TAZ Forum Community

Social Engineering

It comes as no surprise to many people that most people that all beginning hackers and crackers start off with the computer end of business. However, many hacks begins/end with a much more effective technique, Social Engineering. Often, Humans are much easier to crack then their digital counterparts, and there are several ways to do it.

Pretexting

The first is pretexting, the attacker pretends to be someone in authority when they are not, often over the phone. They will more then likely have done research before hand and will know things like, birth date of the person they are imitating, the last bill amount of a company, the holders social security number, or any number of other means of authentication$. Once they have the victim believing their story, there is no shortage of things they can do. For an example, say that you called up a companies DNS provider, and convinced them that your server is now on a new IP, you've set yourself up for a near perfect Phishing attack, which we will talk about more later.

Phishing

Phishing is technically a form of social engineering because it would be my job, as the attacker to make you believe that I am someone I am not. I would possibly take the role of your bank, your credit card company, a sweepstakes official, or a near unlimited number of other companies with whom you deal on a day to day basis. Phishing can take several forms; it may be in the form of an e-mail, telling you we need to verify important information otherwise “Your Account Will Be Canceled”, or a number of other dire warnings. It could also take the form of a fraudulent website, such as the myspace phishing attacks, which captured more then 32,000 legitimate passwords and e-mails. Getting people to use these websites instead of the actual ones is the trick, it could combine an actual computer attack, which may change the link to my website, or it could be a pretexting attack on the DNS combined with phishing like we talked about before.

IVR Phishing

Phishing is not only taking place on the net any more either. Attackers are now setting up phishing Interactive Voice Responders (IVR’s), or those annoying things that say “Press 1 for this, Press 2 for this, Prima tres para espanol!. Often you will receive this ‘Toll Free Number’ from a phishing e-mail. These will ask you to enter your account number, say your name, and possibly your pin number as well.

Road Apples

My personal favorite type of SE is the road apple. Here is a prime example, an attacker was unable to get into the network of a company using direct means, so he made about 40-50 CD’s with nothing but the company’s logo on them, drove at night to the company parking lot, and spread the CD’s around. Each CD contained some form of malware that would ‘phone home’ to his computer. He then went home and simply waited. Around 30-40 of the CD’s were taken in by people in the company, placed in their machines, and run. Soon he had a large number of computers infected, and his attack was underway. A road apple does not just have to be a CD, but could be a thumb drive, or anything containing the malware you want to run.

Quid-pro-quo

The last and my second favorite is Quid-pro-quo, something for something. This can take place in the form of calling random numbers in the company pretending to be from tech support, it’s only a matter of time until you get somebody who is having a legitimate problem. Then while helping them (its beneficial if you actually do fix their problem), you give them commands to enter, or better yet, send them to a phishing site to ‘verify’ themselves, or ‘download’ some scripts that you want run. The other example of quid-pro-quo is workers actually giving away their passwords in return for a cheap pen. In 2003 a security company set up a booth outside the company, and had people write down their passwords (granted anonymously, but usernames are much easier to get), in exchange for a very cheap pen. 90% of the workers who stopped at the booth completed the survey and walked away.

Conclusion

This is only a brief overview of a very broad topic that has almost unlimited applications. The key thing that was not talked about in any of this though is being creative and personable. There are far greater numbers of attacks that can be considered social engineering, and no one could possibly cover all of them in one paper.

Thanks for the explanations jaymill230.
If you want to learn more about Social Engineering I suggest you (readers) read this eBook : "The art of deception" by Kevin Mitnick.

It explains in details what is Social Engineering and its methods.

If you cant find the book (which I doubt) you can email me and I can send it to you..

Thats a great artical on S.E.

but jack19780605 reply is spam as usual.

http://snosoft.blogspot.com/2009/02/fac ... ctive.html


damn good article featuring facebook as an attackers tool

Mitnick: Yeah, he was a good social engineer.