notes.husk.org/likes images.

Security experts used fake Facebook and LinkedIn profiles pretending to represent a smart, attractive young woman to penetrate the defenses of a U.S. government agency with a high level of cybersecurity awareness, as part of an exercise that shows how effective social engineering attacks can be, even against technically sophisticated organizations. The attack was part of a sanctioned penetration test performed in 2012 and its results were presented Wednesday at the RSA Europe security conference in Amsterdam by Aamir Lakhani, a counter-intelligence and cyberdefense specialist who works as a solutions architect at IT services provider World Wide Technology. By building a credible online identity for a fake attractive female named Emily Williams and using that identity to pose as a new hire at the targeted organization, the attackers managed to launch sophisticated attacks against the agency’s employees, including an IT security manager who didn’t even have a social media presence. The agency’s name was not revealed, but Lakhani said it was a very secure one that specializes in offensive cybersecurity and protecting secrets and for which they had to use zero-day attacks in previous tests in order to bypass its strong defenses. The penetration testing team claimed Emily Williams was a 28-year-old MIT graduate with 10 years experience and set up her identity with as much real information as possible. For the fake social media profiles they even used the picture of a real woman – with her approval – who works as a waitress at a restaurant used by many of the targeted organization’s employees. However, no one recognized her. (via Fake social media ID duped security-aware IT guys | ITworld)