MOBILE BASED SOCIAL ENGINEERING

Mobile based Attacks:

SMS based: Sending a fake SMS saying that the user has won a bounty, urging him/her to register with confidential information or try and collect other important details.
Through Malicious Apps: Applications downloaded from third party sources may be malicious; they can access authentication information and other sensitive details.
Through Email and messengers: Attackers can send spam emails or malicious links through messenger applications. When the victim clicks on it- he may be redirected to a malicious site, or a malware could be downloaded or it may lead to some other malicious activity.

Social engineering on corporate side:

Find an insider: It can be a disgruntled employee who may be the target.
Develop relationship: Develop a friendship with this person and maintain this relationship to the point he trusts you.
Exploit the relationship: Extract the information about the company and other sensitive information exploiting the trust that he placed in you.

Insider Attacks:

An insider attack is very difficult to detect. If a disgruntled employee wants to take revenge; he can install malicious applications to steal/modify information, causing significant damage to the organization or he can be bribed by the competitor to reveal or steal company secrets, intellectual property information, etc.

Countermeasures:

  • Educating the employees about the security policies and frameworks, best practices, etc.
  • Creating awareness among the users and employees about social engineering attacks.
  • Enforcing strict perimeter policy, authentication mechanisms.
  • Coming up with effective security policies.
  • Enforcing proper access privileges.
  • Classifying information and protecting access to them.
  • Using Updated antivirus, anti-phishing tools.
  • Monitoring and auditing.

PREVIOUS                                                                                                            NEXT

Comments