Social Engineering Blogs

 By now, we’ve all seen them in one way or another. Whether it be in person (Halloween is approaching…), on our social media newsfeeds or in the media. Newspaper headlines read ‘Killer clown craze: 12 of the creepiest UK sightings’ (The Telegraph, 17th Oct), ‘Killer clown with machete threatens two girls in Suffolk’ (The Telegraph, 16th Oct), ‘Childline flooded with calls about killer clown craze’ (Daily Mail, 13th Oct). With the number of these ‘killer clowns’ growing exponentially, you’ve got to ask the question of what took this from a Halloween outfit to a craze confining communities to their homes.It may not come as a surprise that research has shown the media is strikingly successful in telling its audience what to think about. The more the media reports something, the more available that information is to us and the more frequently we think about it. The agenda setting theory, first proposed in 1922, outlines this effect. It is not surprising then, that killer clowns have become the topic of conversation with them consecutively filling newspaper headlines and their masks filling every scroll down social media. Could it be that this high exposure is what has caused the ‘craze’? Could it be that the volume of others putting on a mask is what is encouraging so many more to do the same? Figure One: The Theory of Planned BehaviourThe theory of planned behaviour suggests there are three components that lead to an intention to perform a certain behaviour (see figure one). Perceived behavioural control is simply the belief that you can control your behaviour. Perhaps the consequence of going out and scaring your community is too high; a risk of arrest, for example. But, thanks to the medias mass publications of clowns filling the streets, their perceived behavioural control is reassessed. An individual’s belief that they can to perform this behaviour grows, under the cover of a mask. Suddenly, a behaviour that seemed out of reach is not so anymore. This of course, ties in with social norms. Whilst it may have been considered unacceptable to go and scare your local community before, suddenly a lot more people doing it and it rapidly becomes a much more normative, and therefore an accepted behaviour to perform. Of course, it is the media that ensures we are aware of the growing number of clowns in our streets.   The attitude towards the behaviour, in this example at least, is likely to build from the other components. The majority of us are probably horrified by these killer clowns, however, there are clearly individuals who have a more positive attitude to the craze. Or perhaps a more positive attitude of the behaviour has been formed as a result of the high exposure; it could be considered humourous rather than horrifying. According to the theory of planned behaviour, the combination of these three components lead to an intent to perform a behaviour. Although hard to get inside the head of a killer clown, you can see how putting on a mask, wig and wandering the local streets can suddenly be perceived as more acceptable; a belief that we possibly owe to media sources for sharing. This media exposure should boldly take its place in the diagram of the theory of planned behaviour, feeding into the three components that influence behaviour intentions (see figure two). Figure Two: Addition of Agenda Setting to Theory of Planned BehaviourThe role of the media treads a very fine line. The damaging effects of them sharing the latest craze can clearly be seen, essentially taking what could have been a few separate instances to the ‘killer clown craze’. But, how long would it take for us to begin to resent the media should they stop sharing the latest horrors? Would we not be outraged if we came face-to-face with a killer clown only to find we could have been warned to stay in our homes, if the media had published the latest instances it had been informed of? Regardless, this latest craze illustrates the strength of agenda setting theory, and the power the media has over us and our behaviours.ReferencesFrancis, J. J., Eccles, M. P., Johnston, M., Walker, A., Grimshaw, J., Foy, R., Kaner, E. F. S., Smith, L., & Bonetti, D. (2004). Constructing questionnaires based on the theory of planned behaviour. A manual for health services researchers, 2010, 2-12. Rogers, E. M., Dearing, J. W., & Bregman, D. (1993). The anatomy of agenda‐setting research. Journal of communication, 43(2), 68-84.

If you haven’t patched this vulnerability, you should.  By: Chase PalmerSenior Program ManagerCISSP In early 2015, Magento found a vulnerability known as Shoplift Bug and released a patch for it. Unfortunately, many businesses still haven’t patched this vulnerability, which could threaten their e-commerce integrity.Here is some more information about the Shoplift Bug, how it makes your system vulnerable, and what you need to do to combat it.SEE ALSO: How do Hackers Hack?How does the Shoplift Bug work? Through the Shoplift Bug, hackers can remotely execute code on Magento software. This vulnerability seems to affect both the community and enterprise versions of Magento.The Shoplifting exploit is actually a chain of vulnerabilities in the Magento core software, but is frighteningly simple.  The exploit uses a Python script that forces the server to downgrade the website from HTTPS to HTTP and then uses SQL injection to create a new user with administrative privileges.Once the attacker has access to the dashboard with administrator access, they will typically install software through the console that will create a backdoor that allows the attacker to remotely alter the functionality of the online store, add or remove products, change the price of products, add phony coupons, and much more.Follow for more data security articles like thisWhat should I do? Unfortunately, this exploit was highly automated and nearly all vulnerable instances of the Magento dashboard are assumed to be compromised.  If you don’t know if you’ve patched your site recently or if you’re a Magento user, check on MageReport.com.If you haven’t installed this patch, here’s a list of steps you should take to patching your website:Download and implement the two patches from the Magento Community Edition download pageTest the patches in a development environment first to make sure they’re working properly before deploying them in your production environmentCheck for unknown files in web server document root directory. If you find any, remove the files, keeping a secure copy if possibleCheck all admin accounts to make sure they’re all authorized. Change all admin passwords have you suspect a breachCheck for unknown IP addresses accessing the system, since hackers may be using legitimate credentials to gain access to your system. Examples of addresses could include 62.76.177.179, 185.22.232.218, and 23.245.26.35 If you need help installing patches, refer to Magento’s Community Security patch forum where community members, moderators, and Magento can assist with questions about downloading and installing patches.If you haven’t already installed this latest patch, you should do so as soon as possible.TweetPatch your systemsRemember, it’s important to stay up to date on your systems and patch any vulnerabilities that pop up. Tips to do this include:Sign up for newsletters/notifications from vendors you use: Once they release a new patch, you’ll be notified. Patch the vulnerability as soon as possible: The sooner you fix the vulnerability, the less time you’ll be open to attacksSet up a schedule to regularly patch and update software: This will keep your software updated in its most secure state. SEE ALSO: Security Patches in Your Business: Complying with PCI Requirement 6.1Chase Palmer (CISSP) is the Senior Program Manager and has been working at SecurityMetrics for seven years. He manages the company’s largest corporate partners in running mass Level 4 PCI DSS programs worldwide. Chase has a Bachelor’s degree in Business Management from Western Governor’s University. He currently lives in Provo, Utah, and he loves everything about motorcycles.