Brewster Kahle
More bad behavior towards libaries. This from a library partner: 1/
We've recently received several suspicious calls asking for book titles and specific information to be read aloud. These requests, which do not appear to be for real book titles, raise concerns about potential social engineering. Social engineering refers to malicious attempts to manipulate people into divulging confidential information or performing actions that compromise security.
Brewster Kahle
2/
For example, in one case, a caller asked a staff member to repeat phrases like "improve HR analytics," "by email," and "6-12 months." When asked for more details, the caller became evasive and requested additional information such as the staff member's name, library hours, address, and phone number—typical signs of a social engineering attempt.
Brewster Kahle
3/
Attackers may ask you to repeat phrases for several reasons, including recording your voice for fraudulent activities like voice authentication systems or testing whether they can extract information for future attacks. These tactics can subtly build rapport, lower suspicion, and gather useful details for more advanced schemes.
Brewster Kahle
4/
We ask that you remain vigilant and take the following steps when handling suspicious calls:
If a caller asks you to repeat unusual phrases or requests information that doesn't seem related to normal library services, politely ask for their name and their relationship to the library—whether they are a student, researcher, or another type of patron.
Brewster Kahle
5/
Document the call by noting the caller's name, the time of the call, and the nature of their request.
If the conversation feels suspicious or out of the ordinary, it's important to keep the interaction brief. Do not share specific book titles or any internal information if the request seems unusual.
Even if the call feels like a prank, document it and report the details to your supervisor
Henner Zeller
@brewsterkahle sounds a bit like the spammers need specific words to build a voice model to subsequently launch the actual attack tricking someone using an artificial voice that resembles someone the target knows.
Brewster Kahle
6/6
and a colleague related:
"A number of libraries in my social groups have reported this as well. Some were asked to repeat titles such as, 'I’d like to change my provider.' "
yuck.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.