A recent
IT-Director
article discussed some of the reasons why small businesses (in the
author's opinion) might not want to make the jump to free software. One of
them was the following:
Technical support will involve participating in internet forums,
asking people of unknown capability for help with any problems and
trusting that what comes back is a real fix, not some means of a
malicious person gaining access to the user's system. This
haphazard way of supporting IT is unattractive, especially for
smaller businesses with limited in-house expertise.
The article goes on to say that businesses respond to this problem by
purchasing support from distributors. Paid support plans are a fine
alternative in many situations, but people who have spent much time
performing system administration have usually learned that, often, answers
from the net can be quicker and more clueful than those from the paid
providers. So the idea that community support could be used as a way to
attack a system is disconcerting.
At first, it also seems rather unlikely. One wonders where this concern
came from, given that there may not be a single case of a system having
been compromised by way of "help" provided through a community forum. As a
business sizes up the threats to its systems, malicious advice from the net
should probably appear fairly low on the list.
That said, this possibility may be worth a little thought. The phishing
problem shows that there is no shortage of people out there with an
interest in social engineering attacks. Provision of bogus advice would
not scale in the way mass phishing attacks do, but it might also fall on
more fertile ground. A system administrator with a broken system,
disgruntled users, and a pointy-haired boss breathing down his or her neck
might be inclined to follow seemingly helpful advice from the net without
thinking about it much first. In a world where software installation
instructions begin with "turn off your antivirus software," any of a number
of ill-advised suggestions might seem entirely reasonable.
So, sooner or later, some joker will probably attempt this sort of attack.
For those who are especially concerned about this possibility, here's a few
possible defenses:
- When asking for help on the net, consider using a non-work email
address. Requests from admin@big-defense-contractor.com may be more
likely to attract suspicious replies. It can only help to keep
potential attackers from knowing where the relevant systems are
located.
- Be highly suspicious of any replies which are not copied back to the
list where the question was originally asked. Hostile advice posted
to a public list will likely be spotted quickly, but there is no
public review of private mail.
- Make a point of understanding any suggested remedies before trying
them.
The above is all entirely obvious stuff, but it should be sufficient to
defend against most social engineering attacks disguised as responses to
requests for help. As is the case in many areas of security, a bit of
common sense goes a long way.
Comments (14 posted)
