Famous Social Engineering Attacks: 12 Ingenious Scams

Famous social engineering attacks: 12 ingenious scams

Human beings are fundamentally social creatures. We like to help each other. We usually defer to people higher up the hierarchy than us. We tend to trust that other people are honest, mean what they say and are who they say they are, because questioning any of those things without good reason is rude.

Unfortunately, these social niceties can make us the weakest link in information security. Hacks often result not from technical flaws but from what’s known as social engineering: human beings being persuaded to let their guard down. Many of the techniques are as old as the con itself, but they’ve been updated for the digital age.

Consider the examples of social engineering attacks below as cautionary tales.

Kevin Mitnick’s wild ride

Kevin Mitnick was one of the most notorious hackers of the 1980s and 1990s computer era. His exploits were driven by curiosity, not profit, and social engineering was his superpower. Here’s a classic Mitnick trick: in 1979, at the ripe old age of 16, he befriended some hackers who had found the number of a dial-up modem for the system Digital Equipment Corporation (DEC) used for OS development, but they told him it was useless because they didn’t have an account name or password. Mitnick simply called DEC’s system manager, claimed to be Anton Chernoff, one of the company’s lead developers, and said he was having trouble logging in; he was immediately given a login that provided high-level access to the system . (Mitnick, now reformed,.)

Brothers in crime

The most famous hackers in the Middle East in the 1990s were Muzher, Shadde and Ramy Badir, three Arab-Israeli brothers who had been blind since birth. The Badirs’ favorite targets were phone companies – at one point they ran their own bootleg telecom service and billed an Israeli army radio station for all the bandwidth – and many of their scams were pulled off through social engineering techniques, such as calling phone company headquarters claiming to be field engineers or chatting up secretaries to get details about their bosses that would help them guess passwords. But the Badirs had truly unique skills: they could wreak havoc by perfectly imitating voices (of the fraud investigator on their trail, for example), and they could identify a phone’s PIN just by hearing someone dial it from across the room.

Tarnishing HP’s reputation

In 2005 and 2006, Hewlett-Packard (HP) was plagued by corporate infighting, and management was convinced a board member was leaking inside information to the media. HP hired private investigators to look into its own board’s communications, which they did through pretexting, a term for a form of social engineering that the ensuing scandal brought to national attention. Armed only with board members’ names and the last four digits of their Social Security numbers, the PIs were able to call AT&T and convince them to provide access to the victims’ detailed call records . Although HP’s leadership said it hadn’t authorized these techniques, the fallout led to several resignations; and although pretexting to obtain financial records was already illegal, the scandal also resulted in a stronger federal law against the practice.

Someday my Prince will come

Emails from “Nigerian princes” asking for help getting large sums of money out of the country are a common subject of internet jokes – but they’re also social engineering traps that have lured the unwary, even those who should know better. In 2007, the treasurer of a sparsely populated Michigan county stole up to US$1.2 million in public money as part of a Nigerian advance-fee fraud, telling friends he would soon retire comfortably and was flying to London to collect the money he thought he had “won”. He returned to the US empty-handed and was soon arrested.

Tabloid turmoil

From 2009 to 2011, the UK media landscape was rocked by revelations that British tabloids had for years hired investigators to hack into the cell phone voicemail of various targets in search of stories; the victims ranged from movie stars to royal courtiers. Particularly shocking was the revelation that investigators may have deleted voicemails left for a murdered girl , giving her parents false hope that she was alive.

Although the techniques used varied, one of the main methods was pretexting, known in British slang as “blagging”; for example, one investigator convinced Vodafone staff to reset actress Sienna Miller’s voicemail PIN by claiming to be ” John from credit control “. (In other cases, investigators were simply able to guess the PIN , which many users never change from the default.)

Small phish opens big holes

Phishing , although somewhat impersonal, is definitely a type of social engineering, as it focuses on persuading the victim to open a file or run an application they shouldn’t through some kind of tempting bait. In 2011, in a hugely embarrassing breach for infosec powerhouse RSA, at least two low-level employees opened a file named ” 2011 Recruitment Plan.xls ” from an unknown sender (the prospect of a job offer is a common phishing lure). The spreadsheet contained a macro that installed a backdoor on their computers, a compromise that undermined the effectiveness of RSA’s flagship SecurID product and cost the company US$66 million.

Prey drinking at the watering hole

Social engineering works in part by understanding victims’ behaviors, such as where they like to spend their time – and that can include time online. Watering hole attacks are considered social engineering in the sense that hackers compromise websites where they know their targets hang out. In 2013, hackers managed to insert malicious JavaScript into the US Department of Labor’s Site Exposure Matrices (SEM) page, which contains data on toxic substances present at Department of Energy facilities. Naturally, the page was frequently visited by Department of Energy employees – and the attackers managed to infect some of their computers with Poison Ivy, a remote access Trojan horse .

Meet the new “boss”

In 2015, networking equipment maker Ubiquiti Networks fell victim to what’s known as “business email compromise” – or, more commonly, a ” CEO scam “. The attackers emailed employees in the finance department of Ubiquiti’s Hong Kong subsidiary, claiming to be a senior executive, and requested wire transfers to “third-party” accounts – accounts under the criminals’ control. Ubiquiti didn’t want to say exactly how the finance staff were fooled; since the company said there was “no evidence that our systems were penetrated”, the hackers likely used a technique such as a lookalike URL to pull off the trick.

Insecure intelligence

In 2015 and 2016, British teenager Kane Gamble managed to gain access to the home and work internet accounts of top US intelligence figures using social engineering as his entry point . For example, he called Verizon and convinced them to grant access to CIA Director John Brennan’s email account, despite being unable to answer Brennan’s security question (his first pet); he called an FBI help desk claiming to be Deputy Director Mark Giuliano and convinced them to grant access to Giuliano’s account, even though the agency knew a hack was under way. Once inside his targets’ computers, he leaked confidential information and caused other havoc; for example, he forwarded Director of National Intelligence Dan Coats’ phone calls to the Free Palestine Movement.

The spear phish that changed an election

Spear phishing is a specialized variant of phishing in which attackers try to trick a high-value target into revealing confidential information, and for Russian-sponsored hackers in 2016, there was no higher-value target than Hillary Clinton’s campaign manager, John Podesta. Podesta received a fake “account reset” email that appeared to be from Google, asking him to log in and change his password; the real domain of the link provided, hidden behind a bit.ly link shortener, was myaccount.google.com-securitysettingpage.ml.

Podesta was suspicious, but one of the aides he consulted made the most consequential typo in history in an email, saying “this is a legitimate email” when he meant to type “illegitimate”. Podesta entered his account information, and the Russian hackers were able to access and leak his emails, which helped sink the Clinton campaign.

The “it’s my first day” excuse

In 2016, an anonymous hacker broke into an internal US Department of Justice network and posted online thousands of personal records of FBI and DHS agents. The attack began when the hacker somehow gained control of a DoJ email address, but he was able to make the most important move through social engineering, as he boasted to Motherboard . When he couldn’t get into the DoJ’s employee portal, “I called up, told them I was new and I didn’t understand how to get past [it],” he said. “They asked if I had a token code, I said no, they said that’s fine – just use ours.” He immediately had access to the DoJ intranet.

Dialog box blindness

By now we’re all used to the dialog boxes that pop up on our computers asking us to confirm some potentially risky course of action – and they can be adapted to manipulate us during a social engineering attack. In 2017, a wave of phishing emails hit Ukrainian targets that included an attached Microsoft Word document with malicious macro code. If macros were disabled, users saw a specially crafted dialog box , designed to look specifically like a Microsoft one, to persuade them to let the macro code run. (If run, the code installed a backdoor on the computer that let attackers listen through the user’s microphone.) The lesson, as with all of these incidents: always look twice before you click or say yes.

SOURCES: CSO ONLINE

Frequently Asked Questions

What are famous social engineering attacks?

Famous social engineering attacks are an important topic covered in this article. Understand their fundamentals and practical applications.

How can you apply these lessons in practice?

Follow the recommendations in this guide to protect your company against social engineering efficiently and safely.

What are the main benefits of understanding these attacks?

Understanding social engineering attacks brings gains in security awareness, protection and cost savings.