Multi-Channel-Angriffe - Cyber Mind Hacks

Imagine you get an email that seems to be from Google and a urgent notification about a account reconstruction. Shortly after that, you also get a call. An alleged Google support employee informed you that someone tried to access your Gmail account. The voice sounds professional and gives faithfully to know about suspicious messages. An absolute nightmare for everyone who believes in the security of their account. What I first heard as a hypothetical scenario is that in October 2024, many Gmail users happened. If you want to learn more about this, take a look at our show notes. You'll find the link to the case. It's a parade of examples for a so-called multi-channel attack. Cybercriminals combine several communication channels like e-mail, telephone calls, and fake websites to make it as believable as possible and to create attacks or sensitive data. Welcome to CybermindTex, your podcast for digital security. I'm Simona from SoSafe and today we're talking about a particularly clever technique that cybercriminals use - multi-channel attacks. This kind of attack makes it particularly difficult to be on your heels. But don't worry, we'll show you how you can protect yourself. Multi-channel attacks are, as your name says, attacks that use several communication channels at the same time to deceive you. Let's take a look at that. You get an e-mail that asks you to put your password back. You may still ignore the whole thing as a suspicious e-mail, but shortly after that you also get an SMS that tells the same story. Now the thing suddenly becomes more believable, right? And that's exactly the goal of multi-channel attacks. They want to eliminate your doubts by using different channels to influence you. These attacks can take place over a large number of platforms. From e-mails and SMS, through social media, to phone calls. Sometimes even fake posts are sent. The idea behind it is simple. The more channels are used, the more likely it is that you believe in the story and fall into the trap. The refined multi-channel attacks are that they combine different channels and build up on each other to confuse you and turn off your protection mechanisms. The scenario or attack is prepared over different channels and handled psychologically. Normally, we all have something like a suspicious radar. When an e-mail looks suspicious or comes from a stranger, we are more cautious or even ignore them. But what happens when the attacks use several channels to secure you from them? The sender seems to trust you because you have already exchanged with him on another channel. Cyber criminals set up a target social engineering to manipulate your victims. They play with emotions, stress, insecurity or drunkenness and use the diversity of channels to lock the victim in the trap. The key to success of this attack is in coordination. The better the different messages are connected, the more likely they will influence you. By the way, we have talked about social engineering in the first episode of Cyber Mind Hacks. If you haven't done that yet, go ahead and listen to it. A common example of a multi-channel attack is the so-called banking pressure scenario. You get an e-mail from your bank that claims your account is compromised. In short, you get an SMS with a link that requires you to pass the account. But that's not all. You receive a call from your bank to confirm your identity. In this case, three channels will be added. Use e-mail, SMS and telephone to give you the feeling that something is really not right and that you have to act immediately. Another example is online shops. Imagine that you receive an SMS about a specific delivery that has been delayed. The link in the message leads you to a website that requires you to confirm your delivery address. In short, you receive an e-mail with the hint that your payment was unsuccessful and you will be asked to return the information. In this case, the criminals use the delivery path and the e-mail system of the common shop to hide your payment data. Further, it will be attacked by social media. You receive a message on Instagram that is supposedly from a friend who tells you about a great robot. Shortly afterwards, it appears on your Facebook page the same application. And then there is an e-mail with a link to an exclusive action. Everything seems to be connected even though it is just a mashing to intercept your data. The most important rule in the recognition and defense of multi-channel attacks is "don't trust blindlings". Only because the same message comes over several channels doesn't mean for a long time that they are legitimate. On the contrary, that could be a sign that something is wrong. A good protection is not to immediately react to demands that cause personal data to be given to you. No matter if by e-mail, SMS or call. Always check the source directly. If you get an e-mail from your bank, for example, call the bank yourself. But use the official telephone number and not the number that is given in the e-mail or SMS. And finally, pay attention to unusual behavior patterns. If you expect to receive the same message over several channels that require you to act quickly, it should be too skeptical. A legitimate company will not bombard you over several platforms, just to force a single action from you. My tip of the day is, always use the multi-factor authentication and be especially careful with messages that use several channels at the same time. That's it for today. Now you know how multi-channel attacks work and what you have to pay attention to to protect yourself. Always think about it. Security on the Internet starts with attention. Do not only trust because a message comes across various channels. Share this podcast with your friends and your family to protect themselves from such attacks. Subscribe to this podcast to learn more about digital security. See you next time.