Intelligence officials are warning their employees not to end up like Central Intelligence Agency Director John Brennan, who recently had his email hacked.
On Friday, the National Counterintelligence and Security Center released the second in a four-part series of videos from a campaign it calls “Know the Risk — Raise Your Shield.” The current phase of the campaign is intended to warn viewers about so-called “social engineering” scams.
The campaign is “intended to help build public awareness of the inherent dangers that the use of social media — Facebook, Twitter, etc. — could present when appropriate protective measures are not taken,” the agency said in a press release.
Related Story: http://www.washingtonexaminer.com/article/2574118/
Those websites are the most common means by which criminals acquire the information necessary to steal passwords through social engineering, which usually involves finding the information to reset a user’s password. That can include a person’s birthdate, place of birth, or the answers to other common security questions. Such scams can usually be prevented with multi-factor authentication, or the use of a secondary device to confirm login attempts.
Hackers announced this week that they accessed CIA Director John Brennan’s personal AOL email account through a similar social engineering scheme. Instead of using social media, they contacted Verizon and tricked workers into providing a few details on his personal life.
The threat of password theft through social engineering is incredibly potent following the breach of the Office of Personnel Management by hackers linked to the Chinese government. Experts have suggested they expect China is going to begin an aggressive campaign to hack the more than 21 million people whose information was included in the database.
Experts have pointed to Brennan as an example in how a person can lose their credentials from even an unsophisticated social engineering scam. “Attacks against personal email aren’t new – going back to 2008, a vice presidential candidate’s email account was compromised by an attacker who social engineered the password reset features,” said Ed Cabrera, the VP of cybersecurity strategy at cyber firm TrendMicro. “Social engineering is a common means to target webmail accounts.”
Cabrera also emphasized the simple steps that could be taken to protect against such attacks. “Users should use two-factor authentication where they can and select security questions that can’t be answered based on easy-to-find information,” he said.
Brennan’s email was allegedly accessed by teenagers, at least one of whom claims to be as young as thirteen. In an an interview with Vice Friday, he said he had not told his parents about his activity, but said government officials “are pretty mad lol.”
The ability to “hack” America’s top spy using a technique that requires no technical ability may be helpful in illustrating the comparative power China now possesses to hack those whose information was included in the OPM breach. For intelligence officials who had their information stolen and who continue to provide excessive information about themselves online, the eventual theft of their virtual credentials is almost a certainty.
However, the threat doesn’t end with victims of the OPM breach. It extends to every individual listed on the SF86 forms that applicants for security clearances are required to submit. That includes family members, neighbors and other associates.
In an interview with the Washington Examiner, National Counterintelligence and Security Center Director William Evanina pointed out the implications of that fact. “Their kids are on those forms,” Evanina said. “Our foreign adversaries and hackers who are looking to obtain our information do not have to be very sophisticated. They just need to be successful with some spearphishing attacks.”
“We hope that this awareness campaign will make you think twice, and provide some tools to protect against clicking links that could potentially manifest in malware, whether it be in the private sector, in the government, or in your home,” Evanina concluded.
Related Story: http://www.washingtonexaminer.com/article/2574468
The NCSC provides support to the counterintelligence and security activities of the U.S. Intelligence Community, the U.S. government, and U.S. private sector entities against threats of intelligence collection or attack by foreign adversaries.
