Community
Defenses of a U.S. government agency were duped by an experimental scam created by security experts.
The “scam” involved Emily Williams, a fictitious attractive woman with a credible online identity (including a real photo that was allowed by a real woman), posing as a new hire at the targeted agency.
Within 15 hours, the fake Emily had 55 LinkedIn connections and 60 for Facebook, with the targeted agency’s employees and contractors. Job offers came, along with offers from men at the agency to assist her with her new job.
Around Christmas time the security experts placed a link on Emily’s social media profiles linking to a Christmas card site they created.
Visitations to this site led to a chain of events culminating in the security team stealing highly sensitive information from the agency. Partner companies with the agency were also compromised.
The experimenters got what they sought within one week. The penetration scam was then done on credit card companies, banks and healthcare organizations with very similar results.
An authentic attacker could have easily compromised any of the partner companies, then attacked the agency through them, making the assault more difficult to detect.
Recap: The scam began from the ground up, inflating Emily’s social network till it enabled the attack team to suck in security personnel and executives. Most of the people who assisted Emily were men. A similar experiment using a fake male profile had no success.
Preventing getting suckered into Social Media Scams
This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.
Sergiy Fitsak Managing Director, Fintech Expert at Softjourn
14 August
Oleksandr Strozhemin Co-founder and CEO at Trinetix
13 August
Elaine Mullan Head of Marketing and Business Development at Corlytics
12 August
Abhinav Paliwal CEO at PayNet Systems- A Neo Banking Software Platform
Welcome to Finextra. We use cookies to help us to deliver our services. You may change your preferences at our Cookie Centre.
Please read our Privacy Policy.