B'Cognizance » I Wiz

INFORMATION SHARING: RISK OF SOCIAL ENGINEERING

admin — Fri, 29 Nov 2013 11:20:33 +0000

Introduction
Society is the group of people interlinked to each other through some relation. Wikipedia defines society as “A society, is a group of people involved with each other through persistent relations, or a large Social grouping sharing the same geographical or social territory, subject to the same political authority and dominant cultural expectations”. Now if we look at the modern day definition of society we will notice that the Society has evolved drastically and now we can see an entirely new side of society i.e. the online society or the Social Media. Social media allows individuals to live a virtual life online and facilitating interpersonal communications in various forms. One of the major reasons why these online information systems became popular other than being fast, cheap, easy to use and readily available is their capability to hold data or what in technical terms we can call documenting data online. Also these serve as a tool where any individual can broadcast whatever he/she feels like without caring about the audience, because it doesn’t matter if he/she requires the audiences or not, they are getting them.
A recent picture released by Facebook depicting the entire worlds interconnected friends network reveals the extent to which people are connected to each other through the online society which makes it easier for anyone to gather information about anyone online.

Sharing Information Online: Falling Prey to Social Engineering
Information forms the very basis of any criminal activity, the more intimate and personal it is, the more critical & the more potential it has to cause damage. While sharing information online it’s very much difficult to decide that what information you should choose to share and what not to, even if you chose not to share any of your information you will leave traces of information about yourself unknowingly while surfing through the internet. To cut the long story short when you go online you can control some of the information and some of it, you simply cannot. So the question that needs to be answered is “What information should be shared?” – I will say NO. Actually if you look at it from the security perspective sharing any type of information can put you in harm’s way, an incident happened in Nashua area of New Hampshire where three burglars robbed over a dozen houses based on the victims Facebook status who flagged it on Facebook that at what time they were not going to be at home [2]. This incident clearly emphasizes the fact that it’s up to the audiences that how they perceive the information that you share online. For example in this case for some it was just that the victims were going on a vacation and for some it was an invitation to rob their houses while they were not at home. Thus I believe that when one goes online sharing information they should know how much can be too much and what should be protected or in simple words what information must not be shared. Attackers use a variety of techniques to extract information from their victims and that too on selected victims. What makes a person prone to become a victim to such attacks, the answer is the fashion in which these individuals share their information online. Sometimes the attacker easily get the information that they require from blogs, social media etc. but sometimes they don’t get all of it or they get a part of the information and the remaining they need to acquire.
One of the common techniques used now a day by attackers to infiltrate the privacy of people and exploiting it for their personal gain, for causing damage to the victims falling prey to this technique is Social Engineering. Social Engineering usually refers to the technique of gaining access by manipulating the human behaviour. It basically involves fooling the individual and gaining confidential information without letting the person know that he has been conned. This technique involves psychological manipulation for acquiring required information. Social Engineering is typically a technique that has not been evolved from computer crimes rather it is related to social sciences but due to its ability to gain information it has found its application in information related crimes as well.
A Social Engineering technique involves studying the target for weeks, analyzing his patterns, gathering relevant information and then conducting the attack. With social media rising and becoming a necessity with each passing day, gathering information about an individual is no big deal. The more people post online the easier it becomes for a social engineer to victimize them. A recent survey by Trend Micro [3] reveals six major risks that can occur to any individual due to the information they post online, Social Engineering being the top of them poses the biggest threat. Social media being the easiest and most effective way to share information becomes the major information repository for attackers.
Social Engineering is one of those attack vectors which does not have any rigid or in other words appropriate technical preventive or corrective solution. The USP of this attack is that it can bypass all the technical controls that were invested for ensuring security and sometimes non-technical ones also. To stay safe from such threats there is only one solution i.e. “Awareness”. In order be safe it is really essential to understand that how an attacker gathers the information and how he/she uses it against an individual, an organization or any social or corporate body. An attacker usually gathers all the necessary information about the victim, this information can come from different sources like social media, blogs, and forums being the top of them. In order to extract information the attacker might use various tactics like to begin with trying to get email or phone number of the victim from any social media website, blog, forum or he might create a rogue web page just to get this information based on the interest of the victim, after getting this information he might search for other relevant information using the pieces of information he already has. He might also use techniques like phishing to get more confidential information like username and password of the victim for some social networking sites etc. from where he can get a lot of information, also in this process the attacker utilizes the information that he has gathered from the online resources to the maximum. Once the attacker has gathered all the relevant information he now proceeds further on and gets into contact with the chosen victim. Now it’s up to him how he wants to exploit the victim. Social Engineering is such a sophisticated attack which when done correctly and properly has the capability to cause severe losses. The attacker can cause monetary loss, social loss, defamation, loss of confidential information and much more.
As mentioned earlier the only effective solution to be safe from Social Engineering attacks is Awareness. Everything that you post online remains on the web forever, no matter even if you delete it. The best practice to stay safe would be to post information which cannot be harmful to you, like you must not post real information about yourselves, family, and your social life on public domains. Also you must lock down your profile on Facebook, twitter and LinkedIn and other social platforms to the maximum and must not allow any unknown entities to view that information.
Separate email Id’s must be used for blogs and forums and for subscribing newsletters and updates from websites like YouTube, LinkedIn etc. Also if possible use a different mail ID for Facebook as if you are using your regular mail id for logging into face book then you might face severe repercussions if your mail Id is compromised which can also result in a compromised Facebook profile. Many apps and services also prompt users to allow them to share their photos, location information etc. and post on their profiles, such applications must be used with caution, also users must lay less social trust online while talking to strangers or even known ones if they sound or seem suspicious.
The bitter truth about the Social Engineering attacks is that, there is no technological solution available that can prevent these attacks effectively. The only solution available that can prevent you from falling prey to Social Engineering is awareness. If the user proceeds with caution while posting any information online and does not respond to malicious and suspicious looking invitations, mails, apps, links etc. he/she can stay safe from such attacks.

References:
[1]Wikipedia

http://en.wikipedia.org/wiki/Society

[2] Source: The New York Times. http://bits.blogs.nytimes.com/2010/09/12/burglars-picked-houses-based-on-facebook-updates/?_r=0
[3] The Risk of Posting on Social Media.

http://about-threats.trendmicro.com/us/infographics/infograph/the-risks-of-posting-in-social-media-networks

Ravi Raman Tiwari
MSCLIS
IIIT Allahabad

WHOLE WORLD UNDER THE CLOUD OF SNOOPING BY NSA’S SECRET SURVEILLANCE PROGRAMS

admin — Fri, 29 Nov 2013 11:11:51 +0000

India was the number one target of snooping by the American agency among the BRICS group of developing nations, which highlighted India on the top list of countries targeted by the secret surveillance programs of the U.S. Agency for gathering internet records and telephone data .
India was snooping by U.S. National Security Agency (NSA) and it is among the top nation under secret surveillance programs for collecting telephone data and internet records. And under BRICS group (i.e. Brazil , Russia , India, China and South Africa ) India is on top list of being intensively targeted ranking 5th in the world. Billons of pieces of information of telephone and internet networks are collected from India in a month only.
Referencing to the top secret documents revealed by NSA whistleblower Edward Snowden, the intelligence gathering activities carried out by US agency in India using at least two extensive programs: first is Boundless Informant and the second is PRISM. Where Boundless Informant is a data-mining system which keeps track of how many calls and emails are collected by the security agency. And Prism is a program which intercepts and collects actual content from the networks. Moreover, Boundless Informant was used for monitoring telephone calls and access to the internet in India, PRISM collected information from Tech Giants like Yahoo, Apple, YouTube and many other web services for the certain specific issues excluded terrorism.
In US , Asked by Indian Journalist why a friendly country like India was subjected to so much surveillance by the U.S., a spokesperson of the Director of National Intelligence said: “The Government of US replied in a diplomatic way and said as we can not discuss on every intelligence specific issue publicly as per our policy. For the sake of nation we gathers foreign intelligence of type gathered by all nations . The DNI spokesman chose not to respond to questions about how the NSA managed to pick so much data from India. The director of the National Security Agency , Gen. Keith Alexander on Oct ,Tuesday dismissed as “completely false” reports that his agency swept up millions of phone records of European citizens. While in earlier, The National Security Agency advised its officials to cite the 9/11 attacks as justification for its internet surveillance activities. The White House claims President Obama didn’t know about NSA spying on world leaders and hence weighs in on the strategy of keeping the president out of the loop.
In INDIA, it was quite surprising when our top Indian officials have been rather contemptuous of the disclosures, asked by External Affairs Minister Salman Khurshid about it ,he said “it is not… actually snooping,” the NSA documents obtained shows that Boundless Informant not only keeps track of emails and calls collected by the NSA but more than that.
Now this Signal Intelligence (SIGINT) system collects all the electronic records or internet data (DNI) and telephone call metadata records (DNR) which is stored in a NSA archive called GM-PLACE.
Collecting metadata of any person without his/her consent is a serious issue. When the investigation done on Metadata, we found that metadata is; the record of phone number of every caller and recipient; the unique serial number of the phones involved; the time and duration of each phone call; and more of this it can even locate the location of caller and recipient during call. And the same case is with the e-mails and other Internet activities of an user. Around 6.2 billion pieces of information or metadata taken from India means US Agency collected information on millions of calls, messages and emails daily as they had done it within 30 days.
NSA’s Global Access Operations (GAO), whose objective is “The Mission Never down or Sleeps,” for the designed NSA program ;used the tool named as Boundless Informant. It is so much powerful and capable that it collects records dynamically (through metadata record counts) without any human intervention and display the information in a map, bar chart, table or view graphically. By obtaining the data from DNI & DNR metadata record the tool can produce the live snapshot of GAO’s capability during any specific time.
How intensely India was targeted by the NSA was actually shown by the maps which provides snapshots of the Boundless Informant data. Now According to one map “global heat map” ,it shows that US agency collected 6.3 billion of pieces of information from the network in India in March 2013. More of that another heat map shows 6.2 billion telephone information at the same time.
US agency used three “global heat maps “ and it clearly shows that how extensively India was subjected to NSA surveillance (strong target of all) where they used color code scheme to depict the intense effect on the country. Ranging from green color which is least subjected to surveillance through yellow and orange to red (most surveillance), India comes in the region of deep orange and red even as fellow BRICS nations like Brazil, Russia and China — all monitored extensively — sit in green or yellow zones.

First heat map , shows some numbers depicting the intense of surveillance by NSA .The data tracked by Boundless Informant is 14 billion reports for Iran followed to it 13.5 billion from Pakistan. At third place , Jordan came with 12.7 billion, followed by Egypt with 7.6 billion at fourth and then India stands at fifth position with 6.3 billion reports.
In the heat map, India is placed between Iran and Pakistan with red color both and China and the U.S. with light orange. Brazil and Russia shaded in light green, while China in light orange.
Third heat map, depicting collection of telephone records (DNR), Deep orange color is shaded in Indian region where 6.2 billion pieces of information collected from telephone networks. India is the only country among BRICS who share same amount of color as other highly monitored nations like Saudi Arabia, Iraq and Venezuela whereas other members of emerging nations came in green zone.
So When India came to know this, raised the issue of NSA Surveillance to U.S. Secretary of State John Kerry when he visited New Delhi on June 24 then in explanation “Mr . Kerry said that no content has been sought or received of any email… So there is no matter to concerned ” said by Indian minister.
But as per the top-secret document passed by former NSA contractor Mr. Snowden who took asylum in Russia after the revelation of surveillance it clearly shows that NSA tool focuses on tracking people .As the metadata is machine readable hence therefore searchable, makes records of persons.
Now In whole world this issue has been raised so sensitively that many relations between US to other nations are in rift. Brazil president had already cancelled their meeting with the US President Obama due to revelation that US spied on Brazil oil company, Petroleo Brasileiro in Sept,2013. Allegations creates bitterness for Canada’s trade and business plans in Brazil .In Aug, Washington US President Obama held a secret meeting with top tech giant Apple, Google, Microsoft , Facebook , AT&T to discuss government Surveillance and discussion lead to fulfill the need for counterterrorism Surveilllance by the Administration. Hence Tech Giants have united against US government’s spying programme. And urged the administration to provide needed transparency and help rebuild the belief of Internet users around the world.
References:
The Guardian Newspaper, The Hindu, Bloomerg.com, The Washington Post Newspaper, Al Jazeera america News.

Ayush Gupta
MSCLIS
IIIT Allahabad