Social engineering - how wars can also take place virtually
Tanks, soldiers, explosions - a typical war scenario? In the 21st century, attacks also take place virtually - and the threat extends far beyond the borders of Ukraine. German security authorities are now also warning of cyber attacks as the conflict progresses. Such attacks can have drastic consequences for companies. Find out what tricks hackers use and what warning signs you should look out for in our new blog post.
In recent weeks, there has been an increase in cyberattacks on Ukrainian companies - bank and government websites have even been taken offline for a short time. So-called DDoS attacks were the trigger for this.Online criminals exploit the capacity limits for network resources by generating extremely high traffic.As this can no longer be processed by the systems at the same time, services are disrupted or even fail completely.The worst-case scenario for companies, if you think of online shops or service centres.The number of attacks has also increased drastically in Germany, as the ‘cyber war’ has long since spread to the EU and therefore also to German companies.
What do hacker attacks look like?
There are different types of attacks, the damage of which can vary. In ‘ping flooding’, for example, the target computer is bombarded with a huge mass of ‘pings’ (network commands). It then attempts to process an increased number of requests, whereby an extreme amount of data is collected.If there is a clocked Internet connection that is billed according to the volume of data used, this results in extremely high costs.
Botnets or ‘zombie systems’ bombard networks with countless attacks and thus cause an overload. The sender addresses are forged and originate from different locations - which makes this type of attack extremely difficult to trace.
Another well-known hacking method is the ‘man-in-the-middle’ (MitM) attack. In so-called ‘session hijacking’, the hacker intervenes in the communication between client and server. The server then communicates with the attacker's computer instead of the presumed client. Passwords and sensitive data can be intercepted by hackers in this way.
Humans as a weak point: social hacking
However, the most dangerous attacks are probably those that focus on the ‘human error source’ - known as social hacking or social engineering. This involves sending emails to victims that appear to be trustworthy, but whose attachments or links are infected with viruses. Phishing’ combines the technical tricks of hackers with human “vulnerabilities”.
The content of the phishing mails specifically appeals to the recipient's psyche. Pitiful pleas for help are just as common as intimidation or threats.Spear phishing is even more personal: cyber criminals observe their victim closely in advance until they dare to launch an attack. Using websites, social media accounts or previous phone calls - where they have obtained information from unsuspecting employees - knowledge and relationships are played out.
A very well-known spear phishing attack is the ‘CEO fraud’ (also known as the ‘fake president fraud’ or ‘boss scam’).An employee receives a request from a superior or the company owner to send access to accounts (e.g. PayPal account access data) or to make a bank transfer because there is an urgent problem or an ‘emergency’.If it is known that the person from the management level can sometimes be a bit abusive, the email text is also adapted accordingly. The intimidated employee provides the data or makes the payment - and falls into the trap. This method works so well not only because the victim feels bound by the instructions of the person higher up in the hierarchy, but also because he knows the sender personally, trusts him and therefore does not question anything.
Recognising the signs of hacking*
- Computer develops a ‘life of its own’
The mouse pointer moves without any action on your part? Then it is probably a ‘remote desktop hack’.It is best to disconnect all computers from the network and check for suspicious activity in network traffic. - Ransomware blocks use
Your PC brings up a message asking you to pay a ransom, e.g. for the release of data or access to the system.Content is no longer available to you due to the installed malware.A computer often becomes infected because a received website link was clicked on that contained malware or the attachment to a message was infected with viruses. - Increased traffic volume
Your online shop is processing an unusually high number of requests or you are being ‘spammed’ with messages? This could be a hacker attack aimed at disrupting the site or its operation.As soon as the network resources reach their capacity limits, the site or shop collapses. - Emails that do not originate from the account holder
Are you suddenly receiving strange messages from employees or colleagues asking you to download attachments or click on links? Watch out!The sender's mailbox has probably been hacked and they are now sending malicious emails to their contacts.In general, you should treat any email that asks you to open something, click on something or forward information with a certain amount of suspicion. Therefore, check the sender's address carefully: is the name of the colleague/company really spelt like this, or is a full stop or hyphen missing?If this is the case, inform your colleague or business partner immediately. - Unknown browser toolbars or browser redirects
Increased caution is required if you suddenly find a toolbar in your browser that you have not installed. If it then also redirects you to another website (‘redirect virus’) when you try to use the Internet, your PC has probably been the target of a hacker attack.There is detection software for this type of virus that can solve the problem.However, you should always back up your data beforehand. - Changed passwords or access no longer possible
Have you recently received an email from an online shop or payment service provider where you are a customer asking you to change your password? This was probably not an email from the company, but a phishing message.Some of these can look very authentic and trustworthy and, if you don't look closely, are confusingly similar to the originals.In any case, contact the company so that the account is blocked and no orders/payments can be made from it.If the account is used by several users, also inform them of the problem in order to minimise the damage. - Software installations & deactivated antivirus programme
If your system suddenly starts installation processes that you have not run, this may also be a sign that the PC has fallen victim to a cyberattack. Check whether your security software has been deactivated and whether the task manager can be opened - if not, the computer has probably already been infected. - Account debits or reminders
Check your account entries regularly (especially for credit cards). Cyber criminals are after the maximum sums and try to transfer the money abroad as quickly as possible to make it more difficult to trace.Here too, the original attack may have been triggered by a phishing email: e.g. fake messages from your bank asking you to change passwords or confirm the new terms and conditions.Logging in is supposed to take place via a fake link in the email, which then automatically places the access data in the hands of the hacker.Extreme caution is also required with reminders: Hackers send deceptively genuine-looking emails from platforms where you regularly place orders and hope that you will pay without thinking for fear of the threatened legal action.Sometimes the reminders are correct, but you are not the buyer because your account has been hacked.
Preventive measures
Hacker attacks are an unpleasant endeavour that can not only cost you large sums of money, but can also cause long-term damage - such as a poor company image.This makes it all the more important for companies to protect themselves adequately.According to an article in ‘IT-Business’ in November 2021, companies in Germany rate their IT security too highly.
70% of the companies surveyed stated that they had already been victims of hacker attacks, yet 66% were also convinced that they could counter virtual attacks without IT experts or external service providers.
The pandemic has already left us with major security gaps with its ‘virtualisation in fast motion’:Home offices had to be set up quickly, communication took place in online meetings and we have also become even more involved in e-commerce in terms of consumption - also due to lockdown. However, increased security measures are vital, especially in uncertain times. Below you will therefore find our tips on how you can best protect yourself against cyberattacks:
15 tips for more IT security in your company:
- Education
- Sensitise & support
- Create responsibilities
- Authorisations
- Clear instructions to substitutes
- Be careful
- Social networks & publications
- Secure passwords
- Establish rules of behaviour towards third parties
- Separate private and professional use
- Make regular updates
- No unnecessary programmes
- Spam filter, virus protection & firewall
- VPN tunnel for home office employees
- Use hardware from the professional sector
Regularly inform all employees in the company about new scams used by hackers.
Make your employees aware of how hackers operate (e.g. phishing emails). Inform them that they should contact the IT department or their superiors if they are unsure.Raise general security awareness in your company - it is better to be too cautious than too careless.
Find out about responsibilities and create clear, regulated processes.
Not every employee needs access to certain programmes, accounts or the Internet in general. Distribute access authorisations.
Sensitise holiday replacements not to open any links or attachments in emails that they do not trust 100%. Even if the absent employee is already in contact with the sender - their mailbox may have been hacked.
Especially with unknown senders or emails with urgent requests.Hackers can also obtain information about the company in advance by telephone in order to carry out targeted ‘spear phishing’.Inform your employees about this too.
Be careful with what you post or publish and make sure that no content is made public that hackers can use.
Unfortunately, passwords such as ‘12345’ or ‘password’ do not adequately protect your accounts.Create secure passwords that do not contain the company name, your name or other ‘guessable’ combinations. You can find out what a secure password looks like in one of our previous blog posts
Third parties should never be given access to internal data - regardless of whether they are online or on the company premises.Instruct your employees accordingly.
Business computers should not be used for private purposes - and vice versa.If an employee already has malware on their PC and uses it at work, the worst-case scenario is that they spread the virus to the entire network.
Encourage your employees to carry out regular updates to ensure that the system is up to date and thus optimally protected against threats.
Do not allow any programmes that are used for entertainment and not for work purposes. The applications may contain malware that spreads on the PC.
Ensure the greatest possible technical security to eliminate phishing mails, malware and viruses before they enter the network.
Use encryption through a VPN tunnel to deny unauthorised persons access to sensitive data.
As IT dealers, we know:The importance of the hardware used is often underestimated. Hard drives, switches and routers that are not intended for the professional sector nevertheless find their place in the IT infrastructure - mainly in SMEs. This is mainly due to the fact that the prices for high-end devices are not feasible for small and medium-sized companies. Used network devices are therefore a clever, inexpensive and, above all, sustainable alternative to expensive new equipment - also because they have already been used reliably and hardware faults can therefore be ruled out.
See for yourself and explore our wide range of network devices such as switches, Gbics, spare parts and accessories.
Professional hardware for your company network
The topic of data protection and data security is more present than ever before - AI-generated phishing emails look deceptively real and can cause enormous damage to company networks. What are the benefits of AI?Find out more in our blog post: ‘Artificial intelligence - will “man versus machine” soon be a reality?’You can also find useful tips and more information on data protection and data security in our article: ‘The issue with data...’.
If you want to sell or dispose of your old IT: We delete your data securely, BSI-compliant and irretrievably. Simply contact us on all topics relating to IT buyback at: +49 (0) 9402- 93 8505 0 or shop@quattrom.com. We will be happy to advise you.
*Both are merely a list of points that could be relevant in the event of an attack / or that can be taken to prevent it. The blog article contains the opinions of the authors in order to offer our customers a wide variety of content. We are not acting as network consultants or providers of security solutions. Please contact your IT admin or partner company if you have any problems.