Protect Yourself from Social Engineering and Email Phishing

0:00The concept and the idea of bamboozling-- of tricking a user into doing some action or behavior that they otherwise wouldn't-- is one of the easiest ways to compromise a system. And it's referred to as social engineering. To begin, let's you and I take a look at some examples of social engineering. Here on the left, I got an email message that, from my inbox, appeared to come from my daughter. But upon closer inspection of the email, it was not my daughter's email address. And in the email, it was attempting to have me click on some link. And that's an example of phishing, where the attacker is attempting to bamboozle the user into doing something that they normally wouldn't do, or shouldn't do.

0:37Another example that recently happened was a text message I got from a friend. And in this text message, it had a link. And right before the link it said, hey, get on this so we can chat. And then it had a link. And it had my name embedded as part of that link. So although it's possible that I could have a friend who created the link and wanted me to go ahead and jump on it to chat, it's probably not likely, especially in the event that there's so many other ways of traditionally communicating with another user, or another person. So I responded back, and I said, are you OK? And then she responded back. And she said, my phone has been hacked. Now the other thing we could do possibly too, is with these URLs that we have in the links, we could go up to virustotal.com, put in those URLs, and just get an opinion of the website.

1:15But what we would never want to do is click on these links directly to see, hey, I wonder what's there. So the old saying that curiosity killed the cat-- that's a pretty good saying. Because curiosity also is what can kill the security of an end user. And then another example is a piece of paper that showed up on one of my relative's doorsteps. And it had the information up here-- sorry we missed you. It looked like a delivery had been attempted. So they're asking us to go ahead and call this number, and then provide a confirmation ID. And it says, oh, please see the important notice on the back. Well on the back, it says that if you call that number, you're giving them permission to go ahead and do marketing to you at that number.

1:50There was no package involved ever. And one of the questions that we may ask is why. Why is social engineering and the human factor such a huge risk in organizations today? And there are some fundamental behaviors that makes individuals like you and I vulnerable to attacks with social engineering. And those behaviors include trust. Because at some level, most people want to trust other people. Another factor is ignorance. Specifically I don't mean ignorance in general, but ignorance regarding social engineering.

2:22There also could be ignorance regarding how devastating the result could be if a social engineering attack is successful. Another factor is fear. For example, if there's a Vishing attack which involves a telephone-- and the V in Vishing is for voice-- the attacker, possibly using hypnotic language, could convince the other person on the line that something really bad is going to happen unless they comply-- for example, the IRS is auditing you, and you need to pay this money, and do it right now, or some other activity that the user would normally never do.

2:53Fear also comes into play if somebody's system has been encrypted, and ransom is being requested. The fear of losing that important data may lead that user into doing something that otherwise they wouldn't, including paying ransom in an attempt to get the keys to unlock the data. There also could be greed involved. Perhaps a user at a company has been there for a long time. They feel they've been taken advantage of, and as a result might comply and do something illegal or unethical to get personal gain at the cost or expense of the company. And what I also like the list here is moral obligation, where the victim or the target feels that they're morally obligated to help another individual.

3:29They may not realize they are helping an attacker, but they feel like they're just doing the right thing. For example, there's a few people on a smoke break. They're all coming in. And one of them comes in, has a box that they're carrying, so some other person holds the door for them. And unknowingly, it's an attacker with a fake badge-- he's dressed like the other workers-- who has now entered the physical premises and is one step closer to compromising the company. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00There are people whose sole purpose is to compromise a company. In this Nugget, you and I get to talk about some of the techniques that we can be aware of and look out for as well as the stages that a social engineer can go through to compromise a company. Let's begin. So here are the four basic phases in a social engineering attack. Number one, there's going to be research on the target company. And then once the research has been done, a victim is selected. It could be a frustrated individual or simply an easy target. Then the hacker could develop a relationship or a friendship with that selected target.

0:32And that relationship could be built physically by going to common places, such as restaurants or bars or other activities that the victim has interest in, or it certainly could be done digitally, by the attacker identifying what the user is interested in, creating a bogus social media page, and then slowly and comfortably building a relationship that way with the intended target. Then the final goal is for the attacker to exploit that relationship to collect sensitive information or get access to details that they otherwise shouldn't have through the victim. One of the techniques the social engineer may use is impersonation, where they are pretending to be someone legitimate or an authorized person when they're not really that person.

1:11And the communication method could be one of many things. It could be email. It can be a telephone call. It could be through social media or it could be physically in person. And the goal of that impersonation is to try to trick the user into revealing sensitive information and/or doing some type of activity that's going to benefit the attacker. Some examples of impersonation may be the attacker calling the desk and saying something like, hi, this is Bob from human resources, I forgot my password, I can't get in, can you help me, or posing as an important user.

1:42And that may go something like this, oh my gosh, JJ Abrams is on the set. I'm the executive assistant for him. He cannot get into email. He's got 10 minutes before he has to go ahead and go to another meeting. He needs help. And he needs it right now. And I don't know JJ Abrams. But when I worked at Paramount Pictures, we had some very important individuals on the lot. And whenever their name was called out, people got an additional pump of adrenaline to get the job done. So that could be used as part of impersonation as well. Other techniques include eavesdropping, just listening in on conversations that otherwise shouldn't be public, or shoulder surfing, which is looking over another person's shoulder as you're typing or you're seeing information on their screen.

2:19There's dumpster diving, where the attacker is going into the trash receptacle at the place of business, looking for information that's been thrown away. It hasn't been disposed of or destroyed properly. There's also the concept of tailgating or piggybacking. And that's when we have a secure access into a facility. That secure access might be a door or it could be a mantrap, which is intended to only let the authorized individual through. And through social engineering, the attacker attempts to have that bypassed by either carrying a box or getting some other method to have an authorized user allow the unauthorized user into the physical premises.

2:53And on the computer side of social engineering, we have techniques like pop-up windows or hoax letters or chain letters or messages that pop up on screens or instant messenger type of communications or spam or fake websites or redirection of the customers to fake websites, all of which could encourage that user to click or do something that would compromise their system. And the difference between a phishing attack, which is email-based-- trying to get the user to click or do or install something based on an email that was sent to them-- versus a spear phishing attack is that a spear phishing attack is directed at specific individuals, for example, in the company.

3:28So when the attacker discovers that Bob really loves cars, perhaps a .PDF is created that's malicious. But the PDF is all about the type of cars that Bob is interested in. So the email is sent to Bob appearing to come from someone else that's non-malicious with the hopes that Bob will click on that link or open that PDF, which then leads to the compromise. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00So let's begin with the interesting spelling of phishing. They swap out the f-- as in normal fishing, like fishing for trout, or bass, or what have you-- with a ph for the f. That's a hacker thing that goes way back. And that's why it's called phishing, with a ph instead of f. And what the attacker or hacker is trying to do is to bait a user, to tempt user to do some activity in order to compromise that user, for example, to reveal their username and password, or perhaps reveal information that otherwise shouldn't be available to the attacker.

0:30And phishing is done primarily through bogus e-mails that are being sent to an individual. And that email that's being received by the victim is made to look as official or authoritative as possible. And that email that the victim receives is going to have either an enticing, or some kind of urgent request, that the attacker is hoping the victim will act on. So let's consider together for a few moments some of the e-mails that we would get that would entices to, for example, click on something, or do some activity. Several things come to mind. Maybe there's a security alert.

1:01That could come from a bank, or from our company, or some other organization that we trust. But instead of actually being a legitimate e-mail from that source, it's a bogus e-mail made to look like it came from an official source. Another one is vacation time, or vacation policy at work. So if we're at work, and we just got an e-mail saying we've just revised the vacation policy. And to see that new policy, they give us a link to click on. The link in that email, although it may look innocent, if it's sent from the attacker, that link is going to lead to something malicious, which could include a fake web site completely made by the attacker, which looks legit.

1:34So to see the vacation policy, we need to put in our username and password. And once we supply that information at that fake website, it's over. The attacker now has the username and password, because we just supplied it through the fake website. Another type of e-mail that we're used to getting is for deliveries-- for example, the United States Postal Service, or UPS, or FedEx. And a lot of times, they'll have links in those emails to track a package. If the attacker has sent us that fake e-mail, and the link in that e-mail-- although it may look good-- leads us to a malicious site.

2:07That's one step closer to the attacker compromising us-- the individual who's reading and acting on that email. And the list goes on. And while phishing is email based, there's also specific types of phishing that an attacker or a hacker can do. There is something referred to as spear phishing. So instead of just casting the bait and sending it out to millions of people, with spear phishing, it's actually targeting specific individuals, for example, specific individuals at a department at a company, or members of a group. And there's also another option called whaling, where we're going for a big phish.

2:40And that would be at, for example, senior executives, senior management, in an attempt to have those individuals do something that they otherwise normally would not do. An example would be an email requesting authorization for a wire transfer of money. And perhaps a big transfer, like, millions of dollars, does have to be approved by multiple people. But if all those people can be phished in a very timely manner, where each of the victims in the attack believes that the appropriate approvals have been done-- a coordinated e-mail attack like that could result in not only a monetary loss based on a wire transfer that's being sent to the wrong individuals, but also public humiliation based on a corporation losing millions of dollars and having that information being publicly known.

3:21That company is going to lose some trust as a result of falling for the phishing attacks. There's also an option called vishing, which instead of using e-mail, it uses the telephone. And that's why there's a v there for vishing. A quick example of that would be getting a phone call from someone claiming to be the IRS, or the sheriff, or some other authoritative figure, indicating that there's some urgent need, there's some cause for action. A quick example of that-- my son moved out of state a few months ago. And in doing so, he rented a moving truck. And while he was traveling, my father-- my son's grandfather-- got a call.

3:55And the call when something like this. Your grandson, Paul, was in a motor vehicle accident as he was traveling to Oregon. And he's not in critical condition. He's going to be OK. He has a few stitches. He's recovering. And this is going to lead eventually to the attacker eliciting money from my father on behalf of his grandson. Now fortunately, this has a pretty happy ending on two counts. Number one, my son was not involved in any accident. This was a total scam-- a vishing scam. The second good part of this story is that my father, although well in his 80s, is very aware of scams of many types.

4:31So my dad, he just come off the caller and said, you know what, you should call his parents-- click. And so the thing that blows me away about that type of an attack is the timing. That means the rental company that was renting the truck-- those records were not secure. That information was being leaked out somewhere. And the attacker had that information. And then the attacker, furthermore, after having that knowledge, also probably knew that the parents of that person, in this day and age, have cell phones, and get contacted all the time, and could reach out directly if there was a problem or an incident to their son, where a grandfather might be a little bit further removed, and possibly a better victim.

5:10So in this idea of tricking an individual to divulging or providing something that they otherwise wouldn't, the attack could come from e-mail, or from social networking. I mean, maybe it looks like a greeting card. And it says, click here to open your birthday greeting. Now in a phishing attack, there's very likely going to be a link or attachment in that e-mail that the attacker hopes that the user will click on or open-- if it's an attachment-- to compromise the user. In the past, many of these phishing e-mails have had poor grammar and bad spelling.

5:40But as technology gets better, and the attackers get better, the e-mails oftentimes look very, very authentic and very, very legit. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00In this Nugget, I'd like to chat with you for a few minutes about how we can both identify a malicious email. And then secondly, and more importantly, how to avoid being tricked by one. So I thought it would be fun and effective for both of us to take a look at some examples of phishing emails. So I'm just going to do a quick search for phishing examples in a browser. Next let's click on the images link right here. So let's go up and grab this one from PayPal right here. So here in the subject of this email, it specifies that your account has been limited. It's also got here a call to action to log into your account now.

0:33Now oftentimes, if you hover over a link, it will reveal the details regarding that URL or that link. So a well-crafted email could put anything here as far as the thing that you click on, and then behind the scenes, what it's going to could be completely different. And that's how the attacker could trick an otherwise unknowing individual to click on that link go to a fake website, which may appear to be a legitimate website. At which point, the user is very likely going to be prompted to provide their username and password. The attacker slash hacker has compromised the user, because he or she now has the username and password of that user for PayPal.

1:08If we look at some other examples here in this email, which is intended to look like it came from the IRS. It's about claiming your tax refund online. There's a link here to get started, and then the user, when they click on that link, it's very likely that on the website they land on, it's going to ask them for information regarding, for example, what is your social security number? What is your date of birth, which will allow the attacker slash hacker to then collect that information and then use it later anyway they see fit. And there's no shortage of examples. If you just want to do a quick search on phishing email examples or phishing examples, there's tons, and tons, and tons that are out there.

1:43So let's minimize that. And let's take a look at what we can do, in measurable terms, to stay safe. That will protect, not only us, but also our companies as we work with emails. Number one, don't trust links that come in an email. If the bank, or the financial institution, or your company is sending you an email with a link in it, don't use it. It's really that simple. And the question may come up, well, what if it really is an alert from the bank and I need to go verify it? Well, the solution to that is, go ahead and open your own browser, put in the URL yourself to go to the bank.

2:19Log in, as you normally would, through your separate browser, not using any links from the email, and do it that way. Number two, never, did I say never? Never give out personal or sensitive information based on an email request. Just don't do it. Number three, carefully look at the addresses. That includes the sender email address, as well as the links that are in the email. If you want to know where they're going, hover over them. Do not click on them if you want to see where they lead to. And look for typos.

2:49For example, if an email came from Payple.com, versus Paypal.com, versus Paypla.com. If we're doing a quick glance, they all may look like they're coming from PayPal, when indeed, only one is really representing PayPal.com. Also, if there's links to a financial institution, they are very likely going to have an "https" in front of them, which implies it's going to be using secure communications to connect to that resource.

3:19However, because we're not going to trust links in an email, we're never going to find out. Because we are not going to click on those links. We're just not going to do it. We're also not going to open any executables, or programs, or attachments if there's any suspicion that that email isn't authentic. So if we got an email from Microsoft.com, that kind of looks like Microsoft.com, but if that second character is a lowercase L, and not an I, that would be coming from a domain that's not Microsoft. So, continuing on our list of how you and I can be safe, here's number four.

3:51And that is to type the real address of where you want to go in a browser. Or you can do a search. And that way, if you want to go to a BankofAmerica.com you can type that in. Or if you want to go to Microsoft.com, you can type that in in a separate browser window. And again, never trust the links that are given in an email. Number five, don't use the phone numbers that are provided in an email. Because if they're bogus, you could be calling a phone number that isn't going to the destination that you think it is. And for the entity receiving that call, that would now be a vishing attack, with a "V," where their intent is to get the user, the victim, to reveal or disclose information that otherwise they shouldn't be disclosing or revealing to the attacker.

4:33Number six, now this sounds a little strong. But I'm going to go out there and say we don't want to open any attachments in email whenever possible. Because what an attacker may do is put something that looks innocent. For example, a text file, or a .PDF. When behind the scenes, when the user actually opens that attachment, it's malicious. So if you get an email from within the company or without the company, and it's got an attachment and you have any concern about, OK, why did this come in? Why am I getting this? Make a phone call. Use a method outside of that email to verify what that is that you've just been sent.

5:07And in most companies, there's an IT supplied method for sharing resources. For example, maybe it's SharePoint, or file services that are on the network. Or other methods that are provided by the IT team that facilitate the sharing of information and documents within your company. So if you have any question about, OK, what is the authorized method that I should be using to share a file, for example with a coworker? Talk to your manager, talk to the IT team, and ask them about what's supported, and the official ways of doing it. And then anything that's outside of those realms, you'd want to avoid.

5:38And if you get any email or messages that say to do otherwise, you should be very, very suspicious of that. And then number seven, I'm going to put over here, is we need to go ahead and follow our company's guidelines on reporting any types of attacks. Including phishing attacks. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00The concept of hacking refers to taking advantage of some type of system vulnerability and usually to compromise security. And oftentimes, that's accomplished by manipulating or modifying a system or an application to have it respond in a non-expected way or a non-intentional way. For example, having a network topology that's willing to advertise itself to the hacker, who is now discovering how your topology looks. Or perhaps discovering the exact version of the operating system that you're running on your server or on your desktops with the intent to further exploit or take advantage of vulnerabilities in that specific operating system.

0:37And you, like me, know that there's not just a black and white with everything in this world today. And that's also true for the various classifications or classes of hackers. For example, a black hat is a person who has some really amazing computer skills, but unfortunately, is resorting to malicious or destructive activities that are not lawful. Another classification is a white hat, and a white hat would also have some really amazing skills. However, instead of using those skills for unauthorized or illegal activities, they're using them for defensive purposes.

1:09So for example, a security consultant who does penetration testing for huge companies who gets signed authorization before he or she starts, also has identified the scope of what's allowed to be tested and has that in writing, and also signs a non-disclosure agreement before going in. That type of security consultant would be considered to be a white hat, a good guy. The next classification is a gray hat, and that would be a person who works offensively as well as defensively in the security arena. And because they may cross the line occasionally, they would not be considered a black hat or a white hat, because they go both ways.

1:46Another classification is a suicide hacker. For example, let's say that Bob discovers, through some means, that the company is downsizing in a few weeks and his job is going to be terminated and Bob is upset, disgruntled. So before Bob leaves the company, he is going to plant some logic bombs that are going to cause disruption of service at some future point. Maybe he's going to plant some Trojan horses and some malware, maybe some back doors that would provide access later after he's fired. And to top it off, he's so upset in the heat of the moment that he just doesn't care if he gets caught.

2:19That would be an example of a suicide hacker, where they're throwing caution to the wind and don't care if they get caught. They're not worried about jail time or other kind of punishment. They're just going to go ahead and do it. Another classification for hackers is called a script kiddie, which is effectively an unskilled hacker who takes advantage of a system by running scripts or tools or software that were developed by somebody else. However, the scary thing is is that virtually anybody can download a tool, click a button, and have that tool launch an attack. And that would include an experienced analyst as well somebody who's brand new.

2:52And generally speaking, when somebody calls somebody else a script kiddie, it's usually not a compliment. It usually implies an unskilled hacker. Another hacker class is a cyber terrorist, which represent people with a huge range of abilities and skills, and they can be motivated by religious or political beliefs to create fear by huge disruption of service of computers and systems of networks. Another classification would be a state-sponsored hacker. This would be an individual or group of individuals who are employed by a government or an entity such as a government to break into, to penetrate and gain top secret info, or perhaps just to damage or place bad information in other types of systems, usually in other governments.

3:34And as cyber warfare heats up and increases, the number of state-sponsored hackers is also increasing. And then the last one I wanted to chat about with you for a moment is a hacktivist, and an example of a hacktivist would be a person who's driven by a political agenda. And perhaps they want to deface or disable a website or embarrass somebody to promote their cause. Now, I've got two questions for you regarding these classes of hackers. Question number one, is it possible that an individual may be in more than one of these classes at any given time?

4:05For example, say we have a user like Bob, who is disgruntled, and he doesn't care if he gets caught. And he's also going to use some tools that maybe he doesn't completely understand that he download from the internet and is simply going to place a run on the network. Now, that's a simple example of how an individual could fit into two or more categories. And my second question for you, my friend, is which of these classes of attackers or hackers could, either through intention or accidentally, land up in really hot water and possibly be put in jail or fined or both due to their activities? Think about that for a moment.

4:36Which one of these classes of attackers could be in trouble based on using tools? And the answer to that question is that any one of these classes of attackers and hackers could end up in very serious trouble if they're not mindful and careful about the tools that they're using. In this Nugget, we've taken a look at a few classes that an attacker or a hacker may fall into, including black hat, white hat, gray hat, suicide hackers, script kiddies, cyber terrorist, state-sponsored hackers, and hacktivists. I hope this has been informative for you, and I'd like to thank you for viewing.