Social Engineering Charniece Craven COSC 316

Outline What is social engineering? Common goals of social engineers Techniques What to do if you have become a victim of social engineering How to avoid being socially engineered

Social Engineering The psychological manipulation of “bugs in the human hardware”. False motive; individual lies to gain unauthorized data Attacks that take advantage of flawed human judgment by convincing the victim to take actions that are counter to security policies. Although technology can provide many protections, it is very hard to protect against human misjudgment Manipulates the victims trust to make breaking in their system easier

Goals of social engineers 3 common goals that many social engineers want to achieve are: Gathering information to guess the password(s) of the victim Identity theft- the thief impersonates the victim sufficiently well to engage in large financial transactions (i.e. taking out large loans or making expensive purchases in the name of the victim) Credit card number theft- the thief learns the credit card number, card owner’s name, expiration date, and three-digit card verification number in order to make purchases until the stolen card is invalidated

Techniques The various social engineering techniques are based on specific attributes of cognitive biases and are exploit in various combinations. The most common forms of social engineering are: Pretexting Phishing Spear phishing Baiting Tailgating Spam Hoaxes Shoulder surfing Impersonation

Pretexting Usually involves some prior research of the victim and uses the information for impersonation Individual pretends to need information in order to confirm the identity of the person they are talking to in hopes of forming trust Ask a sequence of questions strategically to gain significant individual identifiers (i.e., Social Security Number, Date of Birth, Account Number, etc.)

Phishing Usually carried out by authentic looking email, instant messaging, or website Appeal broadly to many people in order to trick as many people as possible Sending an e-mail to a user falsely claiming to be an legitimate company in order to scam an individual into submitting confidential information that may be used for identity theft Looking for vulnerable users and tricking them into thinking they are getting something that they are not

Spear phishing Similar to fishing; uses an email or website to trick you Different from phishing because the email comes from someone who appears to be apart of your organization Aimed at specific individual or group of people and often contains personal details in order to appear more believable Contains specific details that only a trusted person is likely to know

Baiting Similar to a real-world Trojan Horse; virus is disguised to be legitimate data Uses physical media and relies on the curiosity or greed of the victim the social engineer leaves a legitimate looking CD or flash drive infected with malware in hopes that the person uses the device

Tailgating Also known as piggybacking When someone who is not authorized gains entry to a restricted area by following closely behind someone who is authorized People often hold the door for someone without knowing whom the individual is or asking where they are going

Spam Unwanted commercial e-mail Sending useless information and viruses out in hopes to get a response If a response is obtained useless information and viruses continue to be sent out

Hoaxes Malicious deception Deception: an act intended to trick people into believing something is real when it is not (Bing Dictionary) A knowingly fabricated misrepresentation told in order to hide the truth Try to persuade the victim to damage their own system

Shoulder Surfing Direct observation technique Looking over someone's shoulder to get sensitive information Very effective in crowded places

Impersonation Can occur in person, over the phone or on-line Pretending to be someone that you are likely to trust Manipulates our natural thoughts to trust that people are who they say they are

What to do if you’ve been socially engineered Report it to the appropriate personnel within the organization (i.e. network administrators) Constantly check for suspicious or unusual activity (i.e. unexplainable charges to an account) Change all password and usernames if possible Close any accounts that may have been compromised.

Avoiding Social Engineering Attacks Do not disclose personal information Be suspicious of unsolicited phone calls, visits, emails, etc. Pay attention to the URL of websites NEVER share your password

Resources http://en.wikipedia.org/wiki/Social_engineering_(security)#Pretexting http://searchcio.techtarget.com/definition/pretexting http://pentestmag.com/social-engineering-what-it-is-and-how-you-can-avoid-it/ http://www.webopedia.com/TERM/P/phishing.html http://searchsecurity.techtarget.com/definition/spear-phishing