{"id":1022,"date":"2020-01-22T01:36:50","date_gmt":"2020-01-22T01:36:50","guid":{"rendered":"https:\/\/people.utm.my\/azhari\/?p=1022"},"modified":"2020-01-22T01:36:58","modified_gmt":"2020-01-22T01:36:58","slug":"1022","status":"publish","type":"post","link":"https:\/\/people.utm.my\/azhari\/2020\/01\/22\/1022\/","title":{"rendered":""},"content":{"rendered":"<p><iframe loading=\"lazy\" title=\"Social Engineering - Winning SECTF call at DEF CON 25\" width=\"1080\" height=\"608\" src=\"https:\/\/www.youtube.com\/embed\/yhE372sqURU?start=7&#038;feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<div>\n<h3>CEO Trick Instead of Grandparent Scam<\/h3>\n<\/div>\n<div>\n<div class=\"t4-paG\">Hackers use psychological tricks, telling their victims heart-rending stories, putting them under time pressure or intimidating them with authoritarian behavior. As communication channels they use not only email but also faxes, personal conversations or phone calls (vishing). Security specialist Chris Kirsch demonstrated an example of a successful telephone attack in a video by reconstructing a phone call with a genuine company, which won him a social engineering competition at the 2015 DEF CON hacker conference.<\/div>\n<\/div>\n<div>\n<div class=\"t4-paG\">In the summer of 2017 the German Federal Office for Information Security (BSI) issued an explicit warning against criminals claiming to be company executives and instructing employees to transfer large sums of money to foreign bank accounts.<br \/>\nAccording to this, around \u20ac 75 million in damages were incurred by the German economy in 2016. Victims of such a CEO fraud using fake emails included automotive supplier Leoni and messaging app provider Snapchat.<br \/>\nIn the latter case, for example, a payroll clerk issued a current salary list after receiving a phishing email posing to be from the CEO.<\/div>\n<\/div>\n<div>\n<h3>Facebook a Data Source for Human Hacking<\/h3>\n<\/div>\n<div>\n<div class=\"t4-paG\">The more detail the attacker has unearthed about his victim(s) beforehand, the greater the likelihood that the hack will be a success. For example, in two studies in 2014 and 2017,\u00a0<span class=\"underline\"><a href=\"https:\/\/www1.informatik.uni-erlangen.de\/filepool\/publications\/zina\/2017-benenson-unpacking-spear-phishing.pdf\" target=\"_blank\" rel=\"noopener noreferrer\" data-rel=\"content.link\">German security researchers<\/a><\/span> sent emails with a link and similar content to students. The only difference was the salutation. In the case of personalized emails, 56 percent of recipients clicked on the link, and only 20 percent of the non-personalized emails. Thanks to social media like Facebook and Twitter, social engineering attacks today can be targeted much easier and more precisely than before.<\/div>\n<\/div>\n<div>\n<div class=\"t4-paG\">However, \u00a0social engineering also works without personal contact between hacker and victim, however. By USB stick, for example. When\u00a0<span class=\"underline\"><a href=\"https:\/\/zakird.com\/papers\/usb.pdf\" target=\"_blank\" rel=\"noopener noreferrer\" data-rel=\"content.link\">researchers around the Google security expert Elie Bursztein<\/a><\/span> dropped 300 USB flash drives on the campus of the University of Illinois Urbana-Champaign in April 2015 as a test, 48 percent of them were picked up and the files on them opened. Hackers can also search trash cans (a practice known as dumpster diving) for sensitive data like written-down passwords or shadow employees with special access authorizations: This practice is called tailgating or piggybacking allowing unauthorized persons to sneak onto corporate premises.<\/div>\n<\/div>\n<div>\n<div class=\"pull-right t4-paG\">\n<div class=\"t4-richTextImage format--large1x1\">\n<div class=\"t4-image\"><a class=\"zoomLightboxLink\" href=\"https:\/\/www.t-systems.com\/blob\/805404\/8ea125bcff6aa22b060fcf5989a271ea\/IM_Social-Engineering-Infografik.jpg\" data-rel=\"content.image\" data-lb-url=\"\/lightbox\/perspectives-de-en\/security\/information-security\/805404\" data-ng-click=\"open($event);\"> <span class=\"image-rwd image-rwd--large1x1\" data-image-rwd=\"image-rwd\"> <img loading=\"lazy\" decoding=\"async\" class=\"\" src=\"https:\/\/www.t-systems.com\/image\/805404\/large1x1\/fc\/395\/395\/66b0d805a8a888b8998b26b96504028b\/Vl\/im-social-engineering-infografik-jpg.jpg\" alt=\"Successful cases of CEO-Fraud.\" width=\"216\" height=\"216\" \/> <\/span> <i><\/i><\/a><\/div>\n<div class=\"t4-imageDescription\">\n<div class=\"t4-rTxt\">\n<div>\n<div class=\"t4-paG\">Source: BKA Crime statistics &amp; situation assesments <a href=\"https:\/\/www.bka.de\/SharedDocs\/Downloads\/DE\/Publikationen\/JahresberichteUndLagebilder\/Wirtschaftskriminalitaet\/wirtschaftskriminalitaetBundeslagebild2016.html\" target=\"_blank\" rel=\"noopener noreferrer\" data-rel=\"content.link\">www.bka.de<\/a><\/div>\n<\/div>\n<div class=\"clearfix\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div>\n<h3>Awareness Training for Employees<\/h3>\n<\/div>\n<div>\n<div class=\"t4-paG\">IT security is not much of use when employees fail to recognize social engineering attacks The most important measure is therefore employee training to explain the typical tricks of the hackers and to practice the behavior in appropriate situations. One-off sessions are no help, warns the German Federal Office for Information Security (BSI), and recommends regular refresher courses. However, according to Loudhouse, only around one in two companies in the world saw safety issues on the training agenda in 2017.<\/div>\n<\/div>\n<div>\n<div class=\"t4-paG\">Social penetration tests are one way to test the success of awareness training. An authorized person takes on the role of a social engineer and tests how far he can get using hacker methods. The disadvantage is that employees who are tricked may feel exposed. Social engineering measures are, of course, a part of the security concept that companies must submit and implement for ISO 27001 certification on the basis of BSI\u00a0<a href=\"https:\/\/www.bsi.bund.de\/EN\/Topics\/ITGrundschutz\/itgrundschutz_node.html\" target=\"_blank\" rel=\"noopener noreferrer\" data-rel=\"content.link\">IT baseline protection<\/a>.<\/div>\n<\/div>\n<div>\n<div class=\"t4-paG\">In the end, it must be made clear that although employees can pose a security risk, they are also a bulwark against cyberattacks. According to Bitkom, most often companies are made aware of hacker attacks by tips from their workforce.<\/div>\n<\/div>\n<div class=\"clearfix\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>CEO Trick Instead of Grandparent Scam Hackers use psychological tricks, telling their victims heart-rending stories, putting them under time pressure or intimidating them with authoritarian behavior. As communication channels they use not only email but also faxes, personal conversations or phone calls (vishing). Security specialist Chris Kirsch demonstrated an example of a successful telephone attack [&hellip;]<\/p>\n","protected":false},"author":14428,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"video","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-1022","post","type-post","status-publish","format-video","hentry","category-uncategorized","post_format-post-format-video"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/users\/14428"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/comments?post=1022"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1022\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/media?parent=1022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/categories?post=1022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/tags?post=1022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}