Avoiding Social Engineering Attacks

What is a social engineering attack?

In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

What is a phishing attack?

Phishing is a form of social engineering. Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

Phishing attacks may also appear to come from other types of organizations, such as charities. Attackers often take advantage of current events and certain times of the year, such as

• natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)
• epidemics and health scares (e.g., H1N1)
• economic concerns (e.g., IRS scams)
• major political elections
• holidays

How do you avoid being a victim?

• Protect your password.  At KUMC, Information Resources will never ask for your password and you should never share your password with anyone, including your supervisor.   At home, remember that your bank and other companies that you do business with do NOT need your password for any reason.
• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity.
• Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Don't send sensitive information over the Internet before checking a website's security (see Protecting Your Privacy for more information).
• Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).
• If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group.
• Take advantage of any anti-phishing features offered by your email and web browser software.

What do you do if you think you are a victim?

• If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization (call (913) 588-7995 at KUMC). They can be alert for any suspicious or unusual activity.
• If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.
• Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.
• Watch for other signs of identity theft (see Preventing and Responding to Identity Theft for more information).
• Consider reporting the attack to the police, and file a report with the Federal Trade Commission.

This information was adapted from an original production by US-CERT and republished for non-commercial use as outlined in their Privacy & Use policy.

4 Simple Steps to A Clean Machine

 

Awareness is Half the Battle

What To Do If You're "Infected"

How do you know your computer is infected?

Unfortunately, there is no particular way to identify that your computer has been infected with malicious code. Some infections may completely destroy files and shut down your computer, while others may only subtly affect your computer's normal operations. Be aware of any unusual or unexpected behaviors. If you are running anti-virus software, it may alert you that it has found malicious code on your computer. The anti-virus software may be able to clean the malicious code automatically, but if it can't, you will need to take additional steps.

What can you do if you are infected?

Minimize the damage .  If you are at work, contact Information Resources immediately by calling (913) 588-7995. The sooner they can investigate and clean your computer, the less damage to your computer and other computers on the network. If you are on your home computer or a laptop, disconnect your computer from the internet. By removing the internet connection, you prevent an attacker or virus from being able to access your computer and perform tasks such as locating personal data, manipulating or deleting files, or using your computer to attack other computers.

Remove the malicious code.  If you have anti-virus software installed on your computer, update the virus definitions (if possible), and perform a manual scan of your entire system. If you do not have anti-virus software, you can purchase it at a local computer store (see Understanding Anti-Virus Software for more information). If the software can't locate and remove the infection, you may need to reinstall your operating system, usually with a system restore disk that is often supplied with a new computer. Note that reinstalling or restoring the operating system typically erases all of your files and any additional software that you have installed on your computer. After reinstalling the operating system and any other software, install all of the appropriate patches to fix known vulnerabilities (see Understanding Patches for more information).

How can you reduce the risk of another infection?

Dealing with the presence of malicious code on your computer can be a frustrating experience that can cost you time, money, and data. The following recommendations will build your defense against future infections:

• use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. However, attackers are continually writing new viruses, so it is important to keep your anti-virus software current.
• change your passwords - Your original passwords may have been compromised during the infection, so you should change them. This includes passwords for web sites that may have been cached in your browser. Make the passwords difficult for attackers to guess (see Choosing and Protecting Passwords for more information).
• keep software up to date - Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it.
• install or enable a firewall - Firewalls may be able to prevent some types of infection by blocking malicious traffic before it can enter your computer (see Understanding Firewalls for more information). Some operating systems actually include a firewall, but you need to make sure it is enabled.
• use anti-spyware tools - Spyware is a common source of viruses, but you can minimize the number of infections by using a legitimate program that identifies and removes spyware (see Recognizing and Avoiding Spyware for more information).
• follow good security practices - Take appropriate precautions when using email and web browsers so that you reduce the risk that your actions will trigger an infection.

As a precaution, maintain backups of your files on CDs or DVDs so that you have saved copies if you do get infected again.

Additional information:

• Recovering from a Trojan Horse or Virus
• Before You Connect a New Computer to the Internet
• Securing Your Web Browser

This information was adapted from an original production by US-CERT and republished for non-commercial use as outlined in their Privacy & Use policy.

Protect Your Personal Information

Here's another set of tips from our friends at StopThinkConnect.org on how to protect your personal information:

Secure your accounts: Ask for protection beyond passwords. Many account providers now offer additional ways for you verify who you are before you conduct business on that site.

Make passwords long and strong: Combine capital and lowercase letters with numbers and symbols to create a more secure password.

Unique account, unique password: Separate passwords for every account helps to thwart cybercriminals.

Write it down and keep it safe: Everyone can forget a password. Keep a list that’s stored in a safe, secure place away from your computer.

Own your online presence: When available, set the privacy and security settings on websites to your comfort level for information sharing. It’s ok to limit how and with whom you share information.

Major Adobe Data Breach

On October 3, 2013, Adobe announced that it had been a victim of a cyber attack that resulted in a data breach. This breach resulted in attacker(s) gaining access to the detailed information belonging to 38 million customers.  The information includes:

 

• Customer names
• Encrypted credit or debit card numbers
• Expiration dates
• Other information relating to orders

Adobe also acknowledged that the attacker(s) have gained access to the source code for Adobe Acrobat, ColdFusion, and ColdFusion Builder.

Adobe will be emailing all customers who have been affected by this breach and informing them to change their passwords, as well as providing additional guidance to help safeguard against potential misuse of the compromised data if their credit or debit card numbers were part of the breach.
 

Please note that it's likely that attackers will attempt to take advantage of this breach by sending fake emails that appear to come from Adobe.  If you receive an email related to this breach, do NOT click any links or reply with any information. 

Our recommendations for anyone who may be affected by this breach are as follows:

1. Check to see if you are affected by entering your email address at http://adobe.cynic.al/.
2. Change passwords for all Adobe accounts.
3. Change passwords for any other accounts that may use the same password as your account on Adobe.com.  (Remember:  it's not a good idea to use the same password on multiple websites!)
4. Monitor financial accounts that are used for purchasing Adobe products for fraudulent activity.

For more information, see Adobe's website at http://blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html.

Recognizing Fake Antivirus Software

What is fake antivirus?

Fake antivirus is malicious software (malware) designed to steal information from unsuspecting users by mimicking legitimate security software. The malware makes numerous system modifications making it extremely difficult to terminate unauthorized activities and remove the program. It also causes realistic, interactive security warnings to be displayed to the computer user.

How can my computer become infected with fake antivirus?

Criminals distribute this type of malware using search engines, emails, social networking sites, internet advertisements and other malware. They leverage advanced social engineering methodologies and popular technologies to maximize number of infected computers.

How will I know if I am infected?

The presence of pop-ups displaying unusual security warnings and asking for credit card or personal information is the most obvious method of identifying a fake antivirus infection.

What can I do to protect myself?

There are lots of things you can do to protect yourself from these antivirus scams:

• Become familiar with how your antivirus works and make sure it is always up to date.
• Be cautious when visiting web links or opening attachments from unknown senders.
• See Using Caution with Email Attachments for more information.
• Keep software patched and updated.
• See Understanding Patches for more information on the importance of software patching.
• To purchase or renew software subscriptions, visit the vendor sites directly.
• Monitor your credit cards for unauthorized activity.

This information was adapted from an original production by US-CERT and republished for non-commercial use as outlined in their Privacy & Use policy.