A socially engineered penetration test of a credit union's computer system went awry last week, resulting in the issuance of a fraud alert from the agency that supervises federal credit unions. 

Security testing organization MicroSolved sent a package to a credit union client last week, containing a fraudulent letter seemingly coming from the National Credit Union Administration (NCUA). Also contained in the package were two CD-ROMs, part of a penetration test, MicroSolved said in a blog post Friday. But, on the day the package was received, the person responsible for the test was out of the office. So the employee who received the suspicious letter, which bore a NCUA logo and the bogus signature of former Chairman Michael Fryzel, reported it to the NCUA fraud hot line.

On being notified of the suspicious letter and CD-ROMs, the NCUA issued an alert last Tuesday, warning all federal credit unions of the potentially dangerous disks. NCUA's alert warned that the bogus letter directed recipients to run the educational CD-ROMs, but doing so could potentially result in a security breach.

MicroSolved said that the disks contained “simulated malware,” which is safe, does not propagate and is used for testing purposes. In a news release Friday, the NCUA said the incident was isolated to one credit union, and no others should have received the package

“This was a controlled exercise in which the process worked,” MicroSolved said in its blog post. “The social engineering attack itself was unsuccessful and drew the attention of the proper authorities. Had we been actual criminals and attempting fraud, we would have been busted by law enforcement.”

In addition, though the outcome of the test was unintended, the employee's reaction to the suspicious package was exemplary, MicroSolved said. The employee followed proper incident response processes by reporting the suspicious package to the hotline.

"That the intended contact was not there made this a real world test," Randy Abrams, director of technical education at ESET, wrote in a comment on MicroSolved's blog post about the incident. "The employee who blew the whistle should be congratulated on a job well done. The fact that the alert went out means that many more people were educated against one potential attack vector.”

Abrams told SCMagazineUS.com on Monday that those who trained the employee "deserve kudos as well."

But not everyone has been as enthusiastic about the test. While MicroSolved said in its blog post that the NCUA, "understood the situation and seemed appreciative of our efforts," the NCUA said in its own news release Friday that the penetration test resulted in the “unauthorized and improper use of the NCUA logo.”

“Credit unions are not authorized to create facsimile documents bearing NCUA logos or signatures, or to improperly represent communications from NCUA, even during the legitimate conduct of business, such as a computer security assessment,” the organization said.

In addition, another commenter on the MicroSolved blog wrote, "I wonder if spoofing NCUA is the best idea. I know that I would not be happy if I found out that a company was pretending to be us to fool someone into responding to a social engineering attack."

Does someone know any statistics showing how much such attacks actually work and how often people react correctly? Pretty sure that the outcome would be more than 10:1 for successful attacks. Quite frightening when one think about it..

[...]the CEO fell for it, hook, line and sinker along with 10 other employees. Hopefully they will all learn from it.