In this lesson, we are going to focus
on impersonation as a social engineering attack.
When it comes to impersonation
as a social engineering technique, there are four main forms
of impersonation used by attackers.
These are impersonation, brand impersonation,
typosquatting, and watering hole attacks.
First, we have impersonation.
Impersonation refers to an attack
where an adversary assumes the identity
of another person to gain unauthorized access
to resources or steal sensitive data.
Impersonation can be accomplished
through pretending to be someone that people like and trust
or by pretending to be someone
with authority that will intimidate users
to give out some kind of sensitive
or confidential information.
In order for an attacker to perform a successful
impersonation attack, the attacker must first
collect information about the organization so
that they can more easily earn the trust
of the targeted users.
For example, if I randomly call one
of your employees and just to tell them that I might
work in the same company, that could be constructed
as an obvious social engineering attack.
However, if I call the same employee and tell them
that I'm Mike from the IT department located up
on the third floor, and I was just calling and check and see
if their workstation has faced some of the same issues
as the other employees have been reported, it's very likely
that they will assume that the attacker is really
from the IT department and the victim is more
likely to cooperate with the attacker's request.
In this case, providing more details
help to make the lies more believable to a potential victim.
Impersonation attacks can lead to severe consequences
including unauthorized access to sensitive data
disruption of services, or even a complete system takeover.
To mitigate against these types of attacks
organizations must provide security awareness training
to their employees on a regular basis
so that they remain vigilant against these future attacks.
Second, we have brand impersonation.
Brand impersonation is a more specific form
of impersonation where an attacker pretends
to represent a legitimate company or brand.
This is often seen in phishing attacks or social media
based attacks where attackers send emails
or create a website that appears to be
from a reputable company in order to trick victimized users
into revealing sensitive information.
When conducting brand impersonation, the attacker
will use the brand's logo, marketing language
and other identifiable information to make the fraudulent
communications or websites appear to be more legitimate
than they really are.
To protect against brand impersonation, organizations
should educate their users about these types of threats,
use secure email gateways to filter out phishing emails
and regularly monitor the brand's online presence
to detect any fraudulent activities as soon as they occur.
In November of 2020, a fake Twitter account impersonating
the Eli Lilly and Company brand, a major manufacturer
of insulin in the United States, tweeted that insulin
would now be free for all its customers.
This tweet rapidly went viral and was spread
far and wide across the internet.
Unfortunately, though, this was just a brand
impersonation attack conducted against Eli Lilly
and when the investors of the Eli Lilly stock saw the tweet
which they believed to be true and authentic
they began to sell off their shares of the company
which resulted in a 4% decrease
in the stock price in less than 24 hours.
This resulted in Eli Lilly losing billions of dollars
in market capitalization value
simply because a social engineer
created a brand impersonation account
on Twitter and sent out a single malicious tweet.
Third, we have typosquatting.
Typosquatting,
also known as URL hijacking or cyber-squatting,
a form of cyber attack where an attacker registers a
domain name that is similar to a popular website
but contains some of the common typographical errors.
The goal of typosquatting is to victimize users
who may have accidentally mistyped the URL of a website
and instead it redirects them to a fraudulent website owned
by the attacker that is now attempting
to steal their information
or infect their system with malware.
For instance
an attacker might register a domain like gnail.com
hoping to catch users who misspelled gmail.com.
These fraudulent domains are often called cousins,
lookalikes, or doppelganger domains.
Another good example
of this is when an attacker buys a domain
like Di0ntraining.com instead of Diontraining.com
but the first one has a zero instead of a O.
It's hard to see and can be used
to trick users pretty easily
if they're not looking carefully at the URL or web link.
Another way that typosquatting is used
is by registering a hijacked sub-domain
using the primary domain
of a trusted cloud provider such as Azure.com.
Then the attacker can send out phishing emails
that appear to come from Diontraining.Azure.com
which looks legitimate, but the company may not
use that cloud service provider at all.
In the case of Dion Training, at the time of this recording
we don't use Azure for our cloud services
and we instead use Amazon Web Services.
So if you're receiving an email
from Diontraining.Azure.com, then you would know it is
a form of typosquatting or impersonation.
To combat typosquatting,
organizations will often register common
misspellings of their own domain names, use services
that monitor for similar domain registrations
and conduct user security awareness training
to educate users about the risk of typosquatting.
For example, the certification company Accolade
owns the website, Accolade.com, but also owns the
misspelling of their name as acclade.com
which redirects users to their legitimate website
to prevent someone from buying the misspelled domain
in order to trick any Accolade users.
Fourth, we have watering hole attacks.
Watering hole attacks are a targeted form
of cyber attacks where attackers compromise
a specific website or service
that their target is known to use.
Once the site is compromised
the attacker can use it to deliver malware
or launch other attacks against the target
through the watering hole that they have established.
Watering hole attacks are considered to be passive attacks
since the threat actor does not communicate directly
with the target and instead attacks them
through the use of third party websites or services.
Now, the term watering hole is a metaphor
for a naturally occurring phenomenon
in the African plains, predators will often wait
at a watering source like river or a lake
that they often see other animals returning
to in order to drink water and hydrate themselves.
Since the animals go to the same watering hole each day
the predators can wait near the watering hole
and attack the unsuspecting animal
as they approach the watering source to quench the thirst.
In the world of cybersecurity,
the quote unquote "Watering hole" the attacker
chooses to use will usually be a trusted website
or online service.
To mitigate watering hole attacks
organizations should keep their systems and software
up to date, use threat intelligence services
to stay informed about new threats
and employ advanced malware detection and prevention tools.
So remember, there are four basic forms
of impersonation attacks, including impersonation
brand impersonation, typosquatting
and watering hole attacks.
Impersonation refers
to an attack where an adversary assumes the identity
of another person to gain unauthorized access
to resources or sensitive data.
Brand impersonation is a more specific form
of impersonation where an attacker pretends
to represent a legitimate company or brand.
Typosquatting also known as URL Hijacking
or cyber-squatting is a form of a cyber attack where
an attacker will register a domain name that is similar
to a popular website
but contains some type of common typographical errors.
Watering hole attacks are a targeted form of
a cyber attack where attackers compromise a specific website
or service that their target is known to use.
It is important to understand these threats so
that you can implement the appropriate countermeasures
required to maintain a safe
and secure computing environment.