Skip to content

From Wombat Security

Phishing

Phishing is a very simple and useful tool in an attacker’s arsenal. Phishing can lead to the exposure of sensitive information such as usernames, passwords, PII (personally identifiable information), and credit card information. So what is Phishing? It is at method used to obtain sensitive information from a victim that leverages social engineering and communications technologies that normal people use every day. There are various methods of phishing, with the most common being email, vishing (voice phishing), and smshing (text phishing). These methods can be blanket attempts that rely on quantity instead of quality (often called campaigns) or they can be very carefully crafted attacks with very specific targets (spear phishing and whaling). Luckily, identifying and defeating these attacks can be simple if you know what to look out for.

Email Phishing

Email is the hacker’s go-to for most phishing attacks; people wouldn’t think twice about receiving an email. Often times phishing emails will contain a malicious link, a malware attachment, or directly ask for sensitive information. In order to trick victims, these emails are crafted to appear from a big company, such as FedEx, Apple, or even from inside your own organization. Attackers use look-a-like or spoof emails to convince the target the email is legitimate. This can lead to compromised systems and/or exposed personal information, which can lead to further exposure of friends, family, and the victim’s organization.

Defeating Email Phishing:

  • Is the company logo/banner/design slightly off?
  • Would this person/company normally be sending you an email?
  • Should they already have the information they are asking for?
  • Never open unsolicited attachments
  • Legitimate Companies should never ask sensitive information through email
  • Use other methods to confirm the communication

Vishing

Voice phishing is growing in popularity and just like other types of phishing, vishing can be automated making it a dangerous tool. Attack examples include an “FBI” automated message, “IRS” tax refund/payment notification, or as a call from your local home improvement company. When attackers get on the line with their target they present a well thought out and engaging backstory to hook their victims. Impersonation is used in most vishing calls; attackers will impersonate IT staff, management in your company, and HR to appear official.

Defeating Vishing:

  • Ask the caller to provide information only you and they would know to ensure the caller’s identity
  • Never give sensitive information over the phone
  • If the call is suspicious, contact someone close to the individual, or through other means
  • Offer to call the individual back at the number in your staff/corporate directory, or at the number listed on the legitimate website

       

Smshing

Smishing sends texts to the targets phone in hopes of them clicking a malicious link, downloading malware, or returning sensitive information. Texts follow email phishing outlines and can be identified similarly. Many victims fall for smishing because they are unaware of the tactic and more trusting of texts. Don’t trust it more just because it’s a text message.

Defeating Smshing

  • Never provide sensitive information over text message
  • Avoid following random links
  • If you are unsure, reach out to your security team, or the communicating company
  • Do not call the number that texted you

Spear-phishing, Whaling & Campaigns

Most individuals come into contact with phishing campaigns. The goal of campaigns are to reach as many people as possible and hope for a hit. Whereas, spear phishing and whaling are techniques aimed at selected groups of individuals and executives. These are well planned, crafted, and executed, and shouldn’t be taken lightly. They aim to compromise victims with privileged access to systems, accounts, and resources. Victims typically don’t have the time to review these carefully crafted emails highly specific to the target and fall for the trap.

Defeating Spear-phishing and Whaling

  • Report suspicious emails looking for information to security
  • Verify communication with the contact through other methods
  • Attackers often impersonate colleagues, friends, and family
  • Always assume you’re a target
  • Opt for face to face meetings when possible (online or in person)

What is Social Engineering?

We frequently hear about cyber-attacks on organizations using highly technical and sophisticated methods, involving malware and vulnerabilities that most people don’t understand. However, what we don’t typically hear about is how the attacker got in. According to Verizon’s Data Breach Investigation Report, in 2019, a third of all data breaches involved social engineering attacks to include phishing, pretexting, and a variety of other social engineering methods.

Social Engineering involves gaining the trust of unsuspecting users via manipulation or trickery, in order to gain unauthorized system access, credentials, or commit fraud. Attackers will attempt to take advantage of a multitude of psychological traits such as carelessness, curiosity, empathy, complacency, and most frequently ignorance.

Why does it Matter?

Social Engineering attacks are more common than you might think and odds are that you will encounter one yourself in some form or another. Failing to recognize a social engineering attack could range from a minor inconvenience to a life changing event. Compromise from such an attack could lead to needing a password reset to having a bank account drained of funds, or could even be the launching point for the next massive data breach that makes headlines worldwide.

The massive Target data breach of 2013, which exposed the credit card and personal information of 110 million people, was a result of a contractor falling for a phishing email, one of the many social engineering methods attackers use. The DNC email leak in 2016 was caused by a well-crafted but fake password reset request from Google; sent to a high ranking DNC official and resulting in the leak of highly sensitive information regarding the Democratic campaign.

Social Engineering is a large threat to the safety of not just large organizations, but also the individual.

Social Engineering Life Cycle

Much like software development and risk management, many cyber-attacks follow a lifecycle approach; with a continuing cycle of input and output constantly improving the process. Social engineering is no different and even has a few lifecycle models dedicated to it. In its simplest form however, the Social engineering lifecycle follows four basic phases: Investigation, Hook, Play, and Exit.

The Investigation phase is when an attacker performs their recon. They might choose their targets based on position within an organization, ease of access, or they might choose a wide range of targets just to see what sticks. After choosing a target they will use public information to learn as much as possible. Sources such as social media, company websites, and other profiles provide a wealth of information for attackers to use.

The Hook phase involves the initial interaction with the target; ranging from email to in person contact. During the hook, the attackers focus is on spinning a web of lies to manipulate victims at their will.

During the Play phase an attacker gains a stronger foothold and carries out the attack. Depending on their goals, they will begin disrupting or stealing sensitive and valuable data.

The Exit phase points to the end of the lifecycle. The Social Engineer will attempt to remove all traces of their presence and bring an end to their charade. Everything the attacker has gained or learned during the process is then used during a new attack cycle to more effectively con another victim.

Social Engineering and unaware users provide a vast attack surface that can be easily taken advantage of.  Meaning that you need to do everything you can to be prepared for and protect yourself from the conmen of the internet age.

GW Box is the university's enterprise file sharing service for online cloud storage and collaboration. GW also uses Gmail for email service, as such, the community has access to Google Drive as a cloud storage solution as well. Sharing and collaborating is essential to every work and study environment in the 21st century. Whether it’s for class projects or work projects, cloud storage and sharing solutions have changed and simplified how we do things. But, there are practices we should implement and guidelines we should follow in order to use the cloud responsibly. Below are the recommended Best Practices by GW IT and GW Information Security.

 

 

Social media trends are not only fun, but they also include a hint of FOMO if we don’t participate. The same can be said for the newest viral trend of “how hard did aging hit me” challenge, also know as the “10 year challenge.” There have been speculations on the origin and purpose of this trend across the internet, even in the information security Twitter community.

Kate O’Neill’s tweet is a perfect example of a growing distrust the public has of social media and the internet in general after the introduction of many AI technologies, whether they be related to ad content or predictive text.

This affects the GW community at every level; students, staff members, and faculty members alike partake in social media sharing. There is nothing that confirms that O’Neill’s tweet has truth to it. However, our goal is to highlight the need of users to be smart and to be safe online. Always be vigilant of what you post and how much detail you give out, especially when it comes to location sharing. Criminals are becoming increasingly more knowledgable about how to use technology to their advantage, as are large corporations like Facebook where we live our daily lives. The younger the clientele, the more common it is for them to live their life in the digital world. Be #securityaware.

Skeptics can agree that this trend and some others can be seen as data mining or data harvesting parading as a harmless social game. Realistically speaking, information security professionals know that technology has become so mobile that it goes where we go. So, our message to you is be mobile, but be mindful. Stay mindful of what you share and how much you share. It may sound like an older generation reprimanding you, but it is true, everything you do does not have to be a social media post.

Let us know in the comments below if you make it a habit to consider what details you post on social media or if you have generally seen it as harmless fun.

#bemobile #bemindful #securityaware

 

If you use an iPhone, chances are you use FaceTime. Several sources have reported a bug discovered in the FaceTime application. The vulnerability allows a caller to remotely listen to the recipient's microphone before the recipient accepts the FaceTime call. It has also been reported that a variation of this vulnerability will allow a caller to receive video prior to the recipient accepting the FaceTime call.

Apple is working to release a software update to correct the problem later this week. In the meantime, we recommend the GW community disable FaceTime on Apple devices including iPads, iPhones, and Macs.

Instructions for iOS (12.1):

  1. Unlock device and go to “Settings”
  2. Scroll to FaceTime
  3. Toggle FaceTime off

Instructions for macOS (10.14):

  1. Open FaceTime application
  2. Click on the FaceTime menu (to the right of the Apple menu in the top left corner of the screen)
  3. Select “Turn FaceTime off”

Questions? For questions or to report any problems, please contact GW Information Technology at 202-994-GWIT (4948), ithelp@gwu.edu or IT.GWU.EDU.

Sources:

https://9to5mac.com/2019/01/28/facetime-bug-hear-audio/

https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug-iphone-eavesdrop-listen-in-remote-call-security-issue

 

The US Department of Education Office of Federal Student Aid has identified a malicious phishing campaign that may lead to potential fraud associated with student refunds and aid distributions. Multiple institutions of higher education have reported that attackers are using a phishing email to obtain access to student accounts by providing links to bogus student portals.

If you have received this email or a similar one, please do not reply to it, open any attachments or click on the link.

If you have responded to the phishing attempt with your GW NetID and corresponding password, please change your password immediately by visiting identity.gwu.edu and clicking on “Reset/Forgot Password”.

Please remember that you should always be wary of messages requesting account verification, confirmation or upgrade, payment or personal information such as your passwords, GWid, Social Security number or credit card information. Additionally, please ensure that your computer is patched with the most recent operating system updates.

If you receive any phishing attempts in the future, please do not reply to them, open any attachments or click on any links. Please forward the email to abuse@gwu.edu.

If you have any questions about the validity of a link you see or a message you receive, please contact the IT Support Center at 202-994-GWIT (4948), ithelp@gwu.edu or IT.GWU.EDU.

Over the past few months, GW has been introducing two-step authentication to all students, faculty and staff for GW Google apps. By February 28, 2018, the entire GW community will be required to use two-step authentication to sign into GW Google email, calendar and drive.

Two-step authentication is a second layer of security in addition to your password for any kind of login. It means you have to confirm your identity in two ways – with something you know (your password) and something you have (a code sent to your phone).

OK, how does this work?
GW uses Microsoft two-step authentication to ask individuals for a second confirmation of their identity at login, using a physical device in their possession. The device may be a smartphone or tablet using the free Microsoft Authenticator app, a text message sent to your phone, or an automated voice call to landline or cell phone.

Why do we need two-step authentication?
Passwords alone aren’t good enough to protect your personal information and our systems and networks. Two-step authentication makes it much harder for unauthorized individuals to access your account, in addition to GW systems and networks.

Isn’t this an inconvenience?
We hope not! Many people already use two-step authentication systems for online banking and shopping. Even social media sites may ask you to confirm your identity when you’re trying to log in from a new device or location. If you try to use your credit card to buy gas, you may be asked to enter your ZIP code. That's two-step authentication at work.

In addition, the GW community has the ability to select a “Remember me for 14 days” option. This means you’ll only have to use two-step authentication every 14 days to sign into your GW email from a trusted device.

Does two-step authentication really provide better protection?
Yes. While it’s not foolproof or perfect, it is a great additional measure to safeguard your accounts and data. At GW, the most secure option is to use two-step authentication with the Microsoft Authenticator app, which will generate a one-time code each time you login, even if you don’t have cellular reception. This eliminates the possibility of getting hacked through your text messages or email. Although two-step authentication isn’t perfect, it’s one of the best options to protect your data.

The Division of IT is committed to providing the GW community with resources to be more secure. To learn more about two-step authentication at GW, visit https://it.gwu.edu/two-step or check out this November Hatchet article.

If you’re interested in learning more about security best practices and data privacy, the Division of IT is holding a Data Privacy Event on January 30, 2018 in the lower level of District House.

If you like winning things, please take our short data privacy survey: https://it.gwu.edu/data-privacy-survey. Respondents will be entered to win one of two books about data privacy. Your feedback will help us develop better data privacy practices here at GW.

data privacy graphicThis month, we’re talking about the importance of data privacy and steps you can take to better protect your data online. Data Privacy Day is Sunday, January 28 and was created to start a conversation about the importance of data privacy and provide resources to help you protect your data.

Here at GW, the Division of IT provides students, faculty and staff access to GW Google Drive and GW Box to store and collaborate on files. These document management solutions provide plenty of storage space and have features that allow users to easily share documents with others.

security best practicesIn order to protect your data and GW’s data when using these services, follow these security best practices:

  • Evaluate the business need
    • If you don’t need to store or maintain a document, don’t
    • If the document contains regulated data, use GW Box, not GW Google Drive
    • If the document contains restricted or public data, you can use GW Box or GW Google Drive
  • Share with care
    • Be mindful of what you are sharing and with whom you are sharing it. It’s easy to make mistakes when it comes to sharing files so be mindful of typos and these options when you share:
      • Share with “People with the Link” - Anyone with the link to this file is able to access the document (this sharing means public)
      • Share with “People in your company” - Anyone with the link at GW will be able to access the document
      • Share with “People in this folder” - Anyone who has access to the folder will be able to access the document
  • Don’t store credit card numbers
  • Limit use and storage of Social Security Numbers (SSN)
    • Most of the functionality and use of SSN has been replaced by the GWID
    • If you do work with SSNs, be mindful of what you are storing on your local machine and in GW Box and GW Google Drive
    • Only store Social Security Numbers in GW Box and only if there is a valid business need

You can learn more about document management solutions at GW by visiting https://it.gwu.edu/document-management-services.

privacy matters to us graphicThe Division of IT is holding a Data Privacy Event on January 30, 2018 in the lower level of District House. Join us to learn more about data privacy resources.

If you’re interested in helping to shape a data privacy program at GW, please take our short survey: https://it.gwu.edu/data-privacy-survey. Respondents will be entered to win one of two books about data privacy.

spectre and meltdown graphic

By now you have likely heard of the security vulnerabilities known as "Meltdown" and "Spectre." The purpose of this blog post is to give you a brief description of these vulnerabilities and what you need to do to mitigate the associated risks.

Let's discuss Meltdown first. Meltdown is the name given to a CPU (central processing unit; basically the microchip that runs your computer) design flaw that affects the security boundaries enforced by the CPU or processor. It essentially breaks down the boundary that separates user applications from accessing privileged system memory space. The Meltdown vulnerability is confirmed to exist in all Intel processors since 1995, except for Intel Itanium and Intel Atom before 2013. This includes computers by popular vendors such as Apple, Microsoft, Dell, HP, and Lenovo.

Spectre is similar but different in some important ways. Spectre is the name given to a CPU design flaw that allows an attacker to utilize a CPU's cache channel to read arbitrary memory from a running process. Unlike Meltdown, Spectre can only read memory from the current process, not from kernel or system memory. Also, unlike Meltdown, Spectre is confirmed to affect Intel, AMD, and ARM processors. This includes computers, tablets and smartphones made by popular vendors such as Apple, Microsoft, Dell, HP, Google, and Lenovo. The relatively good news is that it is much more difficult to successfully exploit Spectre and the attack surface is limited to user space processes, e.g. web browsers, desktop applications.

There's two important things that we want you to know about these vulnerabilities. If you remember nothing else, remember this:

1.) Don't panic. While these vulnerabilities are widespread and definitely very bad, there is no need to panic. There's no need to go buy a new computer or go back to using pen and paper. You may read some very scary media reports about the potential impacts of these vulnerabilities. This is common when widespread vulnerabilities are announced.

2.) Keep your software up-to-date. This is good cyber-hygiene no matter the circumstance. This includes your operating system (Windows, MacOS, Linux, iOS, and Android), your browser (Microsoft Edge, Google Chrome, Firefox, Safari), and your browser plug-ins. Vendors are working very hard to produce software to mitigate the risks of these vulnerabilities. Make sure you install these updates when they are available.

If you have any questions about how to make sure that you're running the latest software, call the IT Support Center at 202-994-4948 or e-mail ithelp@gwu.edu.

Want to learn more? Check out the following:

Apple announcement: https://support.apple.com/en-us/HT208394

Simple, brief write-up by security researcher Daniel Miessler: https://danielmiessler.com/blog/simple-explanation-difference-meltdown-spectre/

Vulnerability website: https://spectreattack.com/

Last week, the Division of IT sent an e-mail to the GW community regarding  the recent discovery of 1.4 billion stolen credentials(usernames and passwords). The purpose of this blog post is to discuss the risks associated with credential re-use and things you can do to minimize the chances of your GW credentials being used by unauthorized persons. We wanted to take a moment to elaborate on the nature of this threat and how "credential dumps" can impact you and your online safety.

As you may have heard, large websites like Adobe.com, LinkedIn.com, and Yahoo.com have all suffered major cyber incidents in the last few years. A common hallmark of these incidents is that attackers steal the usernames and passwords for users of these sites and then leak the credentials publicly. There's very little that any regular user can do to prevent these types of incidents from occurring, but there are some actions that you can take to safeguard your accounts and your data. The most recent credential dump referenced in the above article is a collection of  credentials gathered from numerous hacks.

Follow these guidelines to help protect your accounts:

1.) Check haveibeenpwned.com* to see if any of your e-mail addresses are associated with any large credential breaches. This site is operated and maintained by Troy Hunt, who is a well-known, reputable computer security expert.

Simply type your e-mail address, click the "pwned?" button and see a list of any websites where your e-mail address and password has been part of a known credential breach.

If you see this, that's good. No passwords to change.

 

If you see this, change the passwords for the impacted accounts.

Feel free to share this URL with your family and friends.

2.) It is important that you do not re-use passwords. For example, if I use my NetID@gwu.edu e-mail address to register for Pinterest.com, the password used should not be the same as the password that you use with your GW e-mail address. This way, if Pinterest is ever compromised, that password is essentially useless for anything other than Pinterest. If you have trouble remembering passwords (applies to roughly 99.9% of all people including the author) use a password manager. While not officially supported by the GW Division of IT, we like LastPass. LastPass works on PCs and Macs, as well as mobile devices that run iOS and Android. Password managers help users manage unique, long, complex passwords in an efficient manner.

3.) Choose passwords that are long (the longer the better) and complex (no dictionary words). Easily guessable passwords or passwords that employ obvious obfuscation techniques (e.g. Ra1seH1gh!) are not great passwords. While GW does not require you to change your password, it's not a bad idea to change your password periodically. There's some competing schools of thought on this issue but the GW security team recommends changing your password at least once annually.

The GW information security team is always on the lookout for notices of public credential dumps. We may tell you about these from time to time, especially if we learn that you may have been impacted by one of these dumps. In the meantime, follow the above guidance. These little things will go a long way to protect your accounts and your data from an attacker.

* - "pwned" is hacker-speak for "owned" or compromised.