{"id":10505,"date":"2021-08-01T00:00:36","date_gmt":"2021-08-01T07:00:36","guid":{"rendered":"https:\/\/todaysveterinarybusiness.com\/?p=10505"},"modified":"2023-03-02T14:15:05","modified_gmt":"2023-03-02T14:15:05","slug":"social-engineering-computer-security","status":"publish","type":"post","link":"https:\/\/navc.sitepreview.app\/todaysveterinarybusiness.com\/social-engineering-computer-security\/","title":{"rendered":"Tricks of the Trade"},"content":{"rendered":"

Criminals who engage in social engineering \u2014 the art of manipulating people into giving up confidential information \u2014 usually hunt for passwords and bank account information, or even for direct access to a computer so that they can secretly install malicious software. They take advantage of a person\u2019s inclination to trust others. One of the primary reasons I decided to focus on the veterinary industry as a cybersecurity consultant is because of the people it employs. Their empathy, trust and integrity are second to none. However, those qualities are exactly what hackers look for.<\/p>\n

Cybersecurity is all about knowing who and what to trust. In the case of social engineering, you as a potential victim need to know when to take people at their word. You need to know when and how to validate their legitimacy. The same can be said about your online activity. Is the website where you shop for personal protective equipment a trustworthy seller? Will it protect your credit card information?<\/p>\n

Whenever I train hospital staff to recognize cybersecurity risks, I always get this question: What is the weakest link in the chain that a hacker will exploit? The answer is simple: It\u2019s the human who accepts any person or scenario at face value. All the layers of protection you put in place won\u2019t matter when someone on your team trusts a masked hacker.<\/p>\n

How to Spot an Attack<\/h3>\n

The easiest way for someone with criminal intent to enter the hacking world is by email. Entire password databases can be found online. Don\u2019t believe me? Google the phrase \u201cGoogle Hacking Database.\u201d The database shows the search operators, or commands, that can find all sorts of information online. Now, type \u201cPassword\u201d into the search field. With a bit of technical ability, you can customize the search operators to focus on the veterinary practice you want to hack.<\/p>\n

Once I have your email password, I likely have the email address and password associated with a majority of your practice\u2019s accounts. This is because most people and practices use one password everywhere. And now that I control your email account, I can email all your contacts, post to your social media pages<\/a> and do much more.<\/p>\n

The emails that hackers send from your account generally contain a link. Because the email came from you, your clients and colleagues think it\u2019s legitimate. The likelihood that they click the link is much higher because they trust you. Clicking on the link often downloads malicious software without the user\u2019s knowledge. The process then starts again as the hackers gain access to your friends\u2019 and colleagues\u2019 accounts.<\/p>\n

If the hacker email doesn\u2019t contain a link, a downloadable file, such as a photo, song, movie or document, might be present. These aren\u2019t ordinary files. They contain embedded malicious software designed to give the criminal access to the recipient\u2019s computer.<\/p>\n

Another danger involves emails from another trusted source. They don\u2019t have to originate at your clinic, meaning I can hack one of your clients to access your practice\u2019s computer system. These phishing attacks are a subset of social engineering in that they imitate a trusted source. According to an annual Verizon report, social engineering attacks are responsible for 93% of successful data breaches.<\/p>\n

A Real-World Example<\/h3>\n

A South Texas pet owner\u2019s email account was compromised. Once inside the account, the hacker saw communication between the client and a veterinary practice manager<\/a> over disputed charges for a dental extraction. The practice manager had sent copies of the dental radiology images. The hacker emailed the practice manager from the client\u2019s account and asked her to review an attached file. Because of the trust established between the client and practice manager, the manager downloaded the file to her computer and opened the image. She saw a photo of a dog, but it wasn\u2019t the client\u2019s pet. Thinking a mistake had occurred, the practice manager closed the file and went about her work.<\/p>\n

Nothing happened for about three days. Then, it happened. She logged into QuickBooks and noticed that hundreds of invoices had been sent to clients and were requesting payment to an account that wasn\u2019t the hospital\u2019s. She also realized that she hadn\u2019t received emails in about two days.<\/p>\n

All this activity was the work of a keylogger. The image opened three days earlier contained a malicious program that recorded everything the practice manager typed and reported it to the hacker. Now, the hacker had the usernames and passwords to all her accounts. The hacker set up an inbox rule automatically moving new emails to the trash folder. The hacker sent thousands of emails from the account in an attempt to perform the same social engineering hack on all her contacts.<\/p>\n

Don\u2019t Become a Victim<\/h3>\n

While social engineering attacks are rampant, short-lived and need only a few users to take the bait, you can protect yourself. Here are five tips:<\/p>\n