Social Engineering With Real Teeth: Twitter 2020 and Target 2013

Two of the most famous breaches of the last decade didn't need a zero-day. One started with a phone call from someone pretending to be IT. The other started with a phishing email to an HVAC contractor.

Why social engineering works

Social engineering is so effective because, unlike most of the TTPs (tactics, techniques, and procedures) threat actors use, it can't be stopped by static controls alone. There's no port to filter, no IDS to tune, no endpoint monitoring system to configure that will stop a skilled social engineer from going after the weakest link in the security chain: the human one.

Almost everyone, at every level of an organization, can hand over something useful by mistake, so everyone is a target. Attackers lean on intimidation, social proof, appeal to authority, scarcity, urgency, pretending to be a friend or acquaintance, and even bribery to get the reaction or information they want. And the delivery varies. These attacks happen in person (impersonation, tailgating), online (spam and phishing emails), and through mobile devices (vishing calls and spam texts).

Let's look at two real examples.

Twitter, July 2020

This one hit at the height of the Covid-19 pandemic, when a record number of employees were working remotely. Attackers called Twitter employees and pretended to be the company's IT help desk, saying they were fixing VPN connection problems (which, with everybody suddenly remote, was believable). Then they sent the employees to a phishing site that looked just like Twitter's real VPN login page.

Here's the part that matters. As an employee typed their credentials into the fake page, the attackers entered them into the real one at the same time. That triggered a real MFA prompt, and some employees approved it. So the MFA didn't fail. It worked exactly as designed, and it got relayed to the attacker.

The first account they got into wasn't an admin account. They used it to explore Twitter's internal sites and find the people with more access. Once they had the account management tools, they took over prominent accounts and posted a bitcoin "send me coins and I'll double them" scam. They stole about $118,000 in bitcoin before Twitter locked them out, according to New York's Department of Financial Services investigation, which also found that the company had been without a CISO since December 2019 and had weak access controls and monitoring. The 17-year-old at the center of the attack was caught and pleaded guilty, getting three years in prison.

Target, 2013

Target's breach started even further away from Target. Attackers sent phishing emails containing malware to Fazio Mechanical Services, a small Pennsylvania HVAC contractor, and harvested its credentials. Those credentials worked on Target's external billing system, which gave them a foothold inside Target's network.

From there, the problem was how Target was built. According to the Senate Commerce Committee's kill chain analysis, Target hadn't isolated its most sensitive systems, so the attackers could move from less sensitive areas to the places where payment data lived. They installed malware on the point-of-sale systems and harvested credit and debit card data. The result was about 40 million payment card records plus roughly 70 million other customer records.

Two more details make it worse. The vendor was using free consumer-grade antivirus with no real-time protection and had no two-factor authentication on its Target access. And Target's FireEye intrusion detection system triggered alerts about the exfiltration malware on November 30, December 2, and December 3. Nobody acted on them. Target had the tools. It just didn't respond.

Takeaway

Obviously, no one thing would have stopped both of these. But a few pretty basic habits would have made each one a lot harder:

• Verify out of band. If "IT" calls you, hang up and call back on a number you already know. That one habit beats the Twitter pretext.
• Use phishing-resistant MFA. Approving a push prompt isn't enough if you can be tricked into approving the wrong one. Hardware security keys (FIDO2) tie the login to the real site, so a lookalike page doesn't work.
• Treat vendors like part of your network. Give them least-privilege access, require MFA, and segment what they can reach. A contractor's stolen password shouldn't lead anywhere near payment data.
• Read the alerts. A detection tool nobody responds to is just a very expensive log file.

And training. People are the target, so people are the defense. The attacker only has to be convincing once.