Social Engineering through Social Media: profiling, scanning for vulnerabilities and victimizing

No ratings

Presented at RuhrSecBochum 2019 by

Christina Lekati

Online presence is undeniably important. But despite the benefits social networking can create, a strong online presence can also create vulnerabilities. Christina will explain how the online presence of a company's employees on social media can attract social engineers to target them and victimize them to "open doors" through the organizational security. The talk covers the topic of information gathering through social media and explains how even seemingly innocent information can be used to manipulate targets, and in what way. Case studies will be provided. A two-part demonstration is included on how a hacker's mind works when harvesting information on social media; The first part includes real examples of posts that expose vulnerabilities, attract attackers and ultimately lead to security breaches. The second part includes a demonstration on how personal information provided online are gathered, categorized, analyzed and then used to craft an attack, as well as how one ends up revealing online more than he intends to. The talk closes with practical recommendations and best practices. The purpose on this talk is not to make everyone delete their online presence but rather, to urge them to use it responsibly. Training and awareness are often a catalytic factor between a successful and an unsuccessful attack attempt.