The Dyre Wolf: The “wolf” of Customer Service
An advanced form of social engineering "that we have never seen before" is being used by a well-funded ring based in Eastern Europe, IBM's security unit warns, adding that it has managed to steal $1 million from American businesses large and small.
IBM describes the practice followed in 2014 by the attackers, whom it calls "The Dyre Wolf", emphasizing that despite their relatively small prey, they use particularly persuasive methods to deceive their potential victims.
Initially, they send emails with infected attachments to employees of the target company, in an attempt to infect as many computers as possible with the Upatre malware, which then silently downloads Dyre. Dyre is activated when the user visits an e-banking page and then displays a fake copy of it in the browser, informing the user that there is a temporary malfunction. At the same time, it asks them to contact the bank by phone at a new phone number. On the other end of the phone line, the alleged bank representative answers, who requests the e-banking login details. Thus, he manages to gain access and immediately proceeds to transfer large sums of money to another bank account and from there to others in succession, so that the transfer is not immediately noticeable. In fact, IBM Security experts report that Dyre Wolf in some cases resort to distraction, crashing the victim's website with an excessively large number of consecutive connection requests in order to mislead the bank and proceed undisturbed with the transfers of large amounts using the data they had obtained through the alleged bank representatives.
The most effective hacking method: The Art of Deception
Kevin Mitnick said it - and wrote an entire book about it - and it remains true. There may be tools that test countless codes, that automatically search for security holes in hundreds of networked computers, and yet... The most effective hacking method is based on our credulity.
The originality in the case of Dyre Wolf, IBM experts point out, is that a human actually answers the phone calls, as is the case with bank customer service.
IBM Security recommends that businesses train their employees so that they do not fall victim to so-called phishing practices.
source: tech.in.gr/
