If your web site offers live chat, be prepared for hackers-"A case Study"

[Venustus]

Live chat has become ubiquitous as a sales and support tool for software as a service (SaaS) or cloud based services. Entire businesses have been built around providing live chat, such as Olark (which my company uses) or Intercom. As the CEO and founder of a SaaS business (Sendwithus.com), I had very little question about if we should support live chat; it was just a question of how to offer live chat to our customers.

Like many enterprise platforms, we support adding multiple team members on an account and setting up user permissions like an account administrator. Early last year we were lucky enough to catch an attacker attempting to social engineer our live chat operator and gain access to a Fortune 1000 customer’s account. I say we were lucky because our typical attitude to support is customer focused, always looking to go the extra mile for a customer. I can imagine that, without certain conditions being met, we could have missed this.

For the uninitiated, social engineering is a form of fraud computer hackers often employ to gain access to information or systems by manipulating employees at their target company. An example of this is the 2013 credit card theft from retail mega chain Target.

In our case, the chat session started innocuously enough:

Further reading

 

[DracusNarcrym]

Social engineering sure is a jack-of-all-trades in a cybercriminal's toolkit.
If they can accomplish to almost bring down an entire corporation by manipulating just a handful of employees, it is certainly obvious what could happen in the case of endpoint users.

 

[hjlbx]

Live chat has become ubiquitous as a sales and support tool for software as a service (SaaS) or cloud based services. Entire businesses have been built around providing live chat, such as Olark (which my company uses) or Intercom. As the CEO and founder of a SaaS business (Sendwithus.com), I had very little question about if we should support live chat; it was just a question of how to offer live chat to our customers.

Like many enterprise platforms, we support adding multiple team members on an account and setting up user permissions like an account administrator. Early last year we were lucky enough to catch an attacker attempting to social engineer our live chat operator and gain access to a Fortune 1000 customer’s account. I say we were lucky because our typical attitude to support is customer focused, always looking to go the extra mile for a customer. I can imagine that, without certain conditions being met, we could have missed this.

For the uninitiated, social engineering is a form of fraud computer hackers often employ to gain access to information or systems by manipulating employees at their target company. An example of this is the 2013 credit card theft from retail mega chain Target.

In our case, the chat session started innocuously enough:

Further reading

• Add any internet facing applications, like chat, to anti-exploit protections (and Guarded Apps list if you use AppGuard).
• Chat apps should be configured to Low Integrity like Internet Explorer (contact chat app publisher directly and ask them what to do for easiest results = let them do the work or slug your way through the discovery process of how to do it).
• In the browser chat should be at the same integrity level as the browser - which should be Low Integrity by default or custom configured to run at Low Integrity.
  
• Internet Explorer is already set to Low Integrity.
• Firefox can be configured to operate at Low Integrity.
• Chrome - I have no idea - since it uses its sandbox I am not sure how privileges work in it.
• Opera can be configured to operate at Low Integrity.

Search online for tutorials for setting Firefox or Opera to Low Integrity.

 

[Venustus]

I'm pretty sure I read somewhere that Chrome already runs at "low integrity" and "untrusted integrity" levels
However,I could be wrong!!

 

[hjlbx]

I'm pretty sure I read somewhere that Chrome already runs at "low integrity" and "untrusted integrity" levels
However,I could be wrong!!

I think perhaps it does. Summary of Chromium project that discuss Integrity Levels:

Sandbox - The Chromium Projects

 

[DracusNarcrym]

Core components of the Windows security architecture such as integrity mechanism very usually go unnoticed by IT staff responsible for the implementation of security measures in work environments.

After all, it's all a matter of proper research in the already well-established documentation pages provided by Microsoft, since all the necessary utilities for configuring those security mechanisms are provided by the Windows installation by default.

In the case of potential attempts at compromising a system by means of social engineering, i.e. manipulating endpoint users, the integrity levels configured to should shield the targeted endpoint system from the manipulated user's actions or from the actions of a compromised application.

 

[hjlbx]

Core components of the Windows security architecture such as integrity mechanism very usually go unnoticed by IT staff responsible for the implementation of security measures in work environments.

After all, it's all a matter of proper research in the already well-established documentation pages provided by Microsoft, since all the necessary utilities for configuring those security mechanisms are provided by the Windows installation by default.

In the case of potential attempts at compromising a system by means of social engineering, i.e. manipulating endpoint users, the integrity levels configured to should shield the targeted endpoint system from the manipulated user's actions or from the actions of a compromised application.

They don't do it because it requires a lot of time and effort.

So, inconvenience is primary deterrent.

Install security soft X-Y-Z and expect it alone to solve all vulnerabilities.

I haven't hardened my OS, because doing so is a long, drawn out process... LOL.

 

[DracusNarcrym]

They don't do it because it requires a lot of time and effort.

So, inconvenience is primary deterrent.

Install security soft X-Y-Z and expect it alone to solve all vulnerabilities.

I haven't hardened my OS, because doing so is a long, drawn out process... LOL.

Well said.

As for the OS-hardening part, I believe we share the same... "opinion". xD

 

[jamescv7]

Live chat sometimes definitely a hassle due to formality process besides on security risk so indeed if you want to seek help or some inquiries make sure that the purpose is something to terminate the contract or request a rebate or other than that.

Because seek help on computer related problems can be solve by your own or known enthusiast.

 

[Cats-4_Owners-2]

I enjoyed this thread! My wife whom dropped her smartphone early this morning (it now looks as though ink was spilled upon her display) & she was just speaking, though not chatting, with our provider's customer service dept. They "verified" she was who she claimed to be by asking her to log onto her account, and they "used proper channels" by verifying her replacement transaction through her email. She'd then intently appreciated my sharing directly from this thread's example of the fails safes set into place to prevent client companies from falling victim to social engineering & fraudulent lies! ..and this time my voice didn't put her to sleep either!

Live chat sometimes definitely a hassle due to formality process besides on security risk so indeed if you want to seek help or some inquiries make sure that the purpose is something to terminate the contract or request a rebate or other than that.

Because seek help on computer related problems can be solve by your own or known enthusiast.

Agreed!
I look forward to canceling our satellite TV in just this way, & a rebate would be marvelous!