Social Engineering Training

Training Goals Increase Laboratory Awareness. Provide the tools required to identify, avoid and report advanced Social Engineering attempts. Spot sophisticated phishing attempts. Avoid phone-based information elicitation. Detect “baiting” attacks via USB keys, CDs, and other physical media.

Why Social Engineering Training? DOE Red Team Tests The Red Team used Social Engineering tactics to attempt to infiltrate the laboratories in Spring They were successful in gaining access and maneuvering without detection at two DOE laboratories and one Site Office. Increased use and sophistication of Social Engineering tactics.

Overview Definition Attacker Motivation Techniques Tests Summary

Definition What is social engineering? Art of manipulating people into performing actions or divulging confidential information. Using trickery to gather information or computer system access. In most cases the attacker never comes face-to- face with the victim.

What motivates social engineers? Obtaining personal information. Gaining unauthorized access. Circumventing established procedures. Because they can.

Pretexting Invented scenario Can use any communication medium. Phone Calls Physical media General Prevention Think about motivation – how could this be used maliciously? Be polite (it could be legitimate). Record available contact information. Ask a question for which the answer is not publicly available.

Tools Used in Pretexting Any publicly available information Postings on public web pages. Phone book information. Professional information. Personal and professional relationships Association with ISU. Association with DOE. Conferences and collaborations in field of expertise.

Specific Techniques Phone Cold Calls / Scams Phishing 1 Trojan Horse 1 Physical Media Baiting 1,2 1 The DOE Red Team used these techniques in their latest successful attacks on two DOE laboratories and one site office. 2 The DOE Red Team was successful using these methods to infiltrate DOE laboratories in the past.

Phone Scams Unexpected / Unsolicited Phone Calls Attempt to elicit personal or organizational information.. Example Pretexts Offer to perform a service. Ask for information about organization (i.e. reporters, prospective students). Claim to be calling for a friend or family members that need access to something. Prevention Be polite. Ask for a number to call *them* back; may allow tracing later. Ask a question for which the answer is not publicly available.

Unsolicited / Unexpected - entice user to: Click on a link to a fraudulent web page. View or execute an attachment. Reply to message. Example Pretexts Standard Viagra, off-shore lottery, etc…spam. Notice from DOE, ISU or other requiring a quick response and personal information. Unsolicited CVs, proposals, professional requests.

– Trojan Horse Malicious software delivered via Attachment Web link Pretext Cool screen saver. Important anti-virus or system upgrade. Latest gossip about a celebrity.

- Prevention Verify Web Links Known Site. URL and text match. Copy and paste rather than click. Verify sender prior to opening attachments or clicking on web links. Contact through different medium (i.e. call sender). Verify via an associate of sender, if known. Examine headers Forward suspect to

Example - Links

Example - Headers

Example - Attachments

What you see: What you don’t see: Attacker’s Server

Physical Media - Baiting Deliver malware via infected CD ROM or USB flash drive. Pretexts “Lost” in a location sure to be found (bathroom, elevator, sidewalk, parking lot). Delivered with a legitimate looking curiosity-piquing label and simply waits for the victim to use the device.

Physical Media - Prevention Verify unexpected mailings with sender. Never put anything into your computer if you don’t know where it’s been. Bring found USB keys, CD-ROMs, or other digital media to IS for examination.

Quick Tests Name 3 clues in this that should make you suspicious

Quick Tests – Solution

Quick Tests Which of these s is legitimate? Which is fake?

Quick Tests The left is a Red Team attack. The right is from DOE.

Quick Tests Can you think of ways the information on Ames Laboratory’s public web page could be exploited to execute a social engineering attack? Can you think of an unsolicited , phone call, or physical mail attack which would be impossible to verify or handle safely?

When to report Social Engineering What to report Spam s with local information. Unusual DOE/Ames Laboratory s. Unsolicited phone calls digging for information/contacts. What not to report General spam.

How to report Social Engineering If Social Engineering techniques are attempted while at work… If you believe you might have revealed sensitive information about the Ames Laboratory… Report it to the IS office at: Phone: This will alert us to any suspicious or unusual activity.

Summary Be suspicious. Think about motivation when revealing information. Verify identity. Be careful what you click on. No one will catch everything – Be willing to ask for help.

Thanks for Attending