Social engineering, when shielding computer systems is not everything

In 2007, one of the most expensive security systems in the world was breached. No weapons, violence, or any type of electronic device were needed for a man left with 28 million dollars in diamonds from the ABM AMRO bank located in Belgium. The only weapon he used cannot be bought: personal charm.

The guy, who called himself Carlos Héctor Flomenbaum, had an Argentine passport that had been stolen in Israel. With this identity he became a client of the bank and built the trust of the employees for a year. While posing as a successful businessman, he gave boxes of chocolates to bank workers. One day, they gave him access to safe deposit boxes containing 120,000 carat gems, and he then carried out one of the largest robberies committed by a single person.

The moral is very simple: no matter what technology is available or how expensive it is, As long as the human factor intervenes, the system remains vulnerable.

The user is the weakest link in security

The previous story leads us to talk about social engineering. A set of psychological techniques and social skills that, used consciously and often premeditated, allow the obtaining information or resources from third parties. What is done afterwards with the information obtained has no limits, although that no longer falls within social engineering. Therefore, when it comes to the world of computing, a social engineer may never touch a computer or access any system.

There have been cases in which it is not necessary for the social engineer to build the trust of his victims or manipulate them, since he can take advantage of data that is visible such as a post it on a desk, the notes in a notebook, the messages seen on the screen of a mobile phone or even search in the trash (a method known as trashing). In other words, you can obtain data without exerting any type of pressure, which means that, in these particular cases, we would not be talking about a technique of deception, but rather taking advantage of the carelessness of others.

In the initial example it is clear that the objective of the theft was the gems, but it also reflects that the most important asset of any company continues to be information. Possibly the thief would not have known things like where the diamonds were if it had not been for the employees provided you with this information. Hence, companies must not only invest in security systems, but also in Train each member of your team for what could happen.

We cannot forget that social engineering continues to be one of the most used techniques among cybercriminals. And it is not surprising since, thanks to this method, They have managed to gather a billion dollars in the last two years from a hundred banks. However, companies in other areas are not exempt from this danger.

The cases that we will see below illustrate To what extent can the human factor influence the economy of a company?, and even in the state of the main markets. These are two examples that are worth keeping in mind when a company decides to invest in improving its computer security.

Ubiquiti Networks case and reverse social engineering

Ubiquiti Networks is an American provider of high-performance networking services for businesses. In 2015 he suffered an attack which caused him to lose 39.1 million dollars. To do this, cybercriminals wrote some emails posing as executive members of the company, and they asked some financial employees to transfer large amounts of money to a particular bank account. As expected, this was the property of cybercriminals.

This social engineering technique takes advantage of certain weaknesses of the human being, as is the fact of being helpful, since that could affect recognition by superiors. It also benefits from the fact that there are many people who are incapable of refusing to do something that, thought coldly, could be harmful.

No one got into Ubiquiti Networks' computer systems, nor did they steal the company's data. In this case, the security gap was in the employees themselves, who lacked training and were unaware of the necessary procedures to protect themselves against this type of scam.

The influence of a false tweet on the world economy

There are those who may have banished it from their memory, but in April 2013 the Associated Press Twitter account published a tweet that for a few minutes shook the world economy:

So, the social network did not offer its clients double authentication factor to log in. With this, the Syrian Electronic Army, the group that claimed responsibility for the attack, took over the Twitter account through sending a phishing email to members of the Associated Press team. Someone took the bait and provided access credentials to the hackers. In the following image you can see the phishing email that was sent to the Associated Press:

Today the outcome is well known: the White House came out denying the tweet, and the Associated Press account was temporarily suspended until its control was recovered. The markets also reestablished their order.

This situation revealed how fragile we are in the face of cyber attacks of this type and, as a consequence, how vulnerable companies and organizations at any level are. Then it was Associated Press, but tomorrow it could be any other company or institution that could be sending messages on its social networks that damage its image, and therefore, the trust it has with its clients and investors.

The importance of taking action and reporting

In a TED talk, IBM Vice President of Security Caleb Barlow urges companies around the world to combat cybercrime in the same way they carry out action protocols in the face of a global health crisis. As we have seen with the cases of Influenza A or the Zika virus, governments and agencies around the world share information instantly about the number of people affected and how the virus is spreading.

This procedure is precisely the opposite of what is carried out today with regard to computer attacks. Compared to the number of cyber attacks that are estimated to occur daily, Hardly any data is known about the companies whose systems have been breached. for fear that this will affect their reputation, or even their financial results. "If we don't share [information], then we are part of the problem," says Barlow.