Computing and Software Wiki - User contributions [en]

Smurfing

2008-04-14T02:40:58Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a term used to describe a specific kind of [http://en.wikipedia.org/wiki/Denial_of_service Denial-of-Service](DoS) attack. The attack is achieved by the abuse of [http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol ICMP] [http://en.wikipedia.org/wiki/Ping echo (ping)] which is sent to broadcast address. This can cause significant a increase in traffic which may block legitimate traffic, thus creating a denial of service. Smurfing victimises two parties generally, the target (the one being attacked), and the amplifier (the intermediate host which involuntarily lends its services to the attacker).

{| __TOC__
|}

{|align="right"
|-
| [[Image:brainy.jpg|thumb|165px|''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
|}
=What is Smurfing?=
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators.[1] "Smurfing" is originally derived from a cartoon, [http://en.wikipedia.org/wiki/Smurfs The Smurfs], which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.[1]

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''[http://en.wikipedia.org/wiki/Fraggle_attack Fraggle]''', which uses [http://en.wikipedia.org/wiki/User_Datagram_Protocol UDP] echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".[2]

=How does a Smurf Attack take place?=
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orchestrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a [http://en.wikipedia.org/wiki/IP_address_spoofing spoofed] source address (the address of the target) to the [http://en.wikipedia.org/wiki/Broadcast_address broadcast address] of the amplifier. The attacker has completed his portion of the attack.[3]

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.[4]

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a DoS and render the target inaccessible to other users.

 
=Prevention=
To prevent a router from being an amplifier, two simple configurations need to be implemented.
* Routers and individual hosts should not respond to ping requests to broadcast addresses.
* Routers should not forward packets directed to broadcast address.[5]

An example of how to configure a router so that packets are not forwarded to broadcast addresses would be:
<code>no ip directed-broadcast</code>
This configuration is for a [http://en.wikipedia.org/wiki/Cisco_Systems Cisco] router.[5]

Another router configuration is to filter ICMP requests by source addresses. By applying a filter which will reject any outgoing packets that contain a source address from a different network, you eliminate the spoofing element of a Smurf attack.[6]

It is important to note that these prevention techniques apply only to protecting a network form being an amplifier or the source of an attack. A similar procedure is required to prevent a Fraggle attack. If, however, the security mechanisms don't adequately enforce the [http://en.wikipedia.org/wiki/Security_policy security policy] of the network, then these prevention techniques can easily be by-passed.

=References=
[http://en.wikipedia.org/wiki/Smurfing_%28crime%29] Structuring

[http://www.pentics.net/denial-of-service/white-papers/smurf.cgi] The Lastest In Denial Of Service Attacks: "Smurfing"

[http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm] Information Warfare Going on the Offensive

[http://www.networkworld.com/archive/1999b/0222gearhead.html] Attacked by smurf

[http://en.wikipedia.org/wiki/Smurf_attack] Smurf attack

[http://www.academ.com/nanog/oct1997/smurfing/sld001.htm] The Lastest In Denial Of Service Attacks: "Smurfing"

=Also See=
[[TCP/IP_Application_Development]]

[[The_Great_Firewall_of_China]]

[[Designing_a_Small_Business_Intranet]]

[[The_Five-Layer_TCP/IP_Model:_Description/Attacks/Defense]]

[[Social_engineering]]

=External Links=
[http://www.webopedia.com/TERM/S/smurf.html smurf]

[http://en.wikipedia.org/wiki/Ip_spoofing IP Spoofing]

[http://www.javvin.com/networksecurity/SmurfAttack.html Smurf Attack and Fraggle Attack]

[http://www-arc.com/sara/cve/Possible_DoS_problem.html Possible DoS (fraggle) Problem]

[ftp://ftp.isi.edu/in-notes/rfc2267.txt Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing]
<hr>

--[[User:Shahinrs|Shahinrs]] 22:40, 13 April 2008 (EDT)

Smurfing

2008-04-14T00:33:45Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of [http://en.wikipedia.org/wiki/Denial_of_service Denial-of-Service](DoS) attack where an attacker floods a target with [http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol ICMP] [http://en.wikipedia.org/wiki/Ping echo (ping)] traffic.
{| __TOC__
|}

{|align="right"
|-
| [[Image:brainy.jpg|thumb|165px|''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
|}

==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, [http://en.wikipedia.org/wiki/Smurfs The Smurfs], which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''[http://en.wikipedia.org/wiki/Fraggle_attack Fraggle]''', which uses [http://en.wikipedia.org/wiki/User_Datagram_Protocol UDP] echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orchestrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a [http://en.wikipedia.org/wiki/IP_address_spoofing spoofed] source address (the address of the target) to the [http://en.wikipedia.org/wiki/Broadcast_address broadcast address] of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a DoS and render the target inaccessible to other users.

 
==Prevention==
To prevent a router from being an amplifier, two simple configurations need to be implemented.
* Routers and individual hosts should not respond to ping requests to broadcast addresses.
* Routers should not forward packets directed to broadcast address.

An example of how to configure a router so that packets are not forwarded to broadcast addresses would be:
<code>no ip directed-broadcast</code>
This configuration is for a [http://en.wikipedia.org/wiki/Cisco_Systems Cisco] router.

Another router configuration is to filter ICMP requests by source addresses. By applying a filter which will reject any outgoing packets that contain a source address from a different network, you eliminate the spoofing element of a Smurf attack.

It is important to note that these prevention techniques apply only to protecting a network form being an amplifier or the source of an attack. A similar procedure is required to prevent a Fraggle attack. If, however, the security mechanisms don't adequately enforce the [http://en.wikipedia.org/wiki/Security_policy security policy] of the network, then these prevention techniques can easily be by-passed.

==References==
* [http://www.webopedia.com/TERM/S/smurf.html smurf]
* [http://www.academ.com/nanog/oct1997/smurfing/sld001.htm The Lastest In Denial Of Service Attacks: "Smurfing"]
* [http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm Information Warfare Going on the Offensive]
* [http://en.wikipedia.org/wiki/Smurf_attack Smurf attack]
* [http://www.networkworld.com/archive/1999b/0222gearhead.html Attacked by smurf]
* [http://www-arc.com/sara/cve/Possible_DoS_problem.html Possible DoS (fraggle) Problem]
* [ftp://ftp.isi.edu/in-notes/rfc2267.txt Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing]
* [http://www.javvin.com/networksecurity/SmurfAttack.html Smurf Attack and Fraggle Attack]
<hr>
--[[User:Shahinrs|Shahinrs]] 20:33, 13 April 2008 (EDT)

Smurfing

2008-04-14T00:29:07Z

Shahinrs:

Smurfing

2008-04-14T00:10:23Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of Denial-of-Service attack where an attacker floods a target with ICMP echo (ping) traffic.
{| __TOC__
|}

{|align="right"
|-
| [[Image:brainy.jpg|thumb|165px|''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
|}

==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, The Smurfs, which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''Fraggle''', which uses UDP echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orchestrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a spoofed source address (the address of the target) to the broadcast address of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a Denial-of-Service and render the target inaccessible to other users.

 
==Prevention==
To prevent a router from being an amplifier, two simple configurations need to be implemented.
* Routers and individual hosts should not respond to ping requests to broadcast addresses.
* Routers should not forward packets directed to broadcast address.

An example of how to configure a router so that packets are not forwarded to broadcast addresses would be:
<code>no ip directed-broadcast</code>
This configuration is for a [[Cisco Systems|Cisco]] router.

Another router configuration is to filter ICMP requests by source addresses. By applying a filter which will reject any outgoing packets that contain a source address from a different network, you eliminate the spoofing element of a Smurf attack.

It is important to note that these prevention techniques apply only to protecting a network form being an amplifier or the source of an attack. A similar procedure is required to prevent a Fraggle attack. If, however, the security mechanism don't adequately enforce the security policy of the network, then these prevention techniques can easily be by-passed.

==References==
* [http://www.webopedia.com/TERM/S/smurf.html smurf]
* [http://www.academ.com/nanog/oct1997/smurfing/sld001.htm The Lastest In Denial Of Service Attacks: "Smurfing"]
* [http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm Information Warfare Going on the Offensive]
* [http://en.wikipedia.org/wiki/Smurf_attack Smurf attack]
* [http://www.networkworld.com/archive/1999b/0222gearhead.html Attacked by smurf]
* [http://www-arc.com/sara/cve/Possible_DoS_problem.html Possible DoS (fraggle) Problem]
* [ftp://ftp.isi.edu/in-notes/rfc2267.txt Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing]
* [http://www.javvin.com/networksecurity/SmurfAttack.html Smurf Attack and Fraggle Attack]
<hr>
[[User:Shahinrs|Shahinrs]]

Smurfing

2008-04-13T21:19:24Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of Denial-of-Service attack where an attacker floods a target with ICMP echo (ping) traffic.
{| __TOC__
|}

{|align="right"
|-
| [[Image:brainy.jpg|thumb|165px|''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
|}

==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, The Smurfs, which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''Fraggle''', which uses UDP echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orcastrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a spoofed source address (the address of the target) to the broadcast address of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a Denial-of-Service and render the target unaccessible to other users.

 
==Prevention==

==References==
http://www.webopedia.com/TERM/S/smurf.html
http://www.pentics.net/denial-of-service/white-papers/smurf.cgi
http://www.academ.com/nanog/oct1997/smurfing/sld001.htm
http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm
http://en.wikipedia.org/wiki/Smurf_attack
http://www.networkworld.com/archive/1999b/0222gearhead.html
http://www-arc.com/sara/cve/Possible_DoS_problem.html

<hr>
[[User:Shahinrs|Shahinrs]]

Smurfing

2008-04-13T21:12:31Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of Denial-of-Service attack where an attacker floods a target with ICMP echo (ping) traffic.

[[Image:brainy.jpg|thumb|165px|right|
''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
{| __TOC__
|}

 
==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, The Smurfs, which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''Fraggle''', which uses UDP echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orcastrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a spoofed source address (the address of the target) to the broadcast address of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a Denial-of-Service and render the target unaccessible to other users.

 
==Prevention==

==References==
http://www.webopedia.com/TERM/S/smurf.html
http://www.pentics.net/denial-of-service/white-papers/smurf.cgi
http://www.academ.com/nanog/oct1997/smurfing/sld001.htm
http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm
http://en.wikipedia.org/wiki/Smurf_attack
http://www.networkworld.com/archive/1999b/0222gearhead.html
http://www-arc.com/sara/cve/Possible_DoS_problem.html

<hr>
[[User:Shahinrs|Shahinrs]]

Smurfing

2008-04-13T21:12:05Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of Denial-of-Service attack where an attacker floods a target with ICMP echo (ping) traffic.

[[Image:brainy.jpg|thumb|165px|right|
''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]
{| __TOC__
|}

==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, The Smurfs, which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''Fraggle''', which uses UDP echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
 

In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orcastrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a spoofed source address (the address of the target) to the broadcast address of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a Denial-of-Service and render the target unaccessible to other users.

 
==Prevention==

==References==
http://www.webopedia.com/TERM/S/smurf.html
http://www.pentics.net/denial-of-service/white-papers/smurf.cgi
http://www.academ.com/nanog/oct1997/smurfing/sld001.htm
http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm
http://en.wikipedia.org/wiki/Smurf_attack
http://www.networkworld.com/archive/1999b/0222gearhead.html
http://www-arc.com/sara/cve/Possible_DoS_problem.html

<hr>
[[User:Shahinrs|Shahinrs]]

Smurfing

2008-04-13T21:10:41Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a form of Denial-of-Service attack where an attacker floods a target with ICMP echo (ping) traffic.

{| __TOC__
|}
 

[[Image:brainy.jpg|thumb|165px|right|
''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]

==What is Smurfing?==
'''Smurfing''' is a banking industry term used to describe the act of splitting up a large financial transaction into several smaller ones to avoid scrutiny from regulators. "Smurfing" is originally derived from a cartoon, The Smurfs, which consisted of a large society of many small individuals. The coining of the term is attributed to Miami-based lawyer, Gregory Baldwin in the 1980s.

'''Smurging''' or a '''Smurf Attack''' in the context of network security describes the act of many small ICMP pings being used to create very large network traffic congestion. The "smurf" attack's cousin is called '''Fraggle''', which uses UDP echo packets in the same fashion as the ICMP echo packets. It was a simple re-write of "smurf".

==How does a Smurf Attack take place?==
{|align="right"
|-
| [[Image:Smurf2.gif|thumb|450px|''http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm#Smurf_Attack'']]
|}
In order for a Smurf Attack to take place there are three parties which need to be considered. First is the attack who orcastrates the attack. Second is the amplifier, who is usually another victim of the attack, and lastly, the target.
===The Attacker===
The attack itself is fairly simple. However the attacker will need a few things before the attack can be carried out. First the attacker will need a fast connection to the internet, and will need to find a large network, or a number of networks, that is attached to the Internet by a router that will forward ICMP requests. This network is the amplifier. The attacker will then send a ping request with a spoofed source address (the address of the target) to the broadcast address of the amplifier. The attacker has completed his portion of the attack.

===The Amplifier===
An amplifier is a large network that is connected to the internet with a router. The router must be able to perform an IP broadcast. When the router receives traffic to the broadcast address, it will forward the message to all the hosts on the network. If the router receives and broadcasts an ICMP ping request, most of the hosts will reply to the source address of the message. This means that if there are 500 hosts which reply to the IP broadcast, then for every 1 ping request to that amplifier, 500 ping relies are sent. When an attacker spoofs the source address of the ping requests, rather than the pings replies going back to the attacker, they will go to the spoofed address (i.e. the victim). If the attacker has a fast connection, then it can send several ping requests very quickly. The amplifier is assumed to have a much faster connection (i.e. T3) to accommodate the ping replies.

===The Target===
The target is generally a specific server or small network. Upon receiving the ICMP replies, the target is no longer able to make its services available to its intended users since it is busy processing these ICMP messages. This creates a Denial-of-Service and render the target unaccessible to other users.

 
==Prevention==

==References==
http://www.webopedia.com/TERM/S/smurf.html
http://www.pentics.net/denial-of-service/white-papers/smurf.cgi
http://www.academ.com/nanog/oct1997/smurfing/sld001.htm
http://faculty.ed.umuc.edu/~meinkej/inss690/cummins/cummins.htm
http://en.wikipedia.org/wiki/Smurf_attack
http://www.networkworld.com/archive/1999b/0222gearhead.html
http://www-arc.com/sara/cve/Possible_DoS_problem.html

<hr>
[[User:Shahinrs|Shahinrs]]

File:Smurf2.gif

2008-04-13T20:21:47Z

Shahinrs:

Smurfing

2008-04-13T20:19:57Z

Shahinrs:

Smurfing

2008-04-11T22:36:09Z

Shahinrs:

'''Smurfing''' or a '''Smurf Attack''' is a way of generating a lot of computer network traffic to a victim site. That is, it is a type of denial-of-service attack. Specifically, it floods a target system via spoofed broadcast ping messages.

In such an attack, a perpetrator sends a large amount of ICMP echo (ping) traffic to IP broadcast addresses, all of it having a spoofed source address of the intended victim. If the routing device delivering traffic to those broadcast addresses delivers the IP broadcast to all hosts (for example via a layer 2 broadcast), most hosts on that IP network will take the ICMP echo request and reply to it with an echo reply, multiplying the traffic by the number of hosts responding. On a multi-access broadcast network, hundreds of machines might reply to each packet.

{| __TOC__
|}
 

[[Image:brainy.jpg|thumb|165px|right|
''Brainy Smurf'' Smurfs, as a society, were against any sort of attack.]]

==What is Smurfing?==

==How does a Smurf Attack take place?==

==Prevention==

==References==

<hr>
[[User:Shahinrs|Shahinrs]]

File:Brainy.jpg

2008-04-11T22:24:33Z

Shahinrs:

Smurfing

2008-04-11T22:21:55Z

Shahinrs: New page: '''Smurfing''' or a '''Smurf Attack''' is a way of generating a lot of computer network traffic to a victim site. That is, it is a type of denial-of-service attack. Specifically, it floods...

'''Smurfing''' or a '''Smurf Attack''' is a way of generating a lot of computer network traffic to a victim site. That is, it is a type of denial-of-service attack. Specifically, it floods a target system via spoofed broadcast ping messages.

In such an attack, a perpetrator sends a large amount of ICMP echo (ping) traffic to IP broadcast addresses, all of it having a spoofed source address of the intended victim. If the routing device delivering traffic to those broadcast addresses delivers the IP broadcast to all hosts (for example via a layer 2 broadcast), most hosts on that IP network will take the ICMP echo request and reply to it with an echo reply, multiplying the traffic by the number of hosts responding. On a multi-access broadcast network, hundreds of machines might reply to each packet.

{| __TOC__
|}
 

==What is Smurfing?==

==How does a Smurf Attack take place?==

==Prevention==

==References==

<hr>
[[User:Shahinrs|Shahinrs]]

Social engineering

2007-12-04T00:25:12Z

Shahinrs:

'''Social Engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

{| __TOC__
|}
 

[[Image:Mitnick.jpg|thumb|300px|right|
'''[http://en.wikipedia.org/wiki/Kevin_Mitnick Kevin David Mitnick]'''
 ''Born October 6, 1963'' 
Convicted of computer related crimes using social engineering.]]

==What is Social Engineering?==
Social Engineering is the manipulation of people to further a person's motives using various methods. “The art and science of getting people to comply to your wishes” - [http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt Bernz]. This "compliance" is generally associated with the acquisition of electronic information. However, Social Engineering can also apply to a border definition which encompasses any kind personal manipulation in an attempt to gain something dishonestly. The manipulation is performed by "tricking" the mark (the unsuspecting victim) into a false sense of trust which is them abused to obtain the sought objective.

==Aspects of Social Engineering==
A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
===Human===
The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what social engineers want, the objectives of a social engineer can be obtained more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.

===System===
The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide social engineers ammunition to construct a persona which is then used to manipulate the people who have access to the system.

==Methods of Social Engineering==
===By Phone===
This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answers, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.

Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was [http://en.wikipedia.org/wiki/Kevin_Mitnick Kevin Mitnick]. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

===Online===
Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on, however, was a link to the attacker's site which simply records the login information.

===Persuasion===
Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these personas provides the social engineer with the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colourful background story, a tempting offer, or even guilt the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

===Dumpster Diving===
Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premise is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calendars, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the company’s protocols, terminology and many employee's names and other personal information.

===Reverse Social Engineering===
The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of preparation; however, it can yield very successful results.

==Protection==
To protect against social engineering attacks, a company should implement [http://en.wikipedia.org/wiki/Security_policy security policies] which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of employees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not [http://en.wikipedia.org/wiki/Need_to_know need-to-know] or confidential (such as passwords). In general a good practice of [[Information_security_awareness|information security awareness]] will provide employees with a more sceptical attitude in giving out information.

==References==
Bernz: “The complete Social Engineering FAQ!”
http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001
http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007
http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006
http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007
http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/
 

<hr>
[[User:Shahinrs|Shahinrs]] 19:25, 3 December 2007 (EST)

Social engineering

2007-12-04T00:21:18Z

Shahinrs:

Social engineering

2007-12-04T00:07:36Z

Shahinrs:

'''Social Engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

{| __TOC__
|}
 

[[Image:Mitnick.jpg|thumb|300px|right|
'''Kevin David Mitnick'''
 ''Born October 6, 1963'' 
Convicted of computer related crimes using social engineering.]]

==What is Social Engineering?==
Social Engineering is the manipulation of people to further a person's motives using various methods. “The art and science of getting people to comply to your wishes” - [http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt Bernz]. This "compliance" is generally associated with the acquisition of electronic information. However, Social Engineering can also apply to a border definition which encompasses any kind personal manipulation in an attempt to gain something dishonestly. The manipulation is performed by "tricking" the mark (the unsuspecting victim) into a false sense of trust which is them abused to obtain the sought objective.

==Aspects of Social Engineering==
A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
===Human===
The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what a social engineer wants, the objectives of a social engineer can be reach more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.

===System===
The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide a social engineer ammunition to construct a persona which is then used to manipulate the people who have access to the system.

==Methods of Social Engineering==
===By Phone===
This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answer, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.

Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

===Online===
Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.

===Persuasion===
Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft|identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

===Dumpster Diving===
Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies protocols, terminology and many employee's names and other personal information.

===Reverse Social Engineering===
The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of preperation, however it can yield very successful results.

==Protection==
To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of emplyees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords). In general a good practice of [[Information_security_awareness|information security awareness]] will provide employees with a more skeptical attitude in giving out information.

== References ==
Bernz: “The complete Social Engineering FAQ!”
http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001
http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007
http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006
http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007
http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/

--[[User:Shahinrs|Shahinrs]] 07:36, 7 November 2007 (EST)

Social engineering

2007-12-04T00:04:27Z

Shahinrs:

'''Social Engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

{| __TOC__
|}
 

[[Image:Mitnick.jpg|thumb|300px|right|
'''Kevin David Mitnick'''
 ''Born October 6, 1963'' 
Convicted of computer related crimes using social engineering.]]

==What is Social Engineering?==
Social Engineering is the manipulation of people to further a person's motives using various methods. “The art and science of getting people to comply to your wishes” - [http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt Bernz]. This "compliance" is generally associated with the acquisition of electronic information. However, Social Engineering can also apply to a border definition which encompasses any kind personal manipulation in an attempt to gain something dishonestly. The manipulation is performed by "tricking" the mark (the unsuspecting victim) into a false sense of trust which is them abused to obtain the sought objective.

==Aspects of Social Engineering==
A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
===Human===
The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what a social engineer wants, the objectives of a social engineer can be reach more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.

===System===
The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide a social engineer ammunition to construct a persona which is then used to manipulate the people who have access to the system.

==Methods of Social Engineering==
===By Phone===
This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answer, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.

Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked and the use of the [[The_Mitnick_attack|Mitnick Attack]]. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

===Online===
Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through [[Phishing|phishing]]. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.

===Persuasion===
Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation (such as [[Identity_Theft||identity theft]] or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

===Dumpster Diving===
Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies protocols, terminology and many employee's names and other personal information.

===Reverse Social Engineering===
The objective in reverse social engineering is to have the mark ask the attacker for information, rather than the other way around. The advantage of this method is that the attacker can give out information that will suit his motives. For example, an attacker can call the supervisor of an office and inform him that there is maintenance scheduled on the office network and if people have problems accessing the system that they should call the attacker. Then the attacker will create a network outage and when the employees call, he can retrieve their login information. This kind of attack requires a significant amount of preperation, however it can yield very successful results.

==Protection==
To protect against social engineering attacks, a company should implement security policies which deal with both physical and psychological elements. Standard physical security mechanisms should be implemented which take into account network protection, password protection, and a system of securely disposing of trash. In addition, the policies should cover the education and training of emplyees to help recognize a social engineering attack. This kind of training should deal with how these attacks can happen, specific examples, and methods in which employees can authenticate who they are speaking with. It should also stress the importance of not giving out information that is not need-to-know or confidential (such as passwords).

== References ==
Bernz: “The complete Social Engineering FAQ!”
http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001
http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007
http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006
http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007
http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/

--[[User:Shahinrs|Shahinrs]] 07:36, 7 November 2007 (EST)

Social engineering

2007-12-03T23:34:37Z

Shahinrs:

'''Social Engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

{| __TOC__
|}
 

[[Image:Mitnick.jpg|thumb|300px|right|
'''Kevin David Mitnick'''
 ''Born October 6, 1963'' 
Convicted of computer related crimes using social engineering.]]

==What is Social Engineering?==
Social Engineering is the manipulation of people to further a person's motives using various methods. “The art and science of getting people to comply to your wishes” - [http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt Bernz]. This "compliance" is generally associated with the acquisition of electronic information. However, Social Engineering can also apply to a border definition which encompasses any kind personal manipulation in an attempt to gain something dishonestly. The manipulation is performed by "tricking" the mark (the unsuspecting victim) into a false sense of trust which is them abused to obtain the sought objective.

==Aspects of Social Engineering==
A social engineering attack can be thought of as process with two key components; human and the system. The human component requires the social engineer to gain the trust of whom ever has access to the system.
===Human===
The human element in social engineering attacks is the method in which the objectives are carried out. Human beings are generally the weakest part of any security system because they can be tricked or corrupted. By attacking the people who have access to what a social engineer wants, the objectives of a social engineer can be reach more easily. People like system administrator, maintenance people, or employees can all potential jeopardized a secure system by giving out information that to someone who they consider to be trustworthy.

===System===
The system refers to any potentially closed system which contains something a social engineer wants. A social engineering attack is only successful if the social engineer has knowledge about the inner workings of the system. Knowledge like protocols, terminology, names of people, important dates, etc., provide a social engineer ammunition to construct a persona which is then used to manipulate the people who have access to the system.

==Methods of Social Engineering==
===By Phone===
This is the most common method of social engineering attacks. An attacker will call the mark, using a persona, and gain the mark's trust. Then the attacker will request information which then might be used to perform another social engineering attack. Help desks are prone to this kind of attack since they are trained to be friendly and give out information. They are also minimally educated in areas of security. An example of this type of attack might be the following scenario. An attacker calls a help desk and asks to speak to the supervisor. When the supervisor answer, the attacker explains that he is the system administrator and that there is a problem with the system. Then the attacker asks the supervisor to login to the system. The attacker then states that he is unable to see the login on his end and that this is a problem. Then the attacker asks the supervisor to give him the login information so that he can try. Once the supervisor has done this, the attacker tells the supervisor that everything seems to be ok and the supervisor is none the wiser.

Another example of a phone attack is when the attacker calls a person in the middle of the night posing as someone from a bank. The attacker asks if they have just made a suspicious purchase (a very large amount or in another country). When the mark says no, the attacker asks for the credit card number for verification, then says the charges will be removed from the account.

Social Engineering can take on many forms on the phone and can have many different objectives. The most notable social engineer in 1990's was Kevin Mitnick. He was arrest in 1995 and convicted of illegally gaining access to computer networks and stealing intellectual property. Mitnick's methods relied on the use of phone calls to the companies which he attacked. Mitnick served 5 years in prison and now runs a security consulting company which gives security advice to companies.

===Online===
Online social engineering attacks are similar to phone attacks, in that they pose as a legitimate entity which the mark will trust. Many online attacks are spread through phishing. This type of social engineering assumes that most users use the same login and password for many internet sites, so by getting the user to sign up for a new site, they will be giving up their login information. These sites might be in the form of new sites which the use might be interested in, or they might pose as sites which the user already has an account for and ask the user to try and login again. The latter example can take for in the following. The mark receives an email informing him that he needs to update his PayPal password by clicking the provided link and logging in. Failure to do so will result in the termination of the account after a specified period. Once the mark clicks on the link, and enters his login information, a message is displayed which confirms the change. The link the mark has clicked on however, was a link to the attacker's site which simply records the login information.

===Persuasion===
Persuasion is the core of social engineering attacks. This method is used in all social engineering attacks and relies on the attacker's grasp of the human psyche. The attacker's ability to persuade is determined by two things. Firstly the attacker must be able to gain trust. This can be accomplished using various techniques. The most common of which are creating a persona by impersonation or imitation. An attacker can pose as either an existing employee or pose as a generic employee. For example, an attacker calling an office can say that his name is Bob Anderson with employee number 123456 (where Bob Anderson is an existing employ who works at a different branch with that employee number), or he can say he's Dale Johnson, a new system administrator brought in to fix the recent system failures (where Dale Johnson is a made up name). The use of these persona provides the social engineer with a the appearance of authenticity which is used to build the mark's trust. Once this authenticity is established, the attacker must then complete the persuasion by implementing the second step, manipulation. This is accomplished by providing a convincing reason to the mark to give the attacker what he wants. This can be a colorful background story, a tempting offer, or even guiling the mark into compliance. The point is to make the mark believe that the persona that is being used is legitimate and that the requests being made are genuine. If a social engineer can master these two elements then he will be very persuasive.

===Dumpster Diving===
Dumpster Diving, also known as trashing, is the "snooping" through trash to collect information. It is a very effective method of obtaining many different types of information. The premis is that many companies and individuals don't apply a high level of security in their garbage because they feel as though what they throw out is no longer relevant. However, much of the trash being discarded can collectively provide the social engineer with the tools needed to create personas and learn about the inner workings of the system. Trash like old user and password lists, company directories, event calenders, printouts of source code and even obsolete hardware can contain information that is relevant to the current state of the system. In particular the social engineer can learn about the companies protocals, termonology and many emplyee's names and other personal information.

===Reverse Social Engineering===
*Pretend to be someone in a position of authority
**employees will ask him for information
*Most difficult method to pull off
**requires lots of preparation
**but can yield the most successful results

==Protection==
*Security policies dealing with both physical and psychological elements
**Standard physical security mechanisms
***networks protection
***good password protection
***secure disposal of trash
***standard security measures we’ve discussed in class
**Education and training of employees
***Making employees aware of Social Engineering
***better recognize an attack
***Authentication
****Making sure the person they are speaking with is that person
**Availability of ANY information
***only give out information that’s need-to-know
***Don’t give out confidential information

==Conclusion==
*Social Engineering attacks are very difficult to protect against.
*A system’s security is only as strong as the people who maintain it.
*With proper training, a social Engineering attack can be made extremely difficult.
*However, it can never been fully projected against.

== References ==
Bernz: “The complete Social Engineering FAQ!”
http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001
http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007
http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006
http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007
http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/

--[[User:Shahinrs|Shahinrs]] 07:36, 7 November 2007 (EST)

Social engineering

2007-12-03T09:16:29Z

Shahinrs:

Social engineering

2007-12-03T07:58:36Z

Shahinrs:

Social engineering

2007-11-30T23:47:41Z

Shahinrs:

'''Social engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

{| __TOC__
|}
 

[[Image:Mitnick.jpg|thumb|300px|right|
'''Kevin David Mitnick'''
 ''Born October 6, 1963'' 
Convicted of computer related crimes using social engineering.]]

==What is Social Engineering?==
Social Engineering is?
*“the art and science of getting people to comply to your wishes” - Bernz.
*Attacks human side of information security
*not mind control or coercion.
*but rather “ticking” people
**do what you want them to do
**give you information that you might not have access to

==Aspects of Social Engineering==

===Human===
*Humans are generally the weakest part of any security system
**System admins, maintenance people, employees
***all have access to the system
***any one of them can jeopardize security if they are not careful
***knowingly or unknowingly
*All Social Engineering attacks have something in common
**Take advantage of a human being’s trust
*Need 2 things for a Social Engineering attack
**A knowledge of the system being attacked
***Lots of background work
***Terminology
***Names of people and places
***Protocols being used
***The ability to gain people’s trust

===Hardware===

==Notable Examples==

==Methods of Social Engineering==
===By Phone===
*Most common method
*Call a company and imitate someone in a position of authority or relevance.
**Supervisor, manager, system admin.
***pretend they can’t log into the system
***or that they need your login to troubleshoot
*Help desks are most prone to this
**used to helping people
**trained to give out information and be friendly
**want to move on to next call
**minimally educated in security area

===Online===
*Many people use same password and login for internet sites
**Using methods like Phishing can allow the Social Engineer to obtain lots of information about a person

===Persuasion===
*The true strength of a Social Engineer
*Gaining trust by
**impersonation (identiy theft)
**imitation (made up identity)
*Uses psychological methods
**Guilt
**Tempting offers

===Dumpster Diving===
*also known as trashing
*looking through garbage for information
*Many companies don’t implement any method of security for their garbage
**user and password lists
**Company directories
**Event calendars
**obsolete computers
**printouts of source codes
**The more a Social Engineer knows about:
***a company
***their protocols
***terminology
***the more likely he’ll be able to succeed.

===Reverse Social Engineering===
*Pretend to be someone in a position of authority
**employees will ask him for information
*Most difficult method to pull off
**requires lots of preparation
**but can yield the most successful results

==Protection==
*Security policies dealing with both physical and psychological elements
**Standard physical security mechanisms
***networks protection
***good password protection
***secure disposal of trash
***standard security measures we’ve discussed in class
**Education and training of employees
***Making employees aware of Social Engineering
***better recognize an attack
***Authentication
****Making sure the person they are speaking with is that person
**Availability of ANY information
***only give out information that’s need-to-know
***Don’t give out confidential information

==Conclusion==
*Social Engineering attacks are very difficult to protect against.
*A system’s security is only as strong as the people who maintain it.
*With proper training, a social Engineering attack can be made extremely difficult.
*However, it can never been fully projected against.

==References==
Bernz: “The complete Social Engineering FAQ!”
http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001
http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007
http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001
http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006
http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007
http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/

--[[User:Shahinrs|Shahinrs]] 07:36, 7 November 2007 (EST)

Social engineering

2007-11-30T23:16:40Z

Shahinrs:

Social engineering

2007-11-30T23:09:58Z

Shahinrs:

Social engineering

2007-11-30T22:35:33Z

Shahinrs:

File:Mitnick.jpg

2007-11-30T22:30:32Z

Shahinrs:

Kevin David Mitnick (born October 6, 1963) is one of the most notable computer hackers of the 1990's. He was convicted of computer related crimes in the late 1990's and served five years in prison (four of which were pre-trial). Mitnick was released on January 21, 2000 and now runs Mitnick Security Consulting, which is a computer security consulting company.

File:Mitnick.jpg

2007-11-30T22:29:51Z

Shahinrs:

Kevin David Mitnick (born October 6, 1963) is one of the most notable computer hackers of the 1990's. He was convicted of computer related crimes in the 1990's and served five years in prison (four of which were pre-trial). Mitnick was released on January 21, 2000 and now runs Mitnick Security Consulting, which is a computer security consulting company.

File:Mitnick.jpg

2007-11-30T22:18:37Z

Shahinrs: Kevin Mitnick, one of the most notable social engineers

Kevin Mitnick, one of the most notable social engineers

Social engineering

2007-11-07T12:36:31Z

Shahinrs: New page: '''Social engineering''' is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is ...