealing

When Roland came to work the next day, everything was somehow different

It is 4:37 pm when Roland checks his email inbox one last time for the working day. After a long coordination meeting, something has certainly happened. Roland works as a clerk in the accounts department and is happy to have a predictable job at a well-known company in the Lüneburg region. Numbers have always been his thing and he still enjoys his work even after 5 years. His sphere of activity relates to a few software programmes, particularly from the Microsoft suite. As an Excel expert, he is available to help and advise every employee in the company, which is not the only reason why he is valued and popular among his colleagues. He regularly plays Doppelkopf with some of his colleagues, including his boss Daniel.

What Roland doesn't know is that this afternoon is about to take a strange turn.

Roland checks his inbox and discovers an email from Daniel. "He's actually on holiday," thinks Roland, but opens it anyway. Daniel replies with holiday greetings. He is already looking forward to the next round of Doppelkopf and sends a picture file as an attachment. The picture is actually a holiday photo, but he somehow recognises it. Roland writes a short e-mail back and then finishes his working day. What Roland doesn't know is that he has just become a victim of social engineering and unfortunately didn't realise it.

Social engineering is at the top of the list of compromised attack methods according to the Global Security Report 2019. These include, among others: Phising, Vishing, Smishing, Social Media Phising, Deepfakes, CEO Fraud, Spear Phising, Baiting, Media Dropping, Honeyspots, Scareware, Quid pro Quo. If you are now thinking: Please what? Then stay tuned.

But before we take a closer look at the methods, let's take a look at the motives of cyber criminals. These can basically be clustered into three categories:

Commercial data traders. They try to penetrate companies' infrastructures and access as much data as possible over as long a period as possible. This enables them to build up the greatest possible pressure in the event of blackmail, for example.
Professional fraudsters. This group typically focuses on money or merchandise fraud. This can affect both companies and private individuals - as the sole aim is to enrich themselves.
Stalkers and bullies. This group usually has a personal relationship with the victim and wants to cause them as much harm as possible.

Millions of attacks are carried out with these intentions. And this is how Roland was ultimately selected and became a victim of social engineering.

What had actually happened? How did the attacker know his double-headed friend Daniel and how could he even send a holiday photo? The answer is: social media. The more information people disclose on these networks, the easier it is for attackers. This was also the case with Roland: his double header rounds are regularly documented under his real name on Instagram. His friends are also linked to the pictures - with their real names. The attackers' approach is always identical - classic social engineering

Approach:

On LinkedIn, anyone can see which company Roland works for and in which department. Accounting in particular is of course a highly sensitive area with important and interesting data. The attacker then used this platform to send Roland a networking request using a fake account. Once accepted, it didn't take long before the attacker knew which colleagues he was exchanging information with and who his boss was. In fact, this networking request would not have been necessary at all, as the privacy settings on LinkedIn can be bypassed relatively easily via Google search. He then stole the holiday photo from his boss Daniel's Facebook page. It was one from the previous year, but Roland didn't notice. What Roland doesn't know, of course, is that the photo was infected with malware, which installed itself on his computer when he opened the file, opening the door to a major attack.

This method is called spear phishing. As a rule, not too much research effort is required to investigate precisely these connections - as in Roland's case. The more data is available online, the easier it is for the potential attacker. These attacks are usually very successful, as they appear very trustworthy due to the direct approach and content. Where should Roland have become suspicious?

In principle, it is always advisable to check the sender, i.e. the email address. This cannot usually be falsified. A healthy suspicion is also advisable. Has Daniel ever sent holiday greetings in the past? Every unexpected email should be scrutinised critically. A good disguise and sock puppets are now part of the standard repertoire of social engineering attacks. These sock puppets are created using prepaid phones. It starts with an email address, which is then used to create social media accounts and ultimately false identities, all within a matter of minutes.

re

So caution is advised: Not every contact request should be accepted and not every email should be opened immediately. Healthy mistrust is extremely important!

Max Mustermann

Healthy mistrust is the basis. This also applies to other methods of attack. Because often other media are simply used. Smishing involves text messages, vishing actually involves a phone call, media dropping involves infected data carriers that suddenly appear somewhere. Attempts are always made to manipulate people, which is why this is also referred to as "human hacking". It works like a game of chess, except that employees are tricked into placing themselves on the right squares so that the attacker has an easy game.

People are easy to manipulate when it comes to their basic needs. This is why topics such as Corona / COVID-19 work particularly well. A topic that poses an acute threat to basic needs. Naturally, people want to find out about it and websites with relevant content have a strong appeal. Criminals know this too, of course. The same applies to the coronavirus app, another topic that has been and continues to be very present and controversial online.

Manipulation is not easy to recognise, of course. But with a few basic techniques, the risk of falling victim to an attack can be significantly reduced. It is particularly important to mention here: It is not just people who are often defined as the "weak point" in a company. It is the interaction between people, organisation and technology. A system is also vulnerable, especially if it has been configured incorrectly. The same applies to people: If employees are not provided with tools and techniques, where are they supposed to get the necessary sensitivity for the topic of IT security? The right balance of these three areas is crucial.

The understanding of how important it is to lock your computer or smartphone, for example, must be internalised. When their employees cycle to work, they lock it when they arrive. They have also learnt this at some point and it has now become automatic.

More tips for risk reduction:

Responsible use of social networks: Don't give out too much, real information on social networks.
Don't let yourself be rushed: First sit back, think and, if necessary, share with colleagues or friends.
Be suspicious! Use the 3-second check of the BSI:
Do I know the sender?
Does the subject line make sense?
Am I expecting an attachment?

Always question messages that seem strange to you.

Use awareness training courses if they are offered by your employer.
Never give out confidential information by email, phone or text message. Reputable companies do not work this way.
If you have clicked on a strange link: Please don't keep quiet about it, contact IT. That way, the experts can react promptly.

If you have any questions about social engineering, phising or security awareness, please don't hesitate to contact us.