Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Iranian Cyberspies Pose as Journalists Online To Ensnare Their Targets
Threaded  |  Newest First  |  Oldest First
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 4:42:30 PM
A Fascinating Look
This gives a really fascinating look behind the scenes of a social engineering initiative, a long-time effort given that it dates back to 2011. Having interviewed experts in social engineering -- people who work with clients on preventative measures and best practices -- I believe this is one of the most challenging areas of security. As people, we want to trust. Our memories fail us; how many people "look or sound familiar" when we get a friend or connect request on FB or LI? Those in high-value positions must be especially aware. But as we know, even lower level targets are attractive as rungs on the ladder.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
5/29/2014 | 4:49:23 PM
Re: A Fascinating Look
Social Media is  a powerful instrument for military operation. I wrote an excellent post on the topic more than one year ago where are explained all the techniques based on exploitation of social networking platform.

 

http://resources.infosecinstitute.com/social-media-use-in-the-military-sector/

 

Let me also another post we it is explained how to "poison" a social network for various purposes.

 

http://securityaffairs.co/wordpress/352/digital-id/social-network-poisoning-they-want-to-spy-on-us-we-evade.html

Regards

 

 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/29/2014 | 4:58:15 PM
Re: A Fascinating Look
This is reminiscent of the controversial "Robin Sage" experiment conducted a few years back, where a phony persona was set up on LinkedIn, Facebook and Twitter to see who would connect to "Robin," who scored connections with people in the Joint Chiefs of Staff, the CIO of the NSA, an intelligence director for the U.S. Marines, a chief of staff for the U.S. House of Representatives, and several Pentagon and DoD employees. "She" even got job offers and dinner invites. Robin Sage and this Iranian campaign demonstrate how easy it is to fall into the trap of trusting someone online without truly vetting them. Anyone can fall victim to this, which is what makes it so disturbing.

 

 
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:04:52 PM
Re: A Fascinating Look
That's wild -- but it's easy to see how people could fall for it. I recall almost falling victim to something a few weeks ago when a real friend's Facebook was hijacked. A fraudulent account was created in his name and the fraudster sent friend requests out. Fortunately, my real friend notified all his contacts about the fake account set up in his name (with his photo) so I didn't accept the duplicate friend request. But I would have done, probably, thinking he or FB had done something to his original account by mistake. 

And we all meet so many people that it's hard to recall all their names. If someone seems legit and mentions meeting you at a conference three months ago, odds are many of us might take this at face value rather than run the risk of offending someone who appeared legit!
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/29/2014 | 5:07:32 PM
Re: A Fascinating Look
So true. I find myself thinking I have to appear rude rather than risk getting 0wned when I get requests for connections to folks I don't know or remember!
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:11:37 PM
Re: A Fascinating Look
Exactly! I have several people hanging in limbo right now for that very reason! Though I doubt any of them are losing sleep over it. :)
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/29/2014 | 4:50:30 PM
Traditional defenses
It's pretty scary to think how defenseless we are against social engineering. Are best-practices like "don't [connect] or friend people you don't know, and don't endorse them for skills on LinkedIn if you don't know" enough to stop a determinined attacker?
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Moderator
5/29/2014 | 5:01:18 PM
Re: Traditional defenses
No, I don't think those suggestions are good enough. Especially when you're dealing with a group like this, which uses real journalists' names to try and reach its targets. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/29/2014 | 4:50:36 PM
Traditional defenses
It's pretty scary to think how defenseless we are against social engineering. Are best-practices like "don't [connect] or friend people you don't know, and don't endorse them for skills on LinkedIn if you don't know" enough to stop a determinined attacker?
Bprince
50%
50%
Bprince,
User Rank: Ninja
5/29/2014 | 9:50:16 PM
Re: Traditional defenses
It is very easy to fall for something like that on a social network, especially after the scammer gets one person who you trust to friend them. Then it can cascade, because other people will say, 'well if so and so knows her from our company, I must have met her as well' or 'that person must be trustworthy.' It is a good way to conduct reconnaissance for spear-phishing. 

BP
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2014 | 11:25:42 AM
Social Engineering and Firewall Subversion
SANS denotes Social engineering as one of the top 4 methods for getting into the internal network and behind the firewall. I would have to agree and rank at least in the top 2 of the 4. Think of it in logical terms. Linkedin tracks your professional background. I look you up on Linkedin and already know your place of business. This is helpful with probing the helpdesk for internal credentials.

If I can foster an email correspondence with anyone at the enterprise, as long as the email isn't aliased, I could possibly have your username. From there facebook could be used to pull personal data and maybe hone down the field of a password possibility if you create your own passwords. With this put into the specialized fields of a dictionary attack, it could take a lot less time to discover your password.

Now account lockouts are the next piece of security that would prevent intrusion. But if I am a hacker I do not want to go on site and try to bypass physical security as well. I would rather try and find an in remotely. Next step for me is to call the helpdesk for remote documentation. Some enterprises have multiple avenues for working remotely. Going back to my previous point about lockouts, the functionality of a remote client is to allow you to work from anywhere. Functionality is the main purpose here. Many don't have a lockout mechanism. So I can try to log in remotely as many times as I want, making my dictionary attack much more efficient. Once I have the credentials. I log in remotely during off hours, and because I don't need to change your password you may not be any the wiser. 

This is all thanks to social engineering.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15570
PUBLISHED: 2020-07-06
The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
CVE-2020-15569
PUBLISHED: 2020-07-06
PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CVE-2020-7690
PUBLISHED: 2020-07-06
It's possible to inject JavaScript code via the html method.
CVE-2020-7691
PUBLISHED: 2020-07-06
It's possible to use <<script>script> in order to go over the filtering regex.
CVE-2020-15562
PUBLISHED: 2020-07-06
An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.