{"id":78098,"date":"2018-01-10T09:00:03","date_gmt":"2018-01-10T17:00:03","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=78098"},"modified":"2023-08-10T14:11:54","modified_gmt":"2023-08-10T21:11:54","slug":"how-to-disrupt-attacks-caused-by-social-engineering","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/10\/how-to-disrupt-attacks-caused-by-social-engineering\/","title":{"rendered":"How to disrupt attacks caused by social engineering"},"content":{"rendered":"

This post is authored by Milad Aslaner, Senior Program Manager, Windows & Devices Group.\u00a0<\/em><\/p>\n

A decade ago, most cyber-attacks started with a piece of malware or a complex method to directly attack the infrastructure of a company. But this picture has changed and today all it takes is a sophisticated e-mail phishing for an identity.<\/p>\n

\"\"<\/p>\n

Figure 1: Trying to identify a loophole in the complex infrastructure<\/em><\/p>\n

Digitalization is happening and there is no way around it. It\u2019s a necessity for all industries and a natural evolutionary step in society. It\u2019s not about when or if digital transformation is happening, but how. Our Microsoft security approach is targeted to enable a secure digital transformation. We achieve that by enabling our customers to protect, detect and respond to cybercrime.<\/p>\n

The art of social engineering is nothing new itself and was already present in the age where broadband connections didn\u2019t even exist. At that time, we used to call these kinds of threat actors not hackers but con men. Frank Abagnale, Senior Consultant at Abagnale & Associates once said \u201cIn the old days, a con man would be good looking, suave, well dressed, well-spoken and presented themselves really well. Those days are gone because it’s not necessary. The people committing these crimes are doing them from hundreds of miles away.\u201d<\/p>\n

Threat actor groups such as STRONTIUM are nothing else than a group of modern con men. They follow the same approach as traditional con men, but they do it in the digital world. They prefer this approach because it has become easier to send a sophisticated phishing email than to find a new loophole or vulnerability allowing them to access critical infrastructure directly.<\/p>\n

\"\"<\/p>\n

Figure 2: Example of a STRONTIUM phishing email<\/em><\/p>\n

Keith A. Rhodes, Chief Technologist at the U.S. General Account Office says, \u201cThere’s always the technical way to break into a network but sometimes it’s easier to go through the people in the company. You just fool them into giving up their own security.”<\/p>\n

According to the Verizon data breach investigation report from 2016, 30 percent of phishing emails were opened. It took a recipient an average of only 40 seconds to open the email and an additional 45 seconds to also open the malicious attachment. 89 percent of all phishing emails were sent by organized crime syndicates and 9 percent by state-sponsored threat actors.<\/p>\n

\"\"<\/p>\n

Figure 3: Verizon Data Breach Report 2016<\/em><\/p>\n

The weakest link remains the human. But while some could argue and say the user is to blame, the reality is that many of the targeted phishing emails are so sophisticated that it is impossible for the average user to notice the difference between a malicious and a legitimate email.<\/p>\n

\"\"<\/p>\n

Figure 4: Example phishing emails that look legitimate at first look<\/em><\/p>\n

Preparing a phishing email can take only a few minutes. First, the threat actors crawl social and professional networks and find as much personal information about the victim as possible. This could include organizational charts, sample corporate documents, common email headlines, pictures of the employee badge and more. There are professional tools available that pull much of this information from public or leaked databases. In fact, if needed, the threat actor can purchase the information from the dark web. For example, one million compromised email and passwords can be traded for approximately $25, bank account logins can be traded for $1 per account, and social security numbers cost approximately $3, including birth date verification. Second, the threat actor prepares an e-mail template that will look familiar to the recipient, such as for example a password reset email, and lastly, they will send it to the user.<\/p>\n

Social engineering has become a very powerful way for many threat actors and depending on the objective of the threat actors they either leverage computer-based, mobile-based, or human-based social engineering.<\/p>\n

\"\"<\/p>\n

Figure 5: Stages of a phishing attack<\/em><\/p>\n