Social Engineering
Social Engineering is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.
Social Engineering can include:
- faking authorities like administrators, members of a certain company,...
- trick uninformed or credulous persons
- physical access to written passwords, serial numbers, security related information,...
It's often aimed on:
- retrieval of user data and passwords
- gaining of permissions
- gaining access to networks
- deleting files
- executing actions or programs
Example: password retrieval via telephone
Hi,
this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your user name and password, so I can adjust your account properly?
Thank you very much
Obtained user name and password for access on foreign network.
Example: backdoor install via mail
Dear Sir or Madam,
we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please help us with downloading and installing the security fix now:
http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip
Thanks for your cooperation
Installed backdoor or botnet client.
Example: "socially engineered" worm via mail
Hi Alice,
have you heard of this horrible ABC virus? I have been infected! All my files were deleted. It's a total chaos.
If you have this virus you MUST delete it! It hides in your C:\WINDOWS\SYSTEM folder. Look there and delete the EMM386.exe!
Be sure to post this mail to all your friends, too! They might be infected.
Bob
Deleted system files and spread a worm.