Ex-NSA bad-guy hunter listened to Scattered Spider's fake help-desk calls: 'Those guys are good'

The call came into the help desk at a large US retailer. An employee had been locked out of their corporate accounts.  But the caller wasn't actually a company employee. He was a Scattered Spider criminal trying to break into the retailer's systems - and he was really good, according to Jon DiMaggio, a former NSA analyst who …

[Anonymous Coward]

I work for a well known organisation and I look after our primary service desk. Sometimes account reset requests get escallated to me as the user can't fullfil our identification requirements or they're of someone "important". The more I read of these social-engineering type attacks, the more I dig my heels in when asking for proof of identity. "Don't you know who I am?" does not cut it.

[Doctor Syntax]

"Don't you know who I am?"

"Not until you prove it."

[Snowy]

Aye if you can not prove it your no one.

[Anonymous Coward]

Even if you can prove it there are limits to what you can allow. Play dumb of you have to, but it doesn't matter who they are.

[theblackhand]

"your call is important to us...."

And the betting on how long they will wait begins..

Just make sure you don't do it over a long weekend, we wouldn't want a repeat of the guy in finance who gnawed off his own foot due to hunger while he was waiting.

[Yet Another Anonymous coward]

"Don't you know who I am?"

I do. You're lucky the bar's open to you.

[Jamie Jones]

"If you are who you say you are, you'd be grateful that I'm protecting your account this way"

[trindflo]

Had the person say as much once they were back in the office. It's kind of scary when the hackers know who is out of the office and when.

[Anonymous Coward]

Alas with Coinbase … support was offshored to poorly paid workers in Far East/India who valued being paid by Ransomware Infiltrators above Coinbase (or third parties) normal wages…. and this bypassed their InfoSec.

Funny that.

[Yet Another Anonymous coward]

No, the criminals are always black hoody wearing hacker geniuses in front of green screens in a basement somewhere. That's why you have to pay Securi-Scary-Solutions $$$$$$ to protect your data with our new magic network box with real magic beans AI technology.

Don't worry about having outsourced your database management to Azerbaijan

[An_Old_Dog]

Accessorising

While you're accessorising your hacker stereotype, remember the black, fingerless gloves, dark sunglasses worn in a dimly-lit lair, male gender, Caucasian features, "ttribal" tattoos, and chatting with his co-malefactors on IRC, typing in "1337 5p34|<" [(e)lite speak].

[Yet Another Anonymous coward]

Re: Accessorising

Look I just find that configuring iptables is easier if I'm wearing a V for Vendetta mask - ok ?

[TeeCee]

"Do you know who I am?"

"No. Do you know who I am?"

"Er...no."

"Well you can fuck off then."

<CLICK>

[Anonymous Coward]

As the old saw has it....

Hell Desk staff are like toilets, can only serve one asshole at a time.

[cd]

Luckily, the TARGET was a big company with a big security budget...

[Bitsminer]

TARGET pronounced Tar-gey.

[elsergiovolador]

Ad

Another gripping tale of cyber intrigue where the villains are “very good,” the defenders are conveniently ex-intelligence heroes, and the solution is - surprise! - more budget for elite insiders. No names, no technicals, just vibes and veiled sales pitches. At this point, the only thing more sophisticated than the hackers is the marketing strategy behind these stories.

[Mike 125]

Re: Ad

I assume your comment is a weak but relevant example of how we are all socially engineered. Or perhaps you just completely fail to see the irony.

[elsergiovolador]

Re: Ad

Yes, the irony of questioning vague fearmongering being met with vague fearmongering. Appreciate the attempt at meta, but if the bar for “social engineering” is “noticing PR fluff,” we’re all doomed. Or maybe that’s the point.

[Anonymous Coward]

Re: Ad

And if it's not? Sorry but if you mean well actually look into the reality of the situation. This story was only made because there was someone interesting to talk to, in reality this is going on constantly everywhere and often enough the infiltration succeeds. Your wrong headed paranoia is preventing you from helping the situation.

Are there scams? Of course! Anyone who actually does these jobs can point to dozens. External auditors are often a big one, but the check a box for the corporate office that has to be checked, so management will sign that check instead of expanding the local team. Notice how that's the opposite of what you are saying?

FYI, of you see something really confident in this space it probably is a scam, but it could just be since ex military or intelligence people puffing themselves up.

[elsergiovolador]

Re: Ad

You’ve accidentally reinforced my point. Yes, real threats exist. But when companies underpay developers, neglect internal security hygiene, and then swoop in with ex-spook “firefighters” for PR damage control, that’s not strategy - it’s theatre. If you need a former intel officer to stop your shop floor getting encrypted, the problem started a long time ago. Fix the fundamentals first, not the headlines.

[Anonymous Coward]

Re: Ad

… or some retailers - even big ones- still run PosReady 7, Windows XP Embedded, Windows Server 2003, 32 bit SQL 2003, Remoteware, can’t remember what the SAN Admin password is….…

[frankyunderwood123]

Re: Ad

No.

This was very real and very damaging for the company.

I suspect the marketing here is more an attempt to save face.

This attack absolutely screwed the coop for weeks.

Plenty of anecdotal evidence in the UK, as In sod all stock in the stores for weeks.

[agurney]

Re: Ad

especially when it's the only shop on the island :(

[billdehaan]

Always attack at five to five

I did defence work, so I had to take a lot of security courses, including both physical security and cyber security, over the years.

I remember one course where the teacher started off by telling us not to let his course make us paranoid. He then spent three hours listing real world security horror stories. By lunch break, pretty much the entire class of 30 people wanted to go home, lock and barricade the doors, brick up the windows, turn off the lights, and spend the night in the fetal position in bed.

One of the lines that stuck with me was "always attack at five to five". That is, five minutes before close of business. If you get people just as they're about to leave for the day, it's a lot easier to convince them to turn over sensitive material. That's because they are in a rush to leave, and if you're calm and patient, they'll be the ones trying to pressure you, not the other way around.

One of the "try this at your company when you get back" tricks the instructor gave us as a to-do was to try and get a VP's email password before the end of the week. Students were all from different companies, so we weren't all trying the same thing at once at the same company.

The approach was simple. Look up the calendars for the VP, directors, and other high value targets in your company. See which ones are heading out of town. The day before he's leaving, just before end of day, after he's left, call his secretary/admin pretending to be IT support. You tell her you're working on his email problem ticket, and you need him to verify that he's can send binary attachments. She can log in as him (this was back in the 1990s) and confirm that he can now receive email, but to confirm he can send, he needs to go to this internal web site, download this patch file, and apply it. Don't worry, you tell the admin, you can do it through the S2MR interface, just be sure have have PGP privacy enabled, and if he's using MD5 encryption, use the 2FA model, but he has SHA256, then you'll need to-

That's as far as I got with the admin I was talking to before she was overwhelmed with the tech jargon and asked me "can't I just give his password and have you do it?". Sure, I said, and she did. I logged in to the mail system, as the VP, took a screen shot of the page to prove I'd done it, and logged out as quickly as I could.

Out of the 30 or so students, I think only 4 weren't able to get into one of their executive's email.

Defences have gotten more sophisticated, and secretaries likely don't know the passwords of the VP they work for any more. But the social engineering attacks have become more sophisticated, too. And with work from home, companies with hundreds, or thousands of employees, aren't going to be know to the IT staff they're calling.

That 1990s-era attack wouldn't work today (crosses fingers and hopes), but I have no reason to believe that the success rate is any better now than it was then.

[Yet Another Anonymous coward]

Re: Always attack at five to five

That would definitely work here.

We're a little outpost of a European Megacorp with 2fa, locked down laptops, intune secure on our phones and mandatory security training

But we have no IT at our site, or in our country. So as a dev i get constant requests to reboot server X, swap a patch cable, press some random button on a Cisco switch. All on teams messaging with no authentication other than an @it at the end of the username

[DS999]

Maybe corporate help desks

Need to give everyone a 2FA keyfob, or a seed to have an app on their phone provide codes. Those who work from home even occasionally will hopefully already have 2FA to access the VPN, they'd just need to make sure every employee does even the guys in the warehouse. When you call for help after they get your identifying information like name and email or employee number they can ask you for your code and verify it as a way of proving you are who you say you are before proceeding further.

There will be a small number of legitimate cases where you can't provide your 2FA code, but those could be treated like an exception and the entire call given more scrutiny than would otherwise be applied - especially if it is a high level employee calling in.

[Wize]

Re: Maybe corporate help desks

Trouble with those things, They will find the users who don't know how they work and get them to read out the number on them, instead of them telling you the number that should be on your keyfob.They get all your login details minus the 2fa number, then call you pretending to be the bank, get your 2fa number read out, and chat shit while their buddie logs in as you. Keep you busy on the line while they fuck around and keep you from noticing any email notifications of "did you mean to log in from another country?"

Not everyone needs to be a sucker, they just need enough suckers to stay profitable. And you need to stay smart enough not to be that low hanging fruit.

[Anonymous Coward]

Re: Maybe corporate help desks

This is why training and review are important even if management wants to be pretend otherwise.

[DS999]

Re: Maybe corporate help desks

You have to teach them to NEVER give you that number to anyone who calls you, and additionally stress that no one will EVER ask you to speak the digits (I am assuming when you initiate a call with the helpdesk it would start out with an IVR system and it would be programmed to insist you type them in not speak them)

That's something that would be easy to check compliance on - have help desk staff randomly cold call people once in a while and ask for the number, and anyone who provides it gets to go through security training again.

[Anonymous Coward]

Someone managed, in a single phone call, to get my bank to change both the email address and the phone number associated with my accounts. Apparently this raised no suspicions at all, and their system does not include contacting the email address and phone number already on record to check whether the change request is genuine.

Eventually they twigged, in a second call, that something was up and blocked a BACS transfer the scammer was trying to make, though they still charged me the transfer fee. Then, after I spent an hour on the phone with them sorting it out, they allowed him to do it again the next day, realised their error again and cancelled both my debit and credit cards, again without telling me.

Actually, they are very nearly my ex-bank. My savings are elsewhere and my current account is being switched next week. The £500 compensation was quite nice.

[anothercynic]

The sad thing is that the bank insists you identify yourself to them, while they are absolutely astonished when you insist they identify themselves to you! "What do you mean? The phone number says we're who we say we are!"

Right you are, love, but with a bit of diddling, I could make it look like I'm calling from Number 10, sooooo... no, you'll have to identify yourself to me, or give me a number I can check against my bank's details where I can ring you.

[Rob F]

There are some banks that are able to recite the number generated by an MFA fob or something accessible only to the bank and the digital account to help prove authenticity. The problem is that banks catering to the general public get stuck with the general lack of digital competency and so they end up compromising security over usability. Denmark had the right idea by centralising the AAA and messaging system, so only your bank or other government system could contact you through it. Very little happened over the phone or SMS.

[T-Woolf]

If you receive a call that claims to be your bank and you have a suspicion that it's not a genuine call, hang up and call them yourself. If they give you a number to call back on, double check it and DO NOT just call them back. If they're a scammer, they can give you a fake number.

[Anonymous Coward]

Yep, and generally didn't bother with any new numbers at all, just use the one physically printed on your card or what came with it.

[notyetanotherid]

And for those that don't know... in the UK you can now just call 159: tell the call handler which bank you want to speak to and they will connect you. No other numbers to remember or look up. https://stopscamsuk.org.uk/our-work/159-phone-number/

[Claptrap314]

No, it's not.

It's 0118 999 881 999 119 725

3

[I could be a dog really]

I didn't know about that, really useful.

But something else to keep in mind - call from a different phone/line !

Some of the scammers have developed the trick of not hanging up, but spotting when you do. On a traditional landline, the connection stays up as long as the caller stays on - the recipient can hang up, pick up the phone again, and still be connected to the caller. So the scammer spots when you hang up, then plays dial tone until they hear dialled digits - at which point a different person can take over with "Thank you for calling $bank, how can I help you". A really good scammer might even have encouraged you to call back at the number on your card, and ask for Fred on extension 2345 - so the fake receptionist can "transfer" you to "Fred" and you think you really are talking to someone at the real bank.

Another idea just came to mind. If the scammer were able to infiltrate the banks (now almost certainly IP based) phone system and register as an extension, no one is going to check in their internal directory so see if there really is a Fred at extension 2345 - they'll just transfer the call to 2345 and put you through to the scammer.

[Wize]

Years back, I got call from my ISP who asked me for proof of who I was.

You called me mate, you prove who you are.

They started some shit about being able to tell me what my postcode was. Yea, mate, my post code is next to my name and number in the phone book.

I do beleive it was my ISP, but was in a mood and didn't want to put up with them trying to upsell me something when I didn't ask, so thought I'd give a lecture on security to them.

[PCScreenOnly]

When a bank or whoever calls me, it is what I do.

I ask them to tell me something they can see and tell me - specifically with banks and a recent transaction. Guarantee you get a "but GDPR", so off you go into why that is a load of bollox and they can tell me as I am the thing GDPR is trying to protect and they are the controller.

[Soruk]

If it's the credit card company, I ask for a few random digits from the account and sort code that the direct debit comes from - details not typically included on a credit card statement.

[IanRS]

Mutual proof of identity

Many years ago one of the telecomms companies (Vodafone I think) had a process whereby you agreed a 4 digit PIN when you became a customer. When they called you, they gave you 2 of the digits and you had to give back the other two. Which two went in which direction could vary. It is a really good, easy to implement, basic method of proving that the vendor calling is who they say they are (or that they have had a major data breech and all the details in the CRM have been nicked). I don't know why more companies do not have something comparable.

[Woodnag]

It is a really good, easy to implement, basic method...

...to you and me. But not to half the population who'd need to have the 4 numbers and the instructions tattood onto a limb, and all other limbs tattood telling them which limb to check.

[DS999]

Shared secrets are great in theory

But PINs and passwords are such a problem that we've been trying to replace them with alternatives where "forgetting" isn't a thing like Face ID and passkeys.

This kind of thing is where apps come in handy. I'd much rather have my bank send me a push notification via their app "issues with your account, please call us" than for them to call me, because AFAIK we've never seen an attack where someone has spoofed a notification from an app. Not saying that's impossible, but I'm pretty sure the bar is a lot higher than just cold calling me with forged caller ID and saying "before we continue we need to verify you are the account holder, can you please provide us your account number and card's PIN number?"

Now yes not everyone uses a smartphone or uses apps but where that's an option I'd much rather have my bank contact me that way. If they called me and I was at all suspicious I'd ask them for their extension number and I'd hang up and call the main number and re-connect with them that way. If they've hacked SS7 and taken over my bank's number they're elite criminals and would likely target someone with a couple digits bigger balance.

[ckm5]

Re: Shared secrets are great in theory

Biometric IDs only work until the system is hacked and you can't rotate the password.

Right now the best we have is physical FIDO keys.

[Anonymous Coward]

Re: Shared secrets are great in theory

I refuse to tie everything to every man and their dog needing an app on my phone. If nothing else, what happens when I lose my phone, it breaks, the battery runs out, ... ? The point when a provider tells me I "must" use their app is the point they become an ex-provider of services.

The only exception is those that use an open standard so I can use one authenticator app to generate the TOTP codes - and which has the ability for me to create an encrypted back-up which could be restored onto another device if needed. But of course, work insists that open standards aren't secure - and I've told them where they can stick their "yes we have to accept Microsoft's word that both the protocol and app are secure" Microsoft authenticator. Conveniently we aren't allowed phones in the office anyway. Just don't get me started on how MS have done MFA in the most user unfriendly way I can think of !

[PCScreenOnly]

Joint banks

I have account with Bank A and another with Bank B. Both are UK banks and same parent., both banks have FSA protection, but the email address is linked between the 2. Change it at Bank A and the email address for Bank B changes too.

Passwords and accounts are separate.

Seems a real risk to me

[DS999]

Re: Joint banks

If you think it is a risk why don't you move one of those accounts to another bank not owned by the same parent?

[PB90210]

Re: Joint banks

Try asking the banks to stop merging...

I once moved some savings from Abbey National to the Alliance and Leicester for extra security, in case either went bust... a couple of months later they merged

[Anonymous Coward]

Re: both banks have FSA protection

Yes, but if you have over £85k in both banks, you are only covered up to a total of £85k.

[PCScreenOnly]

Passcode to phone

Try telling a bank to stop doing that. Do not want to listen - even though it is not too hard to bypass

Run their app on a rooted phone - major risk, we cannot do

[Anonymous Coward]

HSBC Bank Security

I've mentioned before about the inadequacies of my bank. One that still festers in my mind (going to post AC, but you can prob recognise my writing style) was the day I went into my branch, pointed out that, as a Business customer, I'm not allowed to use their Statement machine, could I have a printed statement please? The guy at the counter took my Debit Card and said "Certainly sir" and a few minutes later I had a printed statement in my hands.

What is wrong with that story?

Well, later that day, after transferring some money using their Telephone Banking service I was asked "is there anything else I can help you with today?" I said, well actually there is, recited the above to her, and she struggled to see what the problem was.

At no time was I asked to identify myself in any way other than me giving the counter clerk my debit card. I could have found it in the gutter, wiped it down and bought it in for a laugh. On hearing this I was told this was a clear breach of security, could I say who served me in the branch, we will give them some extra "training". I refused, on the basis that it is the System that should not allow a humble counter clerk to get into my account like that without eyeballing my signature or asking for digits from my PIN. (They seemed to have moved away from such concrete methods to "my voice is my password", which I refuse to formally enrol in).

Then the killer: "Surely you will be able to identify who served me today, because the Statement request will be logged on your system?"

"Er no, we don't log Statement requests."

[Speechless]

I received £100 compensation for their stupidity.

Disclosure: I have, in my younger days, organised a piss up in a brewery.

[ColinPa]

Dont you know who I am?

My father was in the Royal Navy on ashore based ship. It was a ratings first day on guard duty.

One day this guy arrived at the gate, and the conversation went

Him: let me in, Ive left my badge in my office

Guard: No sir - no badge - no entry

Him: But I'm the captain of this ship

Guard: Sorry sir - I cant do it

Him: I'm the captain of this ship - dont you know me

Guard: Sorry - no sir -its my first day

Him: What's your name... .. now call the officer of the watch

OOW: Ah Hello Captain - what's the problem?

Next day the rating was summonsed to the captain's office. This usually meant punishment!

Captain: Well done for not letting me in. I left my badge behind, but if you had let me in, you would be here on a charge, rather than a commendation. Well done.

[GeekyOldFart]

At the place I work, even though we use 2FA across the board, when we reset passwords we will only provide the reset password to the users manager or to their manager. If both are unavailable, the user is SOL until one of them returns, because providing a password directly to the impacted user is strictly verboten. This is to provide an extra level of protection against precisely this kind of social engineering.

"Ok it will be reset within a few minutes and your manager will contact you with your new temporary password..." - It not only breaks the social engineering, but it exposes when one of our Helldesk guys got caught and we play back the call looking for anything they missed. Not to hammer the guy, but to learn the enemy's tactics.

[spuck]

I can appreciate the level of concern, but I can't agree with the idea that you give passwords to anyone other than the user themselves. Compromises must be made somewhere, I suppose...

[Claptrap314]

That's a temporary password that only gets you far enough into the system to change the password.

Given all the existing ways that a manager can ruin a subordinate, I would call this a very minor threat indeed.

I guess if the CEO forgets their password, you get the temporary to the Chairman of the Board?

[IGotOut]

Disconnect Everything

Ahhh the good old days of Natchi and Blaster.

I remember well running around yanking the power from Nortel and Baystack switches and going from desk to desk, server to server with a bootdisk to disinfect each device, one by one. Those that were to far gone were wiped.

Lot easier to recover back in those days....it only took 2 days of non stop work.

[PCScreenOnly]

Re: Disconnect Everything

yeah, would not want to be in security these days, nor recovering. Many places only then find their DR is not good enough, nor were backups etc

[frankyunderwood123]

Co-op early decisive action, really?

Is that why my local coop had empty shelves for two weeks and I was unable to update my will which I did via the coop?

Even now there’s gaps all over the place in the large flagship store in my town.

Luckily there’s a Sainsbury too, which is hugely cheaper and better.

The coop is a bit crap and always has been

[Yet Another Anonymous coward]

Re: Co-op early decisive action, really?

>The coop is a bit crap and always has been

You probably have more to thank the Rochdale Cooperative Movement for than you would think

(unless you personally own large bits of the Home Counties of course)

[FrogsAndChips]

Re: Co-op early decisive action, really?

The coop is a bit crap and always has been

There was a time when they were part of my top-up stores list, but they've become much more expensive and these days I only visit them when I have the '£1 off your shopping' offer on the app so I can grab myself a free item.

[Robert Carnegie]

Re: Co-op early decisive action, really?

Sainsbury's turn will come, I expect. And the Co-op will still be there. I'm a member, by the way.

Is your will electronic? That sounds a bit odd. Doesn't it have to be physical, and physically signed? And you can just make a new one by other means.

[An_Old_Dog]

Favorable Circumstances

I once worked for a large org - mainframe, minis, 13K+ PCs, 2K+ printers - which had the favorable circumstances of low tech-job turnover. ALL the techies knew ALL the other techies - field service, networks, telecom, help desk, machine operators, DBAs, and computer security people - by name, face, and voice.

Yet when you called the help desk to have them reset your password(s), they always (cheerfully) asked for your verifying info.

[sugee]

They trusted but did they verify?

This breach didn’t exploit a system, it exploited belief. A voice that sounded right. A story that made sense. A sense of urgency that felt familiar. No malware. No brute force. Just the weaponization of human instinct. We build deep stacks of security and yet access still comes down to how convincing someone sounds on a phone call.

That’s the flaw. Not in our defenses, but in the quiet assumption that trust can be judged in real time, by people under pressure. In a world where attackers rehearse tone, context, and credibility, the question isn’t “How do we train people better?” it’s “Why are we still asking them to decide?”

What we need isn’t stronger instinct. It's tools that can verify identity.

[itsme_Hethal]

We need better and accessible solutions!

It looks like you gotta have big budget to be safe. But that shouldn't be the case! Security should be accessible to all, especially with the growing digital world.

We need to have solutions to such impersonations and fraudsters than just telling everyone to stay cautious. It is humanly impossible to be cautious 24x7, without losing one's peace of mind or becoming paranoid.

One way of verifying a person on a call or even in-person can be through public key signatures. This can hold the future of digital security for all common people from scamsters like these.

[I could be a dog really]

Am I the only one who thinks part of the problem is "convenience" ?

I bet many of these orgs run a mainly MS estate, with everything tied into one AD. So compromise an account and you have access to everything in the entire estate that the account has access to - and if the account is an admin level account, all the better. Yes, SSO is really convenient, but against that, if systems are at least partially isolated, with different accounts for different systems, it provides some defence from criminals simply strolling around your entire estate without any further effort on their part needed.