all of the good attackers are
very good at impersonation this usually
starts with a pretext
which is simply a lie that sets up the
entire scenario for the particular
attack
there's usually an actor this is usually
the attacker who's trying to gain
access or get information from you and
there's very often
a story i went out to youtube and
transcribed a list of
actual attacks that were used and the
pretext that were used
during the attack itself here's the
first one hello sir my name is wendy and
i'm from microsoft windows
this is an urgent checkup call for your
computer as
we have found several problems with it
obviously they're not calling from
microsoft windows and
wendy is not a representative of
microsoft this is someone who's trying
to either gain access to your computer
to convince you there's something wrong
with it and to pay them to fix it
or to gain access to your computer so
that it can then participate in a botnet
here's another one it's a voicemail
message that says
this is an enforcement action executed
by the u.s
treasury intending your serious
attention
not quite the best grammar but it's
someone who is pretending to be from the
us
treasury and ultimately is trying to get
even more money from you
and lastly congratulations on your
excellent
payment history you now qualify for zero
percent interest rates on
all of your credit card accounts
obviously they want us to then
fill out a financial application which
of course
will have our personal details that i'm
handing right over to the attackers
in each of these situations the attacker
was trying to pretend to be someone they
were not
this was not wendy from microsoft this
was not someone from the us treasury
they were pretending to be from those
organizations this is called
impersonation and if you are someone who
is an attacker
you need to be very good at
impersonating someone else
very often the attacker picks the person
to impersonate
based on some reconnaissance that
they've done of you or your organization
they commonly know your name they know
the organization you work for they know
there's a help desk they might even know
the city and state that the help desk
happens to be in
very often they impersonate as someone
who is higher in rank than you happen to
be
so they're calling from the executive
offices or they're the vice president
in charge of a particular department and
therefore trying to get you to act
quickly based on their particular role
in the organization
it wouldn't be a good help desk
impersonation if you didn't throw around
a lot of technical terms and it's a way
that the attacker can try to confuse the
person who's on the other end of the
phone
and lastly maybe they just act very
friendly that of course they're from
this organization
and they might even mention things that
are occurring in the local area to make
you feel comfortable with who you're
talking to
once the attacker has the victim at ease
they can start extracting information
very easily from that person this is
called eliciting
information from the end user and it's
very often an easy way that the attacker
can get
email addresses passwords or anything
else that makes sense for that
particular attack
this is very commonly done with voice
phishing or vishing where somebody is
performing this attack
over the phone instead of email or text
messages
and of course there are some very common
well-documented psychological methods
that attackers use
to be able to put people at ease and
gather this information from the end
user
very often these attackers are after
your personal information
you may not realize how valuable your
personal details happen to be
identity fraud is a massive problem
around the world
and the attackers know that they can use
your personal details
to be able to perform a lot of different
kinds of attacks in other places
for example they can open up credit card
information or they can use your credit
card information
to be able to make purchases in their
name they might also be able to access
your bank account
and transfer money out of your account
because now they have all of your
personal details
that of course your bank is going to ask
as well to make them prove that you're
you whenever you call into your bank
line
you might often see this extended into
things like loan fraud
where someone opens loans or leases in
your name
because they've effectively become you
they know
everything there is to know about being
you because you provided that identity
to them
using these types of attacks you might
also see your personal information
used in government benefits fraud or tax
fraud
where the attacker is able to get money
sent to them by pretending that they're
you
to be able to avoid these situations you
want to be very protective of your
personal information
and never volunteer anything to anyone
who might be calling you
no one's ever going to ask you for a
password
because that information is not required
to be able to perform technical support
services
you also don't want to give someone
personal details or more information
about you that normally they would not
have and of course it's very useful if
you can
verify the person who's calling you let
me hang up i'll check the number i'll
call you back directly
and will make sure that you are the
person who you say you are
this verification of the people who
might be calling for this information
should be part of your normal processes
especially if you're someone who's in
charge of very important pieces of
information
you want to be sure that you're
communicating with someone who's
legitimate on the other end of the phone
you