Social engineering - Revision history

Shahinrs at 00:25, 4 December 2007

2007-12-04T00:25:12Z

← Older revision		Revision as of 00:25, 4 December 2007
Line 65:		Line 65:
	“Social Engineering”, McGuill Network Communications Services, September 7, 2007		“Social Engineering”, McGuill Network Communications Services, September 7, 2007
	http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/		http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/
		+	<br><br>

-		+	<hr>
-	--[[User:Shahinrs\|Shahinrs]]	+	[[User:Shahinrs\|Shahinrs]] 19:25, 3 December 2007 (EST)

Shahinrs at 00:21, 4 December 2007

2007-12-04T00:21:18Z

← Older revision		Revision as of 00:21, 4 December 2007
Line 6:		Line 6:

	[[Image:Mitnick.jpg\|thumb\|300px\|right\|		[[Image:Mitnick.jpg\|thumb\|300px\|right\|
-	'''Kevin David Mitnick'''	+	'''[http://en.wikipedia.org/wiki/Kevin_Mitnick Kevin David Mitnick]'''
	<br>''Born October 6, 1963''<br>		<br>''Born October 6, 1963''<br>
	Convicted of computer related crimes using social engineering.]]		Convicted of computer related crimes using social engineering.]]
Line 16:		Line 16:
	A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.		A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
	===Human===		===Human===
-	The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what a social ~~engineer wants~~, the objectives of a social engineer can be ~~reach~~ more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.	+	The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what social engineers want, the objectives of a social engineer can be obtained more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.

	===System===		===System===
-	The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide a social ~~engineer~~ ammunition to construct a persona which is then used to manipulate the people who have access to the system.	+	The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide social engineers ammunition to construct a persona which is then used to manipulate the people who have access to the system.

	==Methods of Social Engineering==		==Methods of Social Engineering==
	===By Phone===		===By Phone===
-	This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor ~~answer~~, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.	+	This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answers, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.

	Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.		Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

-	Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack\|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.	+	Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was [http://en.wikipedia.org/wiki/Kevin_Mitnick Kevin Mitnick]. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack\|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

	===Online===		===Online===
-	Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing\|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.	+	Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing\|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on, however, was a link to the attacker's site which simply records the login information.

	===Persuasion===		===Persuasion===
-	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft\|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these ~~persona~~ provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a ~~colorful~~ background story, a tempting offer, or even ~~guiling~~ the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.	+	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft\|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these personas provides the social engineer with the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colourful background story, a tempting offer, or even guilt the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

	===Dumpster Diving===		===Dumpster Diving===
-	Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The ~~premis~~ is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event ~~calenders~~, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the ~~companies~~ protocols, terminology and many employee's names and other personal information.	+	Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premise is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calendars, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the company’s protocols, terminology and many employee's names and other personal information.

	===Reverse Social Engineering===		===Reverse Social Engineering===
-	The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of ~~preperation,~~ however it can yield very successful results.	+	The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of preparation; however, it can yield very successful results.

	==Protection==		==Protection==
-	To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of ~~emplyees~~ to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords). In general a good practice of [[Information_security_awareness\|information security awareness]] will provide employees with a more ~~skeptical~~ attitude in giving out information.	+	To protect against social engineering attacks, a company should implement [http://en.wikipedia.org/wiki/Security_policy security policies] which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of employees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not [http://en.wikipedia.org/wiki/Need_to_know need-to-know] or confidential (such as passwords). In general a good practice of [[Information_security_awareness\|information security awareness]] will provide employees with a more sceptical attitude in giving out information.

-	== References ==	+	==References==
	Bernz: “The complete Social Engineering FAQ!”		Bernz: “The complete Social Engineering FAQ!”
	http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt		http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt
Line 67:		Line 67:


-	--[[User:Shahinrs\|Shahinrs]] ~~07:36, 7 November 2007 (EST)~~	+	--[[User:Shahinrs\|Shahinrs]]

Shahinrs at 00:07, 4 December 2007

2007-12-04T00:07:36Z

← Older revision		Revision as of 00:07, 4 December 2007
Line 33:		Line 33:

	===Persuasion===		===Persuasion===
-	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft\|\|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.	+	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft\|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

	===Dumpster Diving===		===Dumpster Diving===
Line 42:		Line 42:

	==Protection==		==Protection==
-	To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of emplyees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords).	+	To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of emplyees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords). In general a good practice of [[Information_security_awareness\|information security awareness]] will provide employees with a more skeptical attitude in giving out information.

	== References ==		== References ==

Shahinrs at 00:04, 4 December 2007

2007-12-04T00:04:27Z

← Older revision		Revision as of 00:04, 4 December 2007
Line 27:		Line 27:
	Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.		Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

-	Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.	+	Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack\|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

	===Online===		===Online===
-	Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through phishing. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.	+	Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing\|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.

	===Persuasion===		===Persuasion===
-	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.	+	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft\|\|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

	===Dumpster Diving===		===Dumpster Diving===
-	Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies ~~protocals~~, ~~termonology~~ and many ~~emplyee~~'s names and other personal information.	+	Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies protocols, terminology and many employee's names and other personal information.

	===Reverse Social Engineering===		===Reverse Social Engineering===
-	*Pretend to be someone in ~~a position of authority~~	+	The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of preperation, however it can yield very successful results.
-	**employees will ask ~~him~~ for information	+
-	*Most difficult method ~~to pull off~~	+
-	**requires ~~lots~~ of ~~preparation~~	+
-	**but can yield ~~the most~~ successful results	+
-		+

	==Protection==		==Protection==
-	*Security policies ~~dealing~~ with both physical and psychological elements	+	To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of emplyees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords).
-	**Standard physical security mechanisms	+
-	***networks protection	+
-	***good password protection	+
-	***secure disposal of trash	+
-	***standard security measures we’ve discussed in class	+
-	**Education and training of ~~employees~~	+
-	***Making employees aware of Social Engineering	+
-	***better recognize an attack	+
-	***Authentication	+
-	****Making sure the person they are speaking with ~~is that person~~	+
-	**Availability of ~~ANY information~~	+
-	***only give out information ~~that’s~~ need-to-know	+
-	***Don’t give out confidential ~~information~~	+
-		+
-	~~==Conclusion==~~	+
-	*Social Engineering attacks are very difficult to protect against.	+
-	*A system’s security is only as ~~strong as the people who maintain it.~~	+
-	*With proper training, a social Engineering attack can be made extremely difficult.	+
-	*However, it can never been fully projected against.	+

	== References ==		== References ==

Shahinrs at 23:34, 3 December 2007

2007-12-03T23:34:37Z

← Older revision		Revision as of 23:34, 3 December 2007
Line 23:		Line 23:
	==Methods of Social Engineering==		==Methods of Social Engineering==
	===By Phone===		===By Phone===
-	This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack.	+	This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answer, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.
-	*Most common method	+
-	*Call a company and ~~imitate someone~~ in ~~a position~~ of ~~authority or relevance~~.	+	Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.
-	**Supervisor, manager, system ~~admin~~.	+
-	***pretend they can’t log into the system	+	Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.
-	***or that ~~they need your login to troubleshoot~~	+
-	*Help desks are most prone to this	+
-	**used to helping people	+
-	**trained to give ~~out~~ information and be ~~friendly~~	+
-	**want to ~~move~~ on to ~~next call~~	+
-	**minimally educated in security ~~area~~	+

	===Online===		===Online===
-	*Many ~~people~~ use same ~~password and~~ login for internet sites	+	Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through phishing. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.
-	**Using methods like Phishing can ~~allow~~ the ~~Social Engineer~~ to ~~obtain lots~~ of information ~~about~~ a ~~person~~	+

	===Persuasion===		===Persuasion===
-	*The ~~true strength~~ of a ~~Social Engineer~~	+	Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.
-	*Gaining trust by	+
-	**impersonation (~~identiy theft~~)	+
-	**imitation (made up ~~identity~~)	+
-	*Uses psychological methods	+
-	**Guilt	+
-	**Tempting offers	+

	===Dumpster Diving===		===Dumpster Diving===
-	*also known as trashing	+	Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies protocals, termonology and many emplyee's names and other personal information.
-	*looking through ~~garbage for~~ information	+
-	*Many companies don’t implement any method of security ~~for~~ their garbage	+
-	**user and password lists	+
-	**Company directories	+
-	**Event calendars	+
-	**obsolete computers	+
-	**printouts of source ~~codes~~	+
-	**The more a Social Engineer knows about:	+
-	***a company	+
-	***their protocols	+
-	***terminology	+
-	~~***~~the ~~more likely he’ll be able to succeed~~.	+

	===Reverse Social Engineering===		===Reverse Social Engineering===

Shahinrs at 09:16, 3 December 2007

2007-12-03T09:16:29Z

← Older revision		Revision as of 09:16, 3 December 2007
Line 11:		Line 11:

	==What is Social Engineering?==		==What is Social Engineering?==
-	Social Engineering is?	+	Social Engineering is the manipulation of people to further a person's motives using various methods. “The art and science of getting people to comply to your wishes” - [http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt Bernz]. This "compliance" is generally associated with the acquisition of electronic information. However, Social Engineering can also apply to a border definition which encompasses any kind personal manipulation in an attempt to gain something dishonestly. The manipulation is performed by "tricking" the mark (the unsuspecting victim) into a false sense of trust which is them abused to obtain the sought objective.
-	*“the art and science of getting people to comply to your wishes” - Bernz.	+
-	*Attacks human side of information ~~security~~	+
-	*not mind control or coercion.	+
-	*but rather “ticking” people	+
-	**do what you want them to do	+
-	**give you information that you might not have access to	+

	==Aspects of Social Engineering==		==Aspects of Social Engineering==
-		+	A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
-		+
-		+
-		+
-		+
	===Human===		===Human===
-	*Humans are generally the weakest part of any security system	+	The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what a social engineer wants, the objectives of a social engineer can be reach more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.
-	**System admins, maintenance people~~, employees~~	+
-	***all have access to the ~~system~~	+
-	***any one of ~~them~~ can ~~jeopardize security if they are not careful~~	+
-	***knowingly or ~~unknowingly~~	+
-	*All Social Engineering attacks have something in common	+
-	**Take advantage of a ~~human being’s trust~~	+
-	*Need 2 things for a Social Engineering attack	+
-	**A knowledge of the system ~~being attacked~~	+
-	***Lots of background work	+
-	***Terminology	+
-	***Names of people and places	+
-	***Protocols being used	+
-	***The ability to ~~gain people’s trust~~	+
-		+
-	~~===Hardware===~~	+

-	==~~Notable Examples~~==	+	===System===
		+	The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide a social engineer ammunition to construct a persona which is then used to manipulate the people who have access to the system.

	==Methods of Social Engineering==		==Methods of Social Engineering==
	===By Phone===		===By Phone===
		+	This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack.
	*Most common method		*Most common method
	*Call a company and imitate someone in a position of authority or relevance.		*Call a company and imitate someone in a position of authority or relevance.
Line 92:		Line 69:
	**requires lots of preparation		**requires lots of preparation
	**but can yield the most successful results		**but can yield the most successful results
		+

	==Protection==		==Protection==
Line 115:		Line 93:
	*However, it can never been fully projected against.		*However, it can never been fully projected against.

-	==References==	+	== References ==
	Bernz: “The complete Social Engineering FAQ!”		Bernz: “The complete Social Engineering FAQ!”
	http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt		http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Shahinrs at 07:58, 3 December 2007

2007-12-03T07:58:36Z

← Older revision		Revision as of 07:58, 3 December 2007
Line 1:		Line 1:
-	'''Social ~~engineering~~''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.	+	'''Social Engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

	{\| __TOC__		{\| __TOC__