Social Engineering

1. Social Engineering Grifting in the 21st century U of I Experiment Power Grid Security Spring 2003

2. Definitions • Webster—management of human beings in accordance with their place and function in society—applied social science. • Wetware—Human beings (programmers, operators, administrators) attached to a computer system, as opposed to the system’s hardware or software (also liveware & meatware) • Social Engineering—cracking techniques that rely on waknesses in wetware rather than software

3. Social Engineering--UW • Our Definition—Manipulation of human beings to obtain information or confidence pertaining to the security of networked computer systems (with malicious intent)

4. Social Engineering Cycle • Research (Dumpster diving , et. al.) • Developing rapport and trust • Exploiting trust • Use the information Source: Mitnick, 2002

5. Social Engineering Major Tools • Appeal to vanity • Appeal to authority • Eavesdropping • Prey on natural helpfulness • Manipulate lack of awareness of value of info

6. Social Engineering Methods • Posing as fellow employee • Posing as employee of vendor • Posing as an authority figure • Posing as a new employee requesting help • Posing as a vendor offering patch, etc. • Offering help if a problem occurs • Sending free software or patch to install • Sending a virus/Trojan horse • Using false pop-up window asking for log-in • Capturing victim keystrokes • Leaving floppy sitting around with malicious code • Using insider lingo to gain trust • Offering a prize for registering web site with username and password • Dropping document or file at company mail room for in-house delivery • Modifying fax machine heading to appear to come from normal location • Asking receptionist to receive then forward a fax • Asking for a file to be transferred to an apparently internal location • Getting voice mailbox set up for callbacks, making attacker seem internal • Pretending to be from remote office and asking for email access locally Source: Mitnick, 2002

7. Warning Signs of an Attack • Refusal to give callback number • Out-of-ordinary request • Claim of authority • Stresses urgency • Threatens negative consequences of noncompliance • Shows discomfort when questioned • Name dropping • Compliments or flattery • Flirting Source: Mitnick, 2002

8. Common Targets of Attacks • Unaware of info value—receptionist • Special privileges—help desk tech support • Manufacturer/vendor—vendors • Specific departments—accounting, HR Source: Mitnick, 2002

9. Factors Making Companies Vulnerable • Large number of employees • Multiple facilities • Info on employee whereabouts left invoice mail messages • Phone extension info made available • Lack of security training • Lack of data classification system • No incident reporting/response plan Source: Mitnick, 2002

10. Examples: • Passwords displayed on hardware • Internal company info/memos • User’s passwords/account info • Theft of service (Mitnick) • Theft of intellectual property • Footprinting/casing prior to e-attack

11. Why do we care? • Humans are potentially the least secure link in any secure system • “You are the weakest link…Goodbye!”

12. Experiment U of I • War-driving • Revealed many wireless networks in use in industry, manufacturing, commerce and education (not to mention residential) • Most did not take minimal security measures • Why are industries relying on wireless? • Don’t know the risk • Incompetent, apathetic, irresponsible

13. Experiment U of I (cont’d.) • Sent 10 letters to industry/commerce • Identified wireless enabled • Warned about risks • Sent info obtained about network • MAC addresses • Access Point brand & name • WEP status • Offered to help evaluate risks

14. Results 1 • FSI (First Step Internet) • Authentication scheme • Access point names and locations • Security practices • IDS/mitigation • Wireless backbone locations/type/frequency • Future security plans • Client security • End user agreements

15. Results 2 • St. Joseph’s Regional Medical Center • Well informed • Cautious/paranoid/untrusting • Unwilling to divulge any info about their network • Educated about social engineering and would not answer direct questions • Thorough risk assessment determined the liability was smaller than the risk

16. Recent Survey--UK • InfoSecurity Europe 2003 Survey of Office workers at London’s Waterloo Station • 75% gave password immediately • 15% further revealed their password after some simple social engineering tricks • 2/3 have given password to colleagues • 2/3 use the same password for everything

17. Lessons Learned • People can be trained to avoid/prevent social engineering (St. Joe’s) • It only takes one person to divulge insider info (knowingly or unknowingly) for a security breach • Social engineering is still the easiest method of obtaining insider info.