5 ms·

Totally agree that this isn't a great idea on Rogers part. But it strikes me that there is a relatively easy way to detect social engineering in this case. Jus

by tux1968 14y ago

Totally agree that this isn't a great idea on Rogers part. But it strikes me that there is a relatively easy way to detect social engineering in this case. Just give the caller ridiculous answers in response to their first few queries and see if they balk. Only someone who knows the correct answers will challenge you. It would be really nice if there was a better way to ensure the identity of parties on either end of a phone call. In my case, an inability to remember dates causes a headache every time I try to do telephone banking where it seems to be the only type of security questions they use.

MichaelApproved 14y ago
"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Sure, you me and many others on HN could try this or be defensive when we get asked for our information but the common customer wouldn't balk. They would just rattle off the information and continue the conversation. The point of the article is that this style of marketing is training customers to feel comfortable with giving out personal information when they're on the receiving end of a call.
- tomrod 14y ago
  Crazy. Are there any news articles where these type of social engineering scams have been successful?
  - MichaelApproved 14y ago
    I remember when it was a big deal on AIM and other IM services. You'd get a message from an official sounding screen name asking you to verify your password. These types of attacks are why you typically see messages like "we will never ask for your personal information" from service providers.
    - alister 14y ago
      "we will never ask for your personal information" It's a nice first step, but then they break the security model by sending emails with a link to click on. Every single service provider, bank, credit card, airline, or utility that sends me email, sends it with embedded links. Customers have now been trained to click on links and give their passwords to login screens if they look halfway authentic.
      - MichaelApproved 14y ago
        At least in this case, I'm calling the bank. Meaning, I'm vising their page and I can confirm that it's actually the bank that I'm communicating with. Browsers have been getting better about protecting users when it comes to online bank phishing attacks. Secure connections are emphasized more and getting rid of basic auth in the URL helps defend the customer from spoofing tactics.
  - trhtrsh 14y ago
    http://news.ycombinator.com/item?id=4612022 http://news.ycombinator.com/item?id=4612022
alister 14y ago
"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Except that you know what happens when you give ridiculous answers to (secondary) security questions when signing into a bank account or credit card online? You get locked out of your account. I don't think that Rogers' telemarketing system would behave the same way, but just be prepared to have to call Rogers back--answering yet more questions--to re-activate access to your account.

by tux1968 14y ago

MichaelApproved 14y ago

"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Sure, you me and many others on HN could try this or be defensive when we get asked for our information but the common customer wouldn't balk. They would just rattle off the information and continue the conversation. The point of the article is that this style of marketing is training customers to feel comfortable with giving out personal information when they're on the receiving end of a call.

tomrod 14y ago
Crazy. Are there any news articles where these type of social engineering scams have been successful?
- MichaelApproved 14y ago
  I remember when it was a big deal on AIM and other IM services. You'd get a message from an official sounding screen name asking you to verify your password. These types of attacks are why you typically see messages like "we will never ask for your personal information" from service providers.
  - alister 14y ago
    "we will never ask for your personal information" It's a nice first step, but then they break the security model by sending emails with a link to click on. Every single service provider, bank, credit card, airline, or utility that sends me email, sends it with embedded links. Customers have now been trained to click on links and give their passwords to login screens if they look halfway authentic.
    - MichaelApproved 14y ago
      At least in this case, I'm calling the bank. Meaning, I'm vising their page and I can confirm that it's actually the bank that I'm communicating with. Browsers have been getting better about protecting users when it comes to online bank phishing attacks. Secure connections are emphasized more and getting rid of basic auth in the URL helps defend the customer from spoofing tactics.
- trhtrsh 14y ago
  http://news.ycombinator.com/item?id=4612022 http://news.ycombinator.com/item?id=4612022

alister 14y ago

"Just give the caller ridiculous answers in response to their first few queries and see if they balk." Except that you know what happens when you give ridiculous answers to (secondary) security questions when signing into a bank account or credit card online? You get locked out of your account. I don't think that Rogers' telemarketing system would behave the same way, but just be prepared to have to call Rogers back--answering yet more questions--to re-activate access to your account.