Skip to content

Latest commit

 

History

History
149 lines (113 loc) · 6.13 KB

9-Social-Engineering.md

File metadata and controls

149 lines (113 loc) · 6.13 KB
Raw

Social Engineering

⚡︎ This chapter has practical labs

Social Engineering is the art of manipulating a person or group into providing information or a service they would otherwise not have given.

Phases

  1. 🔍 Research target company
    • Dumpster dive, visit websites, tour the company, etc
  2. 🎯 Select the victim
    • Identify frustrated employee or other target
  3. 💬 Build a relationship
    • Develop relationship with target employee
  4. 💰 Exploit the relationship
    • Collect sensitive information and current technologies

Principles

  1. Authority
    • Impersonate or imply a position of authority
  2. Intimidation
    • Frighten by threat
  3. Consensus / Social proof
    • To convince of a general group agreement
  4. Scarcity
    • The situation will not be this way for long
  5. Urgency
    • Works alongside scarcity / act quickly, don't think
  6. Familiarity
    • To imply a closer relationship
  7. Trust
    • To assure reliance on their honesty and integrity

Behaviors

  • Human nature/Trust - trusting others
  • Ignorance of social engineering efforts
  • Fear of consequences of not providing the information
  • Greed - promised gain for providing requested information
  • A sense of moral obligation

Companies Common Risks:

  • Insufficient training
  • Lack of controls
    • Technical
      • e.g: Firewall rule, ACL rules, patch management (...)
    • Administrative
      • e.g: Mandatory Vacations, Job Rotation, Separation of Duties (...)
    • Physical
      • e.g: Proper Lighting, Cameras, Guards, Mantraps (...)
  • Size of the Company Matters
  • Lack of Policies
    • Promiscuous Policy
    • Permisive Policy
    • Prudent Policy
    • Paranoid Policy

Social Engineering Attacks:

Human-Based Attacks 👥

  • Dumpster Diving - Looking for sensitive information in the trash

    • Shredded papers can sometimes indicate sensitive info

  • Impersonation - Pretending to be someone you're not

    • Can be anything from a help desk person up to an authoritative figure (FBI agent)
    • Posing as a tech support professional can really quickly gain trust with a person

  • Shoulder Surfing - Looking over someone's shoulder to get info

    • Can be done long distance with binoculars, etc.

  • Eavesdropping - Listening in on conversations about sensitive information

  • Tailgating - Attacker walks in behind someone who has a valid badge. (e.g: Holding boxes or simply by following without getting notice)

  • Piggybacking - Attacker pretends they lost their badge and asks someone to hold the door

  • RFID Identity Theft (RFID skimming) - Stealing an RFID card signature with a specialized device

  • Reverse Social Engineering - Getting someone to call you and give information

    • Often happens with tech support - an email is sent to user stating they need them to call back (due to technical issue) and the user calls back
    • Can also be combined with a DoS attack to cause a problem that the user would need to call about
    • Always be pleasant - it gets more information

  • Insider Attack - An attack from an employee, generally disgruntled

    • Sometimes subclassified (negligent insider, professional insider)

Computer-Based Attacks 💻

Can begin with sites like Facebook where information about a person is available; For instance - if you know Bob is working on a project, an email crafted to him about that project would seem quite normal if you spoof it from a person on his project.

  • Phishing - crafting an email that appears legitimate but contains links to fake websites or to download malicious content.

    • Ways to Avoid Phishing
      • Beware unknown, unexpected or suspicious originators
      • Beware of who the email is addressed to
      • Verify phone numbers
      • Beware bad spelling or grammar
      • Always check links

  • Spear Phishing - Targeting a person or a group with a phishing attack.

    • Can be more useful because attack can be targeted

  • Whaling - Going after CEOs or other C-level executives.

  • Pharming - Make a user's traffic redirects to a clone website; may use DNS poisoning.

  • Spamming - Sending spam over instant message.

  • Fake Antivirus - Very prevalent attack; pretends to be an anti-virus but is a malicious tool.

Tools

  • SET (Social Engineering Toolkit) - Pentest tool design to perform advanced attacks against human by exploiting their behavior.

  • PhishTank - For phishing detection

  • Wifiphisher - Automated phishing attacks against Wi-Fi networks in order to obtain credentials or inject malware.

  • SPF SpeedPhish framework - Quick recon and deployment of simple social eng. exercises

Mobile-Based Attacks

  • ZitMo (ZeuS-in-the-Mobile) - banking malware that was ported to Android
  • SMS messages can be sent to request premium services
  • Attacks
    • Publishing malicious apps
    • Repackaging legitimate apps
    • Fake security applications
    • SMS (smishing)

Physical Security Basics

  • Physical measures - everything you can touch, taste, smell or get shocked by
    • Includes things like air quality, power concerns, humidity-control systems
  • Technical measures - smartcards and biometrics
  • Operational measures - policies and procedures you set up to enforce a security-minded operation
  • Access controls - physical measures designed to prevent access to controlled areas
    • Biometrics - measures taken for authentication that come from the "something you are" concept
      • False rejection rate (FRR) - when a biometric rejects a valid user
      • False acceptance rate (FAR) - when a biometric accepts an invalid user
      • Crossover error rate (CER) - combination of the two; determines how good a system is
  • Even though hackers normally don't worry about environmental disasters, this is something to think of from a pen test standpoint (hurricanes, tornadoes, floods, etc.)

Prevention

  • Separation of duties
  • Rotation of duties
  • Controlled Access
    • Least privilege
  • Logging & Auditing
  • Policies