We've heard of phishing attacks, but there's a new type of social engineering that uses the mobile phone to trick the victim in a very easy and effective way.
A Symantec video explains a new social engineering technique that attackers use to compromise any email account.
The idea is simple: if you want to reset someone's password, all you really need is their mobile number.
The anatomy of the attack in the video is quite simple, but it is surprisingly effective:
Send the victim a text from an unknown number, warning the victim that they will receive a code to ensure their Google account is secure and asking them to reply with the code to confirm it.
Trigger the Gmail password reset process, which will send a message containing an unlock code to the victim's phone.
The user receives the code that we already mentioned they will receive and sends it back to the attacker.
This way the attacker can unlock the Gmail account without any problems
The video presents the new idea that could probably be quite effective for many gullible mobile owners.
If not most, many would probably answer an unknown number simply assuming it's really the company.
The same attack could also be used to bypass services that use two-factor authentication, although it's worth noting that Google sends SMS if that authentication is set up.
The problem with this type of attack is that no one can stop it. The only protection measure is user education, which will reduce the risk of falling into such traps.
So if you ever receive a message from any number asking for your password, confirmation code, or any other personal information, you should not respond.
There is no reason for them to ask you for the above information (or any other) via SMS.
