Cyber Criminals Go To Great Lengths To Establish Trust

Over the past 10 months or so we've often discussed different social engineering tactics as it relates to different types of spam and malware campaigns.  These tactics range from using pinpoint precision to identify individual scam recipients (like CEOs and other C-Level Executives) to using tragic current events, naked celebrity videos, holiday e-cards, IRS tax refunds, or free/discounted sporting event tickets as a lure to get people to open malicious email attachments or click links that redirect them to web sites that are infested with malware.

So, the question is: How far will cyber criminals go in an attempt to get a foothold on your PC or steal your personally identifiable information?

The answer is simple: As far as they need to. 

Cyber criminals will go to whatever lengths are necessary to trick you into doing what they need you to do in order to get infected with malware.  This means that the success of their campaign is almost solely related to their ability to establish trust and to make their campaign appear as legitimate as possible.  As an example, some of the IRS tax refund scams that we have been seeing this tax season even go so far as to link to or display the real IRS web site's logo, Privacy Policy and Online Help.  The Federal Subpoena scam that we spoke about earlier this week included not only the name of the person that the scam was being sent to and their company name, but also their phone number! 

As cyber criminals continue to hone their social engineering tactics, it is becoming more and more critical that people understand, are aware of, and keep a keen watch out for new potential threat vectors and the techniques that are being used in order to trick them into giving up information that could result in loss of identity, company secrets, or their life savings. 

Losses being incurred as a result of cyber crime are increasing at an alarming rate and now we have reached the point where people are more fearful of being a victim of cyber crime than they are physical crime.  According to Gartner, losses as a result of phishing alone could top the $4B mark in 2008!  That increase is no accident and does not appear to be slowing anytime soon.