69% of IT Departments have been Targeted by Vishing Attacks

A well-known social engineering method is to call a user and pretend you come from IT support and need the user’s password to solve an important technical issue. Other scams include phoning the finance department and impersonating the CEO to get a fast money transfer.

According to the latest Quarterly Threat Trends & Intelligence Report from Agari and PhishLabs, Vishing has grown 550% from quarter 1 2021 to quarter 1 2022!

The growth is of a magnitude where much more attention is required from IT security organizations to come forward with recommendations to protect against vishing attacks.

The IT staff is generally essential for hackers as they have access to critical It-infrastructure. Obtaining their credentials is much more valuable than getting a password for an ordinary user.

A few years back, Service Desk Institute (SDI) conducted a survey amongst their members funded by us. 78% of the managers feared that a criminal could persuade their staff to give away a password.

The question: “Despite your authentication process, do you think a criminal (internal or external) can get a password for a legitimate user’s account?

Of those who answered with YES or NO, 78% said YES. Only 22% are confident that their staff has strong enough procedures and training not to be victims of social engineering.

Indeed, 14% had done all they could but realized the risk remained. This is probably how it is when humans with emotions control a process!

We might think that stolen passwords result from phishing attacks, where the criminal then uses the password for his attack. But then, hackers have other ways to obtain passwords.

Verizon DBIR 2022: Only 41% of Business Email Compromises (BEC) involved Phishing. Of the remaining 59%, 43% (in total = 25%) used stolen credentials against the victim organizations.

The most recommended mitigation against Vishing is the training of the employees. The IT security consulting group Social-Engineer, LLC has published a case study from one of their assignments at a customer of app 18,000 employees.

Initially, tests found a compromise rate of 46% and a 36% shutdown rate. After four years of engagement, dramatic improvements were observed: 28.3% compromise rate and 71.6% shutdown rate. https://www.social-engineer.com/wp-content/uploads/2021/06/A-Case-Study-in-Vishing.pdf

The case illustrates that awareness and training can achieve significant improvements. But it also tells us that a hacker dedicated to the task with persistence can get results. It is tough to predict and control human interactions.

If a user has access to his corporate network and needs to verify him on the phone, you can email him and ask him to read out the text or number you send. But if he has forgotten the password or claims he has (as in a forgotten password situation) and is without access to his corporate email, how can the user verify his identity?

Suppose you ask a supporter at the service desk how often a unique verification method is successful. In that case, we have the risk that the supporter in sympathy for the user “helps” a bit simply because the supporter wants to help.

We have found objective facts from customers’ experience with self-service password solutions, where everything is logged in the verification process. We have analyzed more than 32,000 self-service transactions from our customers to see what the user herself can contribute to the verification steps. The FastPass self-service solution for password reset in most installations allows the user to select between multiple verification methods – in many cases, and they must use two factors to reset the password.

In the logs, we can see if a user tries using a method and then fails. They might then try another test or call the service desk.

We can see that users in 36% of the cases need help remembering the correct answers to their challenge questions.

However, using TOTP tokens has a success rate of 95%. In most cases, the tokens reside on the user’s smartphone. A TOTP or a Push based app can be an excellent proof of verification.

It happens, however, that the user’s phone is lost or forgotten, and you still want them back at work or assist them with essential data for their task. Then you have to find other ways to verify them on the phone.

When he calls for passwords or information, a social engineer will either spoof a phone number or claim it is forgotten. So, you must be able to distinguish between the legitimate user and the false user.

Combining dynamic and contextual data from the system not available to any hacker will add a layer of security, which means we can verify the actual users and discard the false. When in doubt, call a trusted colleague to verify the person.

What are the social engineers hoping to get from their activity? Passwords!

Alex Weinert (Director of Identity Security at Microsoft) states: “Remember that all your attacker cares about is stealing passwords… That’s a key difference between hypothetical and practical security.” 

The first summary illustration in the Verizon 2022 DBIR stated that 50% of data breaches could be attributed to leaked credentials (passwords).

This confirms numerous other studies proving that hackers need passwords as one piece of their puzzle. Password Policies to prevent users from making easy-to-guess passwords are critical. But hackers get even more complex passwords if they use social engineering! Protection of passwords must include protective actions against social engineering.

What can a competent hacker expect to achieve with a vishing campaign against a specific target? Is it really that social engineering with phones will get the desired results?

To assess the scope of the problem, Group-IB carried out a social engineering penetration testing project:

“Of the more than 100 social engineering testing projects we conducted in 2020, we discovered that voice calls (“vishing”) were more effective than phishing emails with links to fake resources or executable attachments. Vishing, which had a success rate of 37%, is particularly effective because victims do not usually expect these calls”….” Vishing combined with Phishing (with both a link to a fake resource and an executable attachment) delivered ultimate efficiency: 75% of our social engineering testing attacks were successful in 2020.

This means that a criminal can get information about critical infrastructure, other employees, and their passwords at a meager cost – and no real risk at this stage. Data breaches are a business now, and the hackers’ efforts are directed where the best price/performance can be achieved. This 37% or 75% success rate explains the 550% growth of Vishing.