Be careful who you approach in the 21st century, mindlessly.
by Joe Freeze and Addison SayleBot
The old ways are finished, and if you’re not thinking 21st century forward, you are about to learn the hard way. Huh? A person is not safe globally or locally. All it takes is getting close enough.
If you would like your cheeks smacked up a little bit, let’s have story time before your nap.
1. Oh boy do I love Bluetooth and all that comes with it.
Bluesnarfing and Bluejacking: Informed citizens use specialized tools to access your device via Bluetooth if it’s set to discoverable. They can potentially pull data like contacts or messages.
Eavesdropping: Even if not discoverable, certain exploits may allow hobbyists to listen to your Bluetooth communications or intercept data being transferred.
2. Hey yo, look, free wifi!
Evil Twin Attack: A citizen sets up a fake Wi-Fi hotspot, tricking you into connecting. Once connected, they can intercept your internet traffic, capture login credentials, and borrow without returning personal data.
Packet Sniffing: Even on legitimate networks, if a resourceful citizen is on the same Wi-Fi, they can use packet-sniffing tools to capture and analyze (Anal-ize?) your unencrypted data.
3. Slide a little closer sweetheart
NFC Sniffing: If your phone or device has NFC enabled (I really hope it does,) a nearby friendly door answerer with the right equipment can capture data or even make payments if your card information is stored.
Relay Attack: Resourceful citizens can use a device to relay the NFC signal between your phone and a payment terminal, potentially making unauthorized purchases.
4. RF you up the SCSI port
RFID Skimming: If your phone has an RFID-enabled feature, nerds can use RFID readers to steal data when in close proximity.
Electromagnetic Interference: Advanced bored people can potentially use EM signals to interfere with your device or intercept signals, though this is more sophisticated and less common (Reserved for the most bored nerds.)
5. I’ll stick it if you let me stick it
Data Theft: Friendly charging stations could potentially be modified to extract data or install malware on your phone or laptop when plugged in.
Malware Installation: Neighbors can set up a charging port to install malicious apps or spyware on your device without your knowledge.
Proximity-based digital threats are real but manageable with good digital hygiene and vigilance.
Now that they(we) have your contacts and emails, you could be vulnerable to several types of automated (This is Joey’s specialty) threats.
Now that part one is complete: GET DATA, the final stuffing will begin… WORK DATA
Here are some easy ways informed citizens can use that data and what it could mean for you:
1. I can already prove you’re not reading, so you’ll probably miss it when this starts.
Automated Phishing Campaigns: Using your contacts, a literate person could deploy automated phishing emails or SMS messages that appear to come from you, tricking your contacts into revealing personal information or clicking on malicious links.
Social Engineering Scams: Normal people could use information about your relationships with contacts to craft more convincing scams. This might include fake urgent requests for money or help, leveraging automation to quickly contact many people on your list; again and again and again and again and again.
2. I have AOL and Hotmail again, yay!!
Credential Stuffing: With email information, average people can use automated scripts to try commonly used passwords or exploit other accounts linked to the same email. If successful, they can use your email to send out spam, phishing links, or malicious attachments.
Automated Forwarding and Filters: Neighbors, family, friends, can set up automated rules in your email account to forward messages or send copies of specific types of emails (like banking or password reset emails) to themselves without you noticing (and we both know you’re not.)
3. Your Business is now MY business Email Compromise (BEC)
Impersonation Attacks: By mimicking your email address or using automated spoofing, anyone can target your business contacts to trick them into sending payments or confidential information.
Invoice and Payment Fraud: Some of us can automate fake invoice requests or change payment instructions in invoices sent to clients or business partners, rerouting payments to fraudulent accounts.
4. Spreading Malware
Malware Distribution: Behind any door can be a person that can create automated messages with malicious attachments or links, sending them to your contacts. If any of them click on these, they may inadvertently download malware or ransomware.
Botnet Involvement: If a informed citizen gains access to your email, they can set up automated replies or forwards containing malicious links or files, turning your email into part of a botnet spreading malware.
5. I bet you didn’t think people think like this.
Automated Data Mining: Computer user(s) can use bots to mine your contacts and emails for more personal information. They can build profiles on you, your business, or your contacts, using this data for identity theft, extortion, or selling it on the dark web.
Targeted Advertising and Scams: Automated systems can tailor scams or fraudulent ads based on information gleaned from your contacts and emails, potentially resulting in ongoing targeting through SMS, email, or even phone calls.
6. Duh, why password reset no work? and SIM Swapping
Automated Account Recovery Attacks: Even your spouse could use your email address to try automated account recovery processes, gaining access to other online accounts tied to that email. They may also attempt SIM swapping by gathering personal details that help convince your mobile provider to transfer your number to their control.
Automation ideas are constantly evolving, so maintaining vigilance and securing your accounts could make a huge difference in mitigating these risks, but you and I both know that you like to save passwords, keep wifi/bt on, and approach/interact with people that you shouldn’t.