Importance of Metadata to Hackers

Metadata is a very useful type of data that gives specific information like OS version, Application used, etc. So, metadata is a goldmine for cybercriminals as it can help tailor attacks for individuals and helps in targeted phishing.

Let us go into a little detail, when planning any attack the hackers need to map out the attack surface and narrow out the effective targets or individuals so as to improve the efficiency of the attack, this is known as Reconnaissance. Recon is one of the most important steps for any attack to succeed. So how is metadata vital in this process?

As you know that phishing attacks are the number one vector to compromise a company. This can be done by a rather harmless-looking email that has a DOCX file as an attachment with an embedded VBA macro that drops a custom PowerShell RAT. For this kind of attack to succeed and not to raise suspicion requires detailed planning. Information that is very essential for these attacks is:

What software is the target using? If he/she uses LibreOffice rather than Microsoft Word, sending a VBA macro wouldn't work in that case.
What is the operating system of the target? Exploit leveraging a vulnerability in how Windows parses TTF fonts wouldn't work on Mac OS.
What's the target's username & e-mail address? This helps with getting a foothold in the post-exploitation phase while staying under the radar.
What is the file share; where most of the company documents are stored? An attacker can plan a lateral movement once the target is compromised or just blow it off with a targeted ransomware attack.
Which contractors are working for the target company? It's known that advanced attackers sometimes choose contractors because of less strict security measures.

The files that you publish without stripping off the sensitive metadata can reveal the above information leading to a personalized and sure-fire attack. This is just one of the ways the metadata can be exploited.

Hackers / Cybercriminals collect a large amount of data for carrying out various nefarious activities like:

Extort a business
Blackmail a business or individual
Apply for fraudulent loans and credit cards under a person’s or business’s name
Illegal money transferring
Gain unauthorized access to personal online accounts, such as Amazon or Facebook
For malicious enjoyment
Revenge against a person or a business

You might also be interested in,