Social Engineering Series

Jun 21

0

Introducing the Social Engineering Series

By | Social Engineering Series | No Comments

OVERVIEW

Social Engineering is the exploitation of people by manipulating them to divulge their personal information. The social engineer will make it seem as if they are one of your trusted contacts or like they are a part of a service provider company to get you to disclose private passwords, social security, medical history, etc.The hacker takes advantage of this scam to infiltrate your network and gain financial compensation. It is very important that you educate yourself on online security and how to avoid this happening to you.

Over the next few months we will be exploring different types of social engineering in a multi-part series.

Jun 22

0

SMiShing

By | Social Engineering Series | No Comments

SMiShing (short for SMS Phishing) is a type of social engineering scam that involves getting a text message from a false sender. The attacker will typically pretend to be a reputable source (such as your bank or PayPal), or claim that you have won a special prize and urge you to take action. Additionally, these texts are often sent with harmful links that spread malware to your device or steal your personal information. Read on to review the most common types of SMiShing scams and suggested tips to help you avoid this increasingly common fraud.

The video below gives more information about this recent crisis:

The Four Most Common SMiShing Scams

1. Bank Scams
A text message appearing to be from your bank that informs you of possible fraudulent activity or an account suspension. The message may urge you to click a link, provide your account number or to confirm personal information.

2. Toll Call Scams
The cyber criminal will text you to request that you call a provided phone number. However, that call may actually be charging you per minute and often times will purposefully keep you on hold so as to charge you more.

3. Malware Scams
The cyber criminal may text you a malicious link that if clicked, can install malware on your device that can make it possible for them to steal your personal information and account login credentials.

4. Service Cancellation Scams
The cyber criminal will text you saying that you’ve signed up for an unrequested service, but that you can cancel by clicking a provided link, which may make your personal information vulnerable.

6 Tips to Avoid SMiShing

1. Research
Research before you respond to a text that claims to be from a source that needs your information or for you to clink a link.

2. Nothing is ever free
When being told that you earned a “free trip”, “prize money”, etc. it is most likely a gimmick to entice you to divulge your personal information or release malware into your phone.

3. Do not reply if being asked about your personal information or finances
If you are asked to provide any personal or financial account information, this should be an automatic red flag. Your bank or other service provider will never text you for this type of information.

4. Avoid messages that contain “5000”
Lookout for messages that contain “5000” or display a number that is not an actual 10 digit phone number because this is a tactic often utilized by scammers to hide their identity and become untraceable.

5. Enable “block texts from the internet”
Your cell phone provider might offer a feature that will allow you to avoid spam text messages that have originated via the internet or an email address (not from another device).

6. Report SMiShing attacks to the Federal Communications Commission (FCC).
The FCC is committed to protecting consumers from unwanted telemarketing calls and text messages, and works closely with industry representatives to give consumers more control over the calls and texts they receive. You may also file a complaint with the FCC if you believe that you’ve received an illegal call or text.

How can iLOCK360 Help?

Did you know that your iLOCK360 membership can help alert you if your phone number may have been compromised?

iLOCK360’s proprietary CyberAlert can help you monitor your identity 24/7/365 for possible compromise on the Dark Web (i.e. the Internet’s black market). Available monitored elements include: Bank Accounts, Credit/Debit Cards, Email Addresses, Phone Numbers, Medical ID Numbers, Social Security Number, Driver’s License and Passport.

Want to know if your phone number may have been compromised by a cybercriminal on the Dark Web? Be sure to login to your iLOCK360 account to setup this feature today.

Jun 15

1

Vishing

By | Social Engineering Series | No Comments

Vishing is a term used to describe voice solicitation, a method using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The goal of this type of manipulation is driven by the hacker’s desire for monetary gain since any information they may obtain about you can be used maliciously to gain access to your accounts, rack up debt, open new accounts in your name or sell your identity for a profit.

Watch this video to understand more about how vishing is done:

So, how does Vishing even happen?

There are three ways that Vishing typically occurs:

1. The hacker may personally call you and pose as a trusted individual or service provider (i.e. a help desk, customer service, and/or tech support) urging you to take action on an issue or requesting more personal information from you. The most common vishing attempts appear as if you are being contacted by your bank, a government organization (such as the IRS), law enforcement, cell phone provider, or to help you collect the winnings of a prize/contest.

2. The hacker may pose as you by “spoofing,” or forging your number to look like they are making a call that is coming from you. They will use this convincing trick to call an individual or service provider and manipulate them into providing sensitive information about you/your account to the hacker – this could compromise your identity, bank accounts, credit cards, etc..

3. The hacker may spoof their number to appear like they are calling from the local area in which you live. This neighborhood vishing attempt relies on many people’s tendencies to answer a number if it appears that it could be from an old friend or someone they may know.

Vishing is affecting more and more people everyday and is gaining popularity among hackers as a preferred type of social engineering.

5 Tips to Protect Yourself from Vishing

1. Watch out for phone calls and text messages
Exercise caution when answering the phone, especially when not expecting a call. This also goes for text messages and voicemails. Hackers will sometimes try to infiltrate your phone by leaving threatening messages by text or voicemail. They may claim to be your service provider and ask for you to call or text them back requesting that they need you to verify personal information in your account. Keep in mind that banks will NEVER ask you for your personal pin, passwords, bank numbers or other info. Similarly, the IRS will never call you demanding payment on taxes owed without first having mailed you a bill. Hackers will try to call and pretend that they are calling from credit cards, banking, or phone service providers, etc.

2. Initiate the Call
If you receive a phone call from a service provider that seems a little phishy, don’t feel obligated to engage in conversation. Instead, hang up and do a search for the company’s official number (not the number you were called from). Use the publicly noted contact information either on the company’s website, an account statement or on the back of your card.

3. Register your phone with National Do Not Call registry
Consider registering your number on the National Do Not Call List to make it harder for you to be a victim of unwanted calls. You can also report unwanted calls on this site. https://www.donotcall.gov/

4. “My Password Was Changed?”
Be aware of password change notifications that you may receive for your accounts and also keep an eye on your account statements. Make sure that you do not reuse the same password across accounts and that you create passwords that are not easily guessed.

Aug 03

0

Pharming

By | Social Engineering Series | No Comments

Pharming is a type of online fraud intended to redirect a website’s traffic to a fake site with the purpose of gaining access to personal information that can be used in online identity theft. This scam can be so convincing that even what may appear to be a real website address can be “poisoned.” Once the user enters personal information such as their credit card or email address, this is where the real problems can occur.

Continue reading below for more information on the different types of Pharming as well as tips to protect yourself while browsing online.

2 Types of Pharming

Malware-Based Pharming

Attackers can take advantage of a user by installing malware on their device that will redirect the user to a bogus website. The site will be made to look identical to a legitimate website, but may have a slight variation to the address (i.e. www.Amazn.com). When the user enters in their personal information such as credit cards or email addresses they can be made vulnerable to identity theft.

Website Takeover

Another type of Pharming is when the hacker gains access to a legitimate site by exploitation of a vulnerability in the DNS server software. DNS servers are computers responsible for resolving Internet names into their real addresses. With this compromise, the hacker can then divert website traffic from a real website to a different IP address. In this case, the visitor would have a very difficult time identifying that they have even been redirected from the intended website.

Precautions to Avoid Pharming

1. Use Antivirus Software. By making sure that you have an antivirus program on your computer it can help decrease your chances of being exposed to scams caused by malware.

2. Check for Spelling. The spelling of a website address can inform you if it is a fraudulent one. Bogus websites often times contain typos and misspellings throughout not only the website address, but also throughout the content on the page.

3. Check the URL. Make sure that the URL that you are visiting is the one that you intend to use. Be sure that there are no additional characters in the URL that do not look familiar.

4. Check the ‘HTTP’ address. Verify that the website you are visiting uses “https” at the beginning of the address. The extra ‘s’ means ‘secure’.

5. Look for Padlock. If there is a padlock icon before the https, that means that the website is secured. However, if there is an unlocked padlock and a broken key this means that the site is not secure.

How Can iLOCK360 Help?

Did you know that your iLOCK360 membership can help alert you if your personal information may have been sold in online identity theft forums?

iLOCK360’s proprietary CyberAlert can help you monitor your identity 24/7/365 for possible compromise on the Dark Web (i.e. the Internet’s black market). Available monitored elements include: Bank Accounts, Credit/Debit Cards, Email Addresses, Phone Numbers, Medical ID Numbers, Social Security Number, Driver’s License and Passport.

Want to know if your information may have been compromised by a cybercriminal on the Dark Web? Be sure to log into your iLOCK360 account to setup this feature today.

Aug 22

0

Baiting

By | Social Engineering Series | No Comments

Baiting is a type of cyber attack that involves use of a physical object. The hacker places a type of electronic storage media (such as a USB, CD, or external hard drive) near the victim in hopes that they can play off the victim’s curiosity. The victim may be eager to reveal see what’s inside and connects the object to their computer to get a closer look – but, this is where the real problem occurs. Once this object is connected, dangerous malware can be spread to infect the victim’s computer and steal important personal data that is stored on the computer. This stolen information can be used either to personally benefit the hacker, or sold for a profit on the Dark Web.

Continue reading below for more information on the different types of Baiting as well as tips for how you can protect yourself.

Top 3 Ways Hackers Bait the Victim

A Provocative Title
Many times the social engineer will label the device with a provocative title that is meant to tempt the victim to view the contents. Common titles may be “2018 employee payroll” or “2018 Executive Bonuses.” The note is created to provoke your curiosity and encourage you to download or open up the contents that are supposedly inside.

No Owner In Sight
The hacker will purposely place the object in the view of the victim and make it seem like it is an easy steal. This gives the victim the impression that they can get away with opening what is inside with unlikely repercussions.

Human Resources
Another way that the hacker is able to still infiltrate is through HR. If the employee finds the suspicious device and believes that it’s supposed rightful place is in HR, then this can set off a chain reaction if the device is opened up and malware is spread. Data breaches often occur in this way, when someone in an organization opens an unknown device to see what its contents were (or to help identify the rightful owner) only to discover that it is a virus with malware that could endanger the company.

Precautions to Avoid Pharming

1. Do not grab anything that isn’t yours. This might go without saying, but by making sure that you do not accidentally (or on purpose) grab a device that isn’t yours, you are decreasing your chances of getting baited and having your critical personal information exposed.

2. Notify Human Resources. When turning a suspicious device over to HR (or another department in your organization), be a good citizen by reminding them that if they are not familiar with the device it could possibly contain malware.

3. Keep Your Workspace Clean. By making sure that your workspace is always picked up and organized, it can make it easier to spot an item that does not belong, and maybe even become a culprit for destruction.

4. Tell Security. Notify security and your fellow employees of the suspicious device as there is high likelihood that additional devices were deposited across the workplace.

How Can iLOCK360 Help?

Did you know that your iLOCK360 membership can help alert you if your personal information may have been bought or sold by hackers online?

iLOCK360’s proprietary CyberAlert can help you monitor your identity 24/7/365 for possible compromise on the Dark Web (i.e. the anonymous online marketplace where illicit activities occur). If your monitored information is found bought or sold online you will be automatically alerted so that action may be taken to address the issue.

CyberAlert’s available monitored features include: Bank Accounts, Credit/Debit Cards, Email Addresses, Phone Numbers, Medical ID Numbers, Social Security Number, Driver’s License and Passport.

Want to know if your information may have been compromised by a cybercriminal on the Dark Web? Be sure to log into your iLOCK360 account to setup this feature today.

The Four Most Common SMiShing Scams

6 Tips to Avoid SMiShing

How can iLOCK360 Help?

So, how does Vishing even happen?

5 Tips to Protect Yourself from Vishing

2 Types of Pharming

Malware-Based Pharming

Website Takeover

Precautions to Avoid Pharming

How Can iLOCK360 Help?

Top 3 Ways Hackers Bait the Victim

Precautions to Avoid Pharming

How Can iLOCK360 Help?

Categories

Recent Posts

Archives

CONTACT

CONNECT

Our Services

Enterprise Services

About Our Company

Our Affiliates

Twitter Feed