Author Archives: Lara Bergman

Bill Dean

When the Associated Press tweeted, “Breaking: Two Explosions in the White House and Barack Obama is injured,” it was quickly revealed that the information was false and was the result of the AP’s Twitter account being hacked.

While the AP Twitter hack has made big news, Sword & Shield Director of Computer Forensics and Security Assessments Bill Dean said that a social engineering hack of this nature “happens all the time,” to businesses of all sizes and the result is no less damaging to them.

Early reports indicated that the AP account was hacked after a phishing attack on its corporate network. One possibility is that a hacker sent an email to an employee or employees, tricking them into going into what looked like an official Twitter page and entering the company’s password. However, the attack could have also been perpetrated by a cyber criminal who made and educated guess of the company’s user name and password based upon gathered knowledge.“It’s important to remember that users are always the weakest link,” Dean said. “You can’t secure users, you must train them.”

The AP Twitter account was restored Wednesday morning and the Syrian Electronic Army, the pro-Bashar Assad group that hacked NPR.org on April 15, has taken responsibility.

Retroactively, a business that has suffered an attack can enlist the help of forensic specialists to perform an incident response or forensic analysis of the computer network and/or affected device(s) to confirm the method and source of the attack.

However, Dean said it’s more important that organizations pro-actively train their users, in addition to patching and protecting their networks and devices.

“As part of our social engineering assessments, we do employ USB drops or send phishing emails,” Dean said. “It only takes one plug-in or email click and we can assume control of the machine.”

Sword & Shield performs social engineering exercises in an attempt to trick employees into divulging confidential information that may be used to compromise network defenses. This form of security assessment targets people and processes instead of technology and works to help company leaders tailor their ongoing IT security training needs.