1. Social Engineering Grifting in the 21 st century U of I Experiment Power Grid Security Spring 2003

2. Definitions  Webster— management of human beings in accordance with their place and function in society—applied social science.  Wetware— Human beings (programmers, operators, administrators) attached to a computer system, as opposed to the system’s hardware or software (also liveware & meatware)  Social Engineering— cracking techniques that rely on waknesses in wetware rather than software

3. Social Engineering--UW  Our Definition— Manipulation of human beings to obtain information or confidence pertaining to the security of networked computer systems (with malicious intent)

4. Social Engineering Cycle  Research (Dumpster diving, et. al.)  Developing rapport and trust  Exploiting trust  Use the information Source: Mitnick, 2002

5. Social Engineering Major Tools  Appeal to vanity  Appeal to authority  Eavesdropping  Prey on natural helpfulness  Manipulate lack of awareness of value of info

6. Social Engineering Methods  Posing as fellow employee  Posing as employee of vendor  Posing as an authority figure  Posing as a new employee requesting help  Posing as a vendor offering patch, etc.  Offering help if a problem occurs  Sending free software or patch to install  Sending a virus/Trojan horse  Using false pop-up window asking for log-in  Capturing victim keystrokes  Leaving floppy sitting around with malicious code  Using insider lingo to gain trust  Offering a prize for registering web site with username and password  Dropping document or file at company mail room for in-house delivery  Modifying fax machine heading to appear to come from normal location  Asking receptionist to receive then forward a fax  Asking for a file to be transferred to an apparently internal location  Getting voice mailbox set up for callbacks, making attacker seem internal  Pretending to be from remote office and asking for email access locally Source: Mitnick, 2002

7. Warning Signs of an Attack  Refusal to give callback number  Out-of-ordinary request  Claim of authority  Stresses urgency  Threatens negative consequences of noncompliance  Shows discomfort when questioned  Name dropping  Compliments or flattery  Flirting Source: Mitnick, 2002

8. Common Targets of Attacks  Unaware of info value—receptionist  Special privileges—help desk tech support  Manufacturer/vendor—vendors  Specific departments—accounting, HR Source: Mitnick, 2002

9. Factors Making Companies Vulnerable  Large number of employees  Multiple facilities  Info on employee whereabouts left invoice mail messages  Phone extension info made available  Lack of security training  Lack of data classification system  No incident reporting/response plan Source: Mitnick, 2002

10. Examples:  Passwords displayed on hardware  Internal company info/memos  User’s passwords/account info  Theft of service (Mitnick)  Theft of intellectual property  Footprinting/casing prior to e-attack

11. Why do we care?  Humans are potentially the least secure link in any secure system  “You are the weakest link…Goodbye!”

12. Experiment U of I  War-driving Revealed many wireless networks in use in industry, manufacturing, commerce and education (not to mention residential) Most did not take minimal security measures  Why are industries relying on wireless? Don’t know the risk Incompetent, apathetic, irresponsible

13. Experiment U of I (cont’d.)  Sent 10 letters to industry/commerce  Identified wireless enabled Warned about risks Sent info obtained about network MAC addresses Access Point brand & name WEP status  Offered to help evaluate risks

14. Results 1  FSI (First Step Internet) Authentication scheme Access point names and locations Security practices IDS/mitigation Wireless backbone locations/type/frequency Future security plans Client security End user agreements

15. Results 2  St. Joseph’s Regional Medical Center Well informed Cautious/paranoid/untrusting Unwilling to divulge any info about their network Educated about social engineering and would not answer direct questions Thorough risk assessment determined the liability was smaller than the risk

16. Recent Survey--UK  InfoSecurity Europe 2003 Survey of Office workers at London’s Waterloo Station 75% gave password immediately 15% further revealed their password after some simple social engineering tricks 2/3 have given password to colleagues 2/3 use the same password for everything

17. Lessons Learned  People can be trained to avoid/prevent social engineering (St. Joe’s)  It only takes one person to divulge insider info (knowingly or unknowingly) for a security breach  Social engineering is still the easiest method of obtaining insider info.