# data[].attributes.headline
What is Social Engineering and how it relates to cyber attacks?

# data[].attributes.subject
What is Social Engineering and how it relates to cyber attacks?

# data[].attributes.headline
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.subject
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.body
-> Compared to classical attacks such as password cracking by brute-force and software vulnerabilities exploit, social engineering exploits human vulnerabilities to bypass or break through security barriers, without having to combat with firewall or antivirus software by deep coding.

-> For some attack scenarios, social engineering can be as simple as making a phone call and impersonating an insider to elicit classified information.

-> The defense of software mainly focuses on the digital domain yet overlooks human factors in security. As the security technology develops day by day, the classical attacks become harder and more and more attackers turn to social engineering.

-> Human vulnerabilities seem inevitable, after all, there is not a cyber system that doesn't rely on humans or involve human factors on earth and these human factors are vulnerable obviously or can be largely turned into security vulnerabilities by skilled attackers.

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
The attackers may manipulate a small number of employees and use their credentials to access the company's internal systems. That’s what happened with one of twitter's hacks. They might take time and scout out the easiest entity working for their target, who can give them what they want and then get the sensitive information.

# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
To protect against social engineering, the fundamental work is to know what social engineering is, what entities significantly constitute or affect social engineering and how these entities relate to each other. Also only defining is not enough, work in terms of policies and education must be done to make those entities aware and secure against those attacks.

# data[].attributes.headline
How hackers take over your accounts using social engineering (Marketplace)

# data[].attributes.subject
How hackers take over your accounts using social engineering (Marketplace)

# data[].attributes.attachment_link.title
How hackers take over your accounts using social engineering (Marketplace)

# data[].attributes.attachment_link.provider_name
The Daily Swig | Cybersecurity news and views

# data[].attributes.attachment_link.readable_text
John Leyden 23 September 2021 at 15:11 UTC
Updated: 23 September 2021 at 15:18 UTC

The trojan horse in Spain is nothing but a pain

Spanish authorities are warning of a phishing campaign that impersonates messaging service WhatsApp in an attempt to trick recipients into downloading a trojan.

Recipients are being urged to download copies of conversations and call histories from a location that offers only the NoPiques malware.

The NoPiques ("Do not chop") trojan comes bundle in a .zip archive which, if opened and run on a vulnerable device, results in infection.

Believable phishing campaign

Dangerous emails typically come with the Spanish language subject line 'Copia de seguridad de mensajes de WhatsApp *913071605 Nº (xxxxx)', although this can vary.

Messages are written in grammatically correct Spanish, or at least with few errors - unlike many malware-peddling phishing messages in English and other languages.

The warning about the malware campaign comes from Oficina de Seguridad del Internauta (OSI) of the Spanish National Cybersecurity Institute (INCIBE).

The alert was promoted on social media by the Guardia Civil policing agency.
Read more about the latest phishing and social engineering attacks
The Daily Swig asked OSI to estimate the possible number of victims caught out by the scam. No word back as yet, but we'll update this story as and when more information comes to hand.

The latest attack follows a similar campaign that OSI warned about in March 2021.

The previous scam posed as messages from either WeTransfer, WhatsApp, Vodafone, the Spanish Ministry of Labor, or the Ministry of the Interior, but actually contained links that downloaded an (unnamed) trojan onto users' devices.

OSI has published a YouTube video (see below) offering advice on how to spot scam phishing messages that pose as communiques from trusted organization, such as government agencies and internet services firms.

YOU MIGHT ALSO LIKE Netgear fixes RCE flaw in routers' parental controls feature

# data[].attributes.attachment_link.title
Fake WhatsApp backup message delivers malware to Spanish speakers' devices

# data[].attributes.attachment_link.description
John Leyden 23 September 2021 at 15:11 UTC Updated: 23 September 2021 at 15:18 UTC The trojan horse in Spain is nothing but a pain Spanish authorities are warning of a phishing campaign that impersonates messaging service WhatsApp in an attempt to trick recipients into downloading a trojan.

# data[].attributes.attachment_link.title
Palestinian Hackers Tricked Victims Into Installing iOS Spyware

# data[].attributes.attachment_link.description
Hacking activity in the Gaza Strip and West Bank has ramped up in recent years as rival Palestinian political parties spar with each other, the Israeli-Palestinian conflict continues, and Palestinian hackers increasingly establish themselves on the global stage.

# data[].attributes.headline
Social Engineering Attack Demo - Kali Linux setoolkit - Cybersecurity - CSE4003

# data[].attributes.subject
Social Engineering Attack Demo - Kali Linux setoolkit - Cybersecurity - CSE4003

# data[].attributes.attachment_link.title
Social Engineering Attack Demo - Kali Linux setoolkit  - Cybersecurity - CSE4003

# data[].attributes.headline
This is how hackers hack you using simple social engineering

# data[].attributes.subject
This is how hackers hack you using simple social engineering

# data[].attributes.attachment_link.title
This is how hackers hack you using simple social engineering

# data[].attributes.attachment_link.readable_text
Last updated on July 30, 2020, at 5:45 PM PT with new sections below on "What we know now" and "What we're doing to protect our service".
----------------------------------------------------------------------------------------------------------
July 30, 2020
As our investigation continues, we're sharing an update to answer some of the remaining questions based on what we've discovered to date. We will provide a more detailed technical report on what occurred at a later date given the ongoing law enforcement investigation and after we've completed work to further safeguard our service.
What we know now
The social engineering that occurred on July 15, 2020, targeted a small number of employees through a phone spear phishing attack. A successful attack required the attackers to obtain access to both our internal network as well as specific employee credentials that granted them access to our internal support tools. Not all of the employees that were initially targeted had permissions to use account management tools, but the attackers used their credentials to access our internal systems and gain information about our processes. This knowledge then enabled them to target additional employees who did have access to our account support tools. Using the credentials of employees with access to these tools, the attackers targeted 130 Twitter accounts, ultimately Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7.

There has been concern following this incident around our tools and levels of employee access. To run our business, we have teams around the world that help with account support. Our teams use proprietary tools to help with a variety of support issues as well as to review content in line with The Twitter Rules and respond to reports. Access to these tools is strictly limited and is only granted for valid business reasons. We have zero tolerance for misuse of credentials or tools, actively monitor for misuse, regularly audit permissions, and take immediate action if anyone accesses account information without a valid business reason. While these tools, controls, and processes are constantly being updated and improved, we are taking a hard look at how we can make them even more sophisticated.

This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems. This was a striking reminder of how important each person on our team is in protecting our service. We take that responsibility seriously and everyone at Twitter is committed to keeping your information safe.

We've communicated directly with the impacted account owners and worked to restore access to any accounts who may have been temporarily locked out during our remediation efforts. Our investigation is ongoing, and we are working with the appropriate authorities to ensure that the people responsible for this attack are identified.
What we're doing to protect our service
Since the attack, we've significantly limited access to our internal tools and systems to ensure ongoing account security while we complete our investigation. As a result, some features (namely, accessing the Your Twitter Data download feature) and processes have been impacted. We will be slower to respond to account support needs, reported Tweets, and applications to our developer platform. We're sorry for any delays this causes, but we believe it's a necessary precaution as we make durable changes to our processes and tooling as a result of this incident. We will gradually resume our normal response times when we're confident it's safe to do so. Thank you for your patience as we work through this.

We're always investing in increased security protocols, techniques and mechanisms - it's how we work to stay ahead of threats as they evolve. Going forward, we're accelerating several of our pre-existing security workstreams and improvements to our tools. We are also improving our methods for detecting and preventing inappropriate access to our internal systems and prioritizing security work across many of our teams. We will continue to organize ongoing company-wide phishing exercises throughout the year.

We will continue to share updates and precautionary steps we take so that others can learn from this, too. We recognize the trust you place in us, and are committing to earning it by continued open, honest and timely updates anytime an incident like this happens.

---------------------------------------------------------------------------------------------------------
July 18, 2020
As we've been informing via the @TwitterSupport account, on Wednesday, July 15, 2020, we detected a security incident at Twitter and took immediate action. As we head into the weekend, we want to provide an overview of where we are.

In this post we summarize the situation as of July 17 at 8:35p Pacific Time. The following information is what we know as of today and may change as our investigation and outside investigations continue. Additionally, as the investigation of this incident is unfolding, there are some details - particularly around remediation - that we are not providing right now to protect the security of the effort. We will provide more details, where possible in the future, so that the community and our peers may learn and benefit from what happened.
What happened
At this time, we believe attackers targeted certain Twitter employees through a social engineering scheme. What does this mean? In this context, social engineering is the intentional manipulation of people into performing certain actions and divulging confidential information.

The attackers successfully manipulated a small number of employees and used their credentials to access Twitter's internal systems, including getting through our two-factor protections. As of now, we know that they accessed tools only available to our internal support teams to target 130 Twitter accounts. For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets. We are continuing our forensic review of all of the accounts to confirm all actions that may have been taken. In addition, we believe they may have attempted to sell some of the usernames.

For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account's information through our " Your Twitter Data " tool. This is a tool that is meant to provide an account owner with a summary of their Twitter account details and activity. We are reaching out directly to any account owner where we know this to be true. None of the eight were verified accounts.
Our actions
We became aware of the attackers' action on Wednesday, and moved quickly to lock down and regain control of the compromised accounts. Our incident response team secured and revoked access to internal systems to prevent the attackers from further accessing our systems or the individual accounts. As mentioned above, we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness and will provide more technical details, where possible, in the future.

In addition to our efforts behind the scenes, shortly after we became aware of the ongoing situation, we took preemptive measures to restrict functionality for many accounts on Twitter - this included things like preventing them from Tweeting or changing passwords. We did this to prevent the attackers from further spreading their scam as well as to prevent them from being able to take control of any additional accounts while we were investigating. We also locked accounts where a password had been recently changed out of an abundance of caution. Late on Wednesday, we were able to return Tweeting functionality to many accounts, and as of today, have restored most of the accounts that were locked pending password changes for their owners.

We are continuing our investigation of this incident, working with law enforcement, and determining longer-term actions we should take to improve the security of our systems. We have multiple teams working around the clock focused on this and on keeping the people who use Twitter safe and informed.
What the attackers accessed
The most important question for people who use Twitter is likely - did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no. For the 130 accounts that were targeted, here is what we know as of today.

Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack.

Attackers were able to view personal information including email addresses and phone numbers, which are displayed to some users of our internal support tools.

In cases where an account was taken over by the attacker, they may have been able to view additional information. Our forensic investigation of these activities is still ongoing.

We believe that for up to 36 of the 130 targeted accounts, the attackers accessed the DM inbox, including 1 elected official in the Netherlands. To date, we have no indication that any other former or current elected official had their DMs accessed. [Added on July 22, 2020]

We are actively working on communicating directly with the account-holders that were impacted.
Our next steps

As we head into the weekend and next week, we are focused on these core objectives:

1. Restoring access for all account owners who may still be locked out as a result of our remediation efforts.

2. Continuing our investigation of the incident and our cooperation with law enforcement.

3. Further securing our systems to prevent future attacks.

4. Rolling out additional company-wide training to guard against social engineering tactics to supplement the training employees receive during onboarding and ongoing phishing exercises throughout the year.

Through all of this, we also begin the long work of rebuilding trust with the people who use and depend on Twitter.

We're acutely aware of our responsibilities to the people who use our service and to society more generally. We're embarrassed, we're disappointed, and more than anything, we're sorry. We know that we must work to regain your trust, and we will support all efforts to bring the perpetrators to justice. We hope that our openness and transparency throughout this process, and the steps and work we will take to safeguard against other attacks in the future, will be the start of making this right.

More to come via @TwitterSupport as our investigation continues.

This Tweet is unavailable

# data[].attributes.attachment_link.description
An update on our security incident and what we know so far.