Hackers Use Social Tricks To Get Bank Passwords

While cyber-attackers can probe websites to find application flaws and network holes, employees at many financial institutions are just as vulnerable to social engineering tricks.

Why hack a website when all it takes is a phone call to get into a customer bank account? That is the question Jim Stickey, CTO of TraceSecurity asks when auditing the security measures in place at banks and credit unions around the country. The audits focus on both physical thefts as well as what Stickey called “virtual thefts”, where thieves use emails and phone calls to get the passwords they need to remotely penetrate sensitive systems.

LinkedIn used to choose targets

TraceSecurity’s auditors employ the mindset of a cyber-criminal to determine what would be targeted, and what techniques would be used, Stickey told eWEEK.

“Most of the time, it’s bank accounts,” Stickey said.

The first step is to identify new employees, Stickey said. Finding out who just started working at the targeted institution, such as a mid-sized credit union or regional bank, is very easy in this day of social networking, as all the attacker has to do is search the targeted institution on LinkedIn.

Once the attacker has a list of employees with a recent start date, the next step is to masquerade as a senior manager.

“New employees are gullible. They don’t want to annoy their managers, so they just do what they are told to do,” Stickey said, adding they are less likely to question suspicious incidents when a superior is involved.

Attackers can call the credit union’s general number directly to find out the name of a manager. The trick works best if the targeted institution is big enough to have multiple branches or offices, because then the attacker can find out the name and phone number of a manager in a different branch, Stickey said.

“New employees are less likely to know what that manager sounds like,” Stickey said.

Phone number spoofing

With the phone number and name of the manager in hand, the attacker calls the employee directly. There are software readily available online that let people spoof their phone numbers. With software, the attacker modifies the caller ID information so that the employee, when looking at the phone display, sees a phone number that matches the pattern the company uses and thinks it’s a legitimate call. Since the employee already thinks the attacker is actually a remote manager, there is already a sense of trust present, Stickey said.

The supposed manager can claim that the branch’s network is down; IT is working on the manager’s computer; or a myriad of other reasonable scenarios as to why the manager can’t login to the network and access a customer account. “Don’t make it a big deal, just mention it and move onto the actual request,” Stickey said.

By asking the employee what account login is being used or reading information to supposedly verify some details, the attacker has obtained sensitive information to compromise the account. The fake manager can also convince the employee to change the password to something else “for security purposes” and then promise to call back after a specified time interval to change the password back, Stickey said.

“That’s 45 minutes for the attacker to do whatever is necessary,” Stickey said. Some attackers may even continue the masquerade by calling back and saying they were done.

New employees don’t want to push back, so it’s important for financial institutions to “empower” them to ask questions and feel comfortable pushing back right from the start, Stickey said. Employees need to hear that it’s okay to tell managers, “No!” or all the rules go out the window, he said.

Pushing back

It’s one thing to teach employees policies, but better to teach them what to do when they are asked to violate policy, especially if it’s by a senior executive or the company president. “The policy might be, ‘Don’t give out privation information over the phone,’ which is good, but the reality is, when the manager asks, you don’t say no,” Stickey said. Employees need to be told to say they can’t do that, and to offer to transfer the call to a senior manager. Attackers will often hang up at this point, since the manager might know the person they are pretending to be and expose the scam.

Another common social engineering tactic relies on email. Many institutions have a corporate directory available on the phone system. Attackers call the phone number late at night to go through the phone directory. Many systems have a quirk where if the caller doesn’t punch in the “first three letters of the person’s name”, it lists all the names matching whatever was entered.

“So press number ‘2’ and wait a few minutes. The system will time out and then give you every name that begins with the letters A, B, and C,” Stickey said.

The attacker can get all the names of the employees relatively fast in this way. The attacker then picks up a free email account from any email provider and sends the employees a spam message. Some companies make this step easy because they publish email addresses online, making it easy to guess what pattern the company follows, whether it’s firstname.lastname, first initial followed by the last name, or some other variation, Stickey said. If the attacker can’t figure it out, then it’s just a matter of entering every possible combination into the message’s BCC field.

Malicious links

While most of the combinations will fail, at least one of the addresses won’t bounce back, Stickey said. With the list of valid email addresses, the attacker can send out messages with links to malicious websites, downloaders or infected attachments to try to compromise at least one user. The malicious links can claim to be e-cards sent by a “secret admirer”, or messages from industry regulators or professional organisations, Stickey said.

Another method is to pretend to be another employee sending an internal email. It’s easy to create domain names that look similar to the legitimate name, such as replacing the o in .com with a 0 to create .C0M, or dropping an i in the company name. At first glance, people will not notice the slightly different domain, Stickey said.

Financial institutions need to restrict Internet usage by employees, Stickey said. Most employees generally need to access a handful of sites, and don’t need to be able to go to so many places on the web during the course of their workday, he said.

“Lock down the sites and 90 percent of the risks go away,” Stickey said. When users can’t go anywhere other than approved sites, the only threat with this kind of social engineering attack is the malicious attachment, and most organisations are “smart enough to strip out the malicious payload”, said Stickey.

Most organisations can afford to do two networks and tell users that if they want to access the general web, they should use the system dedicated for web surfing, Stickey said. The web surfing machines should not have any access to internal systems or sensitive data. It’s similar to how the intelligence and defense industries have a classified and unclassified network, he said.

“The risk is too great that you can’t just let users go anywhere they want,” Stickey said.