Chapter 1. Social engineering
The ultimate low tech hacking threat
Information in this chapter
• How Easy Is It?
• The Mind of a Social Engineer
• The Mind of a Victim
• Tools of the Social Engineering Trade
• One of My Favorite Tools of the Trade
• Social Engineering Would Never Work against Our Company
• What Was I Able to Social Engineer out of Mary?
• The Final Sting—Two Weeks Later—Friday Afternoon
• Why Did This Scam Work?
• Let's Look at a Few More Social Engineering Tools
• Let's Look at That Telephone Butt-in Set on My Tool Belt
• Meet Mr. Phil Drake
• Meet Mr. Paul Henry
• Do You Have a Guest User of Your Credit Card?
• A Few Possible Countermeasures
Social engineering is not a new phenomenon. Yet, it is still one of the most effective outsider-insider threats to any security plan. Despite valiant attempts by corporations to manage risk by not becoming victims of social engineering attacks, it is often far too easy for hackers to use the art of the con to gain access to intellectual property and to the buildings housing that property. This chapter explores the phenomenon of social engineering and explains why it is the ultimate low tech hacking threat. The chapter begins by explaining what social engineering is and how easy it is to pull off. Next, it digs into the minds of a social engineering attacker and a victim of an attack, and covers some of the more popular tools of the trade. The chapter also includes interviews with specialists in technical security issues, and closes with a few countermeasures associated with social engineering.
Key Words: Black hat hacker, Butt-set kit, Caller ID spoofing, KeyGhost, Keystroke logger, Social engineering, Sound amplifier
Some of the things I will discuss in this chapter have been on my mind since the mid-1980s. I believe it's time that I put them in writing and share a few of my thoughts on what I believe could be the most effective and dangerous threat to any security plan: social engineering! It has, in my opinion, become the low tech hacker's most valuable and effective tool. This age-old threat has taken on a new meaning as what I collectively call “bad guys” have continued to use the art of the con to gain access to intellectual property and if necessary the buildings that house that property.
This chapter, or the rest of the book for that matter, isn't meant to be read as a complete story from beginning to end. Social engineering and ways to prevent it are subjects with many meanings. This will be more of a potpourri of tips, tricks, vulnerabilities, and lessons learned from my thirty plus years of dealing with these issues. As an inside penetration team leader, I was constantly looking for more innovative ways to conduct a successful inside penetration test. It was during those years of physical and technical penetration testing that I gained most of my social engineering experience. These skills helped me to eventually hang up my dumpster diving penetration team jersey and retire from the tiger team (a term sometimes used for penetration testing) world UNDETECTED! Although I came close several times, I was never stopped or reported to security as a possible burglar or corporate espionage agent, even though that's what I effectively was.
As you read this chapter, if you think that it has a strong risk management flavor, that was intentional. Just about every area of concern with security today involves managing the risks associated with staying safe and secure. This chapter, and most of the other chapters in this book are chock full of what I like to call techno tidbits of useful risk management countermeasures. Hopefully, many of them will be topics that you might not have considered in the past as you put together your security plan. External, internal, and information systems auditors will find information on a few new potential vulnerabilities that they can recommend countermeasures for.
I've included discussions about social engineering in each of my former books. I've also used the term social engineering as a partial title for many of my presentations over the past 15 years. My most popular presentation to date is titled “Social engineering: Here's how I broke into their buildings.” Following these presentations, I frequently have people come up and talk to me about some of the things that I discussed. Many of these people are longtime friends and attend pretty much every session that I give at the yearly events where I present. What has been encouraging to me this past year is the number of people who come to me after the presentation saying that they incorporated some of what they learned and that they are now conducting some of their own corporate penetration tests to help protect their companies from the threat of social engineering. Each of them seemed to have experienced the same things that I have over the years of using social engineering as a training tool and somewhat of a hobby. They find that it is often way too easy to get people to give them access to places where they are not supposed to be able to easily access and to things that they should not see.
How easy is it?
Way back in 1988, I was a part of an internal security team for a large corporation. On several occasions, I had the opportunity to hear some of the conversations that went on when a “black hat” (in this case malicious) group targeted victims by calling them on the phone. They were using social engineering skills to gain access to proprietary information including passwords. I'll never forget what I heard one of the experienced black hats say to another black hat in training: “Social engineering is the easiest way to break into a system.” He then followed up that comment by saying, “The stupidity of the average system administrator amazes me.”
That was almost 25 years ago, and that was the first time I had heard the words social engineering. Why do I think of it as a tool that could be used by any bad guy from a black hat hacker to a terrorist? Social engineering is what I believe could be the most effective and dangerous outsider–insider threat to any security plan.
In the first three chapters of this book, I will be talking about social engineering, physical security, and a little bit more about locks. If we look at physical security as the target of an attack and locks as the gatekeeper for the entrance into the target, social engineering is often the way that we are able to gain access to the keys that open those locks and possibly the rest of the building. It is often the people who have those keys who become the victims of social engineering. We'll take a much closer look at that as we progress through the book.
The mind of a social engineer
Although I've been using and teaching social engineering for almost two decades now, the true extent of the impact of social engineering really became clear to me about 9 years ago. When I was out in L.A. for a meeting on financial crimes security (what else?), I purchased a very interesting book titled The Art of Deception: Controlling the Human Element of Security by Kevin D. Mitnick and William L. Simon.
Just above the title on the cover of the book in red letters are the words Controlling the Human Element of Security. I found the book to be very well written and full of a lot of good examples of how social engineering works and how companies can try to defend against its use. I also learned quite a bit about a few approaches to targeting a potential victim than I had ever thought of before. A social engineer will continuously learn more clever ways to take advantage of how our minds work in order to perform the illusion or deception. The more that I used social engineering as one of my tools during my penetration testing days, the bolder I became in its use during those tests. After years of success in pretending to be something or someone that I wasn't, I just KNEW that whatever I said to the people that I encountered during the tests would be believed, and it was!
The mind of a victim
Any one of us, at any time, could easily become the victim of some form of social engineering. I personally believe that it is not possible to completely eliminate the risk. There are some things that can and should be done to reduce the risk as much as possible and I'll address some of them in the rest of this chapter. Without some form of training (and practice) in learning how to prevent being a victim of social engineering, you could easily become a victim and not even know it.
Our minds work in very trusting and predictable ways, and that means that exaggerated deviations from the norm might not ever be considered. This is what social engineers count on. Without awareness of the problem and without an understanding of how our minds can be fooled, there is little defense against social engineering. For this awareness training to be of any benefit for an organization, it must include every employee of every organization.
We see things all day long and we don't pay close attention to certain details because they are too familiar to us. That's exactly how the illusions that magicians call magic work and also why so many magic tricks are related to simple everyday things like a deck of cards. I use magic in much of my training and it really adds a lot to the attention span of the people in front of me. They are all so used to seeing those 52 cards that they don't even begin to think about how the different card gimmicks being used in most card tricks work. Most of these illusions are self-working yet almost mind boggling to the unsuspecting mind.
Tools of the social engineering trade
If you would join me in taking a look at Figure 1.1, you will see a picture of the social engineering bag that I used for roughly 10 years. It was a pretty expensive bag to purchase. I spent around $200 for it, but it was money well spent. I often thought of it as something similar to those clown cars that you see in the circus. It is very deceptive how much will fit in that bag. Not only could I put all of my social engineering tools in the bag, but also there was a lot of room left over for the things I was able to take out of the buildings once my penetration test was successful. On the outside it simply looks like a briefcase that pretty much anyone within that organization would be carrying to and from work. On the inside were some slightly different items from what you would normally see someone bringing to work.
I took the time to put the contents of the bag on the table for you to see in Figure 1.2. This is the first time that I've ever done that. Not that what I have in the bag is anything special; it's just that I've never shared the contents with anyone in quite this way, especially in a book.
I wish that I had taken a picture of the bag as I was leaving some of these buildings with everything in it. It even amazed me how much that bag could expand and still look comparatively normal. Some of these things are tools that I have had for more than 40 years. Each has its own purpose and I'll explain some of that as we progress through the book. I know what you're thinking. There's no way that he has a pair of bolt cutters in that bag. Well, they were in there, and I had them with me everywhere I went. On most of our penetration tests the only limitation that was imposed on us by the company hiring us was that we were not allowed to use forced entry. We never used the bolt cutters as a part of our attack, but we did show how easy it would be to bring bolt cutters into the building if someone intended to use them. Most of the items you see were designed to get past various locks we encountered as our team attempted to get into a client's building or to use after we were in there. All right, here's a little quiz just to see if anyone is actually reading this. Anyone who sends me an e-mail listing all of the items that are shown in that picture will be sent a special gift. We will be revisiting some of these tools in Chapter 3.
One of my favorite tools of the trade
Most of my social engineering tools come from yard sales, thrift stores, flea markets, pawn shops, and eBay. I highly encourage all of you to take up the hobby of going out to these places and looking for things. As I describe some of these tools, I'll tell you how much I paid for them and where I got them. These are all tools that I used in one way or another for my social engineering exploits. Figure 1.3 is a picture of the front cover of the manual for a key machine that I purchased a number of years ago at a yard sale for $10.00. What was so nice about this key machine was that it was very small and very accurate, and it had a code micrometer as a part of the machine. This will allow keys to be cut by code if you know the code for that key or the depth of the bitings (sometimes called cuts by senior locksmiths). Machines of this size are available new for around $395. I frequently see them for sale on the Internet for anywhere between $95 and $250. If I could borrow a master key for a few minutes and had some of the key blanks that fit the keyway of a given lock, I could duplicate the key (as described in Chapter 3) and get it back to the person that I borrowed it from (typically using a little social engineering) very quickly. I know what you are thinking. How did I know what the correct key blank was for that lock? I knew because I was in that building once before and also managed to borrow the key briefly during my first visit. I learned over the years that social engineering attacks work best (at least they did for me) when they were two-part attacks. During the first visit our team mostly probed the target just to see how trusted we would be if we were able to gain entry. Normally we were never questioned about anything once we were inside. It was just assumed that if we were in the building, we belonged there. That was not a good assumption.
 |
| Figure 1.3 |
It's time for my first war story. After you read the following description of this social engineering attack, ask yourself if you think you would have fallen for this. This is a perfect example of how a two-part attack can seem so innocent yet be so deadly.
Social engineering would never work against our company
That's what a close friend of mine said one afternoon when we were talking about overall security and the threat of social engineering. This was 14 years ago, but social engineering was already a hot topic that most people were at least a little bit aware of. “We have good security and our employees wouldn't fall for anyone calling on the phone trying to get information from them,” he said. I said, “Give me 90 days so that you won't know when I'm going to call, and I'll test your theory about your employees' awareness of this problem.”
I made the call a few weeks later. “Good afternoon,” a friendly voice answered. “Medical Group, this is Mary, can I help you?” I immediately put on my doctor hat, “Yes, this is Doctor Wiles,” I began. (It's fun saying that even if it is totally fake). “I'm calling to ask a favor,” I continued. “We have a practice similar to yours in Richmond and we're considering purchasing a new medical billing system. Do you use a fully automated system for your accounting, and if so, do you like it?” My friendly voice and simple question didn't raise any suspicion on her part. It was a simple and apparently innocent question.
“Yes we do,” she said. “It's called Doctors Database and I believe that they are located in Denver, Colorado.”
So far, so good. She seemed willing to talk a little more, so I started asking a few more questions. “Do they offer support when you have problems? We've heard some nightmares from friends who purchased medical billing systems and couldn't get support once they paid for it.”
“Yes, we've been very happy with their support,” she answered.
I asked a couple more quick questions. “How about upgrades and things that need to be fixed? Do they have someone locally they send to work on the billing system?”
“No, they do everything over a modem attached to the system. We've never had a problem with their needing to be here,” she said.
I needed a bit more information, so I pressed on. “Before we make such a big decision, I'd like to speak with someone from Doctors Database to be sure that this would be the right billing system for us. Could you give me the name and number of the tech support person that you work with when you call them for support? I always feel more comfortable after I've had a chance to speak with the people that our administrator will be working with when problems develop. Some of those technical people are very hard to understand.”
She apparently had a good working relationship with Doctors Database because she seemed happy to give me a name. “Yes, we work with Jerry Johnson and he's really easy to talk to. He should be in the office this afternoon if you call before 6 PM east coast time. Their phone number is XXX-555-1234 and they have someone available for support by phone 24 hours a day.”
Little did she know that I now had almost everything I needed. Just one more question, and I could politely say thanks and goodbye. “I really appreciate your taking the time to help me with this, Mary. Would you mind if someone from my office called your database administrator if our administrator has any user questions after we get the new billing system? It's always easier to ask someone who actually uses the system rather than trying to get the Doctors Database technical people to answer simple questions. I promise that we won't be a pest.”
She said that she was the administrator of the database and that she would be happy to answer a few questions for us. (It's wonderful living in the friendly sunny south.) “Thanks so much for helping me with this, Mary,” I politely said. “I'll be sure to only have our administrator call you if he really gets stuck. Have a great week and thanks again.”
What was i able to social engineer out of Mary?
This apparently innocent phone call gave me everything that I needed for my final attack. Here's what I got:
• Her name was Mary, and she was the database administrator for the medical office.
• They used a medical billing system from a company called Doctors Database that was located in Denver, Colorado.
• The tech support person that they worked with in Denver was named Jerry Johnson.
• Jerry accesses their computer over a modem to work on it.
To the casual observer, that's not a lot of dangerous information. Most of it seems to be pretty common knowledge that most people would have been willing to share. I didn't ask much about her computer, and I certainly didn't ask anything about login IDs or passwords.
The final sting—two weeks later—friday afternoon
It was 4:40 PM when the phone rang at the Medical Group. John reluctantly answered, knowing that someone calling in that late with a problem could cause him to delay some of his plans for the 3-day weekend. On the third ring, he picked up the phone, “Good afternoon, the Medical Group, John speaking, may I help you.”
I immediately assumed my best social engineering voice and started my attack. “Hello John. This is Bill Jenkins from Doctors Database in Denver. We're calling all of our customers about a serious problem with our medical billing system. It seems that our last update had a virus we were unaware of until this afternoon. It's causing all of the accounts receivable records to be corrupted. Our entire tech support team is calling our clients as quickly as possible to let them know about the problem. I know that Mary normally works with Jerry Johnson, but he is currently working with another client and has asked me to handle the fix for your system. Can I speak with Mary?”
There was a brief silence as I could feel John thinking about his 3-day weekend slipping away as we approached 5 PM. He finally answered. “With the holiday weekend coming up, Mary is off today. I act as her backup on the database work when she's off, and I'll try to help if I can.”
Things were looking up as I began to spring the trap. “John, I'm going to need to log in to your system to fix this and I don't have Jerry's information in front of me with your modem dial-in number, login ID, and password. If that's something we're going to need to get from Mary, I think that we may have a problem if she's not there.” I wanted him to feel a little of the panic that I was trying to convey.
Fortunately, it worked. I could hear him flipping through some papers as we talked. He quickly came back on the line. “I found it here in her notebook. The phone number is (555-867-5309), the login ID is doctor, and the password is also doctor.”
I then went into my good job routine to make him feel completely at ease. “John, you've been a great help, and I can take it from here. It's been taking about 4 hours to clean this up and I know that it's Friday afternoon. I don't see any need for you to hang around. I'll install the fix, and things will be back to normal when you get back on Tuesday. Thanks again for your help and enjoy the weekend.”
Why did this scam work?
I have tried to put into words (changing the names and phone numbers to protect the innocent) a two-part attack that I conducted about 14 years ago at the request of a friend. My friend knew that when the attack happened, it would be recorded on audio tape and given to her as a training aid for her to share with her employees. Without a little bit of awareness training, and a little bit of ongoing suspicion when speaking with strangers on the phone, ANYONE could fall for this kind of an attack.
Many of the hundreds (perhaps thousands) of people who have heard the audio version of this two-part attack have told me that they would have fallen for it as well. That first innocent phone call set the stage for a very believable second phone call where the keys to the kingdom were given away. A lot could have happened to that computer from Friday afternoon until Tuesday morning. Did the real Doctors Database (again, name changed—this is not their real name) know anything about this incident? Absolutely not! They would have had no idea that this was going on. Was Jerry Johnson a real person who worked tech support for Doctors Database? Absolutely, that's who Mary worked with on a regular basis. But Bill Jenkins was a figment of my imagination, carefully placed into the believable tale I had spun.
On top of the social engineering attack vector, the Medical Group's passwords were also extremely insecure. I'm not a big fan of static passwords, but that is a topic for another chapter in another book.
Let's look at a few more social engineering tools
You will probably hear me say this many times throughout this book, but I continued to be amazed at how many great social engineering tools are available at your yard sales, flea markets, pawnshops, and thrift stores. This ranges from hats (like the one in Figure 1.4), jackets with corporate logos, tool belts, tools, listening devices, briefcases (like the one in Figure 1.1), spyware, and locks that can be used quite effectively for social engineering. I think it's a great idea to spend some time looking for these kinds of tools. For one thing you learn a whole lot more about social engineering while you are out there thinking about new ways to use it. I also think it's a very good idea for any company to do their own assessment of their vulnerabilities to social engineering attacks. If the company or organization is big enough to have a security team, that team can begin the process of seeing just how vulnerable their personnel are to this threat and others.
Why is the hard hat shown in Figure 1.4 so effective? The main reason that common everyday objects like that are so effective is that we're used to seeing them, and when we do we automatically assume that the person wearing it is really who they seem to be. The real con men of the world know how to take advantage of that.
I have never worked as an installer or a phone company repairman at a telephone company. I have seen many phone company employees around town, and at my home as I have had my phones worked on, and I certainly do remember what they look like. There are many other people we see every day in our offices and homes that social engineers often imitate while using social engineering to gain access or information. Some of these are delivery people for various firms. Others are people that wear the same types of uniforms or other clothing items that allow them to look and act like they belong wherever they are.
For some excellent examples of how uniforms and clothing can be used by pen testers, check out Chapter 6 written by one of the best pen testers that I personally know, Russ Rogers. He provides several interesting and educational ways to look the part during your pen testing missions.
Figure 1.5 is a picture of me wearing a few of the tools that I picked up along the way from many of my favorite hunting grounds. I suspect that you already have many of these tools in your possession just from things that you have around the house.
In addition to the cool tool belt that I picked up for three bucks at a local flea market, there were a few other interesting finds on that tool belt:
• That telephone-looking gadget is a butt-in set worth about $250. I bought it at another flea market for $20.
• Those pliers next to the tape measure along with a nice knife for cutting cable cost $5 at a local yard sale.
• The tape measure was $2 at a thrift store.
• The scissors in my pouch are quite unique. They are capable of cutting a quarter in half (I've never actually tried that—no sense in wasting a quarter these days). $1 at a yard sale.
• The screw driver in the upper right of my tool pouch has become one of my favorites. It has 4 tips and is a very good quality for the $2 that I paid for it at a thrift store.
• The plastic ties were another $1 at a flea market.
If you're keeping track, I have about $40 in this entire social engineering outfit, and much of it is very usable around the house as well. All that I would need to do is wear a different hat, and I could be most any type of repairman or contractor. I think all of us have watched something on TV or in the movies that shows someone masquerading as someone else trying to get into a building. This is a very well-known threat, but it is still one that can be difficult to prevent. This seems to be especially true down here in the sunny South where I live. It seems that everyone is so friendly and helpful that some people really don't stop to think that the person that they are facing is someone who's trying to gain information, entry into a place where they shouldn't be allowed to go, or possibly do someone harm. Throughout the book I will mention various countermeasures. The only countermeasure for threats like social engineering is always being just a little bit more suspicious. You will hear me say that several more times as I mention more countermeasures. Believe it or not, this is something that people can be trained to do in security awareness training classes. As an absolute minimum, it is very important for every employee to have some sort of chain of command for reporting potential security threats. My decades of dealing with people regarding security and awareness have taught me that people really do care, and do want to do something to help protect their work environment.
While writing this book, I became aware of a new book that is scheduled to be published around the same time as this one. The book is titled Human Compromise: The Art of Social Engineering (ISBN: 978-1-59749-576-9, Syngress), and it was written by Mike Murr. I contacted Mike and spoke with him on the phone for about an hour asking some questions about his book. Throughout my years of using social engineering skills, I didn't really realize why they worked. I just knew that I was pretty good at it and seemed to be able to always get things that I wanted from people when conducting penetration tests. I'm absolutely convinced that it was my social engineering skills that allow me to make the statement that “I retired from penetration testing days UNDETECTED!”
The current description of Mike's book (the actual wording is subject to change as the book approaches publication) includes a hands-on approach to teaching you everything from the field-tested methods for reading body language, to the practical techniques for manipulating human perception, plus a whole lot more.
Keystroke logger: Is there one under your desk?
Some of our penetration team's favorite tools were the software and the newer hardware versions of keystroke loggers. These can make a good social engineer's job a lot easier. If we wanted to find out what a certain individual in a client's company who hired us to conduct the pen test was doing on their computer over a certain time frame, we would install a keystroke reader on their workstation on one visit and retrieve the results on a second visit.
By far, the most effective keystroke loggers that we have used are the KeyGhost hardware loggers being sold as security devices (http://www.keyghost.com). When these are installed between the keyboard of a workstation and the keyboard socket on the back of the computer, they look like they belong there to the casual observer. The logger that we used looked like the induction coils that we used to see on some of the older parallel printer cables. It just doesn't look like anything that you need to worry about. If you didn't put it there, you'd better worry! It's logging every single keystroke that you type in.
The version that I used for several tests would hold about 500,000 characters or a half of a megabyte. That might not sound like much, but that's a lot of data when you consider that the key logger is only logging keystrokes. By the way, backspace keys would show up as ASCII characters (control H for you techies) as would any other nonprinting character that was entered as a part of a password, for example. We have left our key loggers connected to target computers for up to 3 weeks and still only filled about 80% of their capacity.
Here's something else to consider if you feel safer entering information into your web browser over a secure socket connection (https). The encryption happens between your browser and the server that is receiving your sensitive information over the Internet. That's a good thing if you're entering your credit card number or bank account access information. The keystroke logger, however, is reading your keystrokes before they get to your browser. Everything will be in the clear when someone (hopefully only you) looks at the data that your keystroke logger collected.
How do you know if you have a key logger connected to your workstation or home computer? You don't unless you physically look back in the rat's nest that lives behind most computers to see if anything looks like it doesn't belong there. Unless you have been made aware of what a keystroke logger looks like, it probably won't look strange to you even if you do see one. I pass one around for people to see at every one of my security training classes. Statistically, I've read that people are 27 times more likely to remember something if they are able to see it and hold it in their hand. I usually ask my attendees for a show of hands by anyone who hasn't ever seen one of these. Almost every time, more than half of the hands go up. How can you defend yourself against something that you don't even know exists? (Another subtle hint for more awareness training.)
Here's a quick awareness training class using one of my workstations as the target computer. Figure 1.6 shows a workstation in a minimum configuration with only a monitor, mouse, power cord, and keyboard connected to the motherboard. Take a look at that little bulge about 3 inches from the end of the cable that goes to the monitor, the one with the larger connector on the lower left-hand side of the computer. That's the only cable in Figure 1.6 that has an additional piece within the cable. That piece is an induction coil, and you may see one or more on cables found behind most workstations.
Let's take a look at this same workstation in Figure 1.7 after I have installed my keystroke reader between the keyboard and the motherboard socket where the keyboard was connected. Of the two cables in the center next to each other, the keyboard cable is the one on the right.
Now what do we see when we look back there? The keystroke reader looks like a second induction coil and would be very hard to detect if you didn't know what it looked like. I didn't try very hard to hide it, and normally, there are more wires back there than this. There is no way that the computer would know that it is there. It uses virtually no power, and doesn't require that any software be installed to make it work. When I finally remove it and take it back to check out the internal log, the target computer (or you) would never know that it was gone again.
This device can be used as an excellent security device if you suspect that someone is using your computer when you are not there. It is sold primarily for that purpose. That's a good thing as long as you know that it's there. Obviously it can be used for less than ethical purposes as well. When it becomes a threat, it can be a very, very difficult threat to detect. The only countermeasure I'm aware of is to physically check behind the computer to see if anything looks like it doesn't belong there.
Unless you are involved with a well-documented rules of engagement penetration test, be sure that you thoroughly understand the laws associated with capturing someone's keystrokes on a computer that you do not personally own. In most cases I suspect that software application versions of keystroke readers would be considered malware. There could be some tampering issues and possibly trespass issues associated with installing hardware versions of keystroke readers. Also be cautious of the many opinions that you could get with a Google query regarding the legality of using keystroke readers. There are dozens and perhaps hundreds of opinions out there about this, and most of them seemed to be just that, opinions. You need to know and understand the law regarding keystroke reading.
If you conduct your own in-house social engineering tests, I'd suggest that you use one of these key loggers just to see if anyone detects it. I suspect that they won't. For your training purposes I believe you will find the log that it generates to be quite interesting. Keep in mind that the key logger is only detecting keystrokes. It doesn't detect anything that was pointed to and clicked on with the mouse. Quite often keystrokes are what you're really after. To me this would be a good example of low tech social engineering using a fairly high tech device. Obviously the learning curve to use this device is very, very short. All that you need to do is to have a way to gain access to a target computer for a few minutes to install the device. When you come back a week later to remove the device, there will normally be no indication that you've ever been there. Maybe I'm just a little extra paranoid from years of doing this stuff, but whenever I'm out somewhere at a hotel or public location using one of their computers to check things like mail, I'll always look behind the workstation if I can. Obviously there are other concerns with network monitoring beyond just key loggers.
One of my lunchtime tools
This little problem remains high on my list of things that we should all be considering every time we go out for a meal in a public place. Many office buildings have public restaurants either in the building itself or within walking distance. Here's what I think happens all too often. We're at work discussing something important, and someone realizes that it's time for lunch. Out we go to the local fast food restaurant of choice that day. There's no reason to let lunch slow down our train-of-thought for the project that we are working on. The in-depth conversation about that new marketing scheme or great new product that we are about to announce continues as if we were still back at the office.
You would be shocked at how many of these kinds of conversations I've heard over the years in public places, things that were discussed in the open, among total strangers, that should not have left the corporate boardroom. It seems like we are all too busy to stop and think about security and controlling who has access to our proprietary information. I occasionally get a chuckle from my friends when I remind them of a time when the national security message was “loose lips sink ships.” Judging by the conversations that I have had with some of the people who were alive during that time, pretty much everybody took security seriously. Why has that changed so drastically in this high tech world just 6 decades later? We certainly don't have less at risk than they did then. If anything, we have much more at risk, especially in the world of technology. People were careful and concerned that there could be spies anywhere. Has that threat gone away? I don't think so.
There couldn't be any better example of low tech hacking than simply sitting in a crowded restaurant on a typical day, in a typical city, and listening. The technology that exists today for helping people hear things a little better didn't even exist in the “loose lips sink ships” days. These are very legitimate devices that can help anyone who has a hearing problem be able to hear MUCH better. I'm not talking about hearing aids; I'm talking about amplified listening devices that are available just about anywhere. Let's take a look at a couple of them.
This is the smallest sound amplification device that I found (Figure 1.8), and I'm sure that they come much smaller. This one is about an inch wide, 2 inches tall, and 1/ 2 inch thick. It's really compact and innocent looking. The sound amplification is amazing considering that this device only cost around $10 new (my $4 yard sale find was another good deal with this one). Figure 1.9 shows a higher end version of the same kind of device.
The listening device shown in Figure 1.9 is a little more expensive and uses a single AAA battery that is easily replaced. The quality seemed to be a little better than the smaller, less expensive model shown in Figure 1.8. The model in Figure 1.9 cost about $25. With so many people today using MP3 players and other small devices with earphones, you need to be aware that these devices might not be noticed in a crowded public or private meeting space if someone were using one of these for other than their intended use. My purpose in describing these kinds of devices is to make you aware of how available they have become at a very low cost.
Just like any other small electronic gadget, I began to see these regularly at yard sales and flea markets. I picked up a few more just to give to friends and to demonstrate while I'm out at conferences. I've not spent more than $5 for any of them that I've purchased at these yard sales and flea markets. Most were $3 or less.
They have plenty of valuable and legal uses. You just need to be aware that some people could use them for other purposes. Have a nice lunch….
Let's look at that telephone butt-in set on my tool belt
The interesting little gadget shown in Figure 1.10 has been on my want-to-find list for over 20 years. I finally found one at a local flea market where they only wanted $25 for it. Using my “I want to pay less for everything” skills, I was able to get it for a mere $20. This $250 tool has many uses in the social engineering world. One of its primary uses, which you probably saw in Figure 1.5, is to help me look like a telephone dude. Even if it were never used for anything but letting me look like a telephone dude it is an invaluable social engineering tool for making someone look like someone that they aren't.
For some of its more technical uses, I'm going to introduce you to our first expert interview. One of my long-time friends, Phil Drake, is a telecommunications expert. You may have seen some of his disaster recovery chapters in my former books. He has a tremendous amount of experience in many fields that impact the security world as well as the disaster recovery world. Let's ask him a few questions about this nifty tool.
Meet Mr. Phil Drake
I wanted to start something a little different with this book. Throughout my decades of working and living in the worlds of physical security, computer security, and disaster recovery, I have met and become friends with many true experts. The first of these that I introduce in this book is a long-time friend named Phil Drake. Many of you may recognize Phil as being a contributing author in two of our other books. In each of them I had him author a chapter that we titled Personal, Workforce, and Family Preparedness. Phil is one of the best in the world at helping people deal with those issues. I felt that these topics were so important that I wanted them included in both our first book, Techno Security's Guide to Managing Risks for IT Managers, Auditors, and Investigators (ISBN: 978-1-59749-138-9, Syngress), and our fourth book, Techno Security's Guide to Securing SCADA: A Comprehensive Handbook on Protecting the Critical Infrastructure (ISBN: 978-1-59749-282-9, Syngress).
In addition to being an expert in the fields of disaster preparedness and recovery, Phil is an expert in the field of telecommunications. It's that area of expertise that I want to ask him a few things about in this interview with the experts. Let's get on with our first interview:
Jack: Tell me a little about how a low tech hacker could use the butt-in set (Figure 1.10) that I purchased at a flea market.
Phil: My first concern about the butt-in set is not technology related at all. It's a social engineering concern as you have already mentioned. Just having the butt-in set (or butt-set) hanging on a tool belt or in your hand and wearing a hard hat make you the “telephone technician,” and in most workplaces, that makes you practically invisible. We are so dependent on telecommunications today that service technicians carrying tools and replacement equipment are as common as express delivery drivers. We are conditioned not to challenge these people especially if they are in a rush. We don't want to slow down the “repair” process and cost the company extra money or downtime.
If we see technicians working in or around telecommunications equipment outside a facility (manholes or those light green or tan boxes), we assume they belong there and if they need to check inside the building for a problem, human nature is to help out.
It's looking the part. Of course a fake ID, work clothes, and tool belt are all important to the ruse, but the butt-set is the icing on the cake. It's like a stethoscope: you would never challenge someone with a stethoscope around their neck as you assume they are legitimate medical practitioners, especially if you need one in a hurry.
Let me jump in to the middle of Phil's interview and share a quick story along the lines of what Phil was talking about regarding a phone technician. This one happened at my home on two separate occasions. We had experienced a number of severe lightning storms in our neighborhood, and the cable service for some of our homes seemed to stop working. My home was not one of the homes that was affected by this. On the first occasion that I want to share I simply looked out in my yard and saw two men standing over the service boxes where my cable and phone wires are located. (You do know where yours are located at your home, don't you?) I hadn't called anyone, and my phone service and cable service were working perfectly. Whenever I see things like this that are somewhat unexpected, my antisocial engineering mindset comes to play. My countermeasure for this potential threat was to call the phone company and ask if they had sent someone. In this case they had sent these men to look at all of the phone service in our neighborhood. It wasn't until after I knew that they were supposed to be there that I approached them to see how things were going. It's usually not a good idea to approach strangers first before knowing what they are up to. Figure 1.11 is a picture of the exact boxes that they came to inspect out in my yard.
A second similar situation had happened about a year earlier when someone came to our front door stating that he was from the local telephone company and needed to check our outside service boxes. His appearance was very similar to the picture of me with all of my social engineering gear as shown in Figure 1.5. My call to the phone company immediately following my conversation with him also revealed that he was a legitimate phone company technician. What if he hadn't been sent by the phone company? If that were the case, my next call would have been to my local police department. If he was a bad guy, he may have intended to insert a telephone listening device connected to a small tape recorder. These are readily available and I have had several of them for many years. I don't want to throw a warning into the middle of my tip, but always remember most of what the bad guys do is usually a crime. Installing a device like that with criminal intent would violate some sort of wiretap laws for sure. I like to consider these situations where someone is apparently legitimate and doing things outside your home is one of those trust-but-verify situations. It's always good to take the time to make that phone call just to be sure.
Technically speaking, the butt-set can use phone lines to make or receive calls without the legitimate subscriber's knowledge. Need to call an uncle in Korea? Find an unlocked access point (those green or tan boxes) in the neighborhood, hunt for dial tone, and make that call for absolutely free—for you. The legitimate subscriber will have a surprise when the bill comes.
These sets also have a “monitor” setting that allows someone to listen to all calls on the line with no interference whatsoever. This is probably the easiest form of low tech phone tapping.
The majority of the butt-sets found in yard sales and flea markets are older analog technology. The race is on to VoIP and the majority of telephone service to large businesses is digital, but there are still many millions of analog lines in use in business and residential locations for someone to play with.
Jack: Do you have any good social engineering stories of how people have used it to gain information about public branch exchanges (PBXs)?
Phil: There have been a number of incidents where “phone technicians” have appeared to try to gain unauthorized access at business locations. This ruse usually takes the form of “we have alarms from your phone equipment” or “we need to replace some of our equipment in your telephone equipment room.” Sometimes these “technicians” are challenged; sometimes after hours when the security team is busy, they are not.
Once these people have access to the PBX equipment room they own you. I've seen many logins and passwords written on the administration terminals in equipment rooms. After all, it's a secure area, right? If the information isn't written on the admin terminal, it's more than likely under the keyboard or in a drawer close by.
Once individuals have access to the PBX they can easily allow calls from the outside to access long distance lines for “free” long distance. More importantly, these calls made from a company's PBX are traceable back to the PBX and in many cases not to the outside phone line that originated the call. It's a perfect way for criminals to cover their tracks.
A really interesting case a number of years ago involved a supposed phone company technician showing up to replace a bad circuit pack. The individual was allowed access and shortly thereafter telephone extensions around the building stopped working. Thinking this was just part of the “repair” process, security wasn't overly concerned. An hour later a security guard was dispatched to ask when the repairs would be completed. It was then discovered that a number of expensive PBX circuit packs and related equipment had been stolen.
It took several days and thousands of dollars to put the system back together and restore service. Missed customer calls and lost employee productivity added to the loss.
Of course these individuals may not be interested in phone equipment at all. They may be trying to gain access to the facility to gather information on someone or steal money, property, or confidential information.
Jack: Do these individuals need to be on site or can they do harm from the outside?
Phil: In a recent incident, a large company with a small regional office had a very large surprise. The regional office has a small “key” phone system. This is a simple five-line system and each phone has a button for each of the five outside lines.
The surprise came in the form of an $8,000+ phone bill with long distance calls to North Korea, Yemen, and Somalia. Of course the calls were not made by the office personnel. They were made remotely with the criminals billing phone calls to the regional office with two long distance companies. (They didn't even need to use the butt-in set we were just talking about.)
After a few dozen suspicious calls, one long distance carrier called the regional office to inquire if the calls were authorized. The individual answering the call took the message but took no action; they didn't alert anyone or raise the alarm that something might be wrong.
There was no unauthorized access or system penetration, just criminals knowing what to do and that many companies are too busy to catch them. Complacency scored a win for the bad guys in this example. The company had to pay since they were alerted but took no action. Based on the known criminal activities from some of the countries involved, you can bet that the individuals making the calls weren't making vacation plans or checking the weather forecast.
In addition to having some help on the inside, as in the example above, almost all large PBX systems can be remotely administered. This remote administration can be done through a modem (yes, they are still in use) or more likely via VPN access more recently.
The modems are the problem. They are often forgotten but, if still connected, can be used. Yes, someone needs the phone number, login, and password (hopefully) but that information can be obtained with some investigation and time.
Jack: How about lists of default maintenance passwords for systems like PBX's? Are these lists which make excellent social engineering tools still readily available?
Phil: Yes, there are lists of default passwords and user names delivered with new PBX and VoIP phone systems on a number of hacker sites. Many customers never change these defaults even though every manufacturer strongly recommends an immediate change.
Jack: You mentioned IP phone systems. Are they better secured than their older PBX cousins?
Phil: Of course they are much harder to access remotely for administration and most are being located in data centers instead of an out-of-the-way room in the basement. However, security can still be circumvented by social engineering. That individual posing as a phone technician can now have access to the phone system and the highly secured corporate data center as well. In addition, I wonder how many companies actually check the equipment being carried by contractors and service technicians entering company facilities.
The use of VoIP systems is growing; however, the majority of phone systems in use today rely on technology basically unchanged over the past 20 years.
Meet Mr. Paul Henry
My second expert interview for this chapter will be with another of my long-time friends and colleagues, Mr. Paul Henry. Paul has spent decades on the cutting edge of technology with a specialty in technical security issues. When I need to know the absolute latest information available regarding security threats Paul is always the first person I call. He provides some interesting answers to my questions as shown below:
Jack: When I last met with you, you were explaining a low tech hacking way of masking the actual cell phone number that you were calling from. To me that's an excellent example of low tech social engineering using a high tech application that anyone can easily use. Can you explain that application to our readers?
Mr. Henry: There are a number of Internet-based services that provide free or low cost caller ID spoofing services. You know something is popular when a web-site dedicated to it arrives—and yes there is one now dedicated to caller ID spoofing—http://www.calleridspoofing.info/. The subject has been a hot topic in the press lately as a large media organization has been accused of hacking in to people's voice mail accounts using caller ID spoofing. Many people don't realize it but still today if someone calls your cell phone number and can cause your caller ID to be sent to the provider's server using one of the many caller ID spoofing services, they are granted unobstructed access to your voice mail. It is important to note that here in the United States a bill has been passed that makes the spoofing of caller ID illegal—the U.S. House of Representatives passed HR 1258, also known as the infamous Truth In Caller ID Act. The FCC has now adopted rules implementing the Truth In Caller ID Act—http://www.dwt.com/LearningCenter/Advisories?find=424483.
With that being said those that offer these caller ID spoofing services simply offer the services from outside the United States to literally get around the law. It is another example of how legislation can perhaps convince a good person not to do bad things but does nothing to prevent a malicious person from doing bad things.
Jack: Do you think that the bad guys such as foreign spies and possible terrorists use many low tech social engineering tools for gaining access to critical information or locations? Please explain a few that you have come across that you found particularly threatening.
Mr. Henry: The mining of data from social web sites like Facebook has become the number one tool in the arsenal of the bad guys. We place way too much work-related information on our social media pages and a simple search of Facebook or LinkedIn can reveal very useful information for a would-be bad guy. Just do a search using Google for Facebook SCADA or LinkedIn SCADA. You might be surprised by the results.
Many SCADA systems are foolishly connected to the Internet and a quick search with Google for some fairly easy-to-guess search terms could have a potential bad guy controlling a SCADA system in minutes — turning pumps on and off or turning off circuit breakers.
Jack: You are considered by many to be one of the top security minds in the world. What is your feeling about how much social engineering is being used to gain physical access to critical information? Can you give us a few examples of some of the things that you have seen?
Mr. Henry: Social engineering has played a major role in every headline-grabbing hack that we hear about today. Simply put, it has become an all too common and in most cases easy path into the very core of an otherwise protected network environment. Why take the time to directly penetrate a network's fortified gateway when you can easily bypass an organization's perimeter defense with a little social engineering trickery?
• HBGary fell prey to the social engineering skills of a 16-year-old girl. She successfully spoofed an email from a senior executive to an IT department employee in an effort drop security defenses and allow inbound connections that facilitated the hack that exposed over 60,000 HBGary and HBGary Federal emails on the public Internet, some of which contained sensitive/confidential company information.
• RSA fell prey to a socially engineered email sent to an internal employee that started the entry into their network that resulted in the compromise of the security of their Token product. RSA will be replacing an estimated 40,000,000 tokens for customers as a result of the intrusion into their network.
• The government of Iran's nuclear fuel centrifuges controlled by Seimens SCADA products fell prey to free USB sticks given away at a security conference (allegedly targeted). As expected, employees returned to work after the conference and plugged the USB sticks into PCs on the company's network and opened the door for Stuxnet to pillage their SCADA systems.
• Multiple energy companies fell prey to social engineering spear phishing attacks on mobile devices. VPN-connected workers were used to gain additional internal access that facilitated the Night Dragon malware infections in the Americas, Europe, and Asia as well as countries in the Middle East and North Africa.
• Social engineering was behind the Operation Aurora attacks in the form of phishing emails to key personnel that directed employees to websites with specially crafted malware the took advantage of a Day Zero vulnerability in Internet Explorer. Successful attacks were carried out against search giant Google and at least 20 other firms, including Adobe, Juniper Networks, Rackspace, Yahoo!, and Symantec.
• A disgruntled ex-Gucci network engineer allegedly went on an IT rampage after leaving the company and using social engineering to trick Gucci IT department employees into activating a token he had taken a month prior to leaving the company. He used it to gain remote access to the company's network where he allegedly deleted virtual servers, shut down the company's storage area network, and deleted a disk containing corporate mailboxes from an email server.
• The Rupert Murdoch News Corp Media empire is still reeling from the News of the World tabloid cell phone hacking scandal that all began with social engineering and loopholes in voice mail security (users not changing default passwords) to hack into voice mailboxes. It is far from over and has already resulted in the U.K.- based News of the World tabloid being shut down.
Jack: I always like to ask security professionals about their thoughts on an countermeasures that companies can employ to help prevent becoming a victim of social engineering. Can we get your opinion of countermeasures that you have recommended?
Mr. Henry: We have fallen in to the crowd mentality trap in network security. What I mean by that is we as a community know very well that our current defenses such as traditional antivirus, signature-based IDS/IPS, portcentric firewalls, and flaw remediation programs such as Microsoft's WSUS are easily penetrated/bypassed and rendered useless against a relatively low skilled adversary. Yet we continue to use them simply because they are what everyone else is using. After all, if that is what everyone else is doing it must be right….
Traditional AV, IDS, and IPS considerations
First we need to reset our focus. Simply put, it is misdirected today; actually it has been wrong for more than a decade. All of our efforts are at the gateway and seem to involve preventing malware from being delivered in to our environments. We will never break out of the arms race we seem to be locked in to with malicious hackers if we keep playing the game their way. Effectively playing the game their way puts the bad guys in the same position as the casinos in Vegas—the house always wins. We need a game changer and I believe that the most viable game changer is to quit worrying about the delivery mechanisms of malware and apply or focus on not allowing any untrusted code to ever, under any circumstances, execute within our environments.
It is imperative to recognize that the end game for our adversary today is not to trick an internal employee surfing the web into clicking on a specially crafted link that the user cannot resist that leads to a malware-laden website, opening a malicious email attachment with embedded malware, or causing a user to plug in a free USB stick that they picked up at a network security conference that contains targeted malware. The end game is to use these various delivery methods to cause malware to enter the enterprise environment and to execute on internal network resources such as desktops and servers. It almost seems too simple but the reality of our situation is that if we simply prevent unauthorized code that is not explicitly permitted by policy and is not known to be trusted from executing within our network environments, the seemingly unlimited delivery mechanisms available to the bad guys quickly become a non-factor. Who cares how they deliver their malicious code? If it cannot execute it simply no longer matters.
The bottom line with respect to our failed AV, IDS, and IPS solutions that today still continue to expose us to unnecessary risk is to complement them sooner than later with current generation application control/white listing solutions that will allow us to change our focus from malware delivery to the only viable defense in our current threat environment: preventing untrusted and unauthorized applications from executing in the first place.
Traditional firewall consideration
Next we must end on our misplaced trust and reliance on traditional port-centric firewalls—hackers beat us on that effort many years ago. As defenders we always play by the rules and filter applications based on the RFC mandated/recommended service ports:
• WEB TrafficTCP 80
• FTP TrafficTCP 21
• Encrypted Web TrafficTCP 443
• SSH TrafficTCP 22
• Email SMTPTCP 25
• Telnet TrafficTCP 23
• Web Traffic AlternateTCP 8080
• RTP TrafficTCP 3389
• DNSTCP 53
• Multiple MS UsesTCP 135
By way of our defined security policy, we close all possible ports but typically have to leave those above (and some others) still open in order to conduct our business. Well here is a news flash for defenders: the bad guys know that we must leave some specific ports open and they have no intention of abiding by our policies. They simply created malware and bad-ware that can operate literally across any port or service (no policy restrictions for the bad guys) that we happen to leave open. The bottom line is that if your firewall today does not have the ability to identify applications operating over any port or service, you are destined to be compromised (if you're not already).
Ports are no longer relevant. Simply put, if your firewall cannot identify any traffic operating over any port or service, then you will never be able to control your network traffic. If you cannot control known good traffic you stand no chance at all of controlling any bad/malicious traffic.
Flaw remediation
We foolishly focus the majority of attention on Microsoft issues, and to be blunt, Microsoft is not the issue today. The vast majority of attacks today targets third-party software and browser add-ons. So many organizations rely solely on Microsoft WSUS that only handles flaws specific to Microsoft products. We are clearly missing the target and the bad guys know. What has been the most hacked software for more than the past year? Well, it has not been Microsoft; it has been a third-party product vendor Adobe. Is it any wonder we find ourselves in the mess we are in today?
The solution to our flaw remediation issue is to apply a little common sense — don't rely solely on solutions such as WSUS that are unable to remediate issues with the third-party applications and add-ons that are operating in your environment.
Do you have a guest user of your credit card?
Here's another flea market treasure that I found really interesting. The credit card reader shown in Figure 1.12 is capable of storing up to 300 credit card numbers. It's roughly the size of a telephone handset. Finding things like this at flea markets, yard sales, thrift stores, and pawn shops is to me a perfect example of how much expensive high end technology is out there for the taking for a determined social engineer or potential bad guy. This one was most likely replaced by something just a little more modern. It wound up out there in the surplus world and eventually at a flea market. A device of this size wouldn't work well as a concealed skimmer, but it certainly would be small enough to keep concealed somewhere where the bad guy could get to it and quickly swipe your card when given the opportunity. If you think about your last meal at any restaurant, how did you pay for it? You most likely enjoyed the great meal and then handed your credit card to someone to pay for it. Probably 999 times out of 1000 everything is fine. If that one time the person that you handed your card to was looking to steal credit card numbers, there could be an opportunity to scan your card into a reader similar to this before scanning it a second time into the restaurant's credit card reader to pay the bill. Your credit card number stored in the illegal scanner might not be used any time in the immediate future. It may also be quickly sold to people who want to commit credit card fraud. At the time of the theft of your credit card number in this scenario, neither you nor the restaurant would know that it happened. The restaurant would probably never know it, and you wouldn't know it until the card was eventually used to charge things to your account.
Regarding the use of these fairly technical electronic devices, all that using them requires is very low tech hacking and a little social engineering. This seems to be the trend with fairly complex technical pieces of equipment. It seems that the more high tech a piece of equipment is, the more the developers tried to make it easy to use.
A few possible countermeasures
When we consider the risks, threats, vulnerabilities, and countermeasures associated with social engineering, the countermeasures are things that need to be considered by all employees. The overall sneakiness of the threats associated with social engineering make it very easy for social engineers to catch anyone off guard. We just don't like to think that what appear to be kind and caring people are possibly people who are looking to do things to cause harm. Our human nature just doesn't like to consider these things.
Always be slightly suspicious
The number one countermeasure for the threat of social engineering is to be just a little more suspicious than we normally are as good, friendly, trusting citizens. This holds true for social engineering attempts that come by way of a phone call, or a visit from a friendly salesman. The same principle will help all of us to be more aware of possible terrorist planning activates as well. We all need to be just a little bit more aware of what is going on around us and people who are possibly trying to pretend to be other than who they really are as they try to use the age-old skill of social engineering to breach our security.
Unfortunately, this is a difficult countermeasure to continue to implement. We usually stop being concerned about things that happened even a few years ago. I suspect that this has something to do with our wonderful freedom from most of the bad things that people live with every day in other parts of the world. We can never afford to become complacent again. If we do, it will make life much easier for future bad guys, social engineers, and even terrorists.
Start to study the art of social engineering
There are several new groups on the Internet that now address social engineering topics as their main subject. One of those is located at http://www.social— engineering.org. This group and their website have more information on the subject of social engineering than I have seen on any Internet website.
Start a social engineering book library
I've always enjoyed having a lot of different reference books in my library. Sometimes I'll have three or four open at one time when researching a specific subject. I am one of those people who still really likes to hold the book in my hand and not read it from the screen on some handheld or desk resident device. I do understand the convenience of being able to have so many books on one small handheld device; I just don't think that that will ever be me. Here's another book that I would like to recommend that you consider for your library.
• Social Engineering: The Art of Human Hacking by Christopher Hadnagy, (ISBN: 978-0-470-63953-5, Wiley)
This is one of the newer books in my collection. None of these “here's why it works” books existed when I first started using social engineering as a tool for pen testing. It is truly amazing how our minds work and sometimes don't work the way that they should. Christopher is also the lead developer of the website www.social-engineering.org that I mentioned earlier.
You can have some more fun using social engineering in some innovative ways. Time seems to pass so quickly during the summer that I frequently forget my wife's birthday. Several years ago I decided to do something that I thought would help me to remember it. On my Facebook page I changed my birth date to her birth date. Now each year starting a day or so before her birthday I receive birthday wishes from about 50 or 60 of my friends. Some of these wishes are so kind and heartfelt that I really didn't want them to know that this wasn't really my birthday. I guess they'll all know it now! Hopefully they will forgive me. It was absolutely perfect as a way for me to remember with 50 or 60 reminders to wish my wife happy birthday (and not get into trouble again for forgetting it). Now that I've shared my little secret in print, I have changed my Facebook page once again just to keep everybody guessing. Please feel free to use my little social engineering birthday tip if you like. Happy birthday!
Summary
—Low Tech Jack
The threat of the bad guys of the world using social engineering is most likely here to stay. Hopefully some of my experiences with social engineering will raise your interest level and have you dive a little more into learning how it works and why it works. If you are a penetration team leader, social engineering will become one of your primary tools if it isn't already. If you're a security manager you will want to know how social engineering can be used against your employees and how vulnerable they are to these kinds of attacks. If you're a risk manager or an internal auditor, you will want to know a little more about the potential threat of social engineering and how these kinds of threats can be mitigated through countermeasures and employee awareness training. The con that we call social engineering is an age-old behind-the-scenes threat that we all need to continue to learn about as the bad guys of the world find more and more ways to use it.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.