Social Engineering - Revision history

Roehnsch at 20:21, 14 November 2004

2004-11-14T20:21:14Z

← Older revision		Revision as of 20:21, 14 November 2004
Line 3:		Line 3:
	Social Engineering can include:		Social Engineering can include:
	*faking authorities like administrators, members of a certain company,...		*faking authorities like administrators, members of a certain company,...
			*trick uninformed or credulous persons
	*physical access to written passwords, serial numbers, security related information,...		*physical access to written passwords, serial numbers, security related information,...

			It's often aimed on:
			*retrieval of user data and passwords
			*gaining of permissions
			*gaining access to networks
			*deleting files
			*executing actions or programs

Roehnsch at 20:16, 14 November 2004

2004-11-14T20:16:34Z

← Older revision		Revision as of 20:16, 14 November 2004
Line 1:		Line 1:
	'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.		'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.

			Social Engineering can include:
			*faking authorities like administrators, members of a certain company,...
			*physical access to written passwords, serial numbers, security related information,...


	== Example: password retrieval via telephone ==		== Example: password retrieval via telephone ==
Line 9:		Line 14:

	'''Obtained user name and password for access on foreign network.'''		'''Obtained user name and password for access on foreign network.'''


	== Example: backdoor install via mail ==		== Example: backdoor install via mail ==
	''Dear Sir or Madam,''		''Dear Sir or Madam,''

	''we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please ~~download~~ and ~~install~~ the security fix now:''		''we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please help us with downloading and installing the security fix now:''

	''http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip''		''http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip''
Line 20:		Line 26:

	'''Installed backdoor or botnet client.'''		'''Installed backdoor or botnet client.'''


	== Example: "socially engineered" worm via mail ==		== Example: "socially engineered" worm via mail ==

Roehnsch at 20:10, 14 November 2004

2004-11-14T20:10:53Z

← Older revision		Revision as of 20:10, 14 November 2004
Line 1:		Line 1:
	'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.		'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.

	== Example: ~~telephone~~ ~~call~~ ==		== Example: password retrieval via telephone ==
	''Hi,		''Hi,''

	this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your user name and password, so I can adjust your account properly?		''this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your user name and password, so I can adjust your account properly?''

	Thank you very much''		''Thank you very much''

	'''Obtained user name and password for access on foreign network.'''		'''Obtained user name and password for access on foreign network.'''

		⚫	== Example: backdoor install via mail ==
			''Dear Sir or Madam,''

			''we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please download and install the security fix now:''
⚫	== Example: ~~virus~~ ~~warning~~ ~~in a~~ mail ==
⚫	''Hi Alice,

			''http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip''
⚫	have you heard of this horrible ABC virus?
⚫	I have been infected! All my files were deleted. It's a total chaos.

			''Thanks for your cooperation''
⚫	If you have this virus you MUST delete it!
⚫	It hides in your C:\WINDOWS\SYSTEM folder. Look there and delete the EMM386.exe!

			'''Installed backdoor or botnet client.'''
⚫	~~Have~~ this mail ~~posted~~ to all your friends, too! They might be infected.

			== Example: "socially engineered" worm via mail ==
⚫	Bob''
		⚫	''Hi Alice,''

		⚫	''have you heard of this horrible ABC virus?''
		⚫	''I have been infected! All my files were deleted. It's a total chaos.''

		⚫	''If you have this virus you MUST delete it!''
		⚫	''It hides in your C:\WINDOWS\SYSTEM folder. Look there and delete the EMM386.exe!''

		⚫	''Be sure to post this mail to all your friends, too! They might be infected.''

		⚫	''Bob''

	'''Deleted system files and spread a worm.'''		'''Deleted system files and spread a worm.'''

Roehnsch at 19:59, 14 November 2004

2004-11-14T19:59:15Z

← Older revision		Revision as of 19:59, 14 November 2004
Line 2:		Line 2:

	== Example: telephone call ==		== Example: telephone call ==
	Hi,		''Hi,

	this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your password, so I can adjust your account properly?		this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your user name and password, so I can adjust your account properly?

	Thank you very much		Thank you very much''

			'''Obtained user name and password for access on foreign network.'''

⚫	== Example: virus warning ==
	''A "socially engineered" worm could be the following E-Mail:''

		⚫	== Example: virus warning in a mail ==
	Hi Alice,		''Hi Alice,

	have you heard of this horrible ABC virus?		have you heard of this horrible ABC virus?
Line 22:		Line 22:
	Have this mail posted to all your friends, too! They might be infected.		Have this mail posted to all your friends, too! They might be infected.

	Bob		Bob''

			'''Deleted system files and spread a worm.'''

Roehnsch at 19:50, 14 November 2004

2004-11-14T19:50:35Z

← Older revision		Revision as of 19:50, 14 November 2004
Line 1:		Line 1:
	'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of ~~more or less obvious~~ characteristics in human behaviour.		'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.

			== Example: telephone call ==
			Hi,

			this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your password, so I can adjust your account properly?

			Thank you very much


			== Example: virus warning ==
			''A "socially engineered" worm could be the following E-Mail:''

			Hi Alice,

			have you heard of this horrible ABC virus?
			I have been infected! All my files were deleted. It's a total chaos.

			If you have this virus you MUST delete it!
			It hides in your C:\WINDOWS\SYSTEM folder. Look there and delete the EMM386.exe!

			Have this mail posted to all your friends, too! They might be infected.

			Bob

Roehnsch at 17:44, 14 November 2004

2004-11-14T17:44:29Z

New page

'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of more or less obvious characteristics in human behaviour.