Cyberheistv3.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
The Biggest Financial Threat Facing Organizations Worldwide Stu Sjouwerman Publisher/Lead Author CYBERHEIST: The Biggest Financial Threat Facing Organizations Worldwide Stu Sjouwerman Copyright © 2011, 2016, 2020 KnowBe4. Contributing Authors All rights reserved. No part of this book may be reproduced or transmitted in Naomi Alper any form or any manner, electronic or mechanical, including photocopying, Justin Korelc recording or by any information storage and retrieval system, without Kim Lindros permission in writing from the publisher. Jeff T. Parker James Pyles Trademarks Ed Tittel Trademarked names appear throughout this book. Rather than list the names and Michelle Zaval entities that own the trademarks or insert a trademark symbol with each mention Richard G Lowe Jr of the trademarked name, the publisher states that it is using the names for Roger A. Grimes editorial purposes only and to the benefit of the trademark owner, with no intention of infringing upon that trademark. Technical Editors Richard G Lowe Jr Warning and Disclaimer Roger A. Grimes Every effort has been made to make this book as complete and as accurate as possible, but no warranty of fitness is implied. The information provided is on Developmental Editor an “as is” basis. The authors and the publisher shall have neither liability nor Kim Lindros responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book. Copyeditor Kitty Wilson This book is also published in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Technical Editor Darril Gibson KnowBe4 33 N Garden Ave, Suite 1200 Compositor and Graphic Artist Kim Eoff Clearwater, Florida 33755 Proofreader Toll Free: 855-KNOWBE4 (566-9234) Kim Lindros www.KnowBe4.com Indexer Liz Cunningham Cover Design David Brier, DBD International ISBN: 978-0-692-64431-7 Cover Art Photographer Library of Congress Control Number: 2016933543 Alan Poulson Cover and Interior Printing and Binding Published in North America by KnowBe4 Globus Printing 10 9 8 7 6 5 4 3 2 1 This book is dedicated to all the sleepless cybercrime fighters in the world. You know who you are. Thanks very much for what you do. Acknowledgments This project was a true team effort. My sincere thanks to all the people who helped bring my ideas to a tangible, cohesive book. This includes the following contributors: Naomi Alpern, Justin Korelc, Kim Lindros, Jeff T. Parker, James Pyles, Ed Tittel, Richard Lowe Jr, and Michelle Zavala. Ed Tittel also designed and reviewed the original edition’s entire contents. Roger A. Grimes updated, reviewed, and edited the 2020 edition’s entire contents. The production team included these fine people: Kitty Wilson, copy editor; Darril Gibson, technical editor; Kim Eoff, layout design, compositor, and artist; Liz Cunningham, indexer; and Kim Lindros, who wore several hats, including proofreader and project manager. David Brier, DBD International, did the cover design, and the cover art photographer was Alan Poulson. A special and sincere thank you to Roger Grimes, who is the Executive Technical Editor of this version of Cyberheist as well as Data-Driven Defense Evangelist for KnowBe4. Grimes is a cybersecurity industry veteran with over 30 years of experience in computer security and a well- known author of 12 books. His input and expertise was instrumental in incorporating the accurate technical aspects of this latest version of the book. My sincere thanks to everyone who ever worked at Sunbelt Software and who helped to make us the Inc. 500 success that we were. That was a great run! i About the Author Stu Sjouwerman (pronounced “shower-man”) has been in Information Technology for 40+ years, the last 20+ of which were in IT Security. Stu has founded several successful computer security companies, including KnowBe4, Inc. and Sunbelt Software. KnowBe4 is the world’s leading provider of security awareness training and simulated phishing, helping organizations improve their cultures to prevent social engineering and other cybersecurity incidents. KnowBe4 is valued at over $1 billion dollars and has over 30,000 customers. It has been selected as a primary leader of technology and thought leadership by dozens of industry publications. KnowBe4 has won multiple “best place to work” culture awards. As a co-founder of Inc. 500 company Sunbelt Software, he has been specializing in antispyware products since 2003. A few years later, Sunbelt developed antivirus software, integrated a firewall, and at the same time, developed antispam software for both consumers and enterprises. In 2010, Sunbelt was sold to GFI software, a portfolio company of Insight Partners, a $3 billion Boston-based hedge fund. This is Stu’s fourth book. He has co-authored three books about Windows system administration, the first being Windows NT Power Toolkit. Released in October 1999, this book reached #4 on Amazon.com’s USA bestseller list the first week of its release and #1 in the UK. In 2003, a new book about Windows XP was published. The second and third books also reached Amazon’s Top 10 List. From 1996 through 2011, Stu was the Editor-In-Chief of WServer News, an email newsletter to 100,000+ IT system administrators, which helped them to keep their systems secure. Stu also served as editor of GFI Media Services, which published four major online newsletters, including WServer News, WXP News, Win7 News, and GFI Security News. Stu is currently Editor-in-Chief of Cyberheist News, an e-zine tailored to deliver IT security news, technical updates and social engineering alerts to IT professionals. He lives in the Tampa Bay, Florida area with his wife Rebecca and their three cats. iii Table of Contents Acknowledgments __________________________________________________________________ i About the Author __________________________________________________________________ iii Table of Contents ___________________________________________________________________ v List of Tables _____________________________________________________________________ xiii List of Figures ____________________________________________________________________ xv Preface ________________________________________________________________________ xvii About This Book_________________________________________________________________________ xvii Special Elements Used in This Book _________________________________________________________ xviii Contact Us _____________________________________________________________________________ xviii Part 1 The Business of Cybercrime ________________________________________________ 1 Chapter 1 What Drives Cybercrime? __________________________________________________ 3 What Exactly Is Cybercrime? _________________________________________________________________ 4 Who’s a Target for Cybercrime? ______________________________________________________________ 5 A Million Stories for a Million Scams __________________________________________________________ 9 A Case of Criminal Culture _________________________________________________________________ 11 Cybercrime Learning and Lore ______________________________________________________________ 12 Variations on a Scamming Theme ___________________________________________________________ 13 Internet, and the Money Is Easy _____________________________________________________________ 14 Offshore Has Definite Virtues—and Vices _____________________________________________________ 14 Avoiding Exposure to Avoid Losses ___________________________________________________________ 15 Chapter 2 How and Why Scams Survive, Thrive, and Succeed______________________________ 17 The More You Try to Scam, the Better the Odds of Succeeding ____________________________________ 17 Persistence and Variety _________________________________________________________________ 18 A Successful Scam Spawns Countless Imitations ________________________________________________ 18 Old Scams Finding New Victims ___________________________________________________________ 19 Examples of Health Insurance Fraud _______________________________________________________ 21 Simple Technology Tricks Reap Major Results __________________________________________________ 21 Trust Few, Share Little __________________________________________________________________ 22 A Little Knowledge Is Indeed Very Dangerous __________________________________________________ 23 Taking Advantage of Human Nature and Gullibility ______________________________________________ 23 Common Traits of Fraud Victims __________________________________________________________ 24 Chapter 3 Types and Methods of Attacks ______________________________________________ 27 The Social Side of Attacks __________________________________________________________________ 27 Youʼve Been Engineered … Socially, That Is! ___________________________________________________ 28 Social Engineering Tools and Tricks ________________________________________________________ 28 v Anatomy of a Blatant Phishing Attack ________________________________________________________ 30 Examining the Source Code ______________________________________________________________ 31 The Technical Side of Attacks _______________________________________________________________ 33 Disguise and Conquer ___________________________________________________________________ 33 Hidden and Malicious Payloads ___________________________________________________________ 33 The Mechanics of Drive-By Downloads _____________________________________________________