Social Engineering Attacks and the Corona Virus Pandemic
Total Page:16
File Type:pdf, Size:1020Kb
ISSN (Online): 2455-3662 EPRA International Journal of Multidisciplinary Research (IJMR) - Peer Reviewed Journal Volume: 6 | Issue: 10 | October 2020 || Journal DOI: 10.36713/epra2013 || SJIF Impact Factor: 7.032 ||ISI Value: 1.188 SOCIAL ENGINEERING ATTACKS AND THE CORONA VIRUS PANDEMIC Ajayi Adebowale. O.1 Ajayi Oluwabukola. F 2 1 Lecturer, 2 Lecturer, Computer Science Department, Computer Science Department, Babcock University, Babcock University, Ilishan-Remo Ogun State, Ilishan-Remo Ogun State, Nigeria. Nigeria. ABSTRACT Social engineering attacks are amongst the most successful and rampant cyber-attacks. The major focus of social engineering is the manipulation of human targets to further the objectives of an attacker. The present coronavirus pandemic has had a profound effect on how we live and work and has proved to be perfect fodder for the nefarious activities of cybercriminals. This study delineates the underlying problems in social engineering vis-à-vis the corona pandemic. A descriptive survey was carried out on social engineering attacks and the corona virus pandemic including focused group discussions with some cyber attackers and regular users of information systems. A review of current covid- 19 related social engineering schemes are presented. Insights gotten from synthesizing the knowledge gathered from the analysis of social engineering attacks during Covid-19 are also highlighted in this paper. It is very likely that many people will continue to work from home or, at the very least, switch back and forth between home and traditional offices in their normal routines. The study therefore recommends that as the global community stays on high alert for signs of new pandemics or recurrence of the present one, safeguards will need to be put in place ensure that these anxieties don’t expose enterprise IT assets to social engineering tactics. KEYWORDS: social engineering, cyber-attacks, coronavirus pandemic, focused group discussions, descriptive survey I. INTRODUCTION their varying levels of computing expertise. It has The pervasiveness of information technology become imperative to shift our focus to the human also comes with its huge security and privacy elements of information security as social concerns. Reports of security breaches abound in engineering attacks [3] continue to lead the charts developed and developing countries as black hat when it comes to successful cyber and information hackers continue to have their way irrespective of security attacks. A report by Computer emergency degree of technological advancement [1]. The response team CERT and the national security information security ecosystem is proliferated with agency in 2018 placed social engineering attacks at security tools ranging from firewalls, to intrusion the top of security incidents, followed by SQL detection systems, intrusion prevention systems and injection, spyware and ransomware. cryptographic systems, yet security breaches abound. A focus group discussion with Nigerian online This calls for a more holistic approaches to scammers popularly known as yahoo boys revealed information security and more specifically there is a that a large number of their schemes is centred need for human centred security interventions [2]. around social engineering. The major focus of their Like every other system, an information schemes borders on identifying potential victims and security system is only as strong as its weakest points preying on their gullibility and naivety. Very little and several empirical studies have concluded that technical know-how is needed to be a successful users of information systems often represent the yahoo boy as evidenced in the success recorded by weakest part of the information security system. inhabitants of towns and villages with low levels of While research has been focussed on identifying literacy here in Nigeria. Some secondary students vulnerabilities in networked systems, little attention actually drop out of school to begin their black hat has been given to the users of these systems despite careers armed with just a laptop and an internet 2020 EPRA IJMR | www.eprajournals.com | Journal DOI URL: https://doi.org/10.36713/epra2013 163 ISSN (Online): 2455-3662 EPRA International Journal of Multidisciplinary Research (IJMR) - Peer Reviewed Journal Volume: 6 | Issue: 10 | October 2020 || Journal DOI: 10.36713/epra2013 || SJIF Impact Factor: 7.032 ||ISI Value: 1.188 modem. Yet this semi-literate individuals con Threats as they can remain undetected for a long multinationals and educated individuals of their hard period as the attacker receive company receipts and earned money. The success rate of these yahoo boys other valuable communication while sometimes is so high that several literatures now delineate waiting for the opportuned moment to strike. certain security hacks as ‘nigerian scams’ [4]. Successful CFO attacks occur when the Though several schemes are used to lure company’s CFO receives a mail purportedly coming victims into revealing sensitive and sometimes from the CEO, Chairman or Managing director to personal information or even to make them send send huge sums to an offshore account, Most money to perpetrators of social engineering attacks, especially while such higly placed person (CEO, the varying schemes can be characterised based on chairman) is on holidays. The attackers sometimes their mode of operation. Examples of security scams monitor company mails for close to a year to identify identified as Nigerian cyber fraud by certain sections when influential company figures go on breaks of cyber security research includes and are not before striking. If unsuccessful the attacker simply limited to: impersonations on online dating sites, looks for more creative ways to use acquired posting false advertisements on classified sites like company documents, they have been privy to via craiglist.com, lottery scams and phishing scams. In metamorphosed attacks. all of these aforementioned scams, the attackers aim A successful CFO attack on the other hand is to get the trust of unsuspecting victims, lure them said to guarantee a minimum of fifty thousand dollars away from the medium of contact after establishing and annually billions of dollars are lost to sufficient trust and then proceed into executing the perpetrators. Like the previously elucidated examples attack either by asking for payments through several these attacks require proper security education for payment options (Paypal, Western Union, staffs of organisations in conjuction with adoption of Moneygram, wire transfers, gift cards, state-of-the-art intrusion detection systems. It is cryptocurrencies among others). widely accepted in certain corners of the information Detecting these personal cyber attacks remain security world that security is an illusion. As long as a difficult problem given the stealth and sometimes valuables remain in the cyber space there are bound complex process of the attacks. For example, After to be cyber pirates threatening the peace and well- luring an unsuspecting victim from craiglist, an being of the cyberverse. The onus therefore lies on attacker could use google talk to engage his potential the users of these important resources to harm victim. This leaves little data points on the craiglist themselves with sufficient levels of paranoia befitting platform to help inform any detection system running the value of domiciled information. on the craiglist servers. Secondly, after engaging the It is well established that criminals capitalize victim on google talk, the potential victim could be on the fears of their victims and the present COVID- given a legitimate bank account belonging to another 19 pandemic has so far proved to be the perfect unsuspecting victim of a phishing attack which fodder for cybercriminal activities. Every aspect of would then forward such funds to the final recipients the COVID-19 crisis has been exploited by or use the funds to buy gift cards or other tangibles to opportunistic hackers, terrorists, and other criminals. be sent to the attackers themselves [5]. In addition to capitalizing on rampant fear, Trailing social engineering attacks therefore uncertainty, and doubt, attackers are targeting a fresh remains a very arduos task and are nearly impossible new honeypot of federal aid, in the form of payouts to detect by implementing a detection software or from unemployment checks, stimulus checks, and the hardware as they mostly comprise of apparently Paycheck Protection Programs. legitimate steps [6]. Proper education therefore remains the only viable defence to effectively combat II. SOCIAL ENGINEERING attacks on our personal space. CYBERATTACKS AND PANDEMIC Another type of personal cyberattacks ANXIETIES involves large organisations. Among Nigerian yahoo Pervasive social engineering attacks are hindering the boys, such scams are categorised as Chief financial world’s coordinated response to the COVID-19 officer (CFO) scams and Ali Baba scams. These emergency. As noted in this recent press report, scams are considered the most lucrative and tedious cyberattacks have spiked during the first half of 2020 of scams and sometimes involves more than one [7]. The FBI noted that as of May 28, it had received attacker for a successful operation. A group of nearly the same number of complaints for this scammers obtain corporate mails from the dark web calendar year as for all of 2019. and infiltrate the mail domain while studying the Preying on social engineering factors, cyberattackers