Social engineering

From Computing and Software Wiki

Social Engineering is a term used in computer science that referees to a non-technical type of security attack. This attack relies on the human element in any security system and is made vulnerable by exploiting a person's trust in the attacker to divulge sensitive or insensitive information. This is often accomplished by misleading or tricking the person getting attacked. In many cases, the attacked never know that they have been attacked.

Contents 1 What is Social Engineering? 2 Aspects of Social Engineering 2.1 Human 2.2 Hardware 3 Notable Examples 4 Methods of Social Engineering 4.1 By Phone 4.2 Online 4.3 Persuasion 4.4 Dumpster Diving 4.5 Reverse Social Engineering 5 Protection 6 Conclusion 7 References

What is Social Engineering?

Social Engineering is?

• “the art and science of getting people to comply to your wishes” - Bernz.
• Attacks human side of information security
• not mind control or coercion.
• but rather “ticking” people
  • do what you want them to do
  • give you information that you might not have access to

Aspects of Social Engineering

Human

• Humans are generally the weakest part of any security system
  • System admins, maintenance people, employees
    • all have access to the system
    • any one of them can jeopardize security if they are not careful
    • knowingly or unknowingly
• All Social Engineering attacks have something in common
  • Take advantage of a human being’s trust
• Need 2 things for a Social Engineering attack
  • A knowledge of the system being attacked
    • Lots of background work
    • Terminology
    • Names of people and places
    • Protocols being used
    • The ability to gain people’s trust

Hardware

Notable Examples

Methods of Social Engineering

By Phone

• Most common method
• Call a company and imitate someone in a position of authority or relevance.
  • Supervisor, manager, system admin.
    • pretend they can’t log into the system
    • or that they need your login to troubleshoot
• Help desks are most prone to this
  • used to helping people
  • trained to give out information and be friendly
  • want to move on to next call
  • minimally educated in security area

Online

• Many people use same password and login for internet sites
  • Using methods like Phishing can allow the Social Engineer to obtain lots of information about a person

Persuasion

• The true strength of a Social Engineer
• Gaining trust by
  • impersonation (identiy theft)
  • imitation (made up identity)
• Uses psychological methods
  • Guilt
  • Tempting offers

Dumpster Diving

• also known as trashing
• looking through garbage for information
• Many companies don’t implement any method of security for their garbage
  • user and password lists
  • Company directories
  • Event calendars
  • obsolete computers
  • printouts of source codes
  • The more a Social Engineer knows about:
    • a company
    • their protocols
    • terminology
    • the more likely he’ll be able to succeed.

Reverse Social Engineering

• Pretend to be someone in a position of authority
  • employees will ask him for information
• Most difficult method to pull off
  • requires lots of preparation
  • but can yield the most successful results

Protection

• Security policies dealing with both physical and psychological elements
  • Standard physical security mechanisms
    • networks protection
    • good password protection
    • secure disposal of trash
    • standard security measures we’ve discussed in class
  • Education and training of employees
    • Making employees aware of Social Engineering
    • better recognize an attack
    • Authentication
      • Making sure the person they are speaking with is that person
  • Availability of ANY information
    • only give out information that’s need-to-know
    • Don’t give out confidential information

Conclusion

• Social Engineering attacks are very difficult to protect against.
• A system’s security is only as strong as the people who maintain it.
• With proper training, a social Engineering attack can be made extremely difficult.
• However, it can never been fully projected against.

References

Bernz: “The complete Social Engineering FAQ!” http://www.morehouse.org/hin/blckcrwl/hack/soceng.txt

Sarah Granger : “Social Engineering Fundamentals”, SecurityFocus, December 18, 2001 http://www.securityfocus.com/infocus/1527

“Social engineering (security)”, Wikipedia, November 19, 2007 http://en.wikipedia.org/wiki/Social_engineering_(computer_security)

“social engineering”, SearchSecurity, October 10, 2006 http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci531120,00.html

Mitnick, Kevin: “My first RSA Conference,” SecurityFocus, April 30, 2001 http://www.securityfocus.com/news/199

Leslie Hawthorn: “Social Engineering”, O’Reilly Network, March 10, 2006 http://www.oreilly.com/pub/a/womenintech/2007/09/04/social-engineering.html

“Social Engineering”, McGuill Network Communications Services, September 7, 2007 http://www.mcgill.ca/ncs/products/security/threatsdangers/socialeng/

--Shahinrs 07:36, 7 November 2007 (EST)