Social Engineering Attacks: Not Just for Kids
Back in the day when MySpace was first introduced, many worried about who would protect the kids from online con artists and criminals. Maybe we should be asking ourselves who will protect the adults. In recent months, scammers have targeted Facebook, Bebo, Twitter, and now LinkedIn. While there's currently no indication that any oldsters are really falling for the fake celebrity profiles posted on LinkedIn, there is ample indication that the over 30 crowd was easy bait in the Facebook and Twitter attacks.
At the Vegas BlackHat conference in August '08, researchers Shawn Moyer and Nathan Hamiel presented "Satan is On My Friends List: Attacking Social Networks". Part of that demonstration focused on how trivially easy it was to spoof the profiles of well known people in the security industry. The point is, there's no real way (save offline verification) to ensure that the person on the other end of the 'wire' is really the person you think they are. The problem gets exponentially worse when dealing with promiscuous frienders. And we all know some of them - the contacts who will accept any friend request, even from persons they only vaguely know and often from complete strangers.
Social networking sites can be a useful tool for keeping abreast of events in friends, family, or colleagues lives, whether personally or professionally. It can also be a useful tool for networking with associates met at business conferences or with whom you otherwise don't have day-to-day contact. But to be used safely, any correspondence sent via the network should be treated as cautiously as any traditional email would - don't click links in any unsolicited message received unexpectedly and never agree to install anything resulting from a link receiving in an unsolicited message.
The social networking sites are designed to make it easy to network. This ease means it's equally easy for scammers to setup shop. Don't assume that because it happens on a social networking site, that it must be safe. Quite the opposite is true. Offline, trust your real life friends to have your back. But online, trust no one.
Mary Landesman
Reader Comments (1)
I wish some other term was used instead of 'social engineering', since it's really 'people manipulation.
It doesn't help me in my work trying to encourage sales engineers