Note: Sample below may appear distorted but all corresponding word document files contain proper formattingExcerpt from Term Paper:
Social Engineering and Information Security
We are in an age of information explosion and one of the most critical problems facing us is the security and proper management of information. Advanced hardware and software solutions are being constantly developed and refined to patch up any technical loopholes that might allow a hacker attack and prevent consequent breach of information security. While this technical warfare continues, hackers are now pursuing other vectors of attack. Social engineering refers to the increasing employment of techniques, both technical and non-technical, that focus on exploiting the cognitive bias in humans as the weakest link in computer security. What is shocking is the fact that in spite of the great vulnerability to human exploitation, there prevails a seemingly careless attitude in this regard in the corporate world. While more and more money is spent on beefing up hardware security and in acquiring expensive software solutions, little is done to address the social engineering exploits. While government laws and regulations such as the HIPPA, SOX (Sarbanes-Oxley) and the Gramm Leach Bliley act (GLBA) are already in place to protect privacy and information security it is important that more awareness is created about the social engineering threats. This paper is a brief overview of the various technical and non-technical social engineering techniques and the simple but effective measures that could be implemented to protect end users from social engineers.
Social Engineering Techniques
Pretexting is defined as "the act of creating an invented scenario to persuade a targeted victim to release information or perform some action." [Hadnagy & Wilson, chapt4]. Social engineers use extensive research to successfully impersonate in order to make the target believe in them and disclose vital information. The background research and practice enables the social engineer to convince the target easily making it appear as a legitimate case. The phone is the most important tool used for pretexting. Pretexting enables the social engineer to obtain vital personal information from the users. The most famous incident of corporate pretexting was the 2006 HP scandal. In this case, Patricia Dunn, the chairwoman of HP at that time employed security officials who used pretexting to obtain phone records of HP board of directors and other employees to find out an inside leak and was successful in doing that. In a court statement, the FTC reported that "the defendants have obtained confidential customer phone records, including lists of calls made and the dates, times, and duration of the calls, and sold them to third parties without the knowledge or consent of the customers."[Greg Sandoval, Feb 2007]. The 2006 Telephone records and privacy protection act clearly made it illegal for any person or corporate entity to use fraudulent methods of obtaining call records from the Phone Company. Any violations in this regard are duly punishable by imprisonment up to 10 years.
Phishing attacks are a common form of technical social engineering attack that use either a website or an email as the medium for tricking the unaware customer into giving out his/her vital information such as bank account, credit card related information etc. Email phishing scams often involve warnings about breach of account security and ask the customer to reenter their account details and change their passwords. Typically, a phishing email would contain a link to a malicious website that resembles the original website of a reputable bank or any other business. Unaware users would reenter or update their personal details which could then be used by the Social engineer to obtain access to their accounts. [McDowell, 2009]
Phone phishing is the new trend used by social engineers. As more and more users are becoming aware of the dangers of unsolicited emails the hackers have begun to use phishing over phone instead of the emails. Particularly, the availability of low cost VOIP services has attracted them to use this popular media for their fraudulent schemes. Phishing over VOIP is now popularly termed as Vishing. Users are sent voice mails that sound legitimate as from the bank informing them that their account has been frozen. They are then asked to call back to a particular number to reactivate their account. Unwary customers end up calling the numbers and divulge their account details making it a successful Vishing scheme for the hacker. [Sonja Ryst, (2006)]
Social engineers rely on their successful impersonation and persuasion skills to con the users. They utilize the human qualities of 'Trust', 'Helpful nature', 'fear', etc. To circumvent the technical route and gain direct access to confidential user information. A skilled social engineer may use both the direct as well as the peripheral route to persuade the victim into giving in the required information. [Michael Workman, 2007]
With the available computing power hackers can easily target data servers. By using botnets they can disrupt the normal server services. Today it is not so difficult to crack passwords as the availability of cloud computing power and the cluster of literally hundreds of virtual machines would enable any hacker to crack down an encrypted password in under 20 minutes using a simple brute force method while the same process could have taken days together before. [Ted Samson, 2011]
Kevin Mitnick is world renowned for his social engineering exploits and his excellence in elicitation skills. One of his famous exploits include hacking into the DMV (department of motor vehicles) using his well refined impersonation skills and elicitation methods and intercepting police calls to the DMV. In this self reported real story which he calls the "The Reverse Sting," Kevin describes through the character of Eric how he managed to successfully breakthrough into the nonpublic DMV database and how he gained access to driver's license numbers of people and police officers using a combination of non-technical and technical social engineering skills.
Eric knew that posing as a police officer he could have access to all the information from the DMV database. However, the first problem was to find out the unpublished DMV phone number. This he obtained by first calling up the telephone information service and asking for the phone number to the DMV headquarters. Obviously he was only provided with the public number for DMV headquarters. For obtaining the private number that would normally be used by cops he first called the local sheriffs office asking for the number for Teletype department (through which police send and receive information) Eric then called the teletype number and asked for the number that police officers would use to call the DMV headquarters. When he was questioned "Who are you?" he swiftly responded, "This is Al. I was calling [HIDDEN] .." Based on the fact that he already had the non-public Teletype number and that he got the base numbers for the DMV right the Teletype receptionist assumed that he was internal and gave him the number. Eric used the number and called the DMV and posing as a Nortel Technical support guy he asked to speak with a DMV technician. Eric informed the DMV technician that Nortel is updating all the DMS 100 switches and that it could be done entirely online for which he would require the dial in number to the DMS 100 Switch board. Since it seemed to be totally believable, the technician promptly gave in the number. Using his previous experience with Nortel boards and by testing out all the standard passwords, Eric was soon able to break into the system and gained access to 19 dedicated lines.
Now he could intercept any of the different incoming lines to the board. He intercepted one of these lines and connected it to his new cell phone which enabled him to receive all the incoming calls to that particular line on his cell phone. Soon law enforcement officers were routinely calling him for obtaining details for various license numbers. Thus by using a simple mix of non-technical elicitation techniques and technical knowledge, he was able to break into one of the strictly confidential government databases. [Hadnagy, Chapter 8]
Hadnagy Case Study
Christopher Hadnagy, the author of the book, 'The art of Human Hacking', discusses his own personal experience as a Social engineering auditor for a medium sized printing company in the U.S. This audit was performed to convince the CEO of the company to invest in security systems which he was very reluctant to do as he felt that all proprietary processes and other confidential information were very safe and secure with him as he does not use technology so much in his life. In fact, over the phone the CEO had vehemently rejected the need for additional security systems saying, "hacking him would be next to impossible because he guarded these secrets with his life." [Hadnagy, Chapter 8]
Hadnagy, as the auditor, was given the responsibility to convince the CEO about the potential dangers and to gain the approval for the required security upgrades. Hadnagy started by using a simple information processing and aggregating tool such as Maltego and was…[continue]
"Social Engineering Information Security" (2011, March 08) Retrieved October 25, 2016, from http://www.paperdue.com/essay/social-engineering-information-security-120938
"Social Engineering Information Security" 08 March 2011. Web.25 October. 2016. <http://www.paperdue.com/essay/social-engineering-information-security-120938>
"Social Engineering Information Security", 08 March 2011, Accessed.25 October. 2016, http://www.paperdue.com/essay/social-engineering-information-security-120938
Social Engineering Attacks Counter Intelligence Social Engineering Counter Intelligence Describe what social engineering and counterintelligence are and their potential implications to our national security in regard to the leaked Afghan War Diary and the Iraq War Logs. Social engineering is the theft of classified information. Then, using it to change everyone's opinions and perceptions about what is happening. Counter intelligence is preventing hostile enemies or organizations from obtaining access to sensitive material. These
Spamming involves receiving deceptive mail like one has won the lottery then engineers ask for information to receive payment so as to gain financially or for social gains. For fake spyware, they claim to have utilities that are anti-spyware but are actually the spyware that can hack into your system. The engineers in this case pretend to be genuine and are out to offer solutions. Protecting individuals from social engineering There
Social Technology and Security Cincom Systems, a privately-held enterprise software company who is very active on Facebook, LinkedIn, Twitter and has an extensive blog network relies on social media sites to share customer success stories and the latest updates on events the company is participating in. Cincom has six different product divisions, each offering a different type of enterprise software, ranging from Customer Relationship Management (CRM), and Enterprise Resource Planning (ERP)
Social Engineering as it Applies to Information Systems Security The research takes into account several aspects that better create an overview of the term and the impact it has on security systems. In this sense, the first part of the analysis reviews the concept of social engineering and the aspects it entails. Secondly, it provides a series of cases that were influenced by social engineering and the effects each had on
ERP and Information Security Introduction to ERP Even though the plans of information security include the prevention of outsiders to gain access of internal network still the risk from the outsiders still exists. The outsiders can also represent themselves as authorized users in order to cause damage to the transactions of the business systems. Therefore, strict prevention measures should be taken to avoid such situations. The threats of both the hackers have been
victims of an organization's data breach? The largest data brokers, government agencies, retailers, Internet businesses, financial institutions and educational institutions of the nation have disclosed a number of computer intrusions and data breaches. A data breach can take place in case of theft or loss of, or some kind of illegal access to the data that contains sensitive information which is personal and can compromise the integrity or confidentiality of
They include the use of stealthy tactics, tools and techniques in order to avoid detection by antimalware software. The second goal is to create a backdoor that allows the attackers to gain greater access to the compromised software especially if other access points are discovered or patched. The third goal is to initiate the primary mission of the attackers which may be to steal sensitive information, monitor communications or