{"id":2143,"date":"2016-12-29T18:39:10","date_gmt":"2016-12-29T17:39:10","guid":{"rendered":"https:\/\/www.rsconnect.net\/en\/?post_type=article&p=2143"},"modified":"2024-02-11T11:23:54","modified_gmt":"2024-02-11T10:23:54","slug":"social-engineering-using-caller-id","status":"publish","type":"article","link":"https:\/\/www.rsconnect.net\/en\/articles\/social-engineering-using-caller-id\/","title":{"rendered":"Social engineering using caller ID"},"content":{"rendered":"

In a previous blog, we showed the potential risk of Caller ID Spoofing<\/a>. The Caller ID (Calling Line Identification is the official term) is for many people a proof of someone’s identity. When they receive a call from a number they recognize, they tend to trust the calling party.<\/p>\n

Free Trial: Auto-Login for Desk Phones<\/a><\/p>\n

Social Engineering skills<\/h2>\n

But what is then the next step? What can a hacker do with this trust? It is just a telephone call, isn’t it? Well, being trusted allows him to leverage his social engineering skills<\/strong>. He can manipulate the called party at the other side of the line. He can ask for information he normally wouldn’t receive. And he can make the called party do things they normally wouldn’t do.<\/p>\n

Social engineering at the company helpdesk<\/h2>\n

Let’s look at the example given in the CNN item below. Here it is shown how a hacker is calling from a known company Caller ID to the company’s helpdesk. They recognize his call as an internal company call and are therefore less cautious. On the contrary, they are very willing to help him. After all, customer satisfaction is the most important metric for many helpdesks. Using his social engineering skills, he manipulates the helpdesk agent to click on a link with malware which – just an example – gives the hacker immediate access to the company’s IT network.<\/p>\n

The helpdesk agent wouldn’t have done this if some stranger was calling from an outside line. But this was an internal call from a colleague, so why not trust him? One telephone call with a fake CallerID is all the social engineer needs to get access.<\/p>\n