Hacking Tweeps: Twitter and LinkedIn as social engineering tools

“My internal marketing department is looking to issue a communication around Twitter account security (with a business focus).”

Use of Twitter is growing, not only between individuals connecting with their “tweeps,” but also for businesses connecting with their customers, or politicians with their constituents. Twitter has become a forum for sharing all manner of expression on all subjects.

That’s why businesses need to take special care in their security training regarding Twitter and other types of social media.

Twitter and LinkedIn are fertile sources of information for hackers preparing a social engineering attacks. By gathering benign information about a company and “name dropping” in a DM (direct message) conversation, attackers may build a level of trust with insiders and thereby gain secrets.

Employees post seemingly innocuous information on Twitter that may be gathered and assembled by an adversary easily. For example, photos of office space and co-workers, descriptions of work (My d-bag boss makes me fill in his TPS report every Friday #ihateexcel), and names of customers or clients, all reveal enough information for an attack to recruit unwitting accomplices.

I’ve used that technique in my operational penetration testing. I will call an employee claiming to be a new guy from a different office, and that my boss is yelling at me to give him a weekly TPS report, and that I’m having trouble with the macros, “could you please forward me one of yours so I could copy the formulas….”

I recommend a business have a policy that is well-“socialized” around the office with the following components.

  • Encourage employees to limit posts to personal interests, and not related to their work, office, or co-workers
  • Never to share information with strangers, even longtime “connections” on LinkedIn or longtime “tweeps.” Instead refer them to your corporate webpage, or say you will have someone get back to them.
  • Always ask for a callback number or email address from anyone requesting information by phone, LinkedIn or Twitter, and forward the request security or to marketing.
  • Twitter profiles should not indicate place of employment.
  • LinkedIn profiles can be more complete, but only connect with people you actually know or who are personally introduced to you. (Social Engineers create fake, legitimate-sounding profiles on LinkedIn and connect to hundreds of people in a particular industry to appear legitimate.) Just because a person is connected to (or follows) many of the same people as you, does not mean that they are legit.

Twitter and LinkedIn are great tools for business, which, if used properly by well-informed employees, won’t be a gateway for hackers.


Categories: Uncategorized

Avoid the ROI trap

September 22, 2014 1 comment

When legendary former Gartner analyst, Vic Wheatman, and I discussed our latest webinar, we tackled the issue of creating and measuring value.

After the webinar ended, my wheels kept turning as I considered some research I’d completed recently. For one thing, I learned that CEOs think security executives are excellent security managers — but downright rotten business-people.

source Getty Images

source Getty Images

Specifically, CEOs complain that security executives still have the mentality of “keeping bad things from happening” rather than the more business-minded approach of “adding value to the business.”

Here’s the trap. Solving a security problem under budget is not a matter of “finding the best deal.” It is a matter of solving the problem most cost-effectively.  Click here for the recorded webinar.  And read more HERE.


Why Worry About Public Surveillance? Are you Hiding Something?

September 15, 2014 1 comment

In the aftermath of the killing in Ferguson, MO, three police officers – none of whom are from the Ferguson police department – were suspended after blatantly racist and extremist comments and unacceptable behavior. A Rock Island, IL sheriff recently pled guilty to cyberstalking and resigned.

Do you think that, given an opportunity, these local law enforcement officers and others of their ilk would use information gleaned from your cell phone in a responsible manner? Would they respect information privacy?

Local law enforcement does have the opportunity. In September, news broke that owners of encrypted cell phones had identified 19 fake cell phone towers in various parts of the United States; it wasn’t long before the towers were connected to the NSA, as well as local, regional and state law enforcement.

This enables something as simple as tracking a user’s location or as potentially sinister as so-called “Man in the Middle” attacks where calls and texts can be heard or read before being forwarded on to a legitimate cell tower and the intended recipient. Is this a violation of physical security or cybersecurity? Or both?

Do you trust your local law enforcement to protect your information privacy? How many police officers or sheriff’s deputies are trained to understand these limits? In Florida a local police department used cell phone location information to conduct a search without a warrant. What else can and will they do? What have they done?

And what does this do to our expectations of information privacy?

Categories: Uncategorized

Google says Don’t Worry

September 15, 2014 1 comment

“Google Says Not to Worry About 5 Million ‘Gmail Passwords’ Leaked” So said a headline on forbes.com. If you have a gmail account, were you at all concerned that your email address and password was among the 5 million? Of course you were.

Continued data breaches are a cybersecurity headache. They’re also a major public relations nightmare. Telling your customers not to worry doesn’t sound like a good strategy.

So far no one is saying how the Russian Bitcoin security forum actually got the gmail addresses paired with the passwords. Some speculate that, instead of a gmail data breach, whoever was responsible grabbed them from other sites at which gmail customers used their emails and passwords to sign in.

It’s still a public relations problem for Google. Covering various parts of your body and telling everyone not to worry only serves to make people leery. They don’t believe you and suspect your ability to handle cybersecurity and even physical security.

So, whether it’s a data breach or some other problem, most PR professionals believe honesty is the best policy. Tell people their information privacy has been violated, whether via a cybersecurity or physical security breach. Give them directions for changing their passwords. Admit you don’t know what happened, but, by golly, you’re going to find out. And apologize. For goodness sakes, apologize.

People understand apologies, especially if they are followed by a vow to find and fix the problem.

Then tell them when it’s fixed.

Categories: Uncategorized

Your CISO will soon need more clout

September 4, 2014 1 comment

If consumers weren’t skittish enough, Home Depot recently joined the rapidly lengthening list of big box retailers experiencing sometimes prolonged data breaches: Albertson’s, Dairy Queen, The UPS Store, Sally Beauty, Target, Michael’s, Neiman Marcus, P.F. Chang’s and SuperValu.

More than a few Chief Information Security Officers (CISO) must be nervous. In fact, it may be forcing corporations who do not have a CISO to rethink that strategy. Often the CISO position is folded in with or serves under the Chief Information Officer (CIO) or even, if the CIO reports to the Chief Financial Officer (CFO), as is the case in some organizations, two layers under the seat of power. So, the person charged with security risk management may not have the authority to get things done.

With the recent spate of high profile data breaches, translating the message up the chain or even the perception that the CISO’s job is not important enough to be a direct report may not cut it anymore. Shareholders and customers want answers.

Consumers also are flocking to convenient online sites, where they have few other choices than to use a credit or debit card.

Data breaches, whether prolonged or short lived, especially those that compromise customer information, are black eyes that eventually will force consumers to keep their credit and debit cards at home. Having the man or woman in charge of mitigating IT risk fairly far down the food chain doesn’t look good, no matter whose ear he or she may have.


How Geeky Should a CISO Be?

August 26, 2014 2 comments

Michael Daniel, the current White House cybersecurity coordinator, recently admitted to lacking technical know-how; i.e. he can’t code and doesn’t feel the need to learn to do so. Those who have the technical expertise and think it’s important have lit up the Internet with their cries, making it clear that they do not approve.

Does it matter that Michael Daniel can’t code? Read More…michael daniel

GRC is not about Risk or Compliance

August 26, 2014 3 comments

In my earlier post, “Security is Not the Point,” I explained why to most people security is an annoying layer of cost and inconvenience. I said that no one wants security, they want the benefits of security. But if security is not the point, what is?

The last time you had to do some tedious paperwork, you were no doubt muttering under your breath that you’d rather be doing the actual project and not filling out forms and writing a report. We are all like that. Documenting tasks and processes is not fun.

Compliance is like that, too. It is considered the necessary evil, the tedious paperwork required by “the powers-that-be” to meet some basic level of due care. Compliance requirements define the “minimums” for demonstrating that the business is being run responsibly.

However, compliance has a more attractive cousin. Read more HERE.



Get every new post delivered to your Inbox.