Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer with
Speaker 1: how Stuff Works in a love all things tech, and
Speaker 1: today we're going to kind of do a continuation on
Speaker 1: our discussions about critical thinking and skepticism. I know I've
Speaker 1: been talking about that a lot, but this is another
Speaker 1: area where that's important, and recently in the news, there's
Speaker 1: been a lot of talk about spear fishing. Now much
Speaker 1: of that discussion centers on a report from that detailed
Speaker 1: how Russian intelligence agents targeted the United States Democratic National
Speaker 1: Committee or d NC with a spear phishing campaign that
Speaker 1: ultimately allowed the malicious actors to make off with a
Speaker 1: lot of sensitive and confidential information and infiltrate sensitive systems. Now,
Speaker 1: I'm not going to get political on this EPISOD, so
Speaker 1: that's not what I want to focus on. I rather
Speaker 1: want to focus on the strategies that malicious actors use
Speaker 1: to either steal information or convince people to hand it
Speaker 1: over willingly through deception. So I'm going to talk about
Speaker 1: concepts like social engineering, fishing, spear fishing, and whaling and
Speaker 1: I'm listing them in that order because it involves moving
Speaker 1: from a more general concept to a more specific application
Speaker 1: of those concepts. So let's get it started with social engineering. Now,
Speaker 1: generally speaking, social engineering, at least in this context, refers
Speaker 1: to using deception and manipulation in order to get hold
Speaker 1: of information. It's just, really it's just about tricking people
Speaker 1: to give up stuff that normally they wouldn't part with,
Speaker 1: and that's really all it boils down to. Typically, this
Speaker 1: means that someone is pretending to be a trusted entity
Speaker 1: and they work to convince a target or mark in
Speaker 1: the old carnival speak, the marking the person that you
Speaker 1: have marked as being vulnerable. You are trying to get
Speaker 1: them to hand over information or even give them control
Speaker 1: of their devices. So you might convince someone to install
Speaker 1: some malware. It's disguised as something else, like an innocent file,
Speaker 1: but your your job is to get them to do
Speaker 1: something that compromises information or system information systems. And this
Speaker 1: shows us yet again that critical thinking is a really
Speaker 1: important skill. It's good to apply critical thinking when someone
Speaker 1: is asking you for information or telling you that you
Speaker 1: should install a program. Sometimes those are bad people, and
Speaker 1: sometimes they're up to no good. Now, you can think
Speaker 1: of a social engineer as a con artist, so it's
Speaker 1: someone who uses psychological manipulation to get a specific reaction
Speaker 1: from mark. Stage magicians and mentalists use those sort of
Speaker 1: strategies or to entertain. They're not doing it to do
Speaker 1: something underhanded. They're doing it in order to make people uh,
Speaker 1: amazed or laugh or applaud. A stage magician, for example,
Speaker 1: has to learn the art of misdirection. This is the
Speaker 1: technique of getting an audience to pay attention to something
Speaker 1: that is ultimately unimportant, at least as far as the
Speaker 1: mechanics of a trick, and that's so that they don't
Speaker 1: notice the actual important stuff that's going on. It gives
Speaker 1: the magician the time and opportunity to pull off a trick.
Speaker 1: A good magician can hold an audience's attention with some
Speaker 1: mesmerizing stage work. They might incorporate clever pattern, but the
Speaker 1: whole point is to keep focus off of something that
Speaker 1: might otherwise spoil the illusion. Dr Robert Saldini, is a
Speaker 1: professor emeritus of psychology and Marketing at Arizona State University,
Speaker 1: outlined six basic principles of influence. These relate to strategies
Speaker 1: that they're they're drivers that someone can employ to convince
Speaker 1: another person to agree with what they are saying. And essentially,
Speaker 1: these six broad principles can get someone to say yes.
Speaker 1: It's the idea of influencing someone to agree to do something.
Speaker 1: Understanding these principles can help you recognize when someone is
Speaker 1: trying to use those strategies on you. But these are
Speaker 1: strategies that rely on very human traits. They work because
Speaker 1: of the way we're wired. More or less, it's even
Speaker 1: being aware of them doesn't mean that you will be
Speaker 1: immune to them, because it's it's very much dependent upon
Speaker 1: what it means to be human. So Childni cites other
Speaker 1: psychologists who identified what they called judgmental heuristics. You can
Speaker 1: think of these as sort of cognitive shortcuts. They are
Speaker 1: basic rules that we accept as being generally true, so
Speaker 1: it's sort of like a foundational statement that we would
Speaker 1: not question. But if someone knows how those work, they
Speaker 1: can take advantage of it. So, in other words, if
Speaker 1: someone is really good at using these principles, you might
Speaker 1: not be aware of it right away. And I certainly
Speaker 1: consider myself to be vulnerable to them. I know I'm
Speaker 1: vulnerable to them. I can think of examples where people
Speaker 1: use these technique U on me and it worked. Sales
Speaker 1: people in particular tend to really focus on these their
Speaker 1: entire books out there that are all about how to
Speaker 1: leverage these principles in order to make sales, make business deals,
Speaker 1: et cetera. So what are the six big categories. Well,
Speaker 1: the first is the rule of reciprocation. That's our tendency
Speaker 1: to want to repay someone who has done something on
Speaker 1: our behalf. Essentially, this comes down to the concept of favors.
Speaker 1: So an example you might have encountered could be free samples.
Speaker 1: Merchants know that a free sample can create the urge
Speaker 1: within a potential customer to buy a product because that
Speaker 1: person feels obligated after having accepted a sample. So if
Speaker 1: I'm sitting at a table and I have samples of
Speaker 1: let's say it's olive oil, I've got different little bowls
Speaker 1: of olive oil, and you can dip a little bit
Speaker 1: of bread in there and taste them, and I'm there
Speaker 1: saying I'm here to answer any questions. Do you like it?
Speaker 1: What do you think? We have the social pressure within
Speaker 1: us to say, oh, I like it a lot, even
Speaker 1: if we don't. We have that social pressure, Like very
Speaker 1: few of us would say, oh, I don't like this
Speaker 1: at all to someone who seems like they are invested
Speaker 1: in your answer. So we feel obligated to go along
Speaker 1: with it. And we may feel obligated because we have
Speaker 1: accepted something that in return we will buy something even
Speaker 1: if we didn't like the thing, because we feel this
Speaker 1: social pressure. And this goes along with what it means
Speaker 1: to be human. I'll touch back on that when we
Speaker 1: get towards the end of these principles. So most people
Speaker 1: don't like to feel that they are under some sense
Speaker 1: of obligation to someone else. They don't like to feel
Speaker 1: they owe somebody something, and so they will very quickly
Speaker 1: try to act to even the scales right so that
Speaker 1: they are no longer obligated. So rule of reciprocation is
Speaker 1: the first principle. Next is scarcity. People tend to want
Speaker 1: more of stuff that they can have less of. That's
Speaker 1: the basic idea. And you can look at this with
Speaker 1: just like the prices for precious metals. Precious metals are
Speaker 1: precious largely because of their scarcity, because they're so hard
Speaker 1: to get and there's not a whole lot of it.
Speaker 1: That's what drives up their value. People want it more
Speaker 1: because it's harder to get. The entire diamond industry is
Speaker 1: based off of this concept. There are plenty of diamonds,
Speaker 1: There are tons of diamonds. They are not even rare.
Speaker 1: But because the world's supply of natural diamonds is controlled
Speaker 1: essentially by a single company, that company can control the
Speaker 1: scarcity of diamonds and thus inflate their value. Because people
Speaker 1: want what they can't have, So offering someone a chance
Speaker 1: to experience something or possess something that has extremely limited
Speaker 1: availability is a really useful tactic. If you tell someone, hey,
Speaker 1: this service that we have, we're gonna get rid of
Speaker 1: it in a week, typically you see a lot more
Speaker 1: people try and take advantage of that service before it
Speaker 1: goes away forever. It's an incredibly useful way of getting
Speaker 1: people to do something you want them to do. Next
Speaker 1: is the principle of authority, which is the notion that
Speaker 1: people will tend to go along with someone they view
Speaker 1: as being an expert or being credible. So have you
Speaker 1: ever encountered a problem and thought, Uh, someone smarter than
Speaker 1: I am is going to handle this, or you just
Speaker 1: assume that someone more capable than you has the situation covered.
Speaker 1: Maybe you were present when an emergency happened and you
Speaker 1: look around to see if someone else jumps to help,
Speaker 1: because you think, well, clearly, there's gotta be someone here
Speaker 1: who's better at handling this kind of situation than I am,
Speaker 1: so I'm gonna step back and allow that to happen. Well,
Speaker 1: that behavior shows that we frequently will defer and even
Speaker 1: seek out people who appear to be more knowledgeable or
Speaker 1: capable than ourselves under certain situations. So if someone poses
Speaker 1: as a person of authority convincingly, they can more easily
Speaker 1: persuade people to do stuff. The fourth principle of influence,
Speaker 1: according to Cialdini, is consistency. This is related to the
Speaker 1: concept of commitment committing to do something. If you get
Speaker 1: someone to agree to a small initial commitment, that can
Speaker 1: set the ground for a larger commitment further down the road.
Speaker 1: So a classic example in a scam could be the
Speaker 1: Nigerian scam. A lot of Nigerian scams will start off
Speaker 1: where the scam artist first asks for a relatively small
Speaker 1: amount of money because they say, hey, there's a huge
Speaker 1: amount of money in this country. Has your name on it.
Speaker 1: It's it's clearly not meant for you, but because it
Speaker 1: has your name on it, we can get it to you.
Speaker 1: It's an enormous sum. However, in order for me to
Speaker 1: get this money to you, first, I'm gonna need a
Speaker 1: small amount of money from you to help secure this,
Speaker 1: and then we can get you rich. And people will
Speaker 1: say okay, And then the scam ars might come back
Speaker 1: and say, oh, as it turns out, I'm gonna need
Speaker 1: a little bit more money because I'm gonna have to
Speaker 1: bribe some officials here in order to get your wealth
Speaker 1: to you, and so on and so on. The idea
Speaker 1: being that because you've already made an initial commitment, you
Speaker 1: would be willing to make a larger subsequent commitment. And
Speaker 1: this can happen not just in scams, it can happen
Speaker 1: in completelygitimate, although sometimes questionably ethical applications. That in the
Speaker 1: Principles is the principle of liking, which means we're more
Speaker 1: easily influenced by people we like. This is not brain surgery, right,
Speaker 1: If you like someone, you're more willing to agree with
Speaker 1: them and to do things that they need you to do. Now,
Speaker 1: Sheldeoni states there are three factors that go into whether
Speaker 1: or not we actually like someone. First, we tend to
Speaker 1: like people who are similar to ourselves. The more alike
Speaker 1: they are to ourselves, at least to a certain extent,
Speaker 1: the more we tend to like them. Second, we like
Speaker 1: people who complement us because we're vain. We're egotistical creatures.
Speaker 1: If you come up to me and say, hey, I
Speaker 1: really like your work, I am far more likely to
Speaker 1: like you. And Third, we like people who will work
Speaker 1: with us towards a mutual goal. If we both need
Speaker 1: to get a specific task done, and you help me
Speaker 1: do that task, I am more likely to like you.
Speaker 1: So a scam artist might try to wheel out some
Speaker 1: information about you in order to make it seem as
Speaker 1: if the artist also shares the similar interests and values
Speaker 1: that you have, and try and create this pathway to
Speaker 1: get you to like the scam artists so that in return,
Speaker 1: you will actually do whatever the scam artist wants you
Speaker 1: to do. The sixth principle is consensus, which essentially says
Speaker 1: that when we're in doubt, we tend to look at
Speaker 1: what other people are doing so that we can get
Speaker 1: some direction over what we should do. Now, I certainly
Speaker 1: identify with this. I think about just about any situation
Speaker 1: I've been in in which I was joining a group
Speaker 1: of people working together on an activity. Maybe we're all
Speaker 1: doing the same thing over and over, like folding T shirts.
Speaker 1: That's an easy one. We're all folding T shirts, and
Speaker 1: I keep looking over to the left and right to
Speaker 1: see how other people are doing it, so that I
Speaker 1: feel like I'm doing it the right way, that I'm
Speaker 1: not messing up. I have this incredible social pressure on
Speaker 1: me to do it correctly, and rather than try and
Speaker 1: learn this in a more formal way, you know, a
Speaker 1: more process oriented way, I'm doing it looking at how
Speaker 1: everyone else is doing this. Now, if everyone else is
Speaker 1: doing this quote unquote the correct way, that's fine. But
Speaker 1: if people are doing things incorrectly, then all I'm doing
Speaker 1: is adding to the number of people who are doing
Speaker 1: something incorrectly. But there's again, is a lot of social
Speaker 1: pressure at play here for you to do as the
Speaker 1: group does. And this is not just psychobabble. These principles
Speaker 1: put into words behaviors that humans have developed as social creatures.
Speaker 1: Human survival has largely depended upon our working together, and
Speaker 1: so we've developed these behaviors that promote cooperation and they
Speaker 1: discourage inhibiting cooperation. Understanding those behaviors and then subtly leveraging
Speaker 1: them can have a really big impact on interactions, and
Speaker 1: that plays right into the hands of social engineers. So
Speaker 1: if you happen to know people tend to follow these
Speaker 1: principles because humans as a species have sort of evolved
Speaker 1: to be these social creatures, then you can take advantag
Speaker 1: edge of that. Now, granted they are going to be outliers.
Speaker 1: There will be people who do not conform, they do
Speaker 1: not adhere to these principles, they don't have any connection
Speaker 1: to them, But more frequently than not, you're going to
Speaker 1: find that they work and that they work on you. Next,
Speaker 1: I'm going to define the terms like fishing, spear fishing,
Speaker 1: and whaling, and we'll explore some specific tactics and stories
Speaker 1: related to those practices. But first let's take a quick
Speaker 1: break to thank our sponsor. All right, So social engineering
Speaker 1: is all about manipulating people to give them to do
Speaker 1: what you want, typically in a way that involves deception
Speaker 1: and handing over confidential information. But what is fishing all about?
Speaker 1: And it's spelled p h I s H I n
Speaker 1: G by the way, fishing with a pH Fishing describes
Speaker 1: the practice of tricking people into handing over sensitive information
Speaker 1: through some digital means. Most frequently we talk about using
Speaker 1: e ail as a way of phishing for data, but
Speaker 1: you could use a spoofed website, you could use instant messaging,
Speaker 1: but it doesn't really matter. The basic concept is the same.
Speaker 1: You're fishing for data. I find it interesting, by the way,
Speaker 1: that we have a lot of nautically themed terms to
Speaker 1: describe different behaviors on the Internet, because there's fishing, their
Speaker 1: spear fishing, there's whaling, but there's also trolling. Trolling refers
Speaker 1: not to mythical monsters from fairy tales, but from the
Speaker 1: practice of dragging a net behind a boat to troll
Speaker 1: in an effort to scoop up a catch. Trolling on
Speaker 1: the Internet originally referred to people who would go into
Speaker 1: message forums and they would lay down a trap, which
Speaker 1: would be they would post something intended to get a
Speaker 1: rise out of members of the forum, legitimate members, so
Speaker 1: they weren't necessarily aiming at anyone in particular. They were
Speaker 1: just kind of laying a trap for anybody who was
Speaker 1: gullible enough to fall into it. The goal was just
Speaker 1: to rile people up, and why would you do that. Well,
Speaker 1: some people just want to watch the world burn. I
Speaker 1: guess they like to think that they were able to
Speaker 1: have influence on another person and that brings them some
Speaker 1: mean sense of joy. It's not great, but it does
Speaker 1: happen far too frequently. Or sometimes the troll actually has
Speaker 1: ulterior motives beyond just upsetting people. Maybe you have someone
Speaker 1: who's running a different message board, and so what they're
Speaker 1: doing is they're essentially sabotaging what they see as competition.
Speaker 1: But whatever the motivation, the practice involved being obnoxious in
Speaker 1: one way or another in an attempt to get at
Speaker 1: least a hit or two from well meaning but misguided
Speaker 1: forum members. And I say misguided because the person's anger
Speaker 1: or frustration was the trolls goal all along. They're not
Speaker 1: necessarily arguing something they actually believe in. All we wanted
Speaker 1: to do was get someone upset. So if you get upset,
Speaker 1: the troll wins. So the only real way to win
Speaker 1: is not to play. And that's why you often hear
Speaker 1: people say don't feed the trolls. Problem is, if you
Speaker 1: don't feed the trolls, sometimes trolls will just keep on
Speaker 1: trying to get people to agree to awful, awful things,
Speaker 1: So that philosophy only goes so far as well, and
Speaker 1: it's only applicable in certain situations. But that's another podcast.
Speaker 1: Fishing is similar in a lot of ways to trolling,
Speaker 1: except instead of trying to irritate people, you're trying to
Speaker 1: trick people into handing over information they should definitely not
Speaker 1: hand over. Fishing is a general approach. The attacker does
Speaker 1: not necessarily have a particular target in mind. It's kind
Speaker 1: of a blanket attack. They don't really care who ends
Speaker 1: up being a victim. All they want to do is
Speaker 1: gather as many hits as possible. Just doesn't matter. From
Speaker 1: where as such this, phishing messages tend to be pretty generic.
Speaker 1: Phishing emails may appear to come from a legitimate source.
Speaker 1: On a casual glance, they might look like they were
Speaker 1: sent from an actual company, like a bank or a
Speaker 1: government organization. There are countless variations, but they all try
Speaker 1: to fool the recipient into taking an action that will
Speaker 1: ultimately result in a bad outcome for the target. So,
Speaker 1: for example, you might get an email from a bank
Speaker 1: stating that you have an old account with money in
Speaker 1: it and you should transfer that money out of your account.
Speaker 1: It is essentially saying, hey, you got free money, and
Speaker 1: this bank asks that you fill out some information so
Speaker 1: that you can retrieve your cash. But in reality, the
Speaker 1: emails coming from a phishing scheme and it's looking to
Speaker 1: harvest as much confidential information from users as possible. Maybe
Speaker 1: they're saying, give us your current bank account information so
Speaker 1: that we can transfer the money. We can wire it
Speaker 1: from this old account into your current account, but in
Speaker 1: reality they just want access to your current account. That's
Speaker 1: a pretty clumsy example, but it is an example of
Speaker 1: something that could actually happen. Often, the email address in
Speaker 1: a message can be a dead giveaway whether the message
Speaker 1: is legitimate or not. You can look at the originating
Speaker 1: email address and say, well, it says it's from Gmail,
Speaker 1: but the domain on the email is not related at
Speaker 1: all to Google. Well that's a dead giveaway. Chances are
Speaker 1: you're looking at a scam if email address does not
Speaker 1: match whatever entity it claims to be from. And I
Speaker 1: doubt any legitimate organization would ever ask for sensitive details
Speaker 1: to be sent over email. Almost every single one if
Speaker 1: they respond to these kind of attacks, says we will
Speaker 1: never ask for your personal information over email, particularly since
Speaker 1: there's no guarantee that the recipient is using encryption on
Speaker 1: their emails, So if you're not using an encrypted email service,
Speaker 1: there's no guarantee that a third party listening in wouldn't
Speaker 1: get access to that information anyway, even if everything else
Speaker 1: was legitimate. So that being said, it is possible to
Speaker 1: forge an email address so that a message appears to
Speaker 1: be from an official, legitimate source. There's nothing in the
Speaker 1: email protocol on its own, just the regular email protocol
Speaker 1: that verifies an address in the front field is actually
Speaker 1: a legitimate address. Now you can do some snooping yourself.
Speaker 1: You can examine email headers, which might require activating a
Speaker 1: specific feature in your email interface like in Gmail. I
Speaker 1: think it's reveal source or something along those lines. Uh oh,
Speaker 1: show original is what it is. That's what it is.
Speaker 1: You choose show original, and that's gonna give you kind
Speaker 1: of the hypertext version of the email, and that will
Speaker 1: include listing all the servers that the email has passed
Speaker 1: through with the line received colon from, and at the
Speaker 1: bottom of that section, the last received from would represent
Speaker 1: the original computer that sent the email. And if you
Speaker 1: look at that and the original computers domain is different
Speaker 1: from the official domain. Again, that could be a red flag.
Speaker 1: It's not necessarily proof positive, but it does indicate that
Speaker 1: it could be a malicious email and you should be
Speaker 1: careful about it. On the admin side of this, if
Speaker 1: you were a system administrator, organizations can implement what is
Speaker 1: called a sender policy framework to prevent forged email addresses,
Speaker 1: which is an email validation protocol, and essentially it allows
Speaker 1: an organization to map specific I P addresses that are
Speaker 1: authorized to be associated with email addresses containing the organization's
Speaker 1: web domain. So, in other words, it says, if someone
Speaker 1: tries to send an email and they claim that email
Speaker 1: is from US, check to make sure their IP address
Speaker 1: is on this list of authorized IP addresses, and if
Speaker 1: it isn't, don't allow our email. Don't allow that that
Speaker 1: from field to display our domain. It's essentially saying check
Speaker 1: here to make sure that it's legit. But again, you
Speaker 1: have to implement this. It's not something that is natively
Speaker 1: part of the email protocol. Now. I've received countless phishing
Speaker 1: emails over the years, and my favorites are the ones
Speaker 1: from companies or banks that I have never done any
Speaker 1: business with. But even those types of obvious scams can
Speaker 1: fool people. They might think, Hey, I might be able
Speaker 1: to get some free money because these folks think I
Speaker 1: have cash in their coffers, so I'll just play along,
Speaker 1: and I can essentially get some poor SAPs doughe just
Speaker 1: because they happen to have the same name as I
Speaker 1: do that stinks to be them. Only it turns out
Speaker 1: that the SAP all along was the person who received
Speaker 1: the email, because they will end up handing over sensitive
Speaker 1: information to an attacker rather than getting hold of someone
Speaker 1: else's money. A phishing attack doesn't need to get that
Speaker 1: many hits to be a success. Is a pretty cheap
Speaker 1: way of attacking people. It's not expensive to mock up
Speaker 1: an email that looks like it came from an official source,
Speaker 1: and it's also not that expensive to email hundreds of
Speaker 1: thousands of people. It's pretty easy to do so if
Speaker 1: you cast a wide enough net, you're sure to get
Speaker 1: some hits. There might not be a lot, but you
Speaker 1: don't really need a lot to actually make it profitable.
Speaker 1: So it's not an efficient way to trick people, but
Speaker 1: it can still make you money, though not at a
Speaker 1: super high profitability. But also you would be a total
Speaker 1: scumbag for doing it if you try chose to do
Speaker 1: this kind of stuff. So that's fishing. What is spear
Speaker 1: fishing because that's been the news quite a bit with
Speaker 1: this d n C stuff. Well, as I mentioned earlier,
Speaker 1: we're moving from the general to the more specific. So
Speaker 1: spear phishing is phishing. It uses the same sort of
Speaker 1: general approaches phishing, except this time the target is a
Speaker 1: defined one. Instead of it just being a widespread blanket
Speaker 1: attack against anyone and everyone, this is a targeted attack.
Speaker 1: It's targeting a specific company or organization. The emails or
Speaker 1: other messages take aim at the people who work in
Speaker 1: those organizations or for those companies. The attacker might tailor
Speaker 1: their approach specifically for the target. They might be able
Speaker 1: to use the target's actual name in the email. UM
Speaker 1: that's a pretty smart move. Actually, it's likely to increase
Speaker 1: the number of successful hits. So rather than sending out
Speaker 1: generic hey you've got some cash and X bank that
Speaker 1: you need to retrieve, or dear Amazon customer, we see
Speaker 1: you overpaid on your last order, so fill out this
Speaker 1: information for a refund, a spear fisher might take aim
Speaker 1: using details that apply to a specific targeted organization. The
Speaker 1: actual emails might not look that different from general phishing ones,
Speaker 1: though they may contain more specific information, they use similar
Speaker 1: language because again, they're trying to leverage those principles of
Speaker 1: influence that all humans are vulnerable to. A spear phishing
Speaker 1: attack could take the form of an email claiming to
Speaker 1: contain a security patch or a system update that supposedly
Speaker 1: a company wide policy. The email would claim to guide
Speaker 1: employees to bringing their computers up to date, but actually
Speaker 1: they would install a malicious piece of software. Are a
Speaker 1: good old friend, you know malware and malware can take
Speaker 1: lots of different forms, but typically with phishing attacks, the
Speaker 1: malware's purpose is to facilitate the transfer of stolen information.
Speaker 1: It might allow a back channel of access to a
Speaker 1: system's computers, you know that backdoor access that allows a
Speaker 1: hacker to take administrative control of a computer. Or it
Speaker 1: might contain a key logger which will record every keystroke
Speaker 1: made on that computer, which is an effective way to
Speaker 1: steal someone's user and aim or password. Or it could
Speaker 1: be lots of other stuff too. Worse yet, it could
Speaker 1: contain a file or a link to a page that
Speaker 1: would take advantage of a zero day exploit. This is
Speaker 1: a vulnerability that exists in some form of software or
Speaker 1: operating system that has yet to have been published. It's
Speaker 1: very possible that the entity that made the software has
Speaker 1: no way of knowing that it even exists. Zero day
Speaker 1: exploits are incredibly valuable to hackers. If you find one
Speaker 1: and you know that it hasn't been published, then you
Speaker 1: know that you have a really good chance of that
Speaker 1: zero day exploit having a huge impact if you wrap
Speaker 1: it in some other attack, So you could compromise a
Speaker 1: target computer or an entire system, and you give an
Speaker 1: attacker access to that machine or the entire network that
Speaker 1: machine is connected to, at least as far as the
Speaker 1: target would be able to access. And then if you
Speaker 1: had escalation software in there, you can even escalate so
Speaker 1: that you elevate the the status to admin levels test
Speaker 1: that gives you unfettered access to the system. The spear
Speaker 1: phishing attack might look like it came from another employee
Speaker 1: requesting access to certain types of information. It could look
Speaker 1: like it came from a finance department saying, we need
Speaker 1: you to pay this uh this invoice, so just give
Speaker 1: me your your information here. The larger the organization the
Speaker 1: easier it is to slip something like this through, because
Speaker 1: it's not likely that everyone's going to know everyone else.
Speaker 1: The smaller the organization, the more you might say, I'm
Speaker 1: just gonna walk over to Sue's desk and find out
Speaker 1: if Sue actually sent me this email, and that would
Speaker 1: obviously the work against the the intent of the hacker. Next,
Speaker 1: I'm going to share a whale of a tail with
Speaker 1: you me, lads, but first let's take another quick break
Speaker 1: to thank our sponsor. Okay, so we've defined fishing, and
Speaker 1: we define spear fishing, but what is whaling. Whaling refers
Speaker 1: to phishing attacks that are then more specific than spear fishing.
Speaker 1: These attacks target high ranking executives the the whales, or
Speaker 1: they might be high ranking members of an organization. These
Speaker 1: targets have the most potential access to an organization, and
Speaker 1: it's confidential information, so they have a very high value
Speaker 1: attached to them. The attacker stands to gain the most
Speaker 1: from compromising that kind of target. Also, some of them
Speaker 1: are really really not computer savvy, and as such they
Speaker 1: can fall for tricks way too easily. I say this
Speaker 1: having met a lot of executives who seem to have
Speaker 1: only a cursory understanding of how technology works. Uh. As
Speaker 1: they age out of leadership positions, then we see a
Speaker 1: little bit less of that. But we always got to
Speaker 1: remember that typically leadership tends to be older, you know,
Speaker 1: than your rank and file employee, and because technology changes
Speaker 1: so quickly, it's very possible for the older members of
Speaker 1: any group to have less knowledge about the most current
Speaker 1: and potentially most dangerous uses of tech. So whaling again
Speaker 1: follows similar tactics as phishing and spear fishing. It could
Speaker 1: be a much more specific message designed to give the
Speaker 1: best possible chance for a successful hit, but otherwise it's
Speaker 1: pretty much the same as what we've already covered, So
Speaker 1: I'm not gonna waste time rehashing what I've already said.
Speaker 1: Just remember that the specificity I talked about earlier will
Speaker 1: be even more so for whaling. You will have messages
Speaker 1: that call out the executive by name. It might use
Speaker 1: names of people the executive actually knows. It might even
Speaker 1: use a spoofed email address so it seems like it's
Speaker 1: coming from someone the person knows. Of course, the closer
Speaker 1: the friendship, the more you run the risk of not
Speaker 1: sounding like that person, which could set off red flags
Speaker 1: in someone's mind. They might say, huh, soon never talks
Speaker 1: to me like this an email that would end up
Speaker 1: being an issue, But otherwise you have a much greater
Speaker 1: chance of getting a succes us. As always, you should
Speaker 1: use critical thinking whenever you get a message. It's best
Speaker 1: to do so. And while I've focused on email again,
Speaker 1: those phishing attacts could come through other channels such as
Speaker 1: instant messaging or similar communication channels, or even through spoofed websites.
Speaker 1: So using critical thinking and just paying attention can really
Speaker 1: save you a lot of heart heartache in the long run.
Speaker 1: So here's some basic rules you should follow. First, try
Speaker 1: to make sure an incoming message is in fact from
Speaker 1: a legitimate source, particularly if there's an attachment to the
Speaker 1: email or if it's asking you to hand over information.
Speaker 1: That might involve digging a little deeper if the attacker
Speaker 1: bothered to forge an email field, so if they forge
Speaker 1: that from field, then you might need to check the
Speaker 1: source code just to make sure that in fact it
Speaker 1: is legitimate. And then you might even ask like, well,
Speaker 1: why are they asking for this information and why should
Speaker 1: it be done over email? That's not necessarily the most
Speaker 1: secure way. In fact, You should really never send confident
Speaker 1: ential information like user names, passwords, credit card information, wire
Speaker 1: transfer information, anything like that over email or an instant
Speaker 1: message system because most of the time those are not secure.
Speaker 1: They're not a lot of them are not encrypted. So
Speaker 1: even if the person contacting you is completely legitimate, if
Speaker 1: they are on the up and up, you totally trust them.
Speaker 1: They're not gonna do anything to to to mess with
Speaker 1: you the channel. If you're using a channel that's unencrypted,
Speaker 1: someone else could potentially get hold of that information. So
Speaker 1: it may even be that a third party could get
Speaker 1: hold of this information. It's just not a smart move
Speaker 1: to send that kind of stuff over email or instant messager,
Speaker 1: and most legitimate communication will never require you to send
Speaker 1: in sensitive info over email. Rather, you would have to
Speaker 1: visit a legit website that's verified and secure. You look
Speaker 1: for that little lock in the U r L bar,
Speaker 1: and you make sure that the website you go to
Speaker 1: actually belongs to the company or entity that it's supposed
Speaker 1: to belong to before fill anything out. Third, if you're
Speaker 1: in a company or organization and you receive a message
Speaker 1: that seems hinky and it's catered to you or to
Speaker 1: your company, you should probably let someone in I T
Speaker 1: know about it so that they can be on the
Speaker 1: lookout and perhaps issue a company wide alert. Because even
Speaker 1: if you don't fall for this, if it's a spear
Speaker 1: fishing attack that's targeting people who belong to the same
Speaker 1: organization you do or the same company you work for,
Speaker 1: all it takes is a couple, maybe even as few
Speaker 1: as one positive hits to make a lot of damage.
Speaker 1: So if you notice something, you say something, it gives
Speaker 1: you the best chance to not have your company or
Speaker 1: organization fall victim to these kind of attacks. This is
Speaker 1: really serious business. So let's take another look at the
Speaker 1: U S. D n C phishing attacks in twenty sixteen
Speaker 1: that I mentioned earlier. So what actually happened in those attacks. Well,
Speaker 1: according to a joint report from the Department of Homeland
Speaker 1: Security and the FBI, two groups which the report labels
Speaker 1: a P twenty eight and APT twenty nine, breached the
Speaker 1: d n C servers through phishing attacks. APT, by the way,
Speaker 1: stands for Advanced Persistent threat. The first attack started in
Speaker 1: the summer of The group behind the attack was APT
Speaker 1: twenty nine. The attackers sent emails to more than one
Speaker 1: thousand different addresses attached to the d n C, and
Speaker 1: the messages contained malware attachments. They were posing as a
Speaker 1: normal file. It looked like an innocent file. Opening the
Speaker 1: file would install the malware on the target machine. The
Speaker 1: malware established an encrypted communication channel between the compromise systems
Speaker 1: and APT twenty nine. The malware also could escalate privileges,
Speaker 1: meaning the malware was able to trick computers into giving
Speaker 1: the attackers admin level access to the system so they
Speaker 1: could steal information send it back to their own computers
Speaker 1: over this encrypted channel of communication, and because of this
Speaker 1: they were largely undetected for a while. The second attack
Speaker 1: happened in that was a P twenty eight. They sent
Speaker 1: out an email to a large number of people in
Speaker 1: the d n C. The email posed as an organization
Speaker 1: wide policy that would require users to reset their passwords,
Speaker 1: saying passwords have expired. You need to go and follow
Speaker 1: this link and reset your password. So they would go
Speaker 1: to a link and that led to a website that
Speaker 1: was made to look like it was an official d
Speaker 1: NC site, but in fact it was a phishing site,
Speaker 1: so they would guide users to enter their user names
Speaker 1: and their passwords and a new password. Ostensibly so that
Speaker 1: they could reset their passwords, but in reality, the hackers
Speaker 1: were gathering log and credentials and they were just shipp
Speaker 1: shipping them straight to APT. The investigation into those attacks
Speaker 1: is still ongoing, but from what we know, it seems
Speaker 1: pretty certain the attackers were Russian civilian and military intelligence services.
Speaker 1: So you have a group of Russian hackers targeting a
Speaker 1: United States political parties UH systems, and that's a big
Speaker 1: scary thing. No matter what country you live in or
Speaker 1: what country uh you know, no matter which countries are involved,
Speaker 1: this kind of attack is a serious thing where one
Speaker 1: country is trying to influence the political outcome of another country.
Speaker 1: I don't care who you are. That's terrifying. The United States,
Speaker 1: by the way, has done not necessarily cyber crime kind
Speaker 1: of stuff like this, but the US certainly has a
Speaker 1: long history of trying to influence other nations and their
Speaker 1: political proceedings. So I'm not saying the US is innocent
Speaker 1: of those kind of things either, But it is terrifying
Speaker 1: to look at the way that you can actually leverage
Speaker 1: human psychology and have a big impact like this, And honestly,
Speaker 1: I think that's the most troubling thing about fishing attacks
Speaker 1: because they don't have to be sophisticated. There's no need
Speaker 1: to craft a super tricky code. You don't have to
Speaker 1: sit there and secretly infiltrate a computer system. Phishing works
Speaker 1: not because of the technology. I mean technology facilitates it.
Speaker 1: It makes it easier to steal information. But phishing works
Speaker 1: because of the way we humans work. It works because
Speaker 1: we're fallible. We can be tricked, we can be influenced.
Speaker 1: It shows yet again that no matter how secure a
Speaker 1: system is, no matter what technology you have put in place,
Speaker 1: the system is really only as good as the people
Speaker 1: who have access to it. If you design the world's
Speaker 1: most secure bank vault door and it has biometrics and
Speaker 1: voice activation and all this kind of stuff where only
Speaker 1: a select few are able to ever access it, and
Speaker 1: then I leave that door open while I dash off
Speaker 1: to go grab lunch, it doesn't do you any good.
Speaker 1: I have practiced very very very bad security protocol. Phishing
Speaker 1: works because we humans will often take these mental shortcuts
Speaker 1: and we won't use critical thinking. And it doesn't need
Speaker 1: to work every single time. In fact, pending upon the attack,
Speaker 1: it may need to only work once. So if there
Speaker 1: are ten thousand employees of a company, and you just
Speaker 1: need just one of them to click on a malicious attachment.
Speaker 1: That means all you need is a point zero one
Speaker 1: percent success rate. It does not have to be great,
Speaker 1: it just has to work once. So it's no surprise
Speaker 1: that there's so many phishing attacks out in the wild.
Speaker 1: They get results, and they don't need a lot of
Speaker 1: people to fall for them to be effective. That's all
Speaker 1: Also why there's a lot of crappy ones out there,
Speaker 1: because why put in the effort to design something really,
Speaker 1: really good If you can still get hits with something
Speaker 1: that's crappy. That will save you time and effort. So
Speaker 1: just go ahead send the crappy thing out. You won't
Speaker 1: get quality hits, but you'll still get hits. To defeat
Speaker 1: phishing scams, we can institute different protocols and protections to
Speaker 1: help weed out spam emails before they ever get to
Speaker 1: a user, and obvious scams that kind of thing. We
Speaker 1: can blacklist certain uh I P addresses, but ultimately we
Speaker 1: have to rely on people resisting those attempts to influence
Speaker 1: them and use a bit of critical thinking. Now. I
Speaker 1: know I've talked a lot about critical thinking over the
Speaker 1: last two weeks, I'm gonna give it a rest. I'm
Speaker 1: gonna switch gears for the rest of this week, sort of.
Speaker 1: I always try to use critical thinking whenever I'm putting
Speaker 1: a show together, so there is some going on in
Speaker 1: the back end, but I'm not gonna harp on about
Speaker 1: it anymore for the rest of this week. Instead, we're
Speaker 1: going to talk about speech recognition, natural language processing, and
Speaker 1: voice assistant slash virtual assistant slash. It's hard to come
Speaker 1: up with a name for them, but you know, I'm
Speaker 1: talking about your series, your Alexas, your Google assistants, that
Speaker 1: kind of thing. So that's where we're going to concentrate
Speaker 1: on for the rest of this week. If you guys
Speaker 1: have any suggestions for future episodes of Tech Stuff, whether
Speaker 1: it's a specific technology, maybe it's a policy relating to tech.
Speaker 1: Maybe it's a company or a person in technology. Maybe
Speaker 1: there's someone you want me to interview or have on
Speaker 1: as a special guest, Please let me know. Send me
Speaker 1: a message. My email address for this show is tech
Speaker 1: Stuff at how stuff works dot com, or you can
Speaker 1: drop me a line on Facebook or Twitter. The handle
Speaker 1: for both of those is tech Stuff hs W. Don't
Speaker 1: forget to follow us on Instagram and I'll talk to
Speaker 1: you again really soon. For more on this and thousands
Speaker 1: of other topics, because it how stuff works. Dot com