Posted by: David Harley | November 20, 2018

Susceptibility to phishing

A paper from the University of Maryland – Phishing in an Academic Community: A Study of User Susceptibility and Behavior – came up with an unexpected conclusion.

“Students who identified themselves as understanding the definition of phishing had a higher susceptibility than did their peers who were merely aware of phishing attacks, with both groups having a higher susceptibility than those with no knowledge of phishing. ”

It certainly seems counter-intuitive that greater knowledge of the phishing issue should result in greater susceptibility to phishing attacks. Perhaps the answer lies in the wide spread of demographic variables addressed in this study (“age, gender, college affiliation, academic year progression, time spent on a computer, cyber club/cyber scholarship program affiliation, cyber training, and phishing awareness demographics”). There are a number of factors that could have a bearing on this result:

  • The assumptions behind the weighting of that range of variables might be methodologically unsound.
  • My own informal (but longstanding…) experience suggests that people who have significant technological knowledge but are not specialists in security or the relationships between technology and human behaviour may be at least as susceptible to attacks involving psychological manipulation such as phishing, hoaxes and such as are members of the population at large.
  • A significant number of subjects may have overestimated their own understanding of phishing and security, an optimistic assessment that may have spilled over into the experimental design. The possibility of inaccurate self-assessment is a point made by the group conducting the experiment, and it does jibe with my own experience.
  • The group also suggests that the “the act of falling for the phishing scheme might have increased the user’s awareness about phishing.” If this is the case, it certainly suggests a weakness in the experimental design.

In any case, there’s certainly scope for some further research here, whether or not it’s in the specific context of the academic community.

Commentary from The Register here: A little phishing knowledge may be a dangerous thing

David Harley

Advertisements
Posted by: David Harley | October 26, 2018

Je te plumerai le BEC

Posted by: David Harley | October 19, 2018

Recognizing scams

Tomáš Foltýn for ESET: Scams and flaws: Why we get duped – “What are the emotional triggers and errors in judgment that make you fall for an online scam?”


Unrelated, but on a somewhat similar theme:

Phil Muncaster for Infosecurity Magazine: European Banks and Police Warn Consumers of Cyber Scams – “A dedicated site explains the tell-tale signs of such scams, and what consumers can do to stay safe.”

The site includes documents devoted to:

  • Spoofed Bank Websites
  • Romance Scam
  • Phishing / Vishing / Smishing
  • CEO/Business Email Compromise (BEC) Fraud
  • Investment Scams
  • Invoice Fraud

Adrien Gendre of Vade Secure for Help Net: Who gets spear phished, and why? A good generalist guide to the issue.

David Harley

Posted by: David Harley | October 11, 2018

Facebook cloning revisited

A lot of people know by now that the widely-received warning about multiple Friend requests is generally unhelpful (to say the least). Many are dismissing it as a hoax, but that doesn’t address the more general confusion about FB cloning, hacking (not the same thing), clickjacking and clickbait, and general misinformation. This article for ESET attempts to put it into the wider context in a form that doesn’t require a PhD in information security. 

Send in the clones: Facebook cloning revisited

David Harley

Posted by: David Harley | October 6, 2018

Extortion & Breach Compilation archive; BEC as a service

Pierluigi Paganini: Experts warns of a new extortion campaign based on the Breach Compilation archive – “Crooks attempted to monetize the availability of a huge quantity of credentials available in the underground market …. [using] the credentials collected in the infamous database dubbed ‘Breach Compilation’.”

Graham Cluley for Tripwire: BEC-as-a-service offers hacked business accounts for as little as $150 – “Researchers at threat intelligence firm Digital Shadows report that companies don’t even need to be hacked to spill their address books and email archives. Careless backups of email archives on publicly-accessible rsync, FTP, SMB, S3 buckets, and NAS drives have exposed some 12.5 million archive files (.eml, .msg, .pst, .ost, .mbox) containing sensitive and financial information.”

David Harley

Posted by: David Harley | September 18, 2018

Tech support scams: curse of the Evil Cursor, and Technet ads removed

[Also posted to AVIEN]

Jérôme Segura for Malwarebytes: Partnerstroka: Large tech support scam operation features latest browser locker – “We have been monitoring a particular tech support scam campaign for some time which, like several others, relies on malvertising to redirect users to the well-known browser lockers (browlocks) pages. … we were still able to isolate incidents pertaining to this group which we have been tracking under the name Partnerstrokam …. and noticed that the fake alert pages contained what seemed to be a new browlock technique designed specifically for Google Chrome.”

Summary/commentary from Zeljka Zorz for Help Net: Tech support scammers leverage “evil cursor” technique to “lock” Chrome


John E. Dunn for Sophos: Microsoft purges 3,000 tech support scams hiding on TechNet – “Microsoft has taken down thousands of ads for tech support scams that had infested the company’s TechNet support domain in a sly attempt to boost their search ranking….Microsoft’s site was home to around 3,000 of these ads, mostly associated with the gallery.technet.microsoft.com downloads section.

The ads covered a wide range of fraudulent support issues, from virtual currency sites to Google Wallet and Instagram. Johnston told ZDNet…”

David Harley

Posted by: David Harley | August 28, 2018

Green Card scams & Tech Support scams

William Tsing for Malwarebytes: Green card scams: preying on the desperate – Green card scams are far from new. Though in fact this site does actually indicate in the small print that its usefulness to someone wanting to improve their chances of getting a green card via the diversity visa lottery is going to be very limited indeed. But Tsing makes the interesting point that the scam site looks more authentic than the real site because it provides more information, and compares it to “what we see with legitimate tech support and tech support scammers. An official entity does a poor job communicating with its constituency, and that creates a vacuum that scammers are all too eager to fill.” Seems an entirely valid point.

I talked about the issue of inadequate tech support in an article for ESET – Tech support scams and the call of the void – The importance of providing the best possible after-sales service to customers. That article was sparked off by a useful article on the Security Boulevard site by Christopher Burgess on When Scammers Fill the Tech Support Void.

David Harley

Posted by: David Harley | July 27, 2018

Not looking phishy, and not hitting the panic button

An excellent article has just been published by my ESET colleague Lysa Myers. Companies actually compound the phishing problem when they send poorly thought-out messages that are indistinguishable from phishing messages, both to their own staff and to customers (some banks are particularly culpable here). As a result, recipients of such messages are conditioned into accepting without suspicion messages that don’t conform to good practice, and are more susceptible to being taken in by phishing messages. Hook, line, and sinker: How to avoid looking ‘phish-y’  In addition, Lysa points out an issue I hadn’t really considered: “An increasingly common scenario is phishy-looking emails sent by Software as a Service (SaaS) apps like those for fax or shipping services, human resource or accounting portals, collaboration tools, newsletters or even party planners.”

Another colleague (and long-time friend), Bruce P. Burrell, expands on the story I referred to briefly here – Sextortion and leaked passwords – with this article: I saw what you did…or did I? – “It might seem legit but there are several reasons why you should not always hit the panic button when someone claims to have your email password.” Not just a rehash of the news story, but the precursor to what I expect to be a very useful second article with advice from a seasoned security researcher.

It’s worth remembering that phishers and scammers love panicking you into acting incautiously.

David Harley

Posted by: David Harley | July 22, 2018

Microsoft Office 365 as phishing target

HelpNet Security: Microsoft tops list of brands impersonated by phishers. Summarizes an article by Vade Secure’s Phishers’ Favorites Top 25 List. Trailing quite a long way behind are PayPal, Facebook, Netflix etc. Vade reckon that Microsoft is such a favourite because it can be so profitable to get into a Microsoft Office 365 account.

David Harley

Posted by: David Harley | July 15, 2018

Sextortion and leaked passwords

Here’s an interesting article by Brian Krebs: Sextortion Scam Uses Recipient’s Hacked Passwords

The scammer claims to have made a video of the intended victim watching porn, and threatens to send it to their friends unless payment is made. Not particularly novel: the twist with this one is that it “references a real password previously tied to the recipient’s email address.” Krebs suggests that the scammer is using a script to extract passwords and usernames from a known data breach from at least ten years ago.

The giveaway is that very few people are likely to be using the same password now – and it’s unlikely that there are that many people receiving the email who might think that such a video could have been made. Still, it seems that some people have actually paid up, and it’s possible that a more convincing attack might be made sending a more recent password to a given email address, and perhaps using a different type of leverage.

Commentary from Sophos here.

(Further commentary here: Sextortion & leaked passwords revisited

David Harley

Older Posts »

Categories