Social Engineering: Difference between revisions

From
Jump to navigation Jump to search
No edit summary
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.
'''Social Engineering''' is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.

Social Engineering can include:
*faking authorities like administrators, members of a certain company,...
*trick uninformed or credulous persons
*physical access to written passwords, serial numbers, security related information,...

It's often aimed on:
*retrieval of user data and passwords
*gaining of permissions
*gaining access to networks
*deleting files
*executing actions or programs



== Example: password retrieval via telephone ==
== Example: password retrieval via telephone ==
Line 9: Line 22:


'''Obtained user name and password for access on foreign network.'''
'''Obtained user name and password for access on foreign network.'''



== Example: backdoor install via mail ==
== Example: backdoor install via mail ==
''Dear Sir or Madam,''
''Dear Sir or Madam,''


''we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please download and install the security fix now:''
''we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please help us with downloading and installing the security fix now:''


''http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip''
''http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip''
Line 20: Line 34:


'''Installed backdoor or botnet client.'''
'''Installed backdoor or botnet client.'''



== Example: "socially engineered" worm via mail ==
== Example: "socially engineered" worm via mail ==

Latest revision as of 20:21, 14 November 2004

Social Engineering is a type of non-technical retrieval of confidential information or gain of access to computer systems. It makes use of characteristics in human behaviour.

Social Engineering can include:

  • faking authorities like administrators, members of a certain company,...
  • trick uninformed or credulous persons
  • physical access to written passwords, serial numbers, security related information,...

It's often aimed on:

  • retrieval of user data and passwords
  • gaining of permissions
  • gaining access to networks
  • deleting files
  • executing actions or programs


Example: password retrieval via telephone

Hi,

this is Mallory Malicious from the IT security company. You know, I'm responsible for improving your network's safety. Excuse me for using your time, but I have changed the security mode. Now all users have to be updated if they are to have access again. Would you please give me your user name and password, so I can adjust your account properly?

Thank you very much

Obtained user name and password for access on foreign network.


Example: backdoor install via mail

Dear Sir or Madam,

we, the IT security company are responsible for administering your corporate's network. We caught a security hole. Fixing it is of utmost importance to the company. Please help us with downloading and installing the security fix now:

http :// www .reliable-looking-web-address .net/security_fix_2004-11-16.zip

Thanks for your cooperation

Installed backdoor or botnet client.


Example: "socially engineered" worm via mail

Hi Alice,

have you heard of this horrible ABC virus? I have been infected! All my files were deleted. It's a total chaos.

If you have this virus you MUST delete it! It hides in your C:\WINDOWS\SYSTEM folder. Look there and delete the EMM386.exe!

Be sure to post this mail to all your friends, too! They might be infected.

Bob

Deleted system files and spread a worm.