Hacking Humans
Info Security Magazine reports on a new phishing attack against users of travel site Booking.com. The report is worth the read and includes details on one disturbing version of the attacks. “In a variation on this Booking.com campaign, it has been reported that an attacker socially-engineered a hotel in Scotland under the guise of a…
Cyber News has an interesting report on social engineering and disaster fraud, from vulnerabilities in ad-hoc supply corporate chains established after a hurricane or earthquake to bogus “Go Fund Me” campaigns. “Worst of all, most victims of such scams will never even realize they were victims in the first place – who gives money charitably…
Read More “A Social Engineering Scam Where Victims Never Realize They’ve Been Taken” »
“’Procrastination is, quite frankly, one of the keys to success for crooks,’ said Paul Fabara, chief risk officer at Visa. ‘They assume that you’re going to fall for that last-minute offer that guarantees delivery of the product within 24 hours, or even the same day, at a discounted price,’ Fabara said.” The interesting report from CNBC…
The FBI and CISA have issued a warning about hacking group Scattered Spider: “Scattered Spider (also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra) engages in data extortion and several other criminal activities.[1] Scattered Spider threat actors are considered experts in social engineering and use multiple social engineering techniques, especially phishing, push bombing, and…
Read More “Feds Sound Alarm Over Social-Engineering Group Accused of MGM and Caesars Attacks” »
“The quarter saw ‘human hacking’ evolve from a long-standing security challenge to threat actors’ method of choice,” the risk advisory firm says in its new report. “This was evidenced by our observations of the dramatic escalation of social engineering tactics, with significant increases in phishing, smishing, valid accounts, voice phishing and other tactics…” Professional services firms were…
Read More ““Social Engineering Takes Center Stage” in Q3/23: Kroll Report” »
We’ve reported on the many ways AI is being harnesses form social engineering attacks. Now Security Intelligence offers an interesting report on hacking the actual AI itself. “’Prompt injection is a type of security vulnerability that can be exploited to control the behavior of a ChatGPT instance,’ Github explained. A prompt injection can be as simple as…
The NSA, FBI and Multi-State Information Sharing and Analysis Center (MS-ISAC) have published a report on “stopping the attack cycle at phase one.” Get it here. “The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint guide…
Read More “Feds Release “Phishing Guidance” — Tips on Preventing Social Engineering Attacks” »
The massive hack of MGM casinos, est. $100m in damages, was caused by a social engineering attack in which a caller to the company’s IT support team tricked them into “resetting” the caller’s password. This prompted the interesting observation from rAVEe Pubs that many younger tech employees rarely talk on the phone and are uncomfortable…
Read More “Social Engineering Risk: Young Employees Who Don’t Like to Talk on the Phone” »
Read the filing here.
Gamers are subject to the same type of social engineer attacks as everyone else. But they may be more vulnerable due to their psychology (IOW, “cybersecurity culture” is an issue in the gaming community). “The gaming industry is ripe for social engineering. Studies show the level of trust which online gamers place in strangers is pretty…
Read More “Gamers: Watch Out for Social Engineering Attacks” »