- Social Engineering
- The art of manipulating a person or group into providing information or a service they would otherwise not have given
- Research (dumpster dive, visit websites, tour the company, etc.)
- Select the victim (identify frustrated employee or other target)
- Develop a relationship
- Exploit the relationship (collect sensitive information)
- Human nature (trusting others)
- Ignorance of social engineering efforts
- Fear (of consequences of not providing the information)
- Greed (promised gain for providing requested information)
- A sense of moral obligation
- Always be pleasant because it gets more information
- Pretending to be someone you're not
- Can be anything from a help desk person up to an authoritative figure (FBI agent)
- Posing as a tech support professional can really quickly gain trust with a person
- Vishing Voice or VoIP phishing: an impersonation technique in which attacker uses Voice over IP (VoIP) technology to trick individuals into revealing their personal information
- Listening in on conversations about sensitive information
- Looking over someone's shoulder to get info
- Can be done long distance with binoculars, etc.
- Looking for sensitive information in the trash
- Shredded papers can sometimes indicate sensitive info
- Passive activity
- Getting someone to call you and give information
- Often happening with tech support, eg: an email is sent to user stating they need them to call back due to technical issue
- Involved techniques: Sabotage, Marketing, and Support
- Attacker pretends that badge is lost and attacker asks someone to hold/open the door, with consent of the authorized person
- Attacker has a fake badge and walks in behind someone who has a valid one, without consent of the authorized person
- Extracting secrets from people by use of torture or coercion
- Can begin with sites like Facebook where information about a person is available
- Hoax letters: warns the recipients of a non-existent computer virus threat
- Chain letters: offers free gifts
- Instant Chat Messenger: chats via instant chat messages to gather personal information
- Spam Emails
- Crafting an email that appears legitimate but contains links to fake websites or to download malicious content
- Ways to Avoid Phishing
- Beware unknown, unexpected or suspicious originators
- Beware of who the email is addressed to
- Verify phone numbers
- Beware bad spelling or grammar
- Always check links
- Targeting a person or a group with a phishing attack
- Can be more useful because attack can be targeted
- Going after CEOs or other C-level executives
- Use of malicious code that redirects a user's traffic
- 2 ways to perform:
- DNS Cache Poisoning
- Host File Modification
- Using IM as a tool to spread spam
- Pretending to be an anti-virus but is a malicious tool
- Very prevalent attack
- Bouncing e-mail from internal to external mails servers continuously
- Ensuring that no one knows they sent the spam out to thousands of users at a time
- The victim is of a particular group (organization, industry, or region)
- Attacker guesses or observes which websites the group often uses and infects one or more of them with malware. Eventually, some member of the targeted group becomes infected
- Looking for specific information may only attack users coming from a specific IP address
- Attacker leaves malware-infected floppy disks, CD-ROMs, or USB flash drives in locations people will find them, give them legitimate and curiosity-piquing labels, and waits for victims
- Publishing malicious apps
- Repackaging legitimate apps
- Fake security applications
- SMiShing: SMS Phishing
- Privileged Users: most trusted employees of the company
- Disgruntled Employees: unhappy employees or contract workers
- Terminated Employees
- Accident-Prone Employees: accidentally losing device or sending email to incorrect recipients... which leads to unintentional data disclosure
- Third Parties
- Undertrained Staff: trusted employee becomes an unintentional insider due to lack of cybersecurity training
- Malicious insider: disgruntled or terminated employees who steal data or destroy company networks intentionally by injecting malware to corporate network
- Negligent Insider: uneducated on potential security threats, more vulnerable to social engineering attacks
- Professional Insider: most harmful insider, using technical knowledge to identify weakness and vulnerability of company's network and sell confidential information
- Compromised Insider: outsider compromises insider having access to critical assets of an organization