Blog

The following article is being published on our Blog with the permission of Mr. Peter Warmka whom we are most grateful to. What you are about to read in the following article is rather astonishing considering how complex yet how easy it was to accomplish. 01 September 2018 by Peter Warmka, CPP Peter Warmka, CPP, is director of business intelligence for Strategic Risk Management and an adjunct professor for Webster University’s cybersecurity masters program. He is a frequent speaker on social engineering threats at conferences for trade associations and wealth management advisory firms. Warmka is a member of ASIS International. Chief financial officer Malcolm Fisher never thought he would be victimized by cybercrime—until a social engineer successfully impersonated him and bilked his company out of more than $125,000. It was relatively easy for the criminal to identify Fisher as a high-value target given his crucial position within the company—his bio was readily available on the company website. And Fisher’s social media profiles on Facebook, Twitter, and LinkedIn revealed several bits of information that marked him as a dream target for a diligent social engineer. Fisher frequently participated in poker tournaments and was not modest in describing his success at the table. He posted about attending an upcoming tournament in Las Vegas and cataloged his travel plans across social media platforms. Shortly after his arrival to Las Vegas, Fisher received a text message from what appeared to be the tournament organizer providing a link to the updated schedule. When he clicked on the link, nothing seemed to happen—but he had just unwittingly provided the social engineer with entry into his company-issued mobile device. Knowing that the tournament started at 11 the next morning, the fraudster hijacked Fisher’s email account and sent an urgent message at 11:15 a.m. to a colleague. The email—supposedly written by Fisher—instructed the employee to immediately wire $125,000 to a vendor, noting that he would be out of touch for several hours because he was attending the tournament. The employee, never questioning his boss’s instructions, immediately processed the wire transfer. While Fisher left Las Vegas very pleased with his tournament winnings, he soon learned that he was the one who got played. This scenario is not unusual. With more focus than ever on enterprise cybersecurity and preventing data breaches, many executives believe that technology alone provides sufficient protection against such threats. But sophisticated threat actors—whether they be nation states, criminals, activists, or disloyal competitors—will frequently target the most significant vulnerability found in most organizations: the human factor. The interaction between human beings and the technology meant to protect the organization is commonly referred to as the weakest link in security. The most common method used by these threat actors to exploit the human factor vulnerability is social engineering. In fact, according to the 2018 Verizon Data Breach Investigations Report, more than 90 percent of successful security breaches start with some aspect of social engineering. Social engineering is the skillful manipulation of organizational insiders to undertake certain actions of interest to the social engineer. Insiders are not only employees of the organization—they include anyone who may have unescorted access into a target organization, including service providers such as the guard force, cleaning crews, catering companies, vending machine stockers, maintenance contractors, and more. Greater awareness and insight into this process provides a better opportunity to mitigate the risk of social engineering attacks. COLLECTING THE DATA Prior to launching any type of attack against the target, a professional social engineer will spend time collecting available open source information. While such collection may be from a variety of resources, the most frequent medium is simple online research. Almost every organization has a website with information about the company, its products and services, executive profiles, press releases, contact information, and career opportunities. While all such sections may provide useful information to a social engineer, executive profiles—which often contain full names, titles, pictures, and a brief biographic sketch—provide considerable insight into key insiders and where they fit into the organizational structure. Career opportunities, along with company contact information, provide exploitable details and a portal through which a social engineer may seek direct or indirect contact with the organization. Job postings and reviews. Whether posted on the organization’s website or advertised on online job boards, job postings can provide a wealth of information. At a bare minimum, such postings will usually reveal the basic preferred IT qualifications sought from an applicant, providing valuable insight into the operating systems and software programs the organization uses. The job description might also provide insight concerning potential expansion of the organization, whether it be geographically or through a new product or service. With a job posting, an organization is inviting contact with someone from the outside. It provides social engineers an opportunity to electronically submit a cover letter or resume—either directly through human resources or to someone else within the organization chosen by the social engineer to forward the resume onward. The email, along with attachments, can be a medium to introduce malware into the target’s system. While less frequently exploited, such job postings can also create opportunities for social engineers to interview with the employer and elicit sensitive information. Employer review sites such as Glassdoor can provide useful workplace insights posted by employees. These reviews inform the social engineer about the pulse regarding the morale within the organization. Generally, it is much easier to manipulate a disgruntled employee than someone who is happy and loyal to his or her employer. SOCIAL MEDIA AND SEARCH ENGINES While an organization may aggressively use social media to help promote their products and services, an unintended consequence can be the leakage of exploitable information. Employees often upload photographs of themselves and coworkers in the workplace, revealing information about physical workspaces to include actual floor plans, office configurations, security system hardware, IT systems, employee badges, or employee dress. Much of this information can be extremely useful if planning an actual physical intrusion into the company. Creative Google searches will take the social

Often, people seeking the services of a Private Investigator have a misconception about what to expect when meeting with a Private Investigator. Some folks conjured up images of Magnum PI, Columbo or Monk as they begin their search for a Private Investigator to help them with their issue. However, in today’s day and age private investigators come in all shapes and seldom resemble Private Investigators on TV. You might ask how does someone become a Private Investigator? Do they attend a specific college or university? Are they retired law enforcement officers? For the most part, the majority of Private Investigators are retired law enforcement officers who rapidly learn the investigative tools once available to them while they were active law enforcement officers are no longer at their disposal. For many that represents too much to overcome and some give up and live off their pensions while others flourish after learning how to maneuver as a civilian investigator. Retired law enforcement officers also have to acclimate to the fact that they no longer have the authority to serve warrants, knock down doors or enter a private residence without permission. The days of breaking into a suspect’s home, planting a listening device, tapping a suspect ’s phone or installing a hidden camera is unlawful. Even attaching a GPS tracking device on a suspect’s vehicle is illegal. Nearly all states in the USA require Private Investigators to pass a written examination and a background investigation to acquire a Private Investigator’s license. No investigative assignment is like any other. The objective of an assignment might be the same such as an infidelity investigation. However, to achieve the investigative goal inevitably encompasses its own set of unique challenges. It is when the private investigator personally experiences those challenges over time and learns how to overcome them is when the private investigator attains the status of a top notch PI. Some fortunate folks become Private Investigators when a highly regarded old school private investigator takes them under his wing as an intern and teaches them the ins and outs of being a top notch Private Investigator. However, if the intern does not have an innate intuition, keen observation skills or is unable to read whether a subject or witness is being truthful then he pretty much needs to find another profession. Conversely, should the intern possess the skills mentioned above they must understand that they are entering a profession with hundreds of thousands of competitors throughout America and around the world. The private investigator must also learn how to market themselves to be found by potential clients. The majority of potential clients are; business people, married couples, parents, law firms and insurance companies seeking to know whether a claim is fraudulent. Many investigative assignments pertain to criminal cases and predicated upon a Private Investigator’s conscience will dictate if they will take on a case when they know a defendant is guilty. Integrity, professionalism and caring about a client’s concerns are what makes some Private Investigators stand out among all the others.