Social engineering
- 1. Social Engineering The Art of Social Hacking By-Ankush Mohanty
- 2. Introduction • What is Social Engineering? o Manipulate people into doing something, rather than by breaking in using technical means.This type of attack is non technical. • Types of Social Engineering • Ways to prevent Social Engineering
- 4. What is Social Engineering? • Attacker uses human interaction to obtain or compromise information • Attacker my appear unassuming or respectable o Pretend to be a new employee, repair man, ect o May even offer credentials • By asking questions, the attacker may piece enough information together to infiltrate a companies network o May attempt to get information from many sources
- 5. History of Social Engineering • The term Social Engineering was made popular ex- computer criminal Kevin Mitnick. • Confessed to illegally accessing private networks and possession of forged documents. • Claimed to of only used Social Engineering techniques with no help from software programs.
- 6. Kevin Mitnick Famous Social Engineer Hacker • Went to prison for hacking • Became ethical hacker "People are generally helpful, especially to someone who is nice, knowledgeable or insistent."
- 7. A Quote from Kevin Mitnick “You could spend a fortune purchasing technology and services from every exhibitor, speaker and sponsor at the RSA Conference, and your network infrastructure could still remain vulnerable to old-fashioned manipulation.”
- 8. Kevin Mitnick - Art of Deception: • "People inherently want to be helpful and therefore are easily duped" • "They assume a level of trust in order to avoid conflict" • "It's all about gaining access to information that people think is innocuous when it isn't" • Here a nice voice on the phone, we want to be helpful • Social engineering cannot be blocked by technology alone
- 9. Types of Attacks • Phishing • Impersonation on help desk calls • Physical access (such as tailgating) • Shoulder surfing • Dumpster diving • Stealing important documents • Fake software • Trojans
- 10. Phishing • Fraudulently obtaining private information o Send an email that looks like it came from a legitimate business o Request verification of information and warn of some consequence if not provided o Usually contains link to a fraudulent web page that looks legitimate o User gives information to the social engineer Ex: Ebay Scam
- 11. Phishing continued • Spear Fishing o Specific phishing Ex: email that makes claims using your name • Vishing o Phone phishing o Rogue interactive voice system Ex:call bank to verify information Prevention: Honeypot email addresses Education Awareness of network and website changes
- 12. Impersonation on help desk calls • Calling the help desk pretending to be someone else • Usually an employee or someone with authority • Prevention: – Assign pins for calling the help desk – Don‟t do anything on someone‟s order – Stick to the scope of the help desk
- 13. Physical access • Tailgating • Ultimately obtains unauthorize building access • Prevention – Require badges – Employee training – Security officers – No exceptions!
- 14. Shoulder surfing • Someone can watch the keys you press when entering your password • Probably less common • Prevention: – Be aware of who‟s around when entering your password
- 15. Dumpster diving • Looking through the trash for sensitive information • Doesn‟t have to be dumpsters: any trashcan will do • Prevention: – Easy secure document destruction – Lock dumpsters – Erase magnetic media
- 16. Stealing important documents • Can take documents off someone‟s desk • Prevention: – Lock your office – If you don‟t have an office: lock your files securely – Don‟t leave important information in the open
- 17. Fake Software • Fake login screens • The user is aware of the software but thinks it‟s trustworthy • Prevention: – Have a system for making real login screens obvious (personalized key, image, or phrase) – Education – Antivirus (probably won‟t catch custom tailored attacks)
- 18. Trojans • Appears to be useful and legitimate software before running • Performs malicious actions in the background • Does not require interaction after being run • Prevention: – Don„t run programs on someone else‟s computer – Only open attachments you‟re expecting – Use an antivirus
- 19. Weakest Link? • No matter how strong your: o Firewalls o Intrusion Detection Systems o Cryptography o Anti-virus software • You are the weakest link in computer security! o People are more vulnerable than computers • "The weakest link in the security chain is the human element" -Kevin Mitnick
- 20. Ways to Prevent Social Engineering Training • User Awareness o User knows that giving out certain information is bad • Military requires Cyber Transportation to hold o Top Secret Security Clearance o Security Plus Certification • Policies o Employees are not allowed to divulge private information o Prevents employees from being socially pressured or tricked
- 21. Ways to Prevent Social Engineering Cont.. • 3rd Party test - Ethical Hacker o Have a third party come to your company and attempted to hack into your network o 3rd party will attempt to glean information from employees using social engineering o Helps detect problems people have with security • Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about internal information • Do not provide personal information, information about the company(such as internal network) unless authority of person is verified
- 22. General Saftey • Before transmitting personal information over the internet, check the connection is secure and check the url is correct • If unsure if an email message is legitimate, contact the person or company by another means to verify • Be paranoid and aware when interacting with anything that needs protected o The smallest information could compromise what you're protecting
- 23. Questions?