Blog, FastPassCorp IVM Blog
69% of IT Departments have been Targeted by Vishing Attacks | FastPass
69% of IT Departments have been Targeted by Vishing Attacks
This article was originally published by LOGON’s partner FassPassCorp. Click here to view the original article.
Here is a Summary of the Key Numbers:
If you want to hack an IT system, the IT people are the prominent group. They know (or should know) about Phishing and are not easy targets for phishing and smishing campaigns. This might explain the strong growth in vishing attacks against IT departments.
According to Statista, 69% of IT departments have been targeted by Vishing attacks in 2021, an increase of 54% from 2020 based on 600 interviews. If a hacker successfully gains the relevant data from the IT department, they have the keys to the castle! A hacker only needs to succeed once to make it very profitable.
We think the 69% who reported the incident have avoided being victims. The real victims who have disclosed important information, including passwords, probably don’t know what happened! We can safely conclude that more than 2/3 of IT departments have been attacked, and we don’t have the numbers for the success rate.
A well-known social engineering method is to call a user and pretend you come from IT support and need the user’s password to solve an important technical issue. Other scams include phoning the finance department and impersonating the CEO to get a fast money transfer.
According to the latest Quarterly Threat Trends & Intelligence Report from Agari and PhishLabs, Vishing has grown 550% from quarter 1 2021 to quarter 1 2022!
The growth is of a magnitude where much more attention is required from IT security organizations to come forward with recommendations to protect against vishing attacks.
The IT staff is generally essential for hackers as they have access to critical It-infrastructure. Obtaining their credentials is much more valuable than getting a password for an ordinary user.
A few years back, Service Desk Institute (SDI) conducted a survey amongst their members funded by us. 78% of the managers feared that a criminal could persuade their staff to give away a password.
The question: “Despite your authentication process, do you think a criminal (internal or external) can get a password for a legitimate user’s account?
Of those who answered with YES or NO, 78% said YES. Only 22% are confident that their staff has strong enough procedures and training not to be victims of social engineering.
Indeed, 14% had done all they could but realized the risk remained. This is probably how it is when humans with emotions control a process!
We might think that stolen passwords result from phishing attacks, where the criminal then uses the password for his attack. But then, hackers have other ways to obtain passwords.
Verizon DBIR 2022: Only 41% of Business Email Compromises (BEC) involved Phishing. Of the remaining 59%, 43% (in total = 25%) used stolen credentials against the victim organizations.
The most recommended mitigation against Vishing is the training of the employees. The IT security consulting group Social-Engineer, LLC has published a case study from one of their assignments at a customer of app 18,000 employees.
Initially, tests found a compromise rate of 46% and a 36% shutdown rate. After four years of engagement, dramatic improvements were observed: 28.3% compromise rate and 71.6% shutdown rate. https://www.social-engineer.com/wp-content/uploads/2021/06/A-Case-Study-in-Vishing.pdf
The case illustrates that awareness and training can achieve significant improvements. But it also tells us that a hacker dedicated to the task with persistence can get results. It is tough to predict and control human interactions.
If a user has access to his corporate network and needs to verify him on the phone, you can email him and ask him to read out the text or number you send. But if he has forgotten the password or claims he has (as in a forgotten password situation) and is without access to his corporate email, how can the user verify his identity?
Suppose you ask a supporter at the service desk how often a unique verification method is successful. In that case, we have the risk that the supporter in sympathy for the user “helps” a bit simply because the supporter wants to help.
We have found objective facts from customers’ experience with self-service password solutions, where everything is logged in the verification process. We have analyzed more than 32,000 self-service transactions from our customers to see what the user herself can contribute to the verification steps. The FastPass self-service solution for password reset in most installations allows the user to select between multiple verification methods – in many cases, and they must use two factors to reset the password.
In the logs, we can see if a user tries using a method and then fails. They might then try another test or call the service desk.
We can see that users in 36% of the cases need help remembering the correct answers to their challenge questions.
However, using TOTP tokens has a success rate of 95%. In most cases, the tokens reside on the user’s smartphone. A TOTP or a Push based app can be an excellent proof of verification.
It happens, however, that the user’s phone is lost or forgotten, and you still want them back at work or assist them with essential data for their task. Then you have to find other ways to verify them on the phone.
When he calls for passwords or information, a social engineer will either spoof a phone number or claim it is forgotten. So, you must be able to distinguish between the legitimate user and the false user.
Combining dynamic and contextual data from the system not available to any hacker will add a layer of security, which means we can verify the actual users and discard the false. When in doubt, call a trusted colleague to verify the person.
What are the social engineers hoping to get from their activity? Passwords!
Alex Weinert (Director of Identity Security at Microsoft) states: “Remember that all your attacker cares about is stealing passwords… That’s a key difference between hypothetical and practical security.”
The first summary illustration in the Verizon 2022 DBIR stated that 50% of data breaches could be attributed to leaked credentials (passwords).
This confirms numerous other studies proving that hackers need passwords as one piece of their puzzle. Password Policies to prevent users from making easy-to-guess passwords are critical. But hackers get even more complex passwords if they use social engineering! Protection of passwords must include protective actions against social engineering.
What can a competent hacker expect to achieve with a vishing campaign against a specific target? Is it really that social engineering with phones will get the desired results?
To assess the scope of the problem, Group-IB carried out a social engineering penetration testing project:
“Of the more than 100 social engineering testing projects we conducted in 2020, we discovered that voice calls (“vishing”) were more effective than phishing emails with links to fake resources or executable attachments. Vishing, which had a success rate of 37%, is particularly effective because victims do not usually expect these calls”….” Vishing combined with Phishing (with both a link to a fake resource and an executable attachment) delivered ultimate efficiency: 75% of our social engineering testing attacks were successful in 2020.
This means that a criminal can get information about critical infrastructure, other employees, and their passwords at a meager cost – and no real risk at this stage. Data breaches are a business now, and the hackers’ efforts are directed where the best price/performance can be achieved. This 37% or 75% success rate explains the 550% growth of Vishing.
Some Real-Life Vishing Attacks on IT-departments
The above-cited statistics show that some risk for vishing attacks against IT departments exists, but do we know of actual life breaches? We have some prominent examples of this:
- Twitter: Lessons learned from the Twitter Hack of 2020
- Robinhood Data Breach: Robinhood Data Breach
- CISCO: CISCO Corporate Networked Breached
…but we believe it to be much more widespread. When a stolen password is part of an attack, it is tough to research how the hacker has stolen it. The hack might even go unnoticed in some cases, where the criminal “only” steal a few million dollars and then vanishes without a trace.
We note that the list only includes IT companies and Internet-based businesses. It is unlikely that these are the only verticals to be attacked, and it might be so that they are open and disclose their findings. Considering the facts in this blog, many more organizations must have been victims of vishing attacks. They might prefer to keep quiet about it or not even know it has happened!!
Conclusion
Vishing is growing fast because it works and is difficult to prevent, as social engineering is about human behavior and emotions.
The IT department, which is responsible for IT security, is a target too because they have the most valuable assets = the credentials!
Passwords are a necessary piece in the puzzle for hackers, and they can get the passwords from the IT end-user service centers through phone-based social engineering = vishing.
- Criminals phone the IT departments for passwords because it gives them the necessary results at the lowest cost.
- User verification must include IT workflow with multiple verifications
- IT service desks are not prepared for vishing attacks
IT management can decide to do something about it now and protect their assets before the hackers start calling in. Or wait and be surprised when it happens.
Stop social engineering against your service desk
Workflow for secure verification of employees phoning in to get a service, like a new password, personal information, payment transaction, etc.
Get a Free Demo
Book a demo with our specialist to discover how IVM stops social engineering attacks against your service desk
Read Next:
