Social Engineering Part I - Introduction

I'm writing some articles for my local user's group. Let me know what you guy's think.

What do you want to know today?
Social Engineering Part I – Introduction to the methods of the Blackhat
First of a four part series
By 576869746568617

It’s 3:37PM, and the telephone rings. The receptionist answers, and as requested, the call is transferred to the Comptrollers office. The caller doesn’t have to wait long, as the Comptroller is at her desk as usual, pounding away at the ten key.

“This is Mrs. Ashfellow, how may I help you?”

The caller quickly responds: “Hello, Mrs. Ashfellow. This is Bob Jacobson with the IT department at Corporate. We’re having some problems with some of the user accounts at several locations related to a recent virus outbreak and I was wondering if any of your users have noticed anything unusual.”

She ponders the question for a moment ant then responds, “Well, now that you mention it, I’ve been having problems when I try to access Great Plains on the server.”

Salivating, the caller says, “Have we upgraded your PC to Windows XP yet? I’m looking through the tracking software but don’t see an entry.”

She quickly responds: “No, I’m still running 2000.”

His heart quickens, as he realizes this is the moment. Now for the kill. “Mrs. Ashfellow, what is your logon name and password? Perhaps it’s a problem with the account.” The caller receives her answer, and after thanking and assuring her that he’ll fix the issue, quickly goes back to work. Packets fly from the cable modem like mosquitoes searching for a blood meal.

Mrs. Ashfellow and her company have just been the victims of social engineering.

Social Engineering is “the art and science of getting people to comply to your wishes”. More specifically, it is a tactic used by hackers to exploit the weakest link in you IT security: the end-user. As IT security professionals, it is imperative that we understand this type of threat and the tactics used in order to create countermeasures to defend against it.

The hacker, depending on the hacker’s level of skill, research, and persistence, can employ many different social engineering tactics. Most successful hackers treat the social engineering as a separate hack that is a cornerstone of their main focused effort. As with any attack, social engineering starts off at the basics – footprinting, or casing the establishment. This is usually the longest and most labor-intensive part of the attack. Information is gathered by means that usually do not reveal the hacker or the hacker’s intentions, such as whois queries, public records, etc.

After footprinting, the hacker then decides on which course of action might best achieve information that may lead to a system compromise. If the attacker has some kind of contact, he/she may attempt to gain information from an interpersonal relationship. If not, the hacker usually resorts to the use of technology to trick someone into divulging information.

There are several methods for accomplishing this, and some are more effective than others. For example, there is the direct approach of simply calling the telephone number of the target and asking whomever answers for their user name and password. This is the least likely to succeed with a security conscious user. A more popular method is for the hacker to impersonate a technical support employee, as was illustrated in the opening paragraphs of this article. Other methods include impersonating a senior management employee, such as a project manager or V.P., or a helpless user who calls IT for help. A new trend is the use of reverse social engineering. This is similar to reverse psychology, where the hacker calls and entices the target user into voluntarily divulge information by forcing the target user to be the one who asks the majority of the questions. For example, a hacker calling the IT department claiming to be a sales rep for Checkpoint Software or support operator for Microsoft. This works well is the system is first DoSed or infected with a Trojan or virus that causes problems on the network.

Another form of reverse social engineering is what I call the Website Roshambo. This is where the hacker emails a potential target with an enticing offer that links to a website that the hacker has set up. These sites usually offer a gimmick of some kind and require users to create a “free” account. This is very successful, as most users like to keep it simple, and will use the same user name and password on the site as they do to login to the network. The hackers know this and use it to kick your systems in the crotch!

That’s it for Part I. In Part II, I’ll go over some countermeasures and how to test them.

EDIT: Here's a good thread by striek that goes a little more in detail about types of social engineering attacks. It's a realy good read.

Social engineering is a lot harder now days than it was in the past. I know of one incident at my workplace (some Internet Service Provider) where a customer called forgot username/password didnt have (MMN) mothers maiden name, or last 4 digits of S.S (Social Security number) didnt have none of there account billing information and still managed to get the password changed. How did this person do it? Simple. Number 1. called and was acting like a very disgruntled customer (very irate, dickhead) saying stuff such as: "if you dont fix this right now I'm canceling my service," putting our ISP down, making fun of technical staff, etc... while the tech support specialist who was assiting this person "just started" (after 3 weeks of training courses) and the man demanded her supervisor. She didnt want to get into trouble so she just changed the password without obtaining any billing account information to verify this is the correct person. Sadly to say when she did this the whole converstion was being recorded by the QA (quality assurance team for the ISP I work for) who then walked over to her and escorted her out the building 15 minutes later. Now the story goes if you dont have the correct information your not social engineering anybody at the workplace.

You will have to do better than that :D

"Upgrade" to XP? que?

I guess you have never worked military/intelligence?

Cheers :D

Actually, nihil, I'm an Intelligence Analyst (96B). I was just trying to paint a picture of a sucessful social engineering attack by a hacker against an end user who was not properly educated about security by the IT staff in a workplace where there are no information security/assurance policies in place. I'm going to cover that in the next installment.

Very observant, however! As far a Windows goes, I don't run sensitive info on anything but Win2K or NT4SP6a configured C2. Usually, I use a locked down Unix.

Thanks for the feedback. If you have any suggestions on how to make part II better, or anything that you want me to cover, let me know. What do you guys think of using some case studies as examples?

EDIT: My apologies to Remote Access....Didn't mean to steal the title of RA's thread. (yep, RA's banned, but it's the principal of the thing that counts) I did an AO search, but it didn't come up. I just noticed it in the "Similar Treads" listing.

Well, I think that social engineering is one of the most effective ways to gain informations, address and IP's, sometimes easly from none-educated users.
social engineering ain't dying breed.
Thanks for interesting tutorial, 576869746568617.

Quote:

---

Originally posted here by 576869746568617

His heart quickens, as he realizes this is the moment. Now for the kill. Mrs. Ashfellow, what is your logon name and password? Perhaps it's a problem with the account. The caller receives her answer, and after thanking and assuring her that hell fix the issue, quickly goes back to work. Packets fly from the cable modem like mosquitoes searching for a blood meal.

---

This would not work. It's all in how you word it. You can't ask for the password and log on information like that, even management isn't usually that stupid. You have to word it better to make them cough it up.

Like:

Well, I seem to be having a problem with your account on my computer here. Can you log out for me please sir? Then Log back in. Ok, what did you type? Hmm, that didn't show up let me check my system. Everything seems ok, what did you type in the password field? Ok that showed up fine. I'll fix this problem out for you, have a nice day.

That bit has done me well. Drunk's that call my house screaming at my familly that happen to have a high place job really regret it lol.

:D

Quote:

---

Now the story goes if you dont have the correct information your not social engineering anybody at the workplace.

---

:D

This stuff is actually easier to get than it was when social enginerring was a new idea. A trash can in an apatrment complex mailroom will yield alot of information. Just hit the same complex once a week for a month or so. By nature human beings are repetitive. Thos that normally read mail at the can and toss it will continue to do so. So over the course of a month you can have an easy ten identities. So in a way social enginerring is a dead art. It has changed into identity theft.

I agree with you, gore. Most of the time (99.999%), you aren't giong to get any info if you just pop out and say "What's your user name and password?". However, I have had it work a few (and I do mean few) times. Thanks for the feedback, though. I guess I should have proofed it a little more, maybe I would have made it a little more complicated. Mind if I use that line in the re-write?

What can I say....Work in progress!
:D

Quote:

---

Social engineering is a lot harder now days than it was in the past

---

I disagree, Most users in a company don't have security on their mind. In my experence you can get passwords and other information by simply walking around and keeping your eyes open: companies with frequently changing passwords and even ones w/out tend to have workers with post-it notes of login information or workers happy to give information with the hope of IT assistance.

Quote:

---

. In my experence you can get passwords and other information by simply walking around and keeping your eyes open

---

I strongly disagree with the above statement. You cant not simply walk around and obtain peoples passwords in a 'work enviroment' or any other 'enviroment' for that matter. People are very wise to this. Plus the people behind the PC's obviously know there stuff or they wouldnt be in that business. At my work I work for one of the biggest Internet service Providers in the USA will I say no. Am I aloud to say I dont know. The reason I say that (had to sign papers for secercy) my point is it's a lot harder to get peoples passwords than "walking around and keeping your eyes open" if your lucky and have fast eyes you might be able to get a sneak peak to see what there typing a character or two but thats about it. Like I said in my previous post the way that works 'from what I've seen is' acting like a disgruntled customer just keep it to A minium if you start cussing be prepared to have the phone hung up on you because the person on the other end will probably released the call. In my personal opionion you have to be smarter than the person on the other end of the phone to trick them.

Yea you can use it. I'll put it in the GPL. Just give me credit ;)

Quote:

---

Originally posted here by dopeydadwarf
:D :D

This stuff is actually easier to get than it was when social enginerring was a new idea. A trash can in an apatrment complex mailroom will yield alot of information. Just hit the same complex once a week for a month or so. By nature human beings are repetitive. Thos that normally read mail at the can and toss it will continue to do so. So over the course of a month you can have an easy ten identities. So in a way social enginerring is a dead art. It has changed into identity theft.

---

or an easy google search that will find stuff like these http://e.1asphost.com/aleksandarforu...sp?TOPIC_ID=67

do you think that mr Wayne Fitterman United Talent Agency - 9560 Wilshire Blvd. Ste: 400 Beverly Hills
likes his info and cc# posted on eastern european websites. No wonder we pay so much for movies ;)

If anyone here happens to speak macedonian i would love a quick translation

I'm not saying that you can do that in every work environment, and people will not give out their information when realizing they are doing it, but i personally have seen three professional environments with login informaiton in clear view for anyone to see, two offices with employee data and one a large store with admin. login data

Quote:

---

You cant not simply walk around and obtain peoples passwords in a 'work enviroment' or any other 'enviroment' for that matter

---

You're saying that if you walk over to Mr. Andersons desk you won't be able to see his matrix figures on his desk and guess a theme for his password: theredpill ?
By watching people and interacting with them it can sometimes be very easy to discover it between the lines

Computernerd22. Not all people who use computers are IT professionals. It is very possible to just walk around and get login details. I don't know where you work, but obviously if you're in a room of admins, they're not so likely to do this, but if you go into an office with (excuse me) bog-standard employees, half of them will have login details lying on their desks, or stuck onto their monitors, etc. Honestly...you see it all the time.

People aren't as clever as you would think. Most people don't care if someone else knows their passwords as long as they can get on with their work.

ac

Quote:

---

or an easy google search that will find stuff like these http://e.1asphost.com/aleksandarfor...asp?TOPIC_ID=67

---

This a perfect example of the simplicity involved. Just google for it. :D

Here I go on another tangent.

When I did consulting work, I used to preach security till I was blue in the face, and a lot of the companies got it. One in particular didn't. (they were a mfg. of pest control devices.) Now you probably wouldn't think that's a highly competitive market, but it is. The owner didn't get it ans insisted that there be no passwords because he was worried about his emplyees doing stuff and he wanted to be able to "spy" on them. I tried to tell him there was a better, more secure way.....he didn't want to listen.

Now that company is out of business and another sells the product...a result of social engineering and corporate espionage....only took 4 months.


I wonder how many other companies like that are out there....It scares me.

Well first off, thank you for the tutorial lots of numbers guy. It was well written and got the point accross to someone new to the field. SE in and of itself is still around very much so, and very sucessful. Although you do not just come out and say, "Whats your username and password." I do not really think that someone can learn SE from reading a tutorial though. They can learn ideas, and perhaps even techniques, but for the most part it is something that you get better by practice, or you are naturally persuasive and a good speaker. As pointed out, I do not believe (unless you get the IT department :D) it is any harder or easier (relatively compared) to SE people today than it was in the past. Walking around the workplace looking for passwords will probably not work as well and make you look suspicious. Also, people will have seen you.

-Cheers-

Nice tutorial you've written there.

Just one thing--you should also mention the attack where the attacker guides the victim to ask the attacker for help. This is also a very effective method.

If anybody wants an in-depth lesson on Social Engineering, I would strongly reccomend Kevin Mitnick's "The Art of Deception".

My last place of work was recently fully computered ? up, all machinery had a computer to monitor the work load, print out the paper work etc, and ALL units had 'password' as the password. this would only be accessible to the work force, but, sometimes the enemy is within ? the sys/admin was one guy, in a remote office, with a deadlock ? on his door, the server room was supposedly, sealed, but,we , the electrical dept, had to access the room to test the power leads on an annual basis, plus we had to clean change lights, UPS etc. What security comes down to, I believe, is whether the managment layer ENJOY playing computers at home. I would wager that in the factories and offices that have high security, and are NOT IT biased, that they are led / run by people who play with the damn things at home, a bit like US ?? And it follows that in places where security is less than should be expected, that those in command have a low threshold for those 'damn boxes'?? it also follows that social engineering or whatever we want to call it, will ALWAYS have a place in the armoury of the 'professional' hackman? because there IS one born every minute.

Social engineering?______/\/\/\______Trying_to_build_minds?____/\/\/\_____

Victim: hello this is MR. Iknowitall VP of sales how can I help you?
SE: Hi this is john smith from the IT department I'm calling because we have had some unusual activity coming from your workstation in the last couple of days.
Victim: What kind of activity?
SE: well sir it appears that some one has been trying to access restricted data with out clearance form your workstation.
Victim: that’s not possible I’m the only one who uses my computer.
SE: Have you been having trouble accessing anything lately sir.
Victim: well now that I think of it last months sales figures don’t seem to want to come up when I try to get to them.
SE: sir does this happen regurly?
Victim: yes it seems to happen every month for the first couple of days.
SE: I think I see the problem here sir your username does not have permission to access
The most recent sales data until the public release date…that’s not the way it should be set up sir as you are the VP of sales you should have the data as soon as it is available.
Victim: Well what can you do to fix this?
SE: well sir there is nothing I can do over the phone as I have to have access to your
Logon in order to fix the problem but I assure you I can send someone out to fix the problem next week.
Victim Next week! I need those figures sooner than that!
SE: I am sorry sir but that is the soonest I can get someone to you.
Victim: This is unacceptable I need that info sooner than that.
SE: well sir with out your user name and password there is nothing I can do and you know it is against company policy to give that out. Some one has to be physically present to make the needed changes; they should only take a couple of minuets of your time.
Victim: Look I need access sooner than the can you just help me this once?
SE: sir I’m not really supposed to do that.
Victim: look I carry a lot of weight around here as VP of sales if I say its ok then you can do it.
SE: Well ok sir just this once what’s your password and user name?..........................



I have seen the above work once the sucker was reeled in like a fish that just wrote his suicide note.