Social Engineering: The Human Element How Does Social Engineering Work and to What Purpose? Chuck McGann

Objective: A discussion on types of “social engineering” and how it can be both damaging to your business and to home environments. [We may touch on the dangers of Social Media if there is time.]

Defining "Social Engineering"  Social Engineering is defined as the process of deceiving people into giving away access or confidential information by establishing a contrived relationship of trust.  Wikipedia defines it as: "is the act of manipulating people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim." [1] [1]

Defining "Social Media"  Social media is the collective of online communications channels dedicated to community-based input, interaction, content-sharing and collaboration. Websites and applications dedicated to forums, microblogging, social networking, social bookmarking, social curation, and wikis are among the different types of social mediaforums,microbloggingsocial networkingsocial bookmarkingsocial curationwiki

Quick Video  Placeholder for the below video  hsCtaTracking=70edc2a8-64cf-47f8-9f d17e4660%7Cd07bcdc2-0e2c bc3d1e11d hsCtaTracking=70edc2a8-64cf-47f8-9f d17e4660%7Cd07bcdc2-0e2c bc3d1e11d

The Human Element of Trust  Trust is integral to the idea of social influence: it is easier to influence or persuade someone who is trusting. The notion of trust is increasingly adopted to predict acceptance of behaviors by others, institutions (e.g. government agencies) and objects such as machines…

Audience/Targets/Victims  Employees  Customers  Competitors  Hackers  Family  Friends

Targeted Organizations 9

By Industry 10

Real World Example  Fall of 2012, USPS was targeted by an external social engineering attack  Over 150 USPS users opened the phishing  80 recipients provided their User ID and Passwords  CIRT issued a requirement to reset all WebVPN user account passwords  Lost work hours

Research by Check Point Software Technologies  850 IT and Security professionals in North America, Australia, and New Zealand were surveyed  48% of large businesses have suffered from socially engineered attacks at least 25 times  Resulting in losses of between $25,000 and $100,00 per incident

Social Engineering  Types of Attacks  Phishing – Spear/Whale  Impersonation of Help Desk Agent  Fake software  Trojans  Watering Hole  Drive by download

Phishing  Use of deceptive mass ing  Can target specific entities (“Spear phishing and Whale phishing”)  Prevention:  Honeypot addresses  Education  Awareness of network and website changes  Awareness of links and format of actual address  Note -

Phishing Example  Forwarded message  From: Express Mail Service Sent: Friday, April 26, :13 AM Subject: Shipping Info   Delivery information, Your parcel can not be delivered by courier service. Status:Postal code is not specified. LOCATION OF YOUR ITEM:St.Louis STATUS OF YOUR ITEM: not delivered SERVICE: Local Pickup NUMBER OF YOUR PARCEL:U NU INSURANCE: No Print a label and show it at your post office. An additional information If the parcel is not received within 30 working days our company will have the right to claim compensation from you for it is keeping in the amount of $6.10 for each day of keeping of it. You can find the information about the procedure and conditions of parcels keeping in the nearest office. Thank you for attention. DHL Customer.

Impersonation on Help Desk Calls  Calling the Help Desk pretending to be someone else  Usually an employee or someone with authority with a need-to-know  Prevention:  Assign pins for calling the Help Desk  Don’t do anything on someone’s order  Stick to the scope of the Help Desk

Fake Software  Fake login screens  The user is aware of the software but thinks it’s trustworthy  Prevention:  Have a system for making real login screens obvious (personalized key, image, or phrase)  Education  Antivirus (will not be able to detect zero day exploits – new virus signatures)

Trojans  Appears to be useful and legitimate software before running  Performs malicious actions in the background  Does not require interaction after being run  Prevention:  Don‘t run programs on someone else’s computer  Only open attachments you’re expecting  Use an up-to-date antivirus program

Security Awareness Testing  Method, Tools, and Approach   will contain an URL which would be redirected to a data collection and metrics web site  Data Collection and Metrics Web Site  Redirect user to a webpage which will contain information for security awareness

What Can You Do?  Keep software and antivirus current  Strong security awareness program  Use “least privilege” for users  Periodic technology assessments  Assign the responsibility to someone

Places for Help  SANS – Securing the Human   Multi-State Information Sharing and Analysis Center (MSISAC)   Dept. of Health and Human Services (HHS.Gov)  ning.html ning.html  Stop Think Connect 

Weakest Link? No matter how strong your:  Firewalls  Intrusion Detection Systems  Cryptography  Anti-virus software "At the end of the day, people are a critical part of the security process as they can be misled by criminals and make mistakes that lead to malware infections or unintentional data loss“ – Oded Gonda (VP of Check Point) "The weakest link in the security chain is the human element" -Kevin Mitnick

Questions

Reference  (2013, September 11). Trust (Social Sciences). Retrieved: September 13, 2013, from   Schwartz, Mathew J. (2011, September 21). Social Engineering Attacks Cost Companies. Retrieved: September 13, 2013, from companie/ companie/