If you are having trouble viewing this email, click here to view this online



   ISSUE 26

20 September  2013

Article of the Month  Around the World

Social Engineering Attack


What is a Social Engineering Attack?

Social engineering attack is a way of gaining access to your computer or system by imitating as another person. The purpose of social engineering attack is usually to secretly install spyware or other malicious software or to trick you into handing over your passwords or other sensitive financial or personal information. Nowadays this is become very successful method for criminals to access the system or computer without breaking the system. Information gathering of the target is the very first step of good social engineering attacker. Attracter has intended to collect the enough information about the target using different techniques. It can be through e-mails, conversations, questioner or using your social networks.


Why do people fall for social engineering techniques?

Most of time people won't recognize a social engineer's tricks because they are often very sophisticated. Social engineers use a number of psychological tactics on unsuspecting victims. Still attackers can gain the trust of people in different ways. That�s why social engineering attacks are still more popular if there are several awareness methods. To avoid the becoming of a victim of social engineering attack, first you must learn how to filter the attacks from others.
Five Reasons People Fall Victim to Social Engineering Attacks
� The link or attachment came from someone you know
� The link was posted to a forum that you know and trust
� The link points to a video you really want to see
� The link is from a breaking news alert from Google / CNN / MSNBC, etc
� The link / attachment came from an official government / law enforcement agency
Social Engineering attack through emails
Phishing attacks are one of the best examples of widespread social engineering attacks that we have seen for years yet are still beating hard and heavy. They are still happening means that people still fall for them regardless of numerous warnings. The main purpose of phishing email is to get a financial benefit. First they impersonate like trusted website or organization and then attempts to trick the user in to disclosing their personal details like username, password, PIN etc, via a form on the fake website, allowing the criminal to use the details to obtain money.
In general, it can be an email informs to recipients that the bank has changed its IT infrastructure and asks all customers to re-confirm their user information. When the recipient clicks on the link in the email, they are directed to the fake website, where they are prompted to divulge their personal information. The fake website may appear almost identical to the official site. Style, logos, images, navigation menus and other structural components may look the same as they do on the genuine website. All information entered into this fake website, including login details, can subsequently be collected and used by the criminals operating the attack.

Common Characteristics of Phishing Scam Emails

1. Unsolicited requests for sensitive information
2. Content appears genuine
3. Disguised hyperlinks and sender address
4. Email consists of a clickable image
5. Generic Greetings
6. Use various ruses to entice recipients to click

What to do if you receive a Suspected Phishing Scam

1. DO NOT click on any links in the scam email.
2. DO NOT supply any personal information of any kind as a result of the email
3. DO NOT reply to the email or attempt to contact the senders in any way.
4. DO NOT supply any information on the bogus website that may appear in your browser if you have clicked a link in the email.
5. DO NOT open any attachments that arrive with the email
6. REPORT the phishing scam (www.cert.gov.lk).
7. DELETE the email from your computer as soon as possible.


K.Chathuni Dinushka

Chathuni is an undergraduate of Sri Lanka Insitute of Information Technology
who is currently following B.Eng (Hons) in Computer Science and Networking.
Currently she is working as Intern - Information Security Engineer at Sri Lanka CERT|CC .




  Why mobile apps beat Web apps for privacy

�. . .Computerworld - Yet another excellent resource, Groklaw, is shuttering its services as a consequence of what I'll call the ongoing "Surveillance Wars." Rather than debate the politics of surveillance, I want to again make a case for making our software tools harder and more resilient to attack, regardless of where that attack is coming from. .�

  A Sophisticated Social Engineering Attack

'.... In April 2013, the administrative assistant to a vice president at a French-based multinational company received an email referencing an invoice hosted on a popular file sharing service. A few minutes later, the same administrative assistant received a phone call from another vice president within the company, instructing her to examine and process the invoice. The vice president spoke with authority and used perfect French. However, the invoice was a fake and the vice president who called her was an attacker...'

City of London police plans new industry reporting system to tackle cyber-crime


'.... The City of London�s Police Commissioner, Adrian Leppard, is seeking up to �4 million from the Home Office to build a new IT system that will improve reporting on cyber-crime from across all sectors of industry......'

Handling Incident Management in a Virtualized Environment


'.... Incident management (IM) is a necessary part of a security program. When effective, it mitigates business impact, identifies weaknesses in controls, and helps fine-tune response processes. Traditional IM approaches, however, are not always effective in a partially or completely virtualized data center. Consequently, some aspects of incident management and response processes require review and adjustment as an increasing number of critical systems move to virtual servers.
For our discussion of IM, virtualization is defined as the abstraction of logical servers from underlying hardware resources. This is not always the case, but it is a good starting point........'

Hacker Reveals How Devastating A Cyberattack On The Stock Market Could Be

'.... Of all the horrifying scenarios that hackers could pull off � from launching nukes to spoofing air traffic control � the one that poses the biggest risk for Wall Street would be a cyber attack on equity markets.
In the summer issue of hacker magazine 2600, pseudonymous writer "Eight Kay" shows how such a scenario could pan out�

Month in Brief
Facebook Incidents Reported to Sri Lanka CERT|CC in August 2013
 Fake + Harassment
 Gender wise
 Statistics - Sri Lanka CERT|CC


Three ways that Hijacks can happen..

'.... If you live for tech news and/or you�re relatively active on Twitter, you likely heard about some DNS issues that Twitter, the New York Times and other sites went through due to an alleged attack by the Syrian Electronic Army. Despite what some may assume amidst a competitive environment, these are heartbreaking and maddening situations for those of us that live DNS and Internet performance........'

New Zealand bans software patents

'.... New Zealand has finally passed a new Patents Bill that will effectively outlaw software patents after five years of debate, delay, and intense lobbying from multinational software vendors........'

Changing IP address to access public website ruled violation of US law

'.... Changing your IP address or using proxy servers to access public websites you've been forbidden to visit is a violation of the Computer Fraud and Abuse Act (CFAA), a judge ruled Friday in a caseinvolving Craigslist and 3taps.
The legal issue is similar to one in the Aaron Swartz case, in which there was debate over whether Swartz "had committed an unauthorized access under the CFAA when he changed his IP address to circumvent IP address blocking imposed by system administrators trying to keep Swartz off the network," law professor Orin Kerr wrote yesterday on the Volokh Conspiracy blog........'

Blaster worm: Lessons learned a decade later


'...... There are many of my former colleagues who spent literally a year of their lives working with me to fix the aftermath of these problems. There are more friends with whom I later worked with at the Idaho National Lab (INL) that helped me understand the breadth of the problem that was uncovered by Blaster, specifically the reliance of critical infrastructure upon consumer-grade technologies.......'

Password Police: Keep control of kid�s accounts



'.... It seems like a new social network, website or app pops up almost every day! How can you keep up with what your kids are using? Don�t worry,hlntv.com/raisingamerica has you covered. Check back each week for the latest ways your kids are connecting online........'

Notice Board
  Training and Awareness Programmes - September 2013
- September 22-29 Annual hardware maintenance programme Schools in Southern Province




September 9-18


September 23-27

5th National Level school ICT Championship Competition 2013
      �Young Computer Scientist        Competition category project evaluation

      � Creative teachers Competition project evaluation

School of Computing, University of Colombo
- September 16-18 Content development workshop for E-thaksalawa Learning Content Management System ICT Laboratory, Ministry of Education
- September 30- October 1,2 Workshop for preparing standards for zonal and provincial ICT centers selected as training centers for National Vocational Qualification. ICT Laboratory, Ministry of Education
- September 18 Hacking Challenge Renuka Hotel
- September 25 Security Quiz Renuka Hotel


October 02


6th Annual National Conference on Cyber Security
Cinnamon Lake Side Hotel

Brought to you by: