Social Engineering: Grifting in the 21 century by clickmyadspleaseXOXO


									Social Engineering
Grifting in the 21st century

 Webster—management of human beings in accordance with their place and function in society—applied social science.  Wetware—Human beings (programmers, operators, administrators) attached to a computer system, as opposed to the system’s hardware or software (also liveware & meatware)  Social Engineering—cracking techniques that rely on waknesses in wetware rather than software

Social Engineering--UHM
 Our Definition—Manipulation of human beings to obtain information or confidence pertaining to the security of networked computer systems (with malicious intent)

Social Engineering Cycle
 Research (Dumpster diving , et. al.)  Developing rapport and trust

 Exploiting trust
 Use the information

Source: Mitnick, 2002

Social Engineering Major Tools
 Appeal to vanity  Appeal to authority  Eavesdropping  Prey on natural helpfulness

 Manipulate lack of awareness of value of info

Social Engineering Methods
                  

Posing as fellow employee Posing as employee of vendor Posing as an authority figure Posing as a new employee requesting help Posing as a vendor offering patch, etc. Offering help if a problem occurs Sending free software or patch to install Sending a virus/Trojan horse Using false pop-up window asking for log-in Capturing victim keystrokes Leaving floppy sitting around with malicious code Using insider lingo to gain trust Offering a prize for registering web site with username and password Dropping document or file at company mail room for in-house delivery Modifying fax machine heading to appear to come from normal location Asking receptionist to receive then forward a fax Asking for a file to be transferred to an apparently internal location Getting voice mailbox set up for callbacks, making attacker seem internal Pretending to be from remote office and asking for email access locally

Source: Mitnick, 2002

Warning Signs of an Attack
    

Refusal to give callback number Out-of-ordinary request Claim of authority Stresses urgency Threatens negative consequences of noncompliance  Shows discomfort when questioned  Name dropping  Compliments or flattery  Flirting
Source: Mitnick, 2002

Common Targets of Attacks
 Unaware of info value—receptionist  Special privileges—help desk tech support

 Manufacturer/vendor—vendors
 Specific departments—accounting, HR

Source: Mitnick, 2002

Factors Making Companies Vulnerable
 Large number of employees  Multiple facilities  Info on employee whereabouts left invoice

mail messages  Phone extension info made available  Lack of security training  Lack of data classification system  No incident reporting/response plan
Source: Mitnick, 2002

 Passwords displayed on hardware

 Internal company info/memos
 User’s passwords/account info  Theft of service (Mitnick)  Theft of intellectual property  Footprinting/casing prior to e-attack

Why do we care?
 Humans are potentially the least secure link

in any secure system
 “You are the weakest link…Goodbye!”

Experiment U of I
 War-driving
• Revealed many wireless networks in use in industry, manufacturing, commerce and education (not to mention residential) • Most did not take minimal security measures

 Why are industries relying on wireless?
• Don’t know the risk • Incompetent, apathetic, irresponsible

Experiment U of I (cont’d.)
 Sent 10 letters to industry/commerce

 Identified wireless enabled
• Warned about risks • Sent info obtained about network
• MAC addresses • Access Point brand & name • WEP status

 Offered to help evaluate risks

Results 1
 FSI (First Step Internet)
• • • • • • • • Authentication scheme Access point names and locations Security practices IDS/mitigation Wireless backbone locations/type/frequency Future security plans Client security End user agreements

Results 2
 St. Joseph’s Regional Medical Center
• • • • Well informed Cautious/paranoid/untrusting Unwilling to divulge any info about their network Educated about social engineering and would not answer direct questions • Thorough risk assessment determined the liability was smaller than the risk

Recent Survey--UK
 InfoSecurity Europe 2003 Survey of Office

workers at London’s Waterloo Station
• 75% gave password immediately • 15% further revealed their password after some simple social engineering tricks • 2/3 have given password to colleagues • 2/3 use the same password for everything

Lessons Learned
 People can be trained to avoid/prevent

social engineering (St. Joe’s)

 It only takes one person to divulge insider

info (knowingly or unknowingly) for a security breach
 Social engineering is still the easiest method

of obtaining insider info.

  pdf  92909009.pdf  k/soceng.txt

To top