For some folks, it might be a helpless old lady. Here’s another story that illustrates one of the two main problems with employee-based security.
Wednesday, April 30, 2014
Oh the Humanity: Picture of a Thief
In order to improve security awareness among staff, the first step is to change each employee’s mental picture of what it means to be a thief. Every social engineer who calls will not be an easy-to-spot gentleman with an oily voice and diabolical laugh. Awareness cannot be based on preconceived notions about gender, personality, and level of authority.
In order to be successful, social engineers will go to any lengths, will play on your employees’ weaknesses, and will find ways to get in their heads. For many men, that weakness is a friendly girl.
For some folks, it might be a helpless old lady. Here’s another story that illustrates one of the two main problems with employee-based security.
For some folks, it might be a helpless old lady. Here’s another story that illustrates one of the two main problems with employee-based security.
Thursday, April 24, 2014
Are Buzzfeed Quizzes Lowering our Defenses?
So I’ve been toying with shutting down my Facebook account again—mainly because it gets on my nerves. The simple act of scrolling through the posts each morning has reached a ratio of 20% pleasurable and 80% grind. One reason? Buzzfeed quizzes.
Oh, Buzzfeed quizzes. Zimbio quizzes. Shudder.
To be fair, I’ve taken my share. The nerd gene in me just has to know what character I most identify with in every Joss Whedon universe. And while I rarely share my results (because that’s pretty annoying), I have started to wonder about some inherent dangers in the culture of quiz taking.
So, I spent a little time on “Internet research” yesterday (read: surfing the web). I wanted to see if I could get any hard, fast evidence that the data in Buzzfeed quizzes were dangerous. Do they harbor malware? Are they used for phishing purposes? Are there records of any data breaches that stemmed from a Buzzfeed quiz?
Not really. Although it would be a pretty clever ruse for social engineers, it appears that the quizzes are fairly harmless. The danger, it seems, lies more in the attitude and culture behind these personality tests. So many of my “friends” (ok, friended acquaintances) rant regularly about the dangers of Facebook privacy settings. They have a real “Big Brother is watching” or “Everyone is out to get my personal information” complex. But these folks may be very the same ones who will readily answer personal question after personal question in a Buzzfeed quiz and then share the answers with anyone who scrolls past their profile.
Jordan Shapiro hit the nail on the head for me in an article this past January.
“Why is it that when it comes to novelty quizzes, we enjoy being analyzed by simple algorithms that divide and reduce us into a limited number of determinate categories, but when it comes to Google and the NSA we’re terrified of the same thing?”
Personal information is personal information, whether is stolen from us by a social engineer, secretly gathered by the NSA, or voluntarily offered through an online personality quiz.
We seem to have developed an almost desperate need to share our opinions or facts about ourselves in an effort to identify with a larger group of like-minded people. Go ahead and admit it. You feel good when your poll answer is the most popular. The appeal of belonging has made many of us irresponsible—and irresponsible Internet users can be easily lured out of their comfort zones and into a trap.
While the danger may not come directly from an online quiz, click-happy Internet users are bound to slip up in other areas. And the more comfortable we become with oversharing, the more likely we are to find ourselves victims of social engineering scams or identity theft.
“Well, but…what difference does it make?” you say. “It’s not like they’re asking for my social security number. The results are all made up.” OK, that’s true. There is no proven rubric designed to accurately determine which superpower you should have, or whether or not you would in fact die of dysentery on the Oregon Trail. Yet, that does not mean the questions have no value to someone.
“We brush them off as ‘merely entertainment,’ forgetting that by participating–through the act clicking–we’ve once again provided Google with a plethora of personality data that is forever stored in our file,” says Shapiro.
In fact, some limited evidence suggests that quiz and Internet poll builders may be inserting more probing questions into harmless entertainment quizzes to get an idea of who you are, how you behave, or even what you might choose to buy. Lee Munson at BH Consulting gave his take on it in this week's Security Watch blog on oversharing.
“…in a few instances the polls can pose some more serious questions…sometimes some of the sneakier sites on the web will even make completion of the poll mandatory in order to proceed onto your ultimate aim of, say, reading a particular news story. Such polls may not demand your name and address but they do drift roughly into areas of personally identifiable information.”
He also offered a bit of sound advice.
“If you share information you need to be alert. Even if you are divulging personal information within an environment in which you feel safe, you need to be certain that the audience is the one you expect. I myself have a few friends who have completed polls on Facebook only to later discover that they actually handed all that info to a third party unawares.”
It may be time to find new ways to entertain ourselves rather than buying in to a culture of irresponsible clicking and mindless answering. While I may never know which Twin Peaks character I am or how well I know the movie ‘Clueless,” at least no one else will either.
More about Information Security
Oh, Buzzfeed quizzes. Zimbio quizzes. Shudder.To be fair, I’ve taken my share. The nerd gene in me just has to know what character I most identify with in every Joss Whedon universe. And while I rarely share my results (because that’s pretty annoying), I have started to wonder about some inherent dangers in the culture of quiz taking.
So, I spent a little time on “Internet research” yesterday (read: surfing the web). I wanted to see if I could get any hard, fast evidence that the data in Buzzfeed quizzes were dangerous. Do they harbor malware? Are they used for phishing purposes? Are there records of any data breaches that stemmed from a Buzzfeed quiz?
Not really. Although it would be a pretty clever ruse for social engineers, it appears that the quizzes are fairly harmless. The danger, it seems, lies more in the attitude and culture behind these personality tests. So many of my “friends” (ok, friended acquaintances) rant regularly about the dangers of Facebook privacy settings. They have a real “Big Brother is watching” or “Everyone is out to get my personal information” complex. But these folks may be very the same ones who will readily answer personal question after personal question in a Buzzfeed quiz and then share the answers with anyone who scrolls past their profile.
Jordan Shapiro hit the nail on the head for me in an article this past January.
“Why is it that when it comes to novelty quizzes, we enjoy being analyzed by simple algorithms that divide and reduce us into a limited number of determinate categories, but when it comes to Google and the NSA we’re terrified of the same thing?”
Personal information is personal information, whether is stolen from us by a social engineer, secretly gathered by the NSA, or voluntarily offered through an online personality quiz.
We seem to have developed an almost desperate need to share our opinions or facts about ourselves in an effort to identify with a larger group of like-minded people. Go ahead and admit it. You feel good when your poll answer is the most popular. The appeal of belonging has made many of us irresponsible—and irresponsible Internet users can be easily lured out of their comfort zones and into a trap.
While the danger may not come directly from an online quiz, click-happy Internet users are bound to slip up in other areas. And the more comfortable we become with oversharing, the more likely we are to find ourselves victims of social engineering scams or identity theft.
“Well, but…what difference does it make?” you say. “It’s not like they’re asking for my social security number. The results are all made up.” OK, that’s true. There is no proven rubric designed to accurately determine which superpower you should have, or whether or not you would in fact die of dysentery on the Oregon Trail. Yet, that does not mean the questions have no value to someone.
“We brush them off as ‘merely entertainment,’ forgetting that by participating–through the act clicking–we’ve once again provided Google with a plethora of personality data that is forever stored in our file,” says Shapiro.
In fact, some limited evidence suggests that quiz and Internet poll builders may be inserting more probing questions into harmless entertainment quizzes to get an idea of who you are, how you behave, or even what you might choose to buy. Lee Munson at BH Consulting gave his take on it in this week's Security Watch blog on oversharing.
“…in a few instances the polls can pose some more serious questions…sometimes some of the sneakier sites on the web will even make completion of the poll mandatory in order to proceed onto your ultimate aim of, say, reading a particular news story. Such polls may not demand your name and address but they do drift roughly into areas of personally identifiable information.”
He also offered a bit of sound advice.
“If you share information you need to be alert. Even if you are divulging personal information within an environment in which you feel safe, you need to be certain that the audience is the one you expect. I myself have a few friends who have completed polls on Facebook only to later discover that they actually handed all that info to a third party unawares.”
It may be time to find new ways to entertain ourselves rather than buying in to a culture of irresponsible clicking and mindless answering. While I may never know which Twin Peaks character I am or how well I know the movie ‘Clueless,” at least no one else will either.
More about Information Security
Wednesday, April 16, 2014
New "Smishing" Scam has Tampa Bay banks on alert
Just last week, several Tampa Bay area banks reported a new “smishing” scam (SMS phishing, or phishing texts sent to mobile devices) in which mobile users are informed by “bank personnel” that their debit card has been flagged. The text then encourages mobile users to contact a fraudulent number and provide personal financial information.Phishing through text messages are further proof that attacks continue to come from every angle at once, and are getting more and more clever.
Why is it so hard to practice safe surfing on a mobile device? Why do otherwise intelligent Internet users take actions on their phones that they would never take on a home desktop or laptop computer?
Thursday, April 10, 2014
More Hooks in the Water: Spearphishing Up 91%
This just in from Symantec: spearphishing increased 91% in 2013.
Here’s why: it still works. Even though security awareness training and a constant stream of worrisome new stories may be improving the average employee’s click-through rate in run-of-the-mill phishing emails, social engineers still know just how to pinpoint the areas that will lower even a seasoned email user’s defenses. That’s just what spearphishing is: targeted attacks that are hand-crafted to startle or scare an employee into making a bad decision—usually clicking an embedded link that routes to a fraudulent website prepared to collect personal information.
According to Symantec, two of the most common words in last year’s string of emails were “order” and “payment.” In our experience, words like “benefits,” “payroll,” “cancelled,” and “dropped” also do the trick.
Here’s why: it still works. Even though security awareness training and a constant stream of worrisome new stories may be improving the average employee’s click-through rate in run-of-the-mill phishing emails, social engineers still know just how to pinpoint the areas that will lower even a seasoned email user’s defenses. That’s just what spearphishing is: targeted attacks that are hand-crafted to startle or scare an employee into making a bad decision—usually clicking an embedded link that routes to a fraudulent website prepared to collect personal information.
According to Symantec, two of the most common words in last year’s string of emails were “order” and “payment.” In our experience, words like “benefits,” “payroll,” “cancelled,” and “dropped” also do the trick.
Tuesday, April 1, 2014
Why April Fool's Day is NOT the Most Dangerous Day on the Internet
Ah, April Fool’s Day. A day of too-good-to-be true deals, too awful-to-be-true news stories, and more fake pregnancies in my social media stream than I care to shake a stick at.
It’s the one day of the year that I avoid Facebook like the plague.
It’s not that I don’t appreciate a good joke. I mean, I love a good food-that-looks-like-another-food joke (mashed potato cupcakes, anyone?). But on the Internet, April Fool’s feels different. To me, it’s symptomatic of a bigger problem: folks are still not skeptical enough—and every April Fool’s Day reminds me of this fact.
Watching people “fall for it” over and over again—reposting “Baby Born with Three Heads!” or signing up for any website that promises a free iPad—upsets me. And not just because it makes them look dumb.
Of course, as Caitlin Dewey mentions in this Washington Post article, most of the stuff on Facebook or Twitter that people compulsively repost or retweet is harmless. No, Denzel Washington did not die from a heart attack. And no, they have still not found that Malaysian airplane.
Sigh.
But, here’s the kicker: “On the Internet, every day is April Fool’s Day,” and everything out there is not harmless. Our need for a wary eye should not be limited to one day a year, and every web user needs to develop a habit of checking before we click suspicious links or view suspicious pages.
For example, “a number of Web sites that propagate fake stories — including Mediamass or the dubious News-Hound.org profit from display ads when their frauds go viral. Others redirect to phishing sites that attempt to draw out the gullible clicker’s e-mail address and personal information,” says Dewey.
Also, according to this recent list of the seven security trends that may affect your business, 1) phishing is only going to get worse and 2) social media spreads malware very effectively.
So please, on this day of fake engagement posts and “I won the lottery!” jokes, let me make an appeal. Treat every day on the Internet like April Fool’s Day. Ignore strange requests or commands for action or promises of reward on social media sites. Be skeptical of all emails—especially those with embedded links. Slow down, take a deep breath, and think about what you are doing before you mindlessly click, forward, repost, retweet, or otherwise spread potential malware.
Oh, and an added bonus? Your friends will thank you.
More About Social Media
It’s the one day of the year that I avoid Facebook like the plague.
It’s not that I don’t appreciate a good joke. I mean, I love a good food-that-looks-like-another-food joke (mashed potato cupcakes, anyone?). But on the Internet, April Fool’s feels different. To me, it’s symptomatic of a bigger problem: folks are still not skeptical enough—and every April Fool’s Day reminds me of this fact.
Watching people “fall for it” over and over again—reposting “Baby Born with Three Heads!” or signing up for any website that promises a free iPad—upsets me. And not just because it makes them look dumb.
Of course, as Caitlin Dewey mentions in this Washington Post article, most of the stuff on Facebook or Twitter that people compulsively repost or retweet is harmless. No, Denzel Washington did not die from a heart attack. And no, they have still not found that Malaysian airplane.
Sigh.
But, here’s the kicker: “On the Internet, every day is April Fool’s Day,” and everything out there is not harmless. Our need for a wary eye should not be limited to one day a year, and every web user needs to develop a habit of checking before we click suspicious links or view suspicious pages.
For example, “a number of Web sites that propagate fake stories — including Mediamass or the dubious News-Hound.org profit from display ads when their frauds go viral. Others redirect to phishing sites that attempt to draw out the gullible clicker’s e-mail address and personal information,” says Dewey.
Also, according to this recent list of the seven security trends that may affect your business, 1) phishing is only going to get worse and 2) social media spreads malware very effectively.
So please, on this day of fake engagement posts and “I won the lottery!” jokes, let me make an appeal. Treat every day on the Internet like April Fool’s Day. Ignore strange requests or commands for action or promises of reward on social media sites. Be skeptical of all emails—especially those with embedded links. Slow down, take a deep breath, and think about what you are doing before you mindlessly click, forward, repost, retweet, or otherwise spread potential malware.
Oh, and an added bonus? Your friends will thank you.
More About Social Media
Subscribe to:
Posts (Atom)