There is a new take on an old phone scam currently hitting people. The old scam was to pretend to be the telephone company and phone someone saying that they are about to be cut-off if they don't pay a smallish amount by card over the phone immediately. If people don't believe them they are actually encouraged to hang-up and then try to make a call. When they hang-up and then pick the phone up again it is dead. How do they do this? Well it's actually very simple - the scammer doesn't hang-up, they just put their phone on mute. The call was never torn down.
So, what's the 'new take' on this scam? Well, they are now hitting bank and credit card customers. The scammers now pretend to be from the bank and start asking for card details, etc. If you get suspicious (or even sometimes prompted by the scammer themselves) you are encouraged to hang up and call them back on the telephone number shown on the back of your card. They then provide you with an extension number or a name to ask for.
When you hang up they do not, similar to before. However, this time they play the sound of the dialling tone to you until you start 'dialling' the number. All they have to do is wait for you to finish dialling the number then play the ringing tone to you. All the while they haven't hung up and you haven't dialled your bank at all. The scammers then 'answer' the phone and pass you to the person you were speaking to before. You now think you're speaking to your bank.
You did the right thing, but were still trapped. What can you do about this? My suggestion is to call back on a different line. Call your bank back on your mobile, not the landline you first received the call on.
Showing posts with label social engineering. Show all posts
Showing posts with label social engineering. Show all posts
Friday, 13 July 2012
Wednesday, 12 October 2011
Sony to send password reset email
Sony have detected someone trying to gain access to their various networks again, by using ID and password pairs that Sony conclude have been extracted from someone else's network. This may be a valid conclusion as it was only a small percentage of users that were affected (less than 0.1%, which is still 93,000). Sony have been upfront and quick to react, disabling the affected accounts and putting out a notice.
However, their next step, according to the notice given by their Chief Information Security Officer (CISO), is to send all the users who have been affected an email asking them to change their password.
Cue phishing scam!
Surely some bright spark will now construct a phishing email to send out to everyone saying that theirs was one of the 93,000 IDs compromised and could they now change their password. A simple copy of the site would then enable someone to lift thousands of valid credentials from accounts that weren't compromised. The problem is that Sony's users are now expecting an email to arrive to tell them to change their password. The work to trick someone to follow a link has already been done by Sony and the media.
How about not sending an email? Instead, publicise the attack and that some accounts have been disabled (Sony has done this). Next, let the users come to the Sony sites and try to log in. Then you can inform them that their account has been disabled and what the password reset procedure is.
However, their next step, according to the notice given by their Chief Information Security Officer (CISO), is to send all the users who have been affected an email asking them to change their password.
Cue phishing scam!
Surely some bright spark will now construct a phishing email to send out to everyone saying that theirs was one of the 93,000 IDs compromised and could they now change their password. A simple copy of the site would then enable someone to lift thousands of valid credentials from accounts that weren't compromised. The problem is that Sony's users are now expecting an email to arrive to tell them to change their password. The work to trick someone to follow a link has already been done by Sony and the media.
How about not sending an email? Instead, publicise the attack and that some accounts have been disabled (Sony has done this). Next, let the users come to the Sony sites and try to log in. Then you can inform them that their account has been disabled and what the password reset procedure is.
Friday, 30 April 2010
InfoSecurity Europe 2010
Once again InfoSecurity Europe was an interesting place to visit. Lots of good sessions and interesting people to talk to. Most of the usual protagonists were there and the organisers have increased the educational part of the exhibition as well, which is good.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
Surveys or Phishing Emails?
I was recently sent a survey from a well-known survey company (actually, on second thoughts, I'll name them: Capita) and it made me very cross. Why so cross? Well, I spend a considerable amount of time trying to educate people about their role in the security of the network and about phishing/social engineering. This is all undone by survey companies such as the one in question. See for yourself the email sent and use it as a template for future 'white-hat' testing.
What's wrong with this? Many things! Phishing scams are on the increase and are one of the biggest threats to security at the moment. Targeted phishing, or spear phishing, is also on the increase and these surveys could easily fall foul of this type of attack. The survey emails are in a standard format with no personalisation. It appears as a classic phishing email, albeit with better grammar. It would be easy to exploit this 'legitimate' survey to ask for additional personal details. Points to consider:
It gets worse though. When I phoned Capita Surveys, a nice helpful lady called Liz told me who they were currently providing surveys for (I won't give out the organisation names here as that would be irresponsible, but if Capita would like to check with me I can prove this). It would be very easy to quickly knock up a copy of their site with a similar URL and registered SSL Certificate, add in a few extra questions, send those emails and wait for the information to roll in. Well done Capita! They say they take people's security seriously and that answers are secure because they use SSL. However, I would beg to differ.
Capita aren't the only culprit though; I was also recently sent a survey for Microsoft from Mori, which was just as bad. They have to take steps to ensure that their surveys can't be hijacked for targeted attacks. There are anti-phishing technologies and techniques available that, whilst not infallible, would help, so why aren't they used?
Have your Say! Fill in your Staff Survey today!
Dear Colleague
It’s important to complete the Staff Survey to ensure your voice is heard! The purpose of the survey is to make further improvements to staffs’ working lives at Target Organisation.
Your responses will come direct to Capita Surveys & Research Unit, and will be totally anonymous. No one outside the research team – and certainly no one at Target Organisation – will know who has responded or be able to identify individual responses. The survey findings will be analysed by Capita Surveys & Research Unit and only aggregate results will be reported.
To ensure that you have adequate opportunity to participate, the survey closure date is date month year.
In order to participate in the survey visit:
https://sas.capitasurveys.co.uk/targetorganisation
and enter your password: AAdddd
If you have any queries or require support completing the survey please contact us at Capita Surveys & Research Unit on 0800 587 3115.
Yours sincerely
Cheryl Kershaw
Director of Surveys and Research
Capita Surveys & Research Unit
Dear Colleague
It’s important to complete the Staff Survey to ensure your voice is heard! The purpose of the survey is to make further improvements to staffs’ working lives at Target Organisation.
Your responses will come direct to Capita Surveys & Research Unit, and will be totally anonymous. No one outside the research team – and certainly no one at Target Organisation – will know who has responded or be able to identify individual responses. The survey findings will be analysed by Capita Surveys & Research Unit and only aggregate results will be reported.
To ensure that you have adequate opportunity to participate, the survey closure date is date month year.
In order to participate in the survey visit:
https://sas.capitasurveys.co.uk/targetorganisation
and enter your password: AAdddd
If you have any queries or require support completing the survey please contact us at Capita Surveys & Research Unit on 0800 587 3115.
Yours sincerely
Cheryl Kershaw
Director of Surveys and Research
Capita Surveys & Research Unit
What's wrong with this? Many things! Phishing scams are on the increase and are one of the biggest threats to security at the moment. Targeted phishing, or spear phishing, is also on the increase and these surveys could easily fall foul of this type of attack. The survey emails are in a standard format with no personalisation. It appears as a classic phishing email, albeit with better grammar. It would be easy to exploit this 'legitimate' survey to ask for additional personal details. Points to consider:
- There is no personalisation – ‘Dear Colleague’
- The email doesn’t come from the organisation in question – staffsurveys@Capita.co.uk
- The URL does not point to the organisation in question – https://sas.capitasurveys.co.uk/organisationname
- There is no contact within the organisation presented in the email for confirmation – contact Capita Surveys & Research Unit on 0800 587 3115
- They do not use an EV SSL certificate on their site, only DV – QuoVadis Global SSL ICA certifying that this is sas.capitasurveys.co.uk, which could be a phishing site for all a user knows, as it isn’t certified to be Capita or Capita Surveys & Research Unit (see post on EV versus DV certificates)
It gets worse though. When I phoned Capita Surveys, a nice helpful lady called Liz told me who they were currently providing surveys for (I won't give out the organisation names here as that would be irresponsible, but if Capita would like to check with me I can prove this). It would be very easy to quickly knock up a copy of their site with a similar URL and registered SSL Certificate, add in a few extra questions, send those emails and wait for the information to roll in. Well done Capita! They say they take people's security seriously and that answers are secure because they use SSL. However, I would beg to differ.
Capita aren't the only culprit though; I was also recently sent a survey for Microsoft from Mori, which was just as bad. They have to take steps to ensure that their surveys can't be hijacked for targeted attacks. There are anti-phishing technologies and techniques available that, whilst not infallible, would help, so why aren't they used?
Subscribe to:
Posts (Atom)