Adversarial scenarios to harden organizations against fraudulent activity
In the rapidly evolving digital landscape, industries such as financial services, telecommunications, gaming, and healthcare are prime targets for sophisticated cybercriminals. Threat actors pay special attention to payment systems, social engineering of privileged personnel, and systems dealing with customer data. By exploiting these areas via specific scenarios, threat actors are able to commit fraudulent activities against the target which can irreversibly damage their brand and business. This article will delve into real-world scenarios that threat actors are actively employing against organizations to exploit their people, processes, and technology, and how said organizations can work to counter them.
Voice phishing, or “vishing” (i.e. telephonic social engineering), is an attack tactic which recently drew big headlines owing to its prominence in the ranswomare incident that impacted major entities in the second half of 2023. Vishing often sees cybercriminals gain access to target systems by impersonating an employee found on LinkedIn and other online platforms, and then convincing the target company’s IT support services to reset the employee’s password and/or associated MFA tokens to perform account takeovers against the users in single sign-on (SSO) environments. After gaining internal access to the target company’s applications and/or network via vishing, attackers will often seek to leverage publicly available, legitimate remote access tunneling tools to enable nefarious remote control of impacted systems. Once full control is achieved, these actors will leverage their access and the data they’ve retrieved to commit fraudulent activities.
Threat actors go to great lengths to conceal their identities during a vishing attack; examples include:
An attacker strategically targets web or mobile applications that offer gift card purchase capabilities. For instance, they may target a messaging mobile application that enables end users to purchase gift cards valued at $10, $15, or $20. These gift cards can be easily shared with contacts using their phone numbers. To exploit this system, the attacker begins by decompiling the targeted mobile app, allowing them to identify the specific API endpoints used for user authentication and gift card purchases.
By abusing these API endpoints, the attacker can either take advantage of vulnerabilities that enable them to impersonate legitimate users or exploit weaknesses that facilitate the purchasing of gift cards without drawing attention from the impersonated user. In order to ensure their actions remain undetected, the attacker limits their transactions to only buying one or two gift cards at a time.
To further obfuscate their identity, the attacker employs burner accounts and temporary phone numbers to receive the purchased gift cards. These accounts and numbers are promptly closed, making it difficult to trace them back to the attacker. The final stage of the fraud involves exchanging the acquired gift cards for cash or store credit at alternative institutions. To execute the fraud efficiently, the attacker automates the process using small amounts of money targeted against multiple legitimate users.
A medical institution operates multiple web applications that customers utilize for various purposes, including scheduling appointments, refilling prescriptions, accessing lab results, and entering medical history and personal information. An attacker identifies several vulnerabilities within these web applications. Although these vulnerabilities are not critical individually, they can collectively result in the leakage of small portions of customer information.
In past breaches, an attacker identifies vulnerabilities such as the ability to enumerate valid usernames in one application, obtaining phone numbers and email addresses through a leak in another application, and capturing mailing addresses from yet another application. After extensive exploration, the attacker discovers a web application that facilitates password resets via security questions. Alarmingly, this application only requires a valid username, email address, and the corresponding security question answers.
Capitalizing on this oversight, the attacker deliberately engages in a slow brute force attack, as the application lacks any rate limiting mechanisms. Over time, the attacker successfully identifies a handful of valid usernames, email addresses, and associated security question answers, leveraging the information gathered from the vulnerable web applications. With this knowledge in hand, the attacker proceeds to reset user passwords, thus gaining unauthorized access to the health and personal data of select customers. The attacker can use this information to impersonate legitimate customers or use it against other systems. By impersonating other users, attackers are able to continue to escalate their access and gain access to highly sensitive and sought after credit card information, insurance information, and social security information. This data can often be sold on the dark web for a profit or can be leverage to commit insurance or medicare fraud.
In conclusion, conducting scenario based fraud testing against sensitive systems can help organizations properly harden themselves against bad actors seeking to conduct fraudulent cyber activities. By proactively identifying and addressing business logic and process flaws that can lead to fraud, these institutions can better protect themselves and their customers from the ever-present threat of cybercrime.
KPMG offers end-to-end security testing as an outcome-based managed service, helping you consistently validate controls while minimizing remediation efforts. That’s because business transformation is not a fixed destination; it’s an ongoing journey. With managed services, we help you continually evolve your business functions to keep up with ever-changing targets, while driving outcomes like cost reduction, resilience, and stakeholder trust.
Insight
Social engineering
A fatal flaw in cybersecurity
Insight
Preventing broken trust
Managed services can help fill critical role of application security
Insight
Application security as a culture
How to counter agile adversaries
