But what other types of information could potentially place your organisation at risk? Examples include, but are not limited to:
- Supplier lists
- Uniform code
- Staff login portals
- Employee certificates with candidates’ confidential information
- ID badges
- Executive leadership charts
- Regulatory filings – e.g. Companies House is a gold mine of information.
Data leakage can occur through various channels, and many organisations and employees inadvertently disclose this information. Threat actors may seek to identify sensitive details through social media posts, blog posts, publicly accessible documents, and YouTube videos. Much of this can be easily found by using search engines and following a rigorous OSINT (Open-Source Intelligence) methodology.
As mentioned earlier, data leakage is often unintentional; it typically happens because employees and organisations are unaware of the risks associated with certain types of information. There are several ways organisations can protect themselves and mitigate risks. Regular security awareness training can help employees identify information that should remain private and provide clear definitions of what is acceptable to post publicly. Additionally, implementing or updating a comprehensive social media policy can specify what types of information are appropriate for public sharing. This not only protects the organisation but also safeguards employees. Additional measures could also be taken by IT staff in restricting access to social media on company equipment and if exceptions were required these could be allowed by manually specifying groups/users.
While leaked information poses a security risk, the real danger lies in how this data could be exploited. The process of using this information for further attacks is known as weaponization. Weaponization is a critical step within the Cyber Kill Chain and plays an essential role in a threat actor’s exploitation process.
The next section will discuss how the collected information could be used.
Weaponizing Information
As Sir Francis Bacon said, “Knowledge is power.” in this case, the knowledge gained by threat actors can be weaponized to help them achieve their goals.
Weaponization, as previously discussed, refers to the creation of malicious payloads. After gathering Open-Source Intelligence (OSINT) and compiling a dossier of useful information, a threat actor can now craft targeted attacks that are more likely to succeed.
The nature of these attacks varies based on the situation, as different threat actors will have different motives. For example, in the Brooklyn Nine-Nine scenario, the leaked information allowed a reporter to publish an article revealing arrest statistics. This breach of confidentiality turned classified information into public knowledge.
In real-life situations, threat actors aim to execute similar actions, tailoring their behaviour to achieve specific goals. Consequently, weaponization seeks to use information in ways that can cause more significant harm.
Phishing
Phishing involves sending a maliciously crafted email to trick users into taking unwanted actions.
For instance, if a threat actor identifies a login page for employees, they could replicate that page and connect it to a database they control. This phishing page would request user credentials, and if users submit their information, the threat actor could capture it and impersonate the accounts, thereby compromising confidentiality and integrity.
To increase the success of such an attack, the threat actor might use enticing subjects like salary increases or details about new benefits. These intriguing topics can lure in unsuspecting users who may not be particularly security conscious.
Physical Intrusion
Physical intrusion involves breaking into areas that are supposed to be access restricted.
During the OSINT phase, if a threat actor manages to compromise information about staff badges, uniforms, and office locations, they could potentially impersonate employees. By donning appropriate attire, the threat actor could navigate the organisation’s office undetected, blending in with legitimate staff.
Techniques like tailgating – where one individual follows another closely through a secure access point – can be employed to bypass security measures and gain entry to unauthorised areas.
Once inside, the threat actor could compromise employee devices, particularly if computers are left unlocked. They might also deploy “drop boxes” around the office to establish a connection with an external machine they control. From there, the threat actor could aim to capture user credentials, pivot across the network to access different VLANs, view network shares to breach data confidentiality or elevate privileges to attain domain administrator access.
Other forms of attacks could also be executed based on the information obtained, including vishing and password-guessing attacks. The strategies mentioned are just a couple of examples among various techniques.
In conclusion
It is crucial to maintain awareness regarding the information being shared online, as excessive posting can enable threat actors to carry out attacks more effectively.
Increasing employee security awareness and establishing social media policies are good initial steps. However, it is also important to regularly assess the available information.
These assessments can be conducted internally or as part of a security review by a third party. Many companies specialise in conducting open-source intelligence (OSINT) to understand the information available to the public. At Pentest, we incorporate OSINT into our Red Team engagements, not only helping organisations evaluate what information is publicly accessible but also demonstrating how this information could be used by real-world threats to compromise your organisation.
If you are worried about how publicly available information could impact the security of your organisation or would like to discuss how our services can help enhance your security defences, feel free to contact us to discuss how we could help.
