1
00:00:06,330 --> 00:00:07,560
- [Instructor] In this
segment, we're going

2
00:00:07,560 --> 00:00:09,990
to focus in on phone and text spoofing

3
00:00:09,990 --> 00:00:14,133
and how it can be used for
pretexting and impersonation.

4
00:00:15,450 --> 00:00:18,090
Pretexting being a fabricated scenario.

5
00:00:18,090 --> 00:00:21,000
Impersonation, also
referred to as spoofing,

6
00:00:21,000 --> 00:00:23,430
is pretending to be someone else.

7
00:00:23,430 --> 00:00:27,030
Well, to make these type
of attacks very effective

8
00:00:27,030 --> 00:00:28,680
it's critical that the attackers

9
00:00:28,680 --> 00:00:31,110
have good supporting collateral.

10
00:00:31,110 --> 00:00:33,270
So in this segment,
we're gonna take a look

11
00:00:33,270 --> 00:00:36,480
at how easy it is to
display a caller ID number

12
00:00:36,480 --> 00:00:40,200
or a text origination number
of the attacker's choice

13
00:00:40,200 --> 00:00:44,520
to immediately establish trust
with the intended victim.

14
00:00:44,520 --> 00:00:47,790
So we're gonna go to a
site called spoofcard.com.

15
00:00:47,790 --> 00:00:50,970
Now, please note, I am
not in any way suggesting

16
00:00:50,970 --> 00:00:54,330
that this is a malicious
or a nefarious service.

17
00:00:54,330 --> 00:00:56,280
There's really very legitimate uses

18
00:00:56,280 --> 00:01:00,120
for services like this,
specifically protecting privacy.

19
00:01:00,120 --> 00:01:03,120
For example, perhaps
you're a physician on call,

20
00:01:03,120 --> 00:01:05,400
you're returning a patient's call,

21
00:01:05,400 --> 00:01:07,170
you're using your private cell number,

22
00:01:07,170 --> 00:01:11,310
but you don't want that number
to show up on the caller id.

23
00:01:11,310 --> 00:01:15,030
So instead, you can put
an alternate number.

24
00:01:15,030 --> 00:01:17,340
Now, in the terms and
conditions of SpoofCard,

25
00:01:17,340 --> 00:01:20,790
they are very, very clear
that this service is not

26
00:01:20,790 --> 00:01:25,230
to be used for any fraudulent
or illegal purposes.

27
00:01:25,230 --> 00:01:29,043
But you can imagine how technology
like this can be misused.

28
00:01:30,570 --> 00:01:35,040
The attacker controls a
display caller ID number,

29
00:01:35,040 --> 00:01:36,990
perhaps displaying a local number,

30
00:01:36,990 --> 00:01:40,470
a recognizable number or a trusted number.

31
00:01:40,470 --> 00:01:42,750
And there's more, there's an option

32
00:01:42,750 --> 00:01:45,690
to send the call straight to voicemail,

33
00:01:45,690 --> 00:01:48,360
allowing the attacker to set up a scenario

34
00:01:48,360 --> 00:01:51,810
that they can build upon,
perhaps leaving multiple messages

35
00:01:51,810 --> 00:01:54,540
and/or request a call back
at a different number,

36
00:01:54,540 --> 00:01:56,193
maybe even an 800 number.

37
00:01:57,217 --> 00:02:01,500
Another option is to
disguise the caller's voice

38
00:02:01,500 --> 00:02:05,430
as a man or as a woman,
or include specific types

39
00:02:05,430 --> 00:02:07,023
of background noises.

40
00:02:07,860 --> 00:02:11,520
And the same type of
technology can and is used

41
00:02:11,520 --> 00:02:15,240
for texting to disguise
the text origination number

42
00:02:15,240 --> 00:02:17,400
and to allow texts to be sent back

43
00:02:17,400 --> 00:02:19,800
and forth from that number.

44
00:02:19,800 --> 00:02:22,953
Really, really enhancing legitimacy.

45
00:02:24,750 --> 00:02:27,300
You know, over the years
we've all become inundated

46
00:02:27,300 --> 00:02:30,480
with phishing emails, you
know, and we've become jaded

47
00:02:30,480 --> 00:02:33,300
and generally pretty
good at ignoring them.

48
00:02:33,300 --> 00:02:35,550
But, you know, it's quite the opposite

49
00:02:35,550 --> 00:02:38,280
with phone and with text.

50
00:02:38,280 --> 00:02:41,070
Because those feel more
personal, we're inclined

51
00:02:41,070 --> 00:02:45,720
to be trusting, or at
the very least curious.

52
00:02:45,720 --> 00:02:47,220
You know, I think it is so important

53
00:02:47,220 --> 00:02:49,380
to demonstrate this type of technology

54
00:02:49,380 --> 00:02:53,010
to our user communities to
enhance their awareness.

55
00:02:53,010 --> 00:02:55,410
And I guarantee when you show them this,

56
00:02:55,410 --> 00:02:59,373
it will absolutely be
an aha moment for them.

57
00:03:00,270 --> 00:03:02,610
And that my friend, is a closer look

58
00:03:02,610 --> 00:03:04,353
at phone and text spoofing.