Vishing Attacks Increase During COVID-19

“With all the talk about social engineering, phishing, and other types of cyberattacks, no one is talking about vishing –  the telephone equivalent of phishing. “

The COVID-19 pandemic has resulted in an upshot of all types of scams. 

In the midst of a pandemic, the website of the Champaign-Urbana Public Health District was hacked and infected with ransomware. Recently, the World Health Organization (WHO) warned it has seen a five-fold increase in the number of cyberattacks directed at its staff, and email scams targeting the public at large. 

The Federal Trade Commission says that since January 2020 until mid-April, they received 18,235 reports related to COVID-19, and people reported losing $13.44 million dollars to fraud. The top complaint categories relate to travel and vacations, online shopping, bogus text messages, and all kinds of imposters. While reports of robocalls are way down overall, says the FTC, they’re now hearing about callers invoking the COVID-19 pandemic to pretend to be from the government, or making illegal medical or health care pitches, among other topics.

With all the talk about social engineering, phishing, and other types of cyberattacks, no one is talking about vishing –  the telephone equivalent of phishing. 

According to Daniel Norman, Research Analyst at the Information Security Forum, vishing attacks are a very cost-effective mechanism for manipulating individuals, using the voice to humanize the delivery and make the attacker seem more believable. “To ensure success, attackers build up profiles of their targets using a blend of Open Source Intelligence (OSINT) techniques, particularly online,” explains Norman.

“A surprising amount of information is publicly available to attackers, meaning they do not necessarily have to delve into the Dark Web in every reconnaissance mission,” says Norman. “When building these target profiles, attackers typically scour social media platforms, such as LinkedIn, Twitter, Instagram and especially Facebook, to gather as much public information as possible, as well as other associated websites, such as work or sports teams. Information found can range from home addresses to email addresses and even telephone numbers.”

Vishing scams often hook their victims with a legitimate piece of information, like a Social Security or bank account number, says Sam Rubin, Vice President at the Crypsis Group. “Often a partial number—like the last four digits of a Social Security number—is enough to do the trick. More elaborate scams (or more security-savvy individuals) may require more detailed personal information for vishing success,” he says. 

Norman adds that by diving a little deeper into social media profiles one can build up a repository of information, such as what college the target attended, what qualifications they have or training they’ve done, what their favorite brands are, recent purchases and recent vacations… Automated screen-scrapers and other targeted machine learning technologies can all speed this process up tenfold.

“Social security numbers, bank account details and other more intimate information is slightly harder to find but armed with the right tools and contacts, it is easy,” notes Norman. 

More often than not, notes Rui Lopes, Engineering and Technical Support Director at Panda Security, the information comes from “insider employees in companies or institutions that have some level of access to the victims’ personal information or “customer details” (e.g., contact centers). Databases can be sold per record by these “agents” but also obtained in the course of coordinated data theft attacks by malicious actors.”

Rubin adds that in the wake of many large-scale data breaches, this data is widely available for sale on the dark web. “An individual’s name and Social Security number, for example, can cost around $1.00, but large lists with partially masked numbers go for much less in terms of the per-person costs. Threat actors must know how to navigate this online black market—using an anonymizing browser, finding trustworthy markets offering the information for sale, and sometimes gaining access to use the sites.”

“Once in, these dark web markets work like any commercial site connecting buyers and sellers—think eBay or Craigslist, but with stolen PII instead of old furniture and transactions, leveraging the anonymity of cryptocurrency,” notes Rubin.

Imagine now the attacker has a 70 percent complete digital profile of their target, says Norman. “They know from the social media profiles roughly what they’ve bought over the last year and roughly when, indicating potentially when a credit card was used. On the Dark Web, they can then post questions like: Has anyone hacked X organization’s customer service platform between this date and this date and do they have account details for X target. By narrowing the search, it reduces the price they need to pay for the details as it’s just one key target, rather than buying in bulk. One profile with credit card details or the social security number can range anywhere from $50 – $200 – a small price to pay for access to potentially thousands of dollars.”