From the “shaking our heads” files comes the story of how threat actors compromised military personnel mobile devices, credentials, accounts and more.
You’d think that if you received a smartwatch in the mail, you’d immediately throw it out. Apparently, according to a new press release from the U.S. Army’s Department of Army Criminal Investigation, quite a few service members fell for this social engineering tactic.
These smartwatches connect to WiFi, as well as the service members mobile phone where it potentially has unrestricted access to saved data that includes usernames and passwords, contacts and banking information.
The press release also warns of the possibility that both video and voice, when activated on the mobile device may be accessible to the smartwatch, potentially compromising any details shared on phone calls, within texts, etc.
This feels like the ultimate “are you kidding me??!???!” story where I simply can’t believe that anyone fell for this… and yet, enough did that a press release needed to be put out.
The general rule for any kind of attack that uses social engineering – regardless of communication medium, message, branding, etc. – is very simple: if you aren’t expecting it and it sounds too good to be true, it most definitely is NOT true and should be considered malicious in intent – something taught employees within continual new school security awareness training.
Here's how it works:
