Social engineering hacks weaken cyber security during the pandemic

Disinformation, malware, and an array of cyber attacks are rising as fast as case counts

Pro

Image: Stockfresh

9 July 2020

Cyber security inevitably suffers when scares infect the populace. The Covid-19 outbreak appears to be the most acute global crisis since the Second World War.

Every aspect of the Covid-19 crisis has been exploited by opportunistic hackers, terrorists, and other criminals. In addition to capitalising on rampant fear, uncertainty, and doubt, attackers are targeting a fresh new honeypot of federal aid, in the form of pay-outs from unemployment checks, stimulus checks, and the Paycheck Protection Programme.

Social engineering cyber hacks prey on pandemic anxieties

Pervasive social engineering attacks are hindering the world’s coordinated response to the Covid-19 emergency. As noted in this recent press report, cyber attacks have spiked during the first half of 2020. The FBI noted that as of 28 May, it had received nearly the same number of complaints for this calendar year as for all of 2019.

Preying on social engineering factors, cyberattackers exploit the following facets of society’s collective response to the pandemic:

Demand for accurate information on the crisis: A swelling number of malicious COVID-19 websites and emails claim to offer useful information on the coronavirus and how to protect oneself. It’s no surprise that thousands of COVID-19 scam and malware sites are being created daily. Many spread false narratives about the COVID-19 outbreak’s progression and impact while stirring anxiety, selling bogus treatments and cures, price gouging for face masks and other needed supplies, and otherwise taking advantage of nervous people’s gullibility.
Deepened online dependence: DDoS attacks have bombarded websites people depend on for their quarantined existence. In addition, hackers are targeting DDoS attacks at the enterprise VPN ports and protocols used for remote access, thereby crippling employees’ ability to get their work done from the coronavirus-free comfort of home. Hackers may initiate thousands of SSL connections to an SSL VPN and then leave them hanging, exhausting memory and thereby preventing legitimate users from using the service.
Expanded use of email and social media: Phishing attacks have increased. They are frequently cloaked in emails that include pandemic maps or other content related to the Coronavirus. In addition, social media is being used as a broadcast platform for predatory and deceptive content, while the companies that run those communities attempt to nip it in the bud. Social engineering tactics in phishing and spam campaigns trick people into disclosing passwords and other sensitive personal and financial information.
Sudden mandate to work from home: People working from home for the first time are acutely exposed to cybersecurity intrusions. Many remote workers may fail to use prudent cybersecurity practices. These lapses often include not securing their passwords effectively, opting not to use multi-factor authentication, or neglecting the need for a virtual private network. Corporate IT staff may themselves be working from home, lacking the resources needed to monitor and secure a huge remote workforce’s access to corporate IT assets effectively. In addition, there has been a spurt of voice phishing attacks where callers pretend to be from workplace technical support and thereby convince employees to disclose passwords or to enter authentication information into malicious websites.
More vulnerable economic situations: More COVID-19-related ransomware attacks via email exploit people and organisations’ increasingly desperate straits due to job losses and the general recession. Some attacks involve hacking enterprise routers to direct users to bogus COVID-19 websites that trick people into downloading malware onto their computers. An uptick in text message phishing perpetrates such scams or dupes targets into loading malicious content onto mobile devices.
Community efforts to mitigate pandemic risks: Cyberattacks on public-sector healthcare coordinating bodies have ramped up. The US Department of Health and Human Services was recently the target of a cyber attack apparently designed to undermine the country’s response to the Coronavirus pandemic. In addition, a state-sponsored hacking group attempted, albeit unsuccessfully, to breach IT systems at the World Health Organization. The FBI has detected cyber security attacks against the healthcare industry since the start of the outbreak, such as email fraud campaigns designed to solicit donations for non-existent healthcare-related organisations and bogus contact-tracing apps that download malware onto a user’s device.

Social distancing deepens cybersecurity vulnerabilities

Social distancing has become the critical response for flattening the curve of Covid-19. As in-person encounters become less frequent, we will have to rely on each person to ensure that they do not fall victim to these tactics in their myriad virtual and online interactions. That will place more of a burden on the IT infrastructure – and personnel – to guide everybody in the new normal of vigilance against these risks.

Exacerbating it all is the fact that many IT professionals have been thrown off balance by their own need to work from home while supporting a vastly expanded home-based workforce. The increasing demand for social distancing, lockdowns, and shutdowns has made it difficult for many IT vendors, including big cloud service providers, to keep the lights on in their facilities. As users find it harder to receive 24×7 support for cyber security issues that pop up during the Covid-19 emergency, the attacks on their computers, data, and other online assets will grow.

Robotics, post-perimeter, and AI are key cyber defences against social engineering tactics

If there is any hope to reduce society’s exposure to pandemic-stoked social engineering hacks, it comes in the form of AI-driven robotics. To the extent that we can automate more of the tasks in our lives, we will reduce the need for human decisions and our vulnerability to cyber scams. Fortunately, the Covid-19 crisis has brought robotic systems to the front lines in every conceivable scenario: in industry, commerce, and the consumer worlds, including (especially) in the back-end data centres that are the beating hearts of the modern economy.

Post –perimeter security will be another key defence against social engineering hacks in the post-pandemic economy. It ensures that users access cloud apps only from managed devices and secure apps. Enterprise IT can block users from falling prey to social engineering tactics, such as requests to connect their mobile devices to unsupported or risky cloud services. In this way, post-perimeter security gives people who work from home access to many resources beyond the enterprise perimeter while also giving corporate IT fine-grained control over what, when, and how they do this.

Artificial intelligence (AI) will play a pivotal role in post-pandemic defences against social engineering hacks. Automated systems cannot have hard-and-fast rules for detecting the zillion potential cyber security attack vectors. But they can use AI’s embedded machine learning models for high-powered pattern recognition, detecting suspicious behaviour, and activating effective countermeasures in real time. For example, AI-based defences can proactively isolate or quarantine threatening components or traffic after determining that a website is navigating to malicious domains or opening malicious files, or after sensing that installed software is engaging in micro-behaviours that are characteristic of ransomware attacks.

However, AI-based defences are no panacea, especially when monitoring social engineering attacks that have complex signatures and evolve rapidly. AI-based defences detect and block abnormal behavioural patterns involving endpoints, or in the network, or in how users interact with devices, applications, and systems. If the AI-learned attack vector is too broad, it is at risk of blocking an excessive number of legitimate user behaviours as cyber security attacks. If the pattern is too narrow, the cyber security programme risks permitting a wide range of actual attacks to proceed unchecked.

Moving forward

These and other cyber defences will crystallise into a new normal for enterprises in the post-pandemic era. It is likely that many people will continue to work from home or, at the very least, switch back and forth between home and traditional offices in their normal routines. As the global community stays on high alert for signs of new pandemics – or recurrence of the present one – safeguards will need to ensure that these anxieties don’t expose enterprise IT assets to social engineering tactics perpetrated by hackers, terrorists, and other criminals.

IDG News Service