This type of attack assumes that an 'agent' aims to use their position to gain information or money from a visitor. The agent tries to insert information into the visitor’s web content, such as their own account number, or to learn information that they don’t otherwise have access to, such as passwords and security questions.
Practically, the agent may ask the visitor to fetch a letter with hopes to execute a financial transaction while the customer is away for a short amount of time.
How we prevent agent role abuse
Unblu has a number of ways to limit the agent’s access to the visitor’s web content:
The Collaboration Server never transmits passwords.
Agents can’t modify the content of the visitor’s web page.
You can configure the Collaboration Server to block access to certain data presented through the instrumented web application. For example, the Collaboration Server may not show the personal settings page of an agent, it may hide account numbers, it may block access to account numbers and payment amounts, and it may prevent agents from executing payments.
|Unblu don’t restrict traditional methods of social engineering over the telephone. An agent may still be able to talk a customer into giving away the password or executing specific actions. However, this is possible in all consulting situations, and it isn’t made easier by using Unblu.|