- [Instructor] In this quick lesson, I'm gonna talk about
how threat actors or attackers impersonate people
on social media or social networking sites, and
also how attackers can impersonate those websites as well.
And they do that to obtain sensitive information
from their victims.
First, it is extremely easy
for anyone to create a fake account
on either Facebook, Instagram, Twitter
or any other social networking site.
Basically they can do this to impersonate anyone
then basically, you know, they can steal somebody's picture
and create a fake profile to send friend requests
to your friends, interact with those people
and sometimes, you know
perform negative actions in, you know
those websites and those social networking platforms.
And then people will think
that those actions were done by you right.
Now let me shift gears into another tactic
that attackers have used in many cases, and that is
trying to impersonate social networking sites overall
the whole site, and clone them
and then lure those victims to go to those sites
and then obtain information from their victims
whether it's credentials or any other type of information.
Basically the attacker can take advantage
of many different attack scenarios like on the path attacks
which we formally refer to as man in the middle attacks
or DNS poisoning attacks, or any other wire
or wireless type of attack to do this type of action.
Now, in this example, what I'm using is a super popular tool
called a social engineering toolkit.
This tool can be used to launch many different
social engineering attacks
like spearphishing attacks, website attack vectors
create different payloads and much more.
Now, in this example, I'm going to very easily
demonstrate how to impersonate Twitter to then
steal credentials from a user.
Now, of course, you know there's a lot of mitigations
against this because, you know
hopefully you're using multifactor authentication
and so on, but you know
at the same mechanism the hacker can impersonate any website
and then interact with a user to potentially send them
to a malicious one that will steal the session tokens.
And then of course
even bypass multifactor authentication in some scenarios
but let's take a look at how this attack actually works
in the social engineering toolkit.
So again, this is the tool that I was referring to.
From the menu I'm gonna select number one
for social engineering attacks
and then I'm gonna select number two
for website attack vectors.
Now in there I'm gonna do
a credential harvester attack method
and then I have the option to either use a web template,
clone the website, or do a custom import
of all the HTML and CSS files to create that website.
Now, for the simplicity of this example
I'm actually just gonna use number one, the web templates.
And then the first thing that is actually asking you
is what is gonna be the IP address for the post, right?
So the client or the victim to communicate back
to the quote unquote command control system
in this case, your system, right?
But you can actually point this
to a different system as well.
Now, in this example, just for simplicity
the tool already recognize my IP address that you see here
192.168.88.225, I'm just gonna press Enter in there.
And then you see that I have a few options
that are here built in like Java required.
And then the user actually will get a popup message saying
Hey, you need to update Java, or impersonating Google.
But in this case, as I mentioned, you know
I'm gonna impersonate Twitter.
So I'm gonna select number three.
Now in this case, you know of course
this is running on port 80.
So once again, you know
there are different mitigations against this scenario.
However, you can do DNS poisoning attacks
you can do other social engineering attacks
and make these very, very
very intuitive or, you know, I guess, you know
lured your victim to then navigate to that site.
And probably you can build in, you know
these type of modules within captive portals
in a wireless base attack saying, you know, you can log in
with your Twitter account to get free internet access.
And then of course your victims will actually will
will try to do anything that they can to
obtain free internet
and then you can steal their password as well.
So now what I'm going to do is I'm gonna open a new window
from a different system.
And in this case, actually from my Mac, not from Parrot
and as you see, you know, I actually went to 192.168.88.225
and it's asking me for my username and password.
So here I'm actually just putting some fake information
and then whenever I sign in
it redirects me to my real Twitter account.
But in here you see the username
and the password, actually
I just put, this is a password with spaces.
So this is actually correct.
Right? So again, this is just one example out
of many that attackers can do
to do many different type of
impersonations of social media sites.
And again, as I mentioned in the beginning of the lesson
not only, you know, attackers do this type of impersonation
but they impersonate people on social media sites.
So two different things that I actually cover
in this lesson.