Failed SE Pen Test Proves Credit Union Reacted Properly

Viewing 15 reply threads
  • Author
    Posts
    • #4230
      Don Donzal
      Keymaster

      A socially engineered penetration test of a credit union’s computer system went awry last week, resulting in the issuance of a fraud alert from the agency that supervises federal credit unions. 

      Security testing organization MicroSolved sent a package to a credit union client last week, containing a fraudulent letter seemingly coming from the National Credit Union Administration (NCUA). Also contained in the package were two CD-ROMs, part of a penetration test, MicroSolved said in a blog post Friday. But, on the day the package was received, the person responsible for the test was out of the office. So the employee who received the suspicious letter, which bore a NCUA logo and the bogus signature of former Chairman Michael Fryzel, reported it to the NCUA fraud hot line.

      On being notified of the suspicious letter and CD-ROMs, the NCUA issued an alert last Tuesday, warning all federal credit unions of the potentially dangerous disks. NCUA’s alert warned that the bogus letter directed recipients to run the educational CD-ROMs, but doing so could potentially result in a security breach.

      MicroSolved said that the disks contained “simulated malware,” which is safe, does not propagate and is used for testing purposes. In a news release Friday, the NCUA said the incident was isolated to one credit union, and no others should have received the package

      “This was a controlled exercise in which the process worked,” MicroSolved said in its blog post. “The social engineering attack itself was unsuccessful and drew the attention of the proper authorities. Had we been actual criminals and attempting fraud, we would have been busted by law enforcement.”

      In addition, though the outcome of the test was unintended, the employee’s reaction to the suspicious package was exemplary, MicroSolved said. The employee followed proper incident response processes by reporting the suspicious package to the hotline.

      “That the intended contact was not there made this a real world test,” Randy Abrams, director of technical education at ESET, wrote in a comment on MicroSolved’s blog post about the incident. “The employee who blew the whistle should be congratulated on a job well done. The fact that the alert went out means that many more people were educated against one potential attack vector.”

      Abrams told SCMagazineUS.com on Monday that those who trained the employee “deserve kudos as well.”

      But not everyone has been as enthusiastic about the test. While MicroSolved said in its blog post that the NCUA, “understood the situation and seemed appreciative of our efforts,” the NCUA said in its own news release Friday that the penetration test resulted in the “unauthorized and improper use of the NCUA logo.”

      “Credit unions are not authorized to create facsimile documents bearing NCUA logos or signatures, or to improperly represent communications from NCUA, even during the legitimate conduct of business, such as a computer security assessment,” the organization said.

      In addition, another commenter on the MicroSolved blog wrote, “I wonder if spoofing NCUA is the best idea. I know that I would not be happy if I found out that a company was pretending to be us to fool someone into responding to a social engineering attack.”

      Original story:
      http://www.scmagazineus.com/Purported-malicious-CD-ROMs-actually-part-of-pen-test/article/147777/

      Don

    • #26802
      Anonymous
      Participant

      finally  a ray of hope for both SE pentesting and that users can be trained to react appropriately

    • #26803
      UNIX
      Participant

      Does someone know any statistics showing how much such attacks actually work and how often people react correctly? Pretty sure that the outcome would be more than 10:1 for successful attacks. Quite frightening when one think about it..

    • #26804
      RoleReversal
      Participant

      Awesec,

      I’ve been playing around with some similar attack vectors for some research I’m doing for a potential presentation in this are. Whilst I haven’t been in a position to ‘officially’ put this and similar vectors to the test, from my limited workings I’d suggest 10:1 success ratio is being VERY kind to end users.

      More like 9/10 success from my findings, most people just don’t consider this vector as a threat. When I discussed the initial report of the attack on SANS ISC before it was released that this was a pentest, I actually got a comment of ‘why would anyone go to that expense?’; a blank CD and postage stamp seems like a small expense to get a foothold in a banking network to me…

      Anyone else got more trustable (is that a word?) findings?

    • #26805
      UNIX
      Participant

      With 10:1 I meant that at least 9 such attacks are successful and only one get recognized as such. Probably I explained myself wrong, sorry. 😉

    • #26806
      Ketchup
      Participant

      This is slightly off topic, but not exactly:

      I am a horrible actor and half the time I can barely contain myself from giggling when I attempt social engineering.  Needless to say, I am not very successful at it.  🙂  Has anyone considered or has taken some acting lessons at a local art school?  If anyone has taken acting lessons did your employer pay for the courses?

    • #26807
      Don Donzal
      Keymaster

      Excellent point. I haven’t taken acting classes as part of my career development as you ask. But I did a lot of acting in HS and College. I have also done more than my fair share of public speaking. These skills are essential to successful SE attacks, whether it comes naturally or through training.

      Don

    • #26808
      RoleReversal
      Participant

      Awesec, looks like this one has been lost in translation and we’re on the same page then 🙂

    • #26809
      Anonymous
      Participant

      @awesec wrote:

      Does someone know any statistics showing how much such attacks actually work and how often people react correctly? Pretty sure that the outcome would be more than 10:1 for successful attacks. Quite frightening when one think about it..

      it would be hard to get those numbers and it would most certainly be different by type of organization

    • #26810
      Xiv
      Participant

      Great find Don!

      It’s fantastic to read about the outcomes from real life pentests, and as ChrisG pointed out, its excellent to see users reacting to potential threats accordingly!

      Keep up the good work 🙂

      Xiv

    • #26811
      CadillacGolfer
      Participant

      ““Credit unions are not authorized to create facsimile documents bearing NCUA logos or signatures, or to improperly represent communications from NCUA, even during the legitimate conduct of business, such as a computer security assessment,” the organization said.”

      yeah, I’m sure real bad guys will honor the logo copyright  😉

    • #26812
      dmdcissp
      Participant

      I work for a mid-sized credit union and we had our first social engineering test which was a combination of vishing / phishing and the CEO fell for it, hook, line and sinker along with 10 other employees. Hopefully they will all learn from it.

    • #26813
      RoleReversal
      Participant

      @dmdcissp wrote:

      […]the CEO fell for it, hook, line and sinker along with 10 other employees. Hopefully they will all learn from it.

      Depends where the power lays. If the CEO’s word is final than unfortunately this will likely get swept under the carpet to avoid embarrasment. Is a good test though and shows how effect these vectors can be.

    • #26814
      Tails502
      Participant

      woah, thats an eye opener 😮 where i work we have fedex and UPS in all the time, scary how effective this venue could be

    • #26815
      secureseve
      Participant

      I’m still working on other forms of hacking, but I sitll know the basics of SE, but mostly from a non-physical vector. But have any of you hired a woman to perform such tests? I believe from my college 101 psych class ages ago, women have a higher chance of influencing both men and women.

    • #26816
      dynamik
      Participant

      @awesec wrote:

      Does someone know any statistics showing how much such attacks actually work and how often people react correctly? Pretty sure that the outcome would be more than 10:1 for successful attacks. Quite frightening when one think about it..

      I personally have compromised over 80% of the organizations (typically financial institutions) I’ve attempted. The ones I didn’t compromise were just flukes (i.e. someone performed the same service a day ago and there was nothing for me to do – bad intel :(). Not a single person thus far has detected I wasn’t who I appeared to be.

      Most other analysts I work with have a similar success rate. I don’t think even the newbies sink under 50%.

      @Ketchup wrote:

      This is slightly off topic, but not exactly:

      I am a horrible actor and half the time I can barely contain myself from giggling when I attempt social engineering.  Needless to say, I am not very successful at it.  🙂  Has anyone considered or has taken some acting lessons at a local art school?  If anyone has taken acting lessons did your employer pay for the courses?

      Some of the things people say can really catch you off guard. Last week, I got a user to give me her password (I was pretending to be a support rep from a 3rd party and said I had to reset her account because of an account db corruption). Unlike the other users who used dictionary words, she actually had what I consider to be a strong password. After she gave it to me, she’s like, “Yea, I really try to be security conscious.” It was difficult not to laugh at the irony.

      BTW, that’s an awesome premise. Once you “reset” the password, you can ask the user to try to log in and make sure the update worked. That obviously tells you whether the user told you the same password that was in use previously and whether you can log in with it. And they’re grateful for you helping them out before they even realized there was a problem.

      The acting really isn’t too bad, and I don’t consider myself to be a good actor at all. Crying, feigning anger and yelling, etc. are all certainly valid avenues that could be explored. However, I find that I have a respectable amount of success by just being friendly. My inability to play some Shakespearean role really doesn’t impact me as much as you would think.

      When I do my on-site engagements, I legitimately perform the service I’m there to do (or at least look like). If I’m performing a pest inspection, I get down on the ground and inspect every nook and cranny. One of my contacts once called a branch after I left and asked how I did. They gave me a glowing review and were obviously impressed with how thorough I was. The most difficult part is often just walking in the door.

Viewing 15 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2020 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?