This data is collected, collated, stored and analyzed by various organizations, from large social media companies to app creators and data brokers. As you can imagine, your digital footprints put your privacy at risk, but they also affect cybersecurity.
As a cybersecurity researcher, I follow the threat that digital footprints represent in cybersecurity. Hackers can use personal information collected online to find answers to security challenge questions like “in which city did you meet your spouse?” or perfect phishing attacks by posing as a colleague or co-worker. When phishing attacks are successful, they give attackers access to networks and systems that victims are authorized to use.
Flowing footprints for better bait
Phishing attacks have doubled since the beginning of 2020. The success of phishing attacks depends on the authenticity of the content of the messages to the recipient. All phishing attacks require certain information about the targeted individuals, and this information can be obtained from their fingerprints.
Hackers can use freely available open source intelligence gathering tools to uncover the digital footprints of their targets. An attacker can mine a target’s digital fingerprints, which can include audio and video, to extract information such as contacts, relationships, profession, career, likes, dislikes, interests, hobbies, travel, and hangouts.
They can then use this information to create phishing messages that appear more like legitimate messages from a trusted source. The attacker can deliver these personalized messages, spear phishing emails, to the victim or compose as the victim and target the victim’s colleagues, friends and family. Spear phishing attacks can fool even those who are trained to recognize phishing attacks.
One of the most successful forms of phishing attacks has been business email compromise attacks. In these attacks, attackers pose as people with legitimate business relationships (colleagues, vendors, and customers) to initiate fraudulent financial transactions.
A good example is the targeted attack on Ubiquity Networks Inc. in 2015. The attacker sent emails that appeared to come from top executives to employees. The email requested employees to make electronic transfers, resulting in fraudulent transfers of $46.7 million.
Access to a phishing victim’s computer can give the attacker access to the networks and systems of the victim’s employer and clients. For example, one of the employees of the Target retailer’s HVAC supplier was the victim of a phishing attack.
The attackers used his workstation to gain access to Target’s internal network and then to its payment network. The attackers took the opportunity to infect the point-of-sale systems used by Target and steal data from 70 million credit cards.
A big problem and what to do about it
Computer security company Trend Micro found that 91 percent of attacks in which attackers gained undetected access to networks and used that access over time began with phishing messages. The Verizon Data Breach Investigations Report found that 25 percent of all data breach incidents involved phishing.
Given the significant role phishing plays in cyber attacks, I believe it is important for organizations to educate their employees and members on managing their digital footprints. This training should cover how to find the scope of your fingerprints, how to browse safely, and how to use social media responsibly.
This is a PTI story distributed through The Conversation.