Issuu on Google+

e

*

x 0 9


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

S o c i a l

E

n g i n e e r i n g M o d u le 0 9

Engineered by Hackers. Presented by Professionals.

CEH

«■*

E th ic a l H a c k in g C o u n te rm e a s u re s v 8 M o d u l e 0 9 : S o c ia l E n g i n e e r i n g E xam 3 1 2 -5 0

Module 09 Page 1293

Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

S e c u r i t y

N

e w

CEH

s

Cybercriminals Use Social Engineering Emails to Penetrate Corporate Networks S eptem ber 25, 2012

New s P ro d u c t S e rv ic e s

FireEye, Inc. has announced the release of "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data," a report that identifies the social engineering techniques cybercriminals use in email-based advanced cyber attacks. According to the report, the top words cybercriminals use create a sense of urgency to trick unsuspecting recipients into downloading malicious files. The top word category used to evade traditional IT security defenses in email-based attacks relates to express shipping.

C o n ta c t According to recent data from the FireEye "Advanced Threat Report," fo r the first six months of 2012, email-based attacks increased 56 percent. Email-based advanced cyber attacks easily bypass traditional signature-based security defenses, preying on naive users to install malicious files.

About

"Cybercriminals continue to evolve and refine their attack tactics to evade detection and use techniques that work. Spear phishing emails are on the rise because they w ork," said Ashar Aziz, Founder and CEO, FireEye. "Signature-based detection is ineffective against these constantly changing advanced attacks, so IT security departments need to add a layer of advanced threat protection to their security defences." "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data," explains that express shipping terms are included in about one quarter of attacks, including "DHL", "UPS", and "delivery.11 http://biztech2.in. com Copyright Š by EG-G(ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

S e c u rity N e w s C y b e r c r im in a ls P e n e tra te

U se

C o rp o ra te

S o c ia l E n g in e e r in g

E m a ils

to

N e tw o rk s

Source: h ttp ://b iz te c h 2 .in .c o m FireEye, Inc. has a n n o u n ce d th e release o f "T op W o rd s Used in Spear P hish in g A tta cks to S uccessfully C o m p ro m is e E n te rp rise N e tw o rk s and Steal D ata," a re p o rt th a t id e n tifie s th e social e n g in e e rin g te c h n iq u e s

c y b e rc rim in a ls

use in e m a il-b a se d

advanced

cyb e r-a tta cks.

A c c o rd in g to th e re p o rt, th e re are a n u m b e r o f w o rd s c y b e rc rim in a ls use to cre a te a sense o f u rg e n cy to tric k u n su sp e c tin g re c ip ie n ts in to d o w n lo a d in g m a licio u s file s. The to p w o rd c a te g o ry used to evade tra d itio n a l IT s e c u rity defenses in e m a il-b a s e d a tta c k s re la te s to express sh ip p in g . A c c o rd in g to re c e n t data fro m th e FireEye "A d va n ce d T h re a t R e p o rt," fo r th e fir s t six m o n th s o f 2012, e m a il-b a se d a tta cks increased 56 p e rc e n t. Em ail-based advanced c y b e r-a tta c k s easily bypass tr a d itio n a l s ig n a tu re -b a s e d s e c u rity defenses, p re yin g on naive users to in sta ll m a lic io u s files. "C y b e rc rim in a ls c o n tin u e to e v o lv e and re fin e th e ir a tta c k ta c tic s to evade d e te c tio n and use te c h n iq u e s th a t w o rk . Spear p hish in g e m ails are on th e rise because th e y w o rk ," said A shar Aziz,

F o u n d e r and

Module 09 Page 1294

CEO,

FireEye.

"S ig n a tu re -b a se d

d e te c tio n

is in e ffe c tiv e

against th e se

Ethical Hacking and Countermeasures Copyright Š by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

c o n s ta n tly ch a ng in g advanced a ttacks, so IT s e c u rity d e p a rtm e n ts need to add a la ye r o f advance d th r e a t p ro te c tio n to th e ir s e c u rity defense s." "T o p W o rd s Used in Spear P hishing A tta c k s to Successfully C o m p ro m ise E n te rp rise N e tw o rk s and Steal D ata," explains th a t express sh ip p in g te rm s are in clu d e d in a b o u t one q u a rte r o f a ttacks, in c lu d in g "D H L," "UPS," and "d e liv e ry ." U rg e n t te rm s such as " n o tific a tio n " and " a le rt" are in c lu d e d in a b o u t 10 p e rc e n t o f attacks. An exa m p le o f a m a lic io u s a tta c h m e n t is "UPSD e liv e ry -C o n firm a tio n -A le rt_ A p ril-2 0 1 2 .z ip ."

The re p o rt in d ica te s th a t c y b e rc rim in a ls also te n d to use fin a n c e -re la te d w o rd s , such as th e nam es o f fin a n c ia l in s titu tio n s and an associated tra n s a c tio n such as "Lloyds TSB - Login F o rm .h tm l," and ta x -re la te d w o rd s , such as "T a x_ R e fu n d .zip ." Travel and b illin g w o rd s in c lu d in g "A m e ric a n A irlin e s T ic k e t" and "in v o ic e " are also p o p u la r sp e a r p h is h in g e m a il a tta c h m e n t key w o rd s .

Spear p h ish in g em ails are p a rtic u la rly e ffe c tiv e as c y b e rc rim in a ls o fte n use in fo rm a tio n fro m social n e tw o rk in g sites to p e rso n a lize em ails and m ake th e m

lo o k m o re a u th e n tic . W h e n

u n su sp e ctin g users re sp o n d , th e y m ay in a d v e rte n tly d o w n lo a d m a licio u s file s o r click on m a lic io u s links in th e e m a il, a llo w in g c rim in a ls access to c o rp o ra te n e tw o rk s and th e p o te n tia l e x filtra tio n o f in te lle c tu a l p ro p e rty , c u s to m e r in fo rm a tio n , and o th e r va lu a b le c o rp o ra te assets. The re p o rt h ig h lig h ts th a t c y b e rc rim in a ls p r im a r ily use zip file s in o rd e r to hide m a licio u s code, b u t also ranks a d d itio n a l file typ e s, in c lu d in g PDFs and e x e cu ta b le files. "T o p W o rd s Used in Spear P hishing A tta cks to Successfully C o m p ro m ise E n te rp rise N e tw o rk s and Steal D ata" is based on data fro m th e FireEye M a lw a re P ro te c tio n Cloud, a service shared by th o u s a n d s o f FireEye a pp lia n ces a ro u n d th e w o rld , as w e ll as d ire c t m a lw a re in te llig e n c e u n c o v e re d by its research te a m . The re p o rt p ro vid e s a g lobal v ie w in to e m a il-b a se d atta cks th a t ro u tin e ly bypass tr a d itio n a l s e c u rity s o lu tio n s such as fire w a lls and n e x t-g e n e ra tio n fire w a lls , IPSs, a n tiv iru s , and gate w ays.

Copyright Š 2011, Biztech2.com - A N etwork 18 Venture Author: Biztech2.com Staff h t tp ://b iz te c h 2 .in .c o m /r 1e w s /s e c u ritv /c v b e rc rim in a ls -u s e -s o c ia l-e r 1E in e e rir 1g -e m a ils -to -p e n e tra te c o rp o ra te -n e tw o rk s /1 4 4 2 3 2 /0

Module 09 Page 1295

Ethical Hacking and Countermeasures Copyright Š by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

M

o d u l e

Exam 312-50 Certified Ethical Hacker

O

b j e c t i v e s

CEH ‫י‬

J

W h a t Is Social Engineering?

J

J

Factors th a t M ake Com panies

J

M obile-based Social Engineering Social Engineering T hrough Im pe rso n atio n on Social N e tw o rkin g

Vulnerable to Attacks

Sites J

W a rning Signs o f an A ttack

J

Phases in a Social E ngineering A tta ck

J

Com m on Targets o f Social Engineering

J J

k B

J

Id e n tify T he ft

J

Social Engineering Counterm easures

J

H ow to D etect Phishing Emails

Hum an-based Social Engineering

«

Id e n tity T h e ft Counterm easures

C om puter-based Social Engineering

J

Social Engineering Pen Testing

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

M o d u le O b je c tiv e s The in fo rm a tio n c o n ta in e d in th is m o d u le lays o u t an o v e rv ie w on social e n g in e e rin g . W h ile th is m o d u le p o in ts o u t fa lla cie s and advocate s e ffe c tiv e c o u n te rm e a s u re s , th e possible w ays to e x tra c t in fo rm a tio n fro m a n o th e r h u m a n being are o n ly re s tric te d by th e in g e n u ity o f th e a tta c k e r's m in d . W h ile th is a spect m akes it an a rt, and th e p syc h o lo g ic a l n a tu re o f som e o f th e se te c h n iq u e s m ake it a science, th e b o tto m lin e is th a t th e re is no d efense against social e n g in e e rin g ; o n ly c o n s ta n t v ig ila n c e can c irc u m v e n t som e o f th e social e n g in e e rin g te c h n iq u e s th a t a tta c k e rs use. This m o d u le w ill fa m ilia riz e yo u w ith : S

W h a t Is Social E nginee ring?

C om puter-based Social Engineering

S

Factors th a t M ake C om panies

M obile-based Social Engineering

V u ln e ra b le to A tta cks

Social Engineering T hrough Im personation on

8

W a rn in g Signs o f an A tta c k

Social N e tw o rkin g Sites

5

Phases in a Social E nginee ring

Id e n tify Theft

A tta c k S

C o m m o n T argets o f Social E nginee ring

S

H u m an-base d Social E ngineering

Module 09 Page 1296

Social Engineering Counterm easures H ow to D etect Phishing Emails Id e n tity T h e ft C o u n te rm e a su re s Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

Copyright © by EC-G(Uncil. All Rights Reserved. Reproduction is Strictly Prohibited.

J L l }

M o d u le F lo w As m e n tio n e d p re v io u s ly , th e re is no s e c u rity m e ch a n ism th a t can s to p a tta c k e rs fro m

p e rfo rm in g social e n g in e e rin g o th e r th a n e d u c a tin g v ic tim s a b o u t social e n g in e e rin g tric k s and w a rn in g a b o u t its th re a ts . So, n o w w e w ill discuss social e n g in e e rin g concepts.

Social E n g in e e rin g C oncepts

Id e n tity th e f t a Social E n g in e e rin g

Social E n g in e e rin g T e c h n iq u e s

C o u n te rm e a s u re s Im p e rs o n a tio n o n Social N e tw o rk in g Sites

/*■ ‫־‬ JiEE

P e n e tra tio n T e s tin g

This s e ctio n d escribes social e n g in e e rin g and h ig h lig h ts th e fa c to rs v u ln e ra b le to a ttacks, as w e ll as th e im p a c t o f social e n g in e e rin g on an o rg a n iz a tio n .

Module 09 Page 1297

Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

W h a t Is S o c ia l E n g in e e r in g ?

CEH UrtrfW*

0

ttfciul lUilwt

0 J

Social e n g in e e rin g is th e a rt o f c o n v in c in g p e o p le to reveal c o n fid e n tia l in fo rm a tio n

J

Social e n g in ee rs d e p e n d on th e fa ct th a t p e o p le are u n a w a re o f th e ir v a lu a b le in fo rm a tio n and are careless a b o u t p ro te c tin g it

0

0

Copyright Š by IG-Gtuncil. All Rights Reserved. Reproduction is Strictly Prohibited.

W h a t I s S o c ia l E n g in e e r in g ? Social e n g in e e rin g re fe rs to th e m e th o d o f in flu e n c in g and p e rs u a d in g p e o p le to reveal se n sitive in fo rm a tio n in o rd e r to p e rfo rm som e m a lic io u s a c tio n . W ith th e help o f social e n g in e e rin g tric k s , a tta c k e rs can o b ta in c o n fid e n tia l in fo rm a tio n , a u th o riz a tio n d e ta ils, and access d e ta ils o f p e o p le by d e c e iv in g and m a n ip u la tin g th e m . A tta c k e rs can easily breach th e s e c u rity o f an o rg a n iz a tio n using social e n g in e e rin g tric k s . All s e c u rity m easures a d o p te d

by th e o rg a n iz a tio n are in vain w h e n

e m p lo ye e s g et "social

e n g in e e re d " by stra ng ers. Som e e xam ples o f social e n g in e e rin g in clu d e u n w ittin g ly a n sw e rin g th e q u e s tio n s o f stra ng ers, re p ly in g to spam em a il, and b ra g g in g in fr o n t o f c o -w o rke rs. M o s t o fte n , p e o p le are n o t even a w a re o f a s e c u rity lapse on th e ir p a rt. Chances are th a t th e y d ivu lg e in fo rm a tio n to a p o te n tia l a tta c k e r in a d v e rte n tly . A tta c k e rs ta ke special in te re s t in d e v e lo p in g social e n g in e e rin g s k ills , and can be so p ro fic ie n t th a t th e ir v ic tim s m ig h t n o t even realize th a t th e y have been scam m ed. D espite having s e c u rity p o lic ie s in place, o rg a n iza tio n s can be c o m p ro m is e d because social e n g in e e rin g atta cks ta rg e t th e w eakness o f p e o p le to be h e lp fu l. A tta c k e rs are alw ays lo o k in g fo r n e w w ays to g a th e r in fo rm a tio n ; th e y ensure th a t th e y k n o w th e p e rim e te r and th e p e o p le on th e p e rim e te r s e c u rity guards, re c e p tio n is ts , and help desk w o rk e rs in o rd e r to e x p lo it h um a n o ve rsig h t. People have been c o n d itio n e d n o t to be o v e rly suspicious; th e y associate c e rta in b e h a v io r and appea ra nces w ith kn o w n e n titie s . For

Module 09 Page 1298

Ethical Hacking and Countermeasures Copyright Š by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking and Countermeasures Social Engineering

Exam 312-50 Certified Ethical Hacker

instan ce, u po n seeing a m an dressed in a u n ifo rm and ca rryin g a stack packages fo r d e liv e ry , any in d iv id u a l w o u ld ta k e him to be a d e liv e ry person. C om panies lis t th e ir e m p lo y e e IDs, nam es, and em a il addresses on th e ir o ffic ia l w e b s ite s . A lte rn a tiv e ly , a c o rp o ra tio n m ay p u t a d v e rtis e m e n ts in th e p a p e r fo r h ig h -te ch w o rk e rs w h o are tra in e d on O racle databases o r UN IX se rve rs. These b its o f in fo rm a tio n he lp a tta cke rs k n o w w h a t kind o f system th e y are ta c k lin g . This o ve rla p s w ith th e re co n n a issa n ce phase.

Module 09 Page 1299

Ethical Hacking and Countermeasures Copyright Š by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Behaviors V u ln e ra b le to A ttacks

CEH U rtNM

|

H u m a n n a tu re o f tr u s t is th e basis o f any so cia l e n g in e e rin g a tta c k

‫־■־■־‬

Ig n o ra n ce a b o u t so cia l e n g in e e rin g a nd its e ffe c ts a m o n g th e w o rk fo rc e

-*‫־*־־‬

m akes th e o rg a n iz a tio n an easy ta rg e t

H

ItkNjI lUilwt

I

Social e n g in e e rs m ig h t th re a te n severe losses in case o f n o n - c o m p lia n c e

-*“* -* ‫־‬

w it h th e ir re q u e s t

&

Social e n g in e e rs lu re th e ta rg e ts to d iv u lg e in fo rm a tio n by p ro m is in g

IV

s o m e th in g fo r n o th in g

V

Targets are asked fo r h e lp a nd th e y c o m p ly o u t o f a sense o f m o ra l o b lig a tio n

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

B e h a v io r s

V u ln e r a b le

to

A tta c k s

A n a tta c k e r can ta k e a d v a n ta g e o f t h e fo llo w in g b e h a v io rs a n d n a tu r e o f p e o p le t o c o m m i t s o c i a l e n g i n e e r i n g a t t a c k s . T h e s e b e h a v i o r s c a n b e v u l n e r a b i l i t i e s o f s o c ia l e n g in e e rin g a tta c ks : Q

H u m a n n a t u r e o f t r u s t i t s e l f b e c o m e s t h e m a i n b a s is f o r t h e s e s o c ia l e n g i n e e r i n g a t t a c k s . C o m p a n ie s

s h o u ld

ta k e

th e

p ro p e r

in itia tiv e

in

e d u c a tin g

e m p lo y e e s

about

p o s s ib le

v u l n e r a b i l i t i e s a n d a b o u t s o c ia l e n g i n e e r i n g a t t a c k s s o t h a t e m p l o y e e s w i l l b e c a u t i o u s . S o m e t i m e s s o c ia l e n g i n e e r s g o t o t h e e x t e n t o f t h r e a t e n i n g t a r g e t s in c a s e t h e i r r e q u e s t s a re n o t a c c e p te d . W h e n th in g s d o n 't w o r k o u t w it h th r e a te n in g , th e y

lu re th e t a r g e t b y p r o m is in g t h e m

v a r i o u s k i n d s o f t h i n g s lik e c a s h o r o t h e r b e n e f i t s . In s u c h s i t u a t i o n s , t h e t a r g e t m i g h t b e l u r e d a n d t h e r e is t h e p o s s i b i l i t y o f l e a k i n g s e n s i t i v e c o m p a n y d a t a . A t t i m e s , e v e n t a r g e t s c o o p e r a t e w i t h s o c ia l e n g i n e e r s d u e t o s o c i a l o b l i g a t i o n s . Ig n o ra n ce

about

s o c ia l

e n g in e e rin g

and

its

e ffe c ts

am ong

th e

w o rk fo rc e

m akes

th e

o rg a n iz a tio n an easy ta rg e t. T h e p e r s o n c a n a ls o r e v e a l t h e s e n s i t i v e i n f o r m a t i o n in o r d e r t o a v o i d g e t t i n g in t r o u b l e b y n o t p ro v id in g

i n f o r m a t i o n , as h e o r s h e m a y t h i n k t h a t i t w o u l d

a ffe c t th e

c o m p a n y 's

b u sin ess.

M o d u le 0 9 P ag e 1300

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Factors that M a k e C om panies V u ln e ra b le to A ttacks

In s u f f ic ie n t

CE H

Easy

S e c u r ity

A ccess o f

T r a in in g

In fo r m a tio n

Lack o f S e c u r ity

O r g a n iz a tio n a l

P o lic ie s

U n its

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

F a c to r s

th a t M

a k e

C o m p a n ie s

V u ln e r a b le

to

A tta c k s

S o c ia l e n g i n e e r i n g c a n b e a g r e a t t h r e a t t o c o m p a n i e s . It is n o t p r e d i c t a b l e . It c a n o n l y be p r e v e n t e d b y e d u c a tin g e m p lo y e e s a b o u t s o c ia l e n g in e e r in g a n d th e th r e a ts a s s o c ia te d w i t h it. T h e r e a r e m a n y f a c t o r s t h a t m a k e c o m p a n i e s v u l n e r a b l e t o a t t a c k s . A f e w f a c t o r s a r e m e n t i o n e d as f o l l o w s : In s u ffic ie n t S e c u rity T r a in in g It is t h e m i n i m u m r e s p o n s i b i l i t y o f a n y o r g a n i z a t i o n t o e d u c a t e t h e i r e m p l o y e e s a b o u t v a r i o u s s e c u r i t y a s p e c t s i n c l u d i n g t h r e a t s o f s o c ia l e n g i n e e r i n g in o r d e r t o r e d u c e its i m p a c t o n c o m p a n i e s . U n le s s t h e y h a v e t h e k n o w l e d g e o f s o c ia l e n g i n e e r i n g t r i c k s a n d t h e i r i m p a c t , t h e y d o n ' t e v e n k n o w e v e n i f t h e y h a v e b e e n t a r g e t e d a n d . T h e r e f o r e , i t is a d v i s a b l e t h a t e v e r y c o m p a n y m u s t e d u c a t e o r t r a i n its e m p l o y e e s a b o u t s o c ia l e n g i n e e r i n g a n d its t h r e a t s .

L a c k

o f S e c u rity P o lic ie s

S e c u rity s ta n d a rd s s h o u ld be in c re a s e d d r a s t ic a lly b y c o m p a n ie s t o b rin g a w a re n e s s

M o d u le 0 9 P ag e 1301

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

t o e m p lo y e e s . T a k e e x t r e m e m e a s u r e s r e la te d t o e v e r y p o s s ib le s e c u r ity t h r e a t o r v u ln e r a b ilit y . A f e w m e a s u r e s s u c h as a p a s s w o r d c h a n g e p o l i c y , a c c e s s p r i v i l e g e s , u n i q u e u s e r i d e n t i f i c a t i o n , c e n t r a l i z e d s e c u r i t y , a n d so o n c a n b e b e n e f i c i a l . Y o u s h o u l d a ls o i m p l e m e n t a n i n f o r m a t i o n s h a rin g p o lic y .

E a s y A c c e s s

o f In fo r m a tio n

For e ve ry c o m p a n y , one o f th e

m a i n a s s e ts is its d a t a b a s e . E v e r y c o m p a n y m u s t

p r o t e c t i t b y p r o v i d i n g s t r o n g s e c u r i t y . It is t o b e k e p t in v i e w t h a t e a s y a c c e s s o f c o n f i d e n t i a l in fo r m a tio n s h o u ld be a v o id e d . E m p lo y e e s ha ve t o be re s tric te d t o th e in fo r m a tio n to s o m e e x te n t. Key p e rs o n s o f th e c o m p a n y w h o h a v e access t o th e s e n s itiv e d a ta s h o u ld be h ig h ly tr a in e d a n d p r o p e r s u rv e illa n c e has t o be m a in ta in e d .

S e v e ra l O r g a n iz a t io n a l U n its -------------

It is e a s y f o r a n a t t a c k e r t o g r a b i n f o r m a t i o n a b o u t v a r i o u s o r g a n i z a t i o n a l u n i t s t h a t is

m e n tio n e d on th e In te rn e t fo r a d v e rtis e m e n t o r p r o m o tio n a l p u rp o s e s .

M o d u le 0 9 P ag e 1302

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

W hy Is Social E n g in ee rin g E ffective? S e c u r it y p o lic ie s a r e a s s t r o n g a s t h e i r w e a k e s t lin k , a n d h u m a n s a r e t h e m o s t s u s c e p t ib le f a c t o r

It is d i f f i c u l t t o d e t e c t s o c ia l e n g i n e e r in g a t t e m p t s

T h e r e is n o m e t h o d t o e n s u r e c o m p l e t e s e c u r i t y f r o m s o c ia l e n g i n e e r in g a t t a c k s

T h e r e is n o s p e c if ic s o f t w a r e o r h a r d w a r e f o r d e f e n d i n g a g a in s t a s o c ia l e n g i n e e r in g a t t a c k

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

W

h y

Is

S o c ia l E n g in e e r in g

E ffe c tiv e ?

T h e f o l l o w i n g a r e t h e r e a s o n w h y s o c ia l e n g i n e e r i n g is so e f f e c t i v e : Q

D e s p i t e t h e p r e s e n c e o f v a r i o u s s e c u r i t y p o l ic i e s , y o u c a n n o t p r e v e n t p e o p l e f r o m b e i n g s o c i a l l y e n g i n e e r e d s i n c e t h e h u m a n f a c t o r is t h e m o s t s u s c e p t i b l e t o v a r i a t i o n .

Q

It is d i f f i c u l t t o d e t e c t s o c ia l e n g i n e e r i n g a t t e m p t s . S o c ia l e n g i n e e r i n g is t h e a r t

and

s c i e n c e o f g e t t i n g p e o p l e t o c o m p l y w i t h a n a t t a c k e r ' s w i s h e s . O f t e n t h i s is t h e w a y t h a t a tta c k e r s g e t a f o o t in s id e a c o r p o r a t i o n ' s d o o r . Q

N o m e t h o d c a n g u a r a n t e e c o m p l e t e s e c u r i t y f r o m s o c ia l e n g i n e e r i n g a t t a c k s .

Q

N o h a r d w a r e o r s o f t w a r e is a v a i l a b l e t o d e f e n d a g a i n s t s o c ia l e n g i n e e r i n g a t t a c k s .

M o d u le 0 9 P ag e 1303

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

W

a

Exam 3 1 2 -5 0 C ertified Ethical H acker

r n

i n

g

S

i g n s

o

f

a n

A

t t a

c k

C E H

In te rn e t atta cks have b e co m e a business and a tta cke rs are

O

c o n s ta n tly a tte m p tin g to in v a d e n e tw o rk s

t o

W a r n in g S ig n s S h o w h aste a n d d ro p

S h o w d is c o m fo rt

M ake

th e n a m e in a d v e rte n tly

w h e n q u e s tio n e d

in fo r m a l re q u e s ts

U n u s u a lly

C la im a u t h o r ity a nd

S h o w in a b ility to give

c o m p lim e n t o r p raise

th r e a te n if in fo r m a tio n

v a lid c a llb a c k n u m b e r

is n o t p ro v id e d

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

W

a r n in g

A lth o u g h

S ig n s

o f a n

i t is n o t p o s s i b l e t o

A t t a c k firm ly

d e t e c t s o c ia l e n g i n e e r i n g

a tte m p ts

fro m

an

a t t a c k e r , y o u c a n s ti l l i d e n t i f y s o c ia l e n g i n e e r i n g a t t e m p t s b y o b s e r v i n g b e h a v i o r o f t h e s o c ia l e n g i n e e r . T h e f o l l o w i n g a r e w a r n i n g s ig n s o f s o c i a l e n g i n e e r i n g a t t e m p t s : If s o m e o n e is d o i n g t h e f o l l o w i n g t h i n g s w i t h y o u , b e w a r e !

It m i g h t b e s o c ia l e n g i n e e r i n g

a tte m p ts : 0

S h o w in a b ilit y t o g iv e a v a lid c a llb a c k n u m b e r

0

M a k e in fo rm a l re q u e s ts

0

C la i m a u t h o r i t y a n d t h r e a t e n i f i n f o r m a t i o n is n o t p r o v i d e d

0

S h o w h a s te a n d d r o p a n a m e in a d v e r te n t ly

0

U n u s u a lly c o m p l im e n t o r p ra is e

0

S h o w d is c o m fo r t w h e n q u e s tio n e d

M o d u le 0 9 P ag e 1304

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Phases in a Social E n g in e e rin g A ttack

Research on Target Company iB ii

( ^H I

UrtifW4 ttkK4l Mmhat

Select Victim

gj

!a ~ 1 “1 ili » a ‫־‬i a* » ii a a

Dum pster diving,

Identify the frustrated employees o f the target company

websites, employees, to u r company, etc.

□ Develop Relationship

Exploit the Relationship Collect sensitive account information, financial information, and current technologies

Develop relationship w ith the selected employees

a!

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

P h a s e s

in

a

S o c ia l E n g in e e r in g

A t t a c k

T h e a t t a c k e r p e r f o r m s s o c ia l e n g i n e e r i n g in t h e f o l l o w i n g s e q u e n c e .

R e s e a rc h th e

ta rg e t c o m p a n y

T h e a t t a c k e r , b e f o r e a c t u a l l y a t t a c k i n g a n y n e t w o r k , g a t h e r s i n f o r m a t i o n in o r d e r t o f i n d p o s s i b l e w a y s t o e n t e r t h e t a r g e t n e t w o r k . S o c ia l e n g i n e e r i n g is o n e s u c h t e c h n i q u e t o g r a b i n f o r m a t i o n . T h e a t t a c k e r i n i t i a l l y c a r r i e s o u t r e s e a r c h o n t h e t a r g e t c o m p a n y t o f i n d b a s ic i n f o r m a t i o n s u c h as k i n d o f b u s i n e s s , o r g a n i z a t i o n l o c a t i o n , n u m b e r o f e m p l o y e e s , e tc . D u r i n g th is p hase, th e a tta c k e r m a y c o n d u c t d u m p s t e r d iv in g , b ro w s e th r o u g h th e c o m p a n y w e b s ite , f i n d e m p l o y e e d e t a i l s , e tc .

S e le c t v i c t i m A fte r p e rfo rm in g in -d e p th re search on th e ta r g e t c o m p a n y , th e a tta c k e r chooses th e k e y v ic tim a t t e m p t t o e x p lo it t o g ra b s e n s itiv e a n d u s e fu l in fo r m a tio n . D is g r u n tle d e m p lo y e e s o f th e c o m p a n y a re a b o o n t o th e a tta c k e r. T h e a tta c k e r tr ie s t o fin d th e s e e m p lo y e e s a n d lu re t h e m t o re v e a l t h e i r c o m p a n y in fo r m a tio n . As th e y a re d is s a tis fie d w it h th e c o m p a n y , th e y m a y b e w i l l i n g t o l e a k o r d i s c lo s e s e n s i t i v e d a t a o f t h e c o m p a n y t o t h e a t t a c k e r .

M o d u le 0 9 P ag e 1305

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

D e v e lo p

th e

Exam 3 1 2 -5 0 C ertified Ethical H acker

re la tio n s h ip

O n ce such e m p lo y e e s a re id e n tifie d , a tta c k e rs t r y t o d e v e lo p re la tio n s h ip s w it h t h e m so t h a t t h e y can e x tr a c t c o n f i d e n t i a l i n f o r m a t i o n

fro m

th e m . T h e n th e y use t h a t

in fo r m a tio n fo r f u r t h e r in fo r m a tio n e x tra c tin g o r to la u n c h a tta c k s .

E x p lo it th e O nce th e

r e la tio n s h ip

a t t a c k e r b u ild s

a re la tio n s h ip w it h

th e

e m p lo y e e s

o f th e

c o m p a n y , th e

a tta c k e r trie s to e x p lo it th e re la tio n s h ip o f th e e m p lo y e e w it h th e c o m p a n y a n d trie s t o e x tr a c t s e n s i t i v e i n f o r m a t i o n s u c h as a c c o u n t i n f o r m a t i o n , f i n a n c i a l i n f o r m a t i o n , c u r r e n t t e c h n o l o g i e s u s e d , f u t u r e p la n s , e tc .

M o d u le 0 9 P ag e 1306

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Economic Losses

V 7

Loss o f Privacy

Damage o f G oo dw ill

T em porary o r P erm anent Closure

Lawsuits and A rb itra tio n s

ill U Hi Hi ‫־‬4 ‫י י‬

Dangers o f Terrorism

*

‫י י‬

«

ii

ii

iii

ill

‫י‬

ii

‫* ״‬

~

O rg a n iz a tio n

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

I m

p a c t

o n

th e

O r g a n iz a t io n

T h o u g h s o c ia l e n g i n e e r i n g d o e s n ' t s e e m t o b e s e r i o u s t h r e a t , i t c a n le a d t o g r e a t lo s s f o r a c o m p a n y . T h e v a r i o u s f o r m s o f lo ss c a u s e d b y s o c ia l e n g i n e e r i n g i n c l u d e : QQ—

E c o n o m ic

OQQ ©©‫־‬ u.

-

lo s s e s

C o m p e tito rs

may

use

s o c ia l e n g i n e e r i n g

te c h n iq u e s

to

s te a l

in fo rm a tio n

such

f u t u r e d e v e l o p m e n t p l a n s a n d a c o m p a n y ' s m a r k e t i n g s t r a t e g y , w h i c h in t u r n m a y i n f l i c t g r e a t e c o n o m ic losses o n a c o m p a n y .

D a m a g e

o f g o o d w ill

G o o d w i l l o f a n o r g a n i z a t i o n is i m p o r t a n t f o r a t t r a c t i n g c u s t o m e r s . S o c ia l e n g i n e e r i n g a tta c k s m a y leak s e n s itiv e o rg a n iz a tio n a l d a ta a n d d a m a g e th e g o o d w ill o f an o rg a n iz a tio n .

L o s s o f p riv a c y P r i v a c y is a m a j o r c o n c e r n , e s p e c i a l l y f o r l a r g e o r g a n i z a t i o n s . If a n o r g a n i z a t i o n

is

u n a b l e t o m a i n t a i n t h e p r i v a c y o f its s t a k e h o l d e r s o r c u s t o m e r s , t h e n p e o p l e m a y lo s e t r u s t in th e

com pany

and

may

not

want

to

c o n tin u e

w ith

th e

o rg a n iz a tio n .

C o n s e q u e n tly ,

th e

o r g a n i z a t i o n c o u l d f a c e lo s s o f b u s i n e s s .

M o d u le 0 9 P ag e 1307

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .

as


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

D a n g e rs o f te r ro ris m T e rro ris m

a n d a n ti-s o c ia l e le m e n ts p o se a t h r e a t t o an o rg a n iz a tio n 's p e o p le a n d

p r o p e r t y . S o c ia l e n g i n e e r i n g a t t a c k s m a y b e u s e d b y t e r r o r i s t s t o m a k e a b l u e p r i n t o f th e ir ta rg e t.

L a w s u its a n d a r b itr a tio n --------

L a w s u i t s a n d a r b i t r a t i o n r e s u l t in n e g a t i v e p u b l i c i t y f o r a n o r g a n i z a t i o n a n d a f f e c t t h e

b u s in e s s ' p e r fo r m a n c e .

T e m p o ra ry ‫־‬

‫־‬

o r p e r m a n e n t c lo s u re

S o c ia l e n g i n e e r i n g a t t a c k s t h a t r e s u l t s in lo s s o f g o o d w i l l a n d l a w s u i t s a n d a r b i t r a t i o n

m a y f o r c e a t e m p o r a r y o r p e r m a n e n t c l o s u r e o f a n o r g a n i z a t i o n a n d its b u s i n e s s a c t i v i t i e s .

M o d u le 0 9 P ag e 1308

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

“ R e b e c c a ” a n d “ ][ e s s i c a ”

C EH C«rt1fw<

J

Attackers use the term "Rebecca" and "Jessica" to denote social engineering victim s

J

IU njI Nm Im

Rebecca and Jessica means a person who is an easy target fo r social engineering, such as the receptionist o f a company

Rebecca

Jessica

"T h e re w as a R ebecca a t th e b an k a nd I a m g o in g to call h e r to e x tra c t th e p riv ile g e d in fo rm a tio n ." E x a m p le :

"I m e t M s. Jessica, she w as an easy ta rg e t fo r social e n g in e e rin g ." "D o yo u have a R ebecca in y o u r c o m p a n y ? "

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

“ R e b e c c a ”

a n d

“ J e s s ic a ”

©

A t t a c k e r s u s e t h e t e r m s ‫ ״‬R e b e c c a " a n d " J e s s ic a " t o i m p l y s o c i a l e n g i n e e r i n g a t t a c k s

©

T h e y c o m m o n l y u s e t h e s e t e r m s in t h e i r a t t e m p t s t o " s o c i a l l y e n g i n e e r " v i c t i m s

©

R e b e c c a o r Je ssica m e a n s a p e r s o n w h o is a n e a s y t a r g e t f o r s o c ia l e n g i n e e r i n g s u c h as th e re c e p tio n is t o f a c o m p a n y

E x a m p le s : e

" T h e r e w a s a R e b e c c a a t t h e b a n k , a n d I a m g o i n g t o c a ll h e r t o e x t r a c t p r i v i l e g e d in fo rm a tio n ."

Q

" I m e t M s . J e s sic a ; s h e w a s a n e a s y t a r g e t f o r s o c ia l e n g i n e e r i n g . "

Q

" D o y o u h a v e a n y R e b e c c a s in y o u r c o m p a n y ? "

M o d u le 0 9 Page 1309

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Receptionists and Help Desk Personnel

Technical Support Executives

System Administrators

Vendors of the Target Organization

Users and Clients

Copyright © by EG-Gouncil. All Rights Reserved. Reproduction Is Strictly Prohibited.

C o m m o n

T a r g e ts

R e c e p tio n is ts

o f S o c ia l E n g in e e r in g

a n d

H e lp D e s k P e r s o n n e ll

m S o c ia l e n g i n e e r s g e n e r a l l y t a r g e t s e r v i c e d e s k o r h e l p d e s k p e r s o n n e l o f t h e t a r g e t o r g a n iz a tio n a n d t r y t o tr ic k t h e m in to r e v e a lin g c o n fid e n tia l in fo r m a t io n a b o u t th e com pany.

T e c h n ic a l S u p p o rt E x e c u tiv e s T e c h n i c a l s u p p o r t e x e c u t i v e s c a n b e o n e o f t h e t a r g e t s o f t h e s o c ia l e n g i n e e r s as t h e y m a y c a ll t e c h n i c a l s u p p o r t e x e c u t i v e s a n d t r y t o o b t a i n s e n s i t i v e i n f o r m a t i o n b y p r e t e n d i n g t o b e a h i g h e r - l e v e l m a n a g e m e n t a d m i n i s t r a t o r , c u s t o m e r , v e n d o r , e tc .

G

Q ‫׳ — —י‬

S y s te m

A d m in is tr a to r s

S o c ia l e n g i n e e r s k n o w t h a t t h e s y s t e m a d m i n i s t r a t o r is t h e p e r s o n w h o m a i n t a i n s t h e

s e c u rity

o f th e

s y s te m s

in

p a ssw o rd s. in fo rm a tio n .

th e

o rg a n iz a tio n .

The

s y s te m

o rg a n iz a tio n

and

may

If t h e

a tta c k e r

T h e re fo re ,

M o d u le 0 9 P ag e 1310

is a b l e

s y s te m

to

a d m in is tra to r

know tric k

is r e s p o n s i b l e

in fo rm a tio n

h im

a d m in is tra to r s

or

he r,

may

such

th e n

a ls o

be

as

th e

fo r

m a in ta in in g

a d m in is tra to r a tta c k e r can

th e

ta rg e t

of

th e

account

get

u s e fu l

a tta c k e rs .

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

U s e rs a n d —

‫־‬

Exam 3 1 2-50 C ertified Ethical H acker

C lie n ts

A n a t t a c k e r m a y c a ll u s e r s a n d c l i e n t s b y p r e t e n d i n g t o b e a t e c h s u p p o r t p e r s o n a n d

m a y tr y to e x tra c t s e n s itiv e in fo r m a tio n .

V e n d o rs S o m e tim e s ,

o f th e a

T a rg e t O r g a n iz a tio n

s o c ia l

e n g in e e r

may

a ls o

ta rg e t

ve n d o rs

to

g a in

c o n fid e n tia l

in fo r m a tio n a b o u t th e ta r g e t o rg a n iz a tio n .

M o d u le 0 9 P ag e 1311

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Com m on Targets of Social E ngineering: O ffice W orkers d

Despite having the best firewall, intrusion-detection, and antivirus systems, you are still h it w ith security breaches

CEH

Attackers can attem pt social engineering attacks on office workers to extract the sensitive data, such as: «

S e c u rity p o lic ie s

a

S e n s itiv e d o c u m e n ts

«

O ffic e n e t w o r k in fr a s tru c tu r e

«

P a s s w o rd s

A ttacker m aking an a tte m p t as a valid em ployee to ga th e r in fo rm a tio n fro m th e sta ff o f a com pany

The victim em ployee gives in fo rm a tio n back assuming th e attacker t o be a valid em plo yee

A ttacker

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

7/A A

| | H

C o m m o n W

T a r g e ts

o f

S o c ia l

E n g in e e r in g :

O ffic e

o r k e r s

S e c u r i t y b r e a c h e s a r e c o m m o n in s p i t e o f o r g a n i z a t i o n s e m p l o y i n g a n t i v i r u s s y s t e m s , i n t r u s i o n d e te c t io n s y s te m s , a n d o t h e r s t a t e - o f - t h e - a r t s e c u r ity t e c h n o lo g y . H e re th e a tta c k e r tr ie s t o e x p lo it e m p lo y e e s ' a tt it u d e s re g a r d in g m a in ta in in g th e s e c re c y o f an o rg a n iz a tio n 's s e n s itiv e in fo rm a tio n . A t t a c k e r s m i g h t a t t e m p t s o c ia l e n g i n e e r i n g a t t a c k s o n o f f i c e w o r k e r s t o e x t r a c t s e n s i t i v e d a t a s u c h as: Q

S e c u rity p o lic ie s

e

S e n s itiv e d o c u m e n t s

Q

O ffic e n e tw o r k in fr a s t r u c tu r e

Q

Passw ords

M o d u le 0 9 P ag e 1312

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

A tta c k e r m a k in g an a tte m p t as a v a lid e m p lo y e e to g a th e r in fo r m a tio n fr o m th e s ta ff o f a c o m p a n y

< .............................................................................................. The v ic tim e m p lo y e e gives in fo r m a tio n b ack a s s u m in g th e a tta c k e r to be a v a lid e m p lo y e e

V ic tim

FIGURE 09.1: Targets of Social Engineering

M o d u le 0 9 P ag e 1313

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

M o d u le F lo w

CEH

(•rt1fw< ttfciui lUilwt

Copyright © by IG‫־‬GtllllCil. All Rights Reserved. Reproduction is Strictly Prohibited.

M o d u le

F lo w

So

have

fa r,

we

d is c u s s e d

v a rio u s

s o c ia l

e n g in e e rin g

c o n c e p ts

and

how

s o c ia l

e n g i n e e r i n g c a n b e u s e d t o l a u n c h a t t a c k s a g a i n s t a n o r g a n i z a t i o n . N o w w e w i l l d is c u s s s o c ia l e n g in e e rin g te c h n iq u e s .

ML

S o c ia l E n g i n e e r i n g C o n c e p t s

H i

S o c ia l E n g i n e e r i n g T e c h n i q u e s

m

I m p e r s o n a t i o n o n S o c ia l N e t w o r k i n g S it e s

f f 1 ‫׳‬

eea

Id e n tity th e f t

S o c ia l E n g i n e e r i n g C o u n te rm e a s u re s

/‫׳‬ M

x:

J===

1 P e n e tra tio n

T e s tin g

T h is s e c t i o n h i g h l i g h t s t h e t y p e s o f s o c ia l e n g i n e e r i n g a n d v a r i o u s e x a m p l e s .

M o d u le 0 9 P ag e 1314

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

T

y p

e

Exam 3 1 2 -5 0 C ertified Ethical H acker

s

o

f

S

o c i a l

E

n

g

i n

e

e

r i n

g

C E H UrtifM itfciui NmIm

Human-based Social Engineering J

G a th e rs s e n s itiv e in f o r m a t io n b y in t e r a c t io n

J

A tta c k s o f th is c a te g o r y e x p lo it t r u s t , fe a r , a n d h e lp in g n a t u r e o f h u m a n s

Computer-based Social Engineering F

f

J

S o c ia l e n g in e e r in g is c a r r ie d o u t w it h t h e h e lp o f c o m p u t e r s

Mobile-based Social Engineering J

It is c a r r ie d o u t w it h t h e h e lp o f m o b ile a p p lic a t io n s

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

T y p e s

o f S o c ia l E n g in e e r in g

In a s o c ia l e n g i n e e r i n g a t t a c k , t h e a t t a c k e r u s e s s o c i a l s k i l l s t o t r i c k s t h e v i c t i m i n t o d i s c l o s i n g p e r s o n a l i n f o r m a t i o n s u c h as c r e d i t c a r d n u m b e r s , b a n k a c c o u n t n u m b e r s , p h o n e n u m b e rs, o r c o n fid e n tia l

in fo rm a tio n

a b o u t th e ir o rg a n iz a tio n

o r c o m p u t e r s y s te m ,

u s in g

w h i c h h e o r s h e e i t h e r l a u n c h e s a n a t t a c k o r c o m m i t s f r a u d . S o c ia l e n g i n e e r i n g c a n b e b r o a d l y d iv id e d in to th r e e ty p e s : h u m a n -b a s e d , c o m p u te r-b a s e d , a n d m o b ile -b a s e d .

H u m a n -b a s e d — By

s o c ia l e n g in e e r in g

H u m a n - b a s e d s o c ia l e n g i n e e r i n g i n v o l v e s h u m a n i n t e r a c t i o n in o n e m a n n e r o r o t h e r .

in te ra c tin g

w ith

th e

v ic tim ,

th e

a tta c k e r

g a th e rs

th e

d e s ire d

in fo rm a tio n

about

an

o r g a n i z a t i o n . E x a m p l e , b y i m p e r s o n a t i n g a n IT s u p p o r t t e c h n i c i a n , t h e a t t a c k e r c a n e a s i ly g a in access t o t h e s e rv e r ro o m . T h e fo llo w in g a re w a y s b y w h ic h th e a tta c k e r can p e r f o r m h u m a n b a s e d s o c ia l e n g i n e e r i n g : Q

P o s in g as a l e g i t i m a t e e n d u s e r

Q

P o s in g as a n i m p o r t a n t u s e r

©

P o s in g as t e c h n i c a l s u p p o r t

M o d u le 0 9 P ag e 1315

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

C o m p u te r-b a s e d

s o c ia l e n g in e e r in g

C o m p u t e r - b a s e d s o c ia l e n g i n e e r i n g d e p e n d s o n c o m p u t e r s a n d I n t e r n e t s y s t e m s t o c a rry o u t th e ta r g e te d a c tio n . T h e fo llo w in g a re th e w a y s b y w h ic h th e a tt a c k e r can p e r fo r m c o m p u t e r - b a s e d s o c ia l e n g i n e e r i n g : 0

P h is h i n g

0

Fake m a il

0

P o p -u p w in d o w a tta cks

M o b ile - b a s e d >— ‫׳ — ׳‬

S o c ia l E n g in e e r in g

M o b i l e - b a s e d s o c ia l e n g i n e e r i n g is c a r r i e d o u t w i t h t h e h e l p o f m o b i l e a p p l i c a t i o n s .

A tta c k e r s c re a te m a lic io u s a p p lic a tio n s w it h a ttr a c tiv e fe a tu r e s a n d s im ila r n a m e s t o th o s e o f p o p u l a r a p p l i c a t i o n s , a n d p u b l i s h t h e m in m a j o r a p p s t o r e s . U s e rs , w h e n t h e y d o w n l o a d t h i s a p p lic a tio n , a re a tta c k e d by m a lw a r e . T h e f o llo w in g a re th e w a y s by w h ic h th e a tta c k e r can p e r f o r m m o b ile - b a s e d s o c ia l e n g in e e r in g : 0

P u b lis h in g m a lic io u s a p p s

0

R e p a c k a g in g le g itim a te a p p s

0

Fake S e c u rity a p p lic a tio n s

0

U s in g S M S

M o d u le 0 9 P ag e 1316

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Human-based Social Engineering

CEH UrtifM ttfciui NmIm

Posing as a legitimate end user J

G iv e id e n t it y a n d a sk f o r t h e s e n s itiv e i n f o r m a t io n

"Hi! This is Jo h n , f r o m D e p a r tm e n t X. I h a v e fo r g o t te n m y p a s s w o r d . Can I g e t it? "

m

b

rn r

Posing as an important user J

IT ▲ t

P o s in g as a V IP o f a t a r g e t c o m p a n y , v a lu a b le c u s to m e r , e tc .

a

"Hi! This is K evin, CFO S e creta ry. I'm w o r k in g o n a n u r g e n t p r o je c t a n d lo s t m y s y s te m p a s s w o r d . Can y o u h e lp m e o u t? "

Posing as technical support C all as t e c h n ic a l s u p p o r t s t a f f a n d r e q u e s t ID s a n d p a s s w o rd s t o r e tr ie v e d a ta

"Sir, this is M athew , Technical support, X com pany. Last n ig h t w e h a d a sy stem crash here, a n d w e are checking fo r th e lo st data. Can u give m e your ID a n d p a ssw o rd ? " Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

H u m a n - b a s e d

S o c ia l E n g in e e r in g

In h u m a n - b a s e d s o c ia l e n g i n e e r i n g , t h e a t t a c k e r f u l l y i n t e r a c t s w i t h v i c t i m , p e r s o n - t o - p e r s o n , a n d t h e n c o l l e c t s s e n s i t i v e i n f o r m a t i o n . In t h i s t y p e o f s o c ia l e n g i n e e r i n g , t h e a t t a c k e r a t t a c k s th e

v ic tim 's

p s y c h o lo g y

u s in g fe a r o r t r u s t a n d th e

v ic tim

g iv e s t h e

a tta c k e r s e n s itiv e o r

c o n fid e n tia l in fo rm a tio n .

P o s in g An

as a L e g itim a te

a tta c k e r

m ig h t

use t h e

E n d U s e r

te c h n iq u e

o f im p e rs o n a tin g

an

e m p lo y e e ,

and

th e n

r e s o r tin g t o u n u s u a l m e t h o d s t o g a in access t o t h e p r iv ile g e d d a ta . He o r s h e m a y g ive a fa k e i d e n t i t y a n d a s k f o r s e n s i t i v e i n f o r m a t i o n . A n o t h e r e x a m p l e o f t h i s is t h a t a " f r i e n d " o f an e m p lo y e e

m ig h t tr y to

re trie v e

in fo r m a tio n th a t a b e d r id d e n e m p lo y e e s u p p o s e d ly needs.

T h e r e is a w e l l - r e c o g n i z e d r u l e in s o c i a l i n t e r a c t i o n t h a t a f a v o r b e g e t s a f a v o r , e v e n i f t h e o r i g i n a l " f a v o r " is o f f e r e d w i t h o u t a r e q u e s t f r o m t h e r e c i p i e n t . T h is is k n o w n as r e c i p r o c a t i o n . C o r p o r a t e e n v i r o n m e n t s d e a l w i t h r e c i p r o c a t i o n o n a d a i l y b a s is . E m p l o y e e s h e l p o n e a n o t h e r , e x p e c t i n g a f a v o r in r e t u r n . S o c ia l e n g i n e e r s t r y t o

ta k e

a d v a n ta g e

o f t h i s s o c ia l t r a i t v ia

im p e rs o n a tio n . E x a m p le " H i ! T h is is J o h n , f r o m D e p a r t m e n t X. I h a v e f o r g o t t e n m y p a s s w o r d . C a n I g e t i t ? "

M o d u le 0 9 P ag e 1317

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

P o s in g

Exam 3 1 2 -5 0 C ertified Ethical H acker

as a n Im p o rta n t U s e r

Im p e rs o n a tio n

is t a k e n t o a h i g h e r le v e l b y a s s u m i n g t h e

id e n tity o f an im p o r t a n t

e m p l o y e e in o r d e r t o a d d a n e l e m e n t o f i n t i m i d a t i o n . T h e r e c i p r o c a t i o n f a c t o r a ls o p l a y s a r o l e in t h i s s c e n a r i o , w h e r e l o w e r - l e v e l e m p l o y e e s m i g h t g o o u t o f t h e i r w a y t o h e l p a h i g h e r - l e v e l e m p l o y e e , so t h a t t h e i r f a v o r r e c e i v e s t h e p o s i t i v e a t t e n t i o n n e e d e d t o h e l p t h e m in t h e

c o rp o ra te

e n v i r o n m e n t . A n o t h e r b e h a v i o r a l t e n d e n c y t h a t a id s a s o c ia l e n g i n e e r is

p e o p l e ' s i n c l i n a t i o n n o t t o q u e s t i o n a u t h o r i t y . A n a t t a c k e r p o s i n g as a n i m p o r t a n t i n d i v i d u a l — s u c h as a v i c e p r e s i d e n t o r d i r e c t o r — c a n o f t e n

m a n ip u la te

a n u n p r e p a r e d e m p l o y e e . T h is

t e c h n i q u e a s s u m e s g r e a t e r s ig n ific a n c e w h e n t h e a t t a c k e r c o n s id e r s it a c h a lle n g e t o g e t a w a y w i t h i m p e r s o n a t i n g a n a u t h o r i t y f i g u r e . F o r e x a m p l e , a h e l p d e s k e m p l o y e e is less l i k e l y t o t u r n d o w n a r e q u e s t f r o m a v i c e p r e s i d e n t w h o sa ys h e o r s h e is p r e s s e d f o r t i m e a n d n e e d s t o g e t som e

im p o rta n t in fo rm a tio n

f o r a m e e t i n g . T h e s o c ia l e n g i n e e r m a y u s e t h e

a u th o rity to

in tim id a t e o r m a y e v e n t h r e a te n t o r e p o r t e m p lo y e e s t o t h e i r s u p e rv is o r if th e y d o n o t p ro v id e th e re q u e s te d in fo rm a tio n . E x a m p le ‫ ״‬H i! T h is is K e v in , t h e CFO s e c r e t a r y . I‫ ׳‬m w o r k i n g o n a n u r g e n t p r o j e c t a n d l o s t m y s y s t e m p a s s w o rd . Can y o u h e lp m e o u t ? "

M o d u le 0 9 P ag e 1318

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

P o s in g

Exam 3 1 2 -5 0 C ertified Ethical H acker

a s T e c h n ic a l S u p p o rt

A n o t h e r t e c h n i q u e i n v o l v e s a n a t t a c k e r m a s q u e r a d i n g as a t e c h n i c a l s u p p o r t p e r s o n , p a r t i c u l a r l y w h e n t h e v i c t i m is n o t p r o f i c i e n t in t e c h n i c a l a r e a s . T h e a t t a c k e r m a y p o s e as a h a rd w a re

v e n d o r,

a te c h n ic ia n ,

o r a c o m p u te r-a c c e s s o rie s

s u p p lie r w h e n

a p p ro a c h in g th e

v ic tim . O n e d e m o n s t r a t io n a t a h a c k e r m e e t in g h a d th e s p e a k e r c a llin g u p S ta r b u c k s a n d a s k in g t h e e m p l o y e e i f h is b r o a d b a n d c o n n e c t i o n w a s w o r k i n g c o r r e c t l y . T h e p e r p l e x e d e m p l o y e e r e p lie d t h a t it w a s t h e m o d e m t h a t w a s g iv in g t h e m t r o u b le . T h e a tt a c k e r , w i t h o u t g iv in g a n y c re d e n tia ls ,

went

on

to

get

th e

e m p lo y e e

to

read

th e

c re d it

card

num ber

t r a n s a c t i o n . In a c o r p o r a t e s c e n a r i o , t h e a t t a c k e r m a y a s k e m p l o y e e s t o

o f th e

la s t

r e v e a l t h e i r l o g in

i n f o r m a t i o n i n c l u d i n g a p a s s w o r d , in o r d e r t o s o r t o u t a n o n e x i s t e n t p r o b l e m . E x a m p le : " S ir, t h i s is M a t h e w , t e c h n i c a l s u p p o r t a t X c o m p a n y . L a s t n i g h t w e h a d a s y s t e m c r a s h h e r e , a n d w e a r e c h e c k i n g f o r l o s t d a t a . C a n y o u g i v e m e y o u r ID a n d p a s s w o r d ? "

M o d u le 0 9 P ag e 1319

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

C A L L - 407 45 986 74 I W t WORKING 24 HOURS A DAY

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

T e c h n ic a l S u p p o r t E x a m p le s E x a m p le : 1 A m a n c a lls a c o m p a n y ' s h e l p d e s k a n d sa y s h e h a s f o r g o t t e n h is p a s s w o r d . H e a d d s t h a t i f h e m is s e s t h e d e a d l i n e o n a b ig a d v e r t i s i n g p r o j e c t , h is b o s s m i g h t f i r e h i m . T h e h e l p d e s k w o r k e r fe e ls s o rry fo r h im

and

q u ic k ly resets th e

p a ssw o rd ,

u n w ittin g ly

g iv in g t h e

a tta c k e r c le a r

e n tra n c e in to th e c o rp o r a te n e tw o rk . E x a m p le : 2 A n a t t a c k e r s e n d s a p r o d u c t i n q u i r y m a i l t o J o h n , w h o is a s a l e s p e r s o n o f a c o m p a n y . T h e a t t a c k e r r e c e i v e s a n a u t o m a t i c r e p l y t h a t h e ( J o h n ) is o u t o f o f f i c e t r a v e l i n g o v e r s e a s ; u s i n g t h i s a d v a n ta g e , th e

a tta c k e r

im p e rs o n a te s

John

and

c a lls t h e

ta rg e t

c o m p a n y 's

te ch

su p p o rt

n u m b e r a s k i n g f o r h e l p in r e s e t t i n g h is p a s s w o r d b e c a u s e h e is o v e r s e a s a n d c a n n o t a c c e s s his e m a i l . If t h e t e c h p e r s o n b e l i e v e s t h e a t t a c k e r , h e i m m e d i a t e l y r e s e t s t h e p a s s w o r d b y w h i c h t h e a t t a c k e r g a in s a c c e s s t o J o h n ' s e m a i l , as w e l l t o o t h e r n e t w o r k r e s o u r c e s , i f J o h n h a s u s e d t h e s a m e p a s s w o r d . T h e n t h e a t t a c k e r c a n a ls o a c c e s s V P N f o r r e m o t e a c c e s s .

M o d u le 0 9 P ag e 1320

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

P

C

A u t h o r it y

Exam 3 1 2 -5 0 C ertified Ethical H acker

S u p p o r t E x a m p le

"H i, I a m Jo h n B r o w n . I'm w i t h t h e e x t e r n a l a u d i t o r s A r t h u r S a n d e rs o n . W e 'v e b e e n t o l d b y c o r p o r a te t o d o a s u rp ris e in s p e c tio n o f y o u r d is a s te r r e c o v e r y p ro c e d u re s . Y o u r d e p a r t m e n t has 10 m in u te s t o s h o w m e h o w y o u w o u ld re c o v e r f r o m a w e b s ite cra s h ."

M o d u le 0 9 P ag e 1321

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

A

u

t h

Exam 3 1 2 -5 0 C ertified Ethical H acker

o

r i t y

S

u p p o r t

E

x a

m

p

l e

CEH

(Cont’d)

"H i I'm S h a ro n , a sales

re p o u t of th e N e w Y ork o ffic e . I k n o w this is short n o tic e , b u t I h ave a g ro u p o f prospective c lie n ts o u t in th e c a r th a t I'v e b ee n tr y in g fo r months to get to o u ts o u rc e th e ir s e c u rity tr a in in g nee d s to us. T h e y 're located ju s t a fe w m ile s a w a y a n d I th in k th a t if I can g ive th e m a quick to u r o f o u r fa c ilitie s , it s h o u ld be e n o u g h to p ush th e m o v e r th e e dge a n d g e t th e m to sign u p.

Oh y e a h , th e y a re p a r tic u la r ly in te re s te d in w h a t s e c u rity p re c a u tio n s w e 'v e a d o p te d . Seem s s o m e o n e hacked in to th e ir w e b s ite a w h ile back, w h ic h is o ne o f th e re a so n s th e y 'r e c o n s id e rin g o u r c o m p a n y ." n

f

^

1

t

Copyright © by EG-GNOCil. All Rights Reserved. Reproduction is Strictly Prohibited.

A u t h o r it y ------------

S u p p o r t E x a m p le

( C o n t’d )

" H i I ' m S h a r o n ; a s a le s r e p o u t o f t h e N e w Y o r k o f f i c e . I k n o w t h i s is s h o r t n o t i c e , b u t I

h a v e a g r o u p o f p r o s p e c t i v e c l i e n t s o u t in t h e c a r t h a t I'v e b e e n t r y i n g f o r m o n t h s t o g e t t o o u t s o u r c e t h e i r s e c u r i t y t r a i n i n g n e e d s t o us. T h e y ' r e l o c a t e d j u s t a f e w m i l e s a w a y a n d I t h i n k t h a t if I can g ive t h e m a q u ic k t o u r o f o u r fa c ilitie s , it s h o u ld be e n o u g h t o p u s h t h e m o v e r t h e edge and get th e m

to

s ig n u p . O h y e a h , t h e y a r e p a r t i c u l a r l y i n t e r e s t e d

in w h a t s e c u r i t y

p r e c a u t i o n s w e ' v e a d o p t e d . S e e m s s o m e o n e h a c k e d i n t o t h e i r w e b s i t e a w h i l e b a c k , w h i c h is o n e o f th e re a s o n s th e y 'r e c o n s id e rin g o u r c o m p a n y ."

M o d u le 0 9 P ag e 1322

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

A u t h o r it y T

Exam 3 1 2 -5 0 C ertified Ethical H acker

S u p p o r t E x a m p le

( C o n tâ&#x20AC;&#x2122;d )

" H i , I ' m w i t h A i r c o n E x p re s s S e rv ic e s . W e r e c e i v e d a ca ll t h a t t h e c o m p u t e r r o o m w a s

g e t t i n g t o o w a r m a n d n e e d t o c h e c k y o u r H V A C s y s t e m . " U s in g p r o f e s s i o n a l - s o u n d i n g t e r m s lik e H V A C ( h e a t i n g , v e n t i l a t i o n , a n d a i r c o n d i t i o n i n g ) m a y a d d j u s t e n o u g h c r e d i b i l i t y t o a n in tru d e r 's m a s q u e r a d e t o a llo w h im o r h e r t o g a in access t o t h e t a r g e t e d s e c u re d re s o u rc e .

M o d u le 0 9 P ag e 1323

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

H u m a n - b a s e d

S o c ia l E n g in e e r in g :

E a v e s d r o p p in g

a n d

S h o u ld e r S u r fin g

CEH

Shoulder Surfing

Eavesdropping E a v e s d ro p p in g o r u n a u th o riz e d

S h o u ld e r s u rfin g uses d ire c t

lis te n in g o f c o n v e rs a tio n s o r re a d in g

o b s e rv a tio n te c h n iq u e s such as lo o k in g o v e r s o m e o n e 's s h o u ld e r to

o f m essages

g e t in fo rm a tio n such as p a s s w o rd s ,

In te rc e p tio n o f a n y fo r m such as a u d io ,

t l

v id e o , o r w r it te n

PINs, a c c o u n t n u m b e rs , etc. S h o u ld e r s u rfin g can also be d o n e fo rm

It can a lso b e d o n e u sin g

a lo n g e r d ista n ce w ith th e aid o f v is io n

c o m m u n ic a tio n c h a n n e ls su ch as

e n h a n c in g d evice s such as b in o c u la rs

te le p h o n e lin e s , e m a il, in s ta n t

to o b ta in s e n s itiv e in fo rm a tio n

m e ssa g in g , e tc.

t l

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

H u m a n - b a s e d a n d

S o c ia l E n g in e e r in g :

E a v e s d r o p p in g

S h o u ld e r S u r fin g

H u m a n - b a s e d s o c ia l e n g i n e e r i n g r e f e r s t o p e r s o n - t o - p e r s o n c o m m u n i c a t i o n t o r e t r i e v e d e s i r e d d a ta . A tt a c k e r can p e r f o r m c e rta in a c tiv itie s t o g a th e r in f o r m a t i o n f r o m o t h e r p e rs o n s . H u m a n - b a s e d s o c ia l e n g i n e e r i n g i n c l u d e s d i f f e r e n t t e c h n i q u e s , i n c l u d i n g :

” —

E a v e s d r o p p in g E a v e s d ro p p in g

re fe rs to th e

p ro ce ss o f u n a u th o r iz e d

lis te n in g to

c o m m u n ic a tio n

b e t w e e n p e r s o n s o r u n a u t h o r i z e d r e a d i n g o f m e s s a g e s . It i n c l u d e s i n t e r c e p t i o n o f a n y f o r m o f c o m m u n i c a t i o n , i n c l u d i n g a u d i o , v i d e o , o r w r i t t e n . It c a n a ls o b e d o n e u s i n g c o m m u n i c a t i o n c h a n n e l s s u c h as t e l e p h o n e lin e s , e m a i l , i n s t a n t m e s s a g i n g , e tc .

S h o u ld e r

S u r fin g

S h o u ld e r s u rfin g

is t h e

pro ce ss o f o b s e rv in g o r lo o k in g o v e r s o m e o n e 's s h o u ld e r

w h i l e t h e p e r s o n is e n t e r i n g p a s s w o r d s , p e r s o n a l i n f o r m a t i o n , PIN n u m b e r s , a c c o u n t n u m b e r s , a n d o t h e r in f o r m a t io n . T h ie v e s lo o k o v e r y o u r s h o u ld e r , o r e v e n w a tc h f r o m a d is ta n c e u sin g b i n o c u l a r s , in o r d e r t o g e t t h o s e p i e c e s o f i n f o r m a t i o n .

M o d u le 0 9 P ag e 1324

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0linCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Hum an-based Social Engineering: D um pster D iv in g

C EH

Dumpster diving is looking for treasure in someone else's trash

3^‫־‬sh Bins

Phone Bills

L

f

t

' Operations 1 Information

Financial ‫ו‬ Information ‫ן‬

Sticky

N o te s

Copyright © by EG-G0HCil. All Rights Reserved. Reproduction Is Strictly Prohibited.

H u m a n - b a s e d —N

_

S o c ia l E n g in e e r in g :

D u m p s t e r

D iv in g

D u m p s t e r d i v i n g is a p r o c e s s o f r e t r i e v i n g i n f o r m a t i o n b y s e a r c h i n g t h e t r a s h t o g e t

d a t a s u c h as a c c e s s c o d e s , p a s s w o r d s w r i t t e n d o w n o n s t i c k y n o t e s , p h o n e lis ts , c a l e n d a r s , a n d o r g a n iz a tio n a l c h a r t t o s te a l o n e 's i d e n t i t y . A tta c k e r s can use th is i n f o r m a t i o n t o la u n c h an a tta c k o n th e ta r g e t's n e tw o rk .

M o d u le 0 9 P ag e 1325

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Human-based Social Engineering

CEH

Third-Party Authorization

Tailgating

S u rv e y a ta r g e t c o m p a n y to

R e fe r t o a n i m p o r t a n t p e r s o n

A n u n a u th o r iz e d p e r s o n , w e a r in g

c o lle c t in f o r m a tio n o n :

in t h e o r g a n iz a t io n a n d t r y t o

a fa k e ID b a d g e , e n te r s a s e c u re d

c o lle c t d a ta

a re a b y c lo s e ly f o llo w in g an

"Mr. George, our Finance M anager, a sk ed th a t I pick up th e au d it reports. Will you p lea se provide th em to m e?"

a u th o r iz e d p e rs o n t h r o u g h a d o o r

In Person

V «

C u rre n t te c h n o lo g ie s C o n ta c t in fo r m a tio n

r e q u ir in g k e y a cce ss

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

H u m a n - b a s e d In

S o c ia l E n g in e e r in g

p e rs o n

A tta c k e r s m ig h t t r y t o v is it a t a r g e t s ite a n d p h y s ic a lly s u r v e y th e o r g a n iz a tio n f o r in fo r m a tio n . A g re a t deal o f in fo r m a tio n can be g le a n e d fr o m th e to p s o f desks, th e tra s h , o r eve n

phone

d ire c to rie s a nd

n a m e p la te s . A tta c k e rs

m a y d i s g u i s e t h e m s e l v e s as a

c o u r i e r o r d e l i v e r y p e r s o n , a j a n i t o r , o r t h e y m a y h a n g o u t as a v i s i t o r in t h e l o b b y . T h e y c a n p o s e as a b u s i n e s s p e r s o n , c l i e n t , o r t e c h n i c i a n . O n c e i n s id e , t h e y c a n l o o k f o r p a s s w o r d s o n t e r m i n a l s , i m p o r t a n t p a p e r s l y in g o n d e s k s , o r t h e y m a y e v e n t r y t o o v e r h e a r c o n f i d e n t i a l c o n v e rs a tio n s . S o c ia l e n g i n e e r i n g in p e r s o n i n c l u d e s a s u r v e y o f a t a r g e t c o m p a n y t o c o l l e c t i n f o r m a t i o n o f : 0

C u r r e n t t e c h n o l o g i e s i m p l e m e n t e d in t h e c o m p a n y

0

C o n t a c t i n f o r m a t i o n o f e m p l o y e e s a n d so o n

T h ir d -p a rty A u th o riz a tio n A n o th e r a u th o riz e d

p o p u la r

by som e

te c h n iq u e

a u th o rity

fig u re

fo r to

a tta c k e rs o b ta in

is t o

re p re s e n t

in fo rm a tio n

on

th e ir

th e m s e lv e s b e h a lf.

as

a g e n ts

For in s ta n c e ,

k n o w i n g w h o is r e s p o n s i b l e f o r g r a n t i n g a c c e s s t o d e s i r e d i n f o r m a t i o n , a n a t t a c k e r m i g h t k e e p ta b s on h im o r h e r a n d use th e in d iv id u a l's a b s e n c e t o le v e ra g e access t o t h e n e e d e d d a ta . T h e

M o d u le 0 9 P ag e 1 3 2 6

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

a tta c k e r m ig h t a p p ro a c h th e h e lp d e sk o r o t h e r p e rs o n n e l c la im in g he o r she has a p p ro v a l t o a c c e s s t h i s i n f o r m a t i o n . T h is c a n b e p a r t i c u l a r l y e f f e c t i v e i f t h e p e r s o n is o n v a c a t i o n o r o u t o f t o w n , a n d v e r i f i c a t i o n is n o t i n s t a n t l y p o s s i b le . Even th o u g h t h e r e m ig h t be a h in t o f s u s p ic io n o n t h e a u t h e n t i c i t y o f th e re q u e s t, p e o p le te n d t o o v e r l o o k t h i s in o r d e r t o b e h e l p f u l in t h e w o r k p l a c e . P e o p l e t e n d t o b e l i e v e t h a t o t h e r s a r e e x p r e s s i n g t h e i r t r u e i n t e n t i o n s w h e n t h e y m a k e a s t a t e m e n t . R e f e r t o a n i m p o r t a n t p e r s o n in th e o r g a n iz a tio n t o t r y t o c o lle c t d a ta .

T a ilg a tin g An u n a u th o riz e d

p e r s o n w e a r i n g a f a k e ID b a d g e e n t e r s a s e c u r e d a r e a b y c l o s e l y

f o l l o w i n g an a u th o r iz e d p e rs o n t h r o u g h a d o o r r e q u ir in g ke y access. A n a u t h o r iz e d p e rs o n m a y n o t be a w a r e o f h a v in g p r o v id e d an u n a u th o r iz e d p e rs o n access t o a s e c u re d area. T a ilg a tin g i n v o l v e s c o n n e c t i n g a u s e r t o a c o m p u t e r in t h e s a m e s e s s i o n as ( a n d u n d e r t h e s a m e r i g h t f u l i d e n t i f i c a t i o n as) a n o t h e r u s e r , w h o s e s e s s io n h a s b e e n i n t e r r u p t e d .

M o d u le 0 9 P ag e 1327

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Human-based Social Engineering (Cont’d)

£ £H |

(•rtifWd lU.ul lUilwt

ts ► Re Reverse Social Engineering J

Piggybacking

A s itu a t io n in w h ic h an

J

a tta c k e r p re s e n ts h im s e lf as

"I f o r g o t m y ID b a d g e a t h o m e . P le a s e h e lp m e ."

a n a u t h o r i t y a n d t h e ta r g e t J

s e e k s h is a d v ic e o ffe r in g t h e

A n a u th o r iz e d p e rs o n a llo w s ( in t e n t io n a lly o r u n in te n tio n a lly )

in f o r m a tio n t h a t h e n e e d s

a n u n a u th o r iz e d p e r s o n t o p ass J

R e ve rse s o c ia l e n g in e e r in g

t h r o u g h a s e c u re d o o r

a tta c k in v o lv e s s a b o ta g e , m a r k e t in g , a n d te c h s u p p o r t

‫ן‬

J

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

H u m a n - b a s e d R e v e rs e o

S o c ia l E n g in e e r in g

( C o n t’ d )

S o c ia l E n g in e e r in g

In r e v e r s e s o c ia l e n g i n e e r i n g , a p e r p e t r a t o r a s s u m e s t h e r o l e o f a p e r s o n in a u t h o r i t y a n d has e m p lo y e e s a s k in g h im o r h e r f o r in f o r m a t io n . T h e a tt a c k e r u s u a lly m a n ip u la te s

t h e t y p e s o f q u e s t i o n s a s k e d t o g e t t h e r e q u i r e d i n f o r m a t i o n . T h e s o c ia l e n g i n e e r f i r s t c r e a t e s a p r o b l e m , a n d t h e n p r e s e n t s h i m s e l f o r h e r s e l f as t h e e x p e r t o f s u c h a p r o b l e m t h r o u g h g e n e r a l c o n v e r s a t i o n , e n c o u r a g i n g e m p l o y e e s t o a s k f o r s o l u t i o n s . F o r e x a m p l e , a n e m p l o y e e m a y a sk a b o u t h o w t h i s p r o b l e m a f f e c t e d p a r t i c u l a r f i l e s , s e r v e r s , o r e q u i p m e n t . T h is p r o v i d e s p e r t i n e n t i n f o r m a t i o n t o t h e s o c ia l e n g i n e e r . M a n y d i f f e r e n t s k ills a n d e x p e r i e n c e s a r e r e q u i r e d t o c a r r y o u t th is t a c t ic s u c c e s s fu lly . P ig g y b a c k in g P i g g y b a c k i n g is a p r o c e s s o f d a t a a t t a c k t h a t c a n b e d o n e p h y s i c a l l y a n d e l e c t r o n i c a l l y . P h y s ic a l p i g g y b a c k i n g is a c h i e v e d b y m i s u s i n g a f a l s e a s s o c i a t i o n t o g a i n a n a d v a n t a g e a n d g e t a c c e s s . A n a t t a c k e r c a n s lip b e h i n d a l e g i t i m a t e e m p l o y e e a n d g a i n a c c e s s t o a s e c u r e a r e a t h a t w o u ld u s u a lly b e lo c k e d o r re q u ir e s o m e ty p e o f b i o m e t r ic access f o r e n tr a n c e a n d c o n tr o l m e c h a n i s m t o o p e n a d o o r lo c k , e tc .

M o d u le 0 9 P ag e 1328

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

E l e c t r o n i c p i g g y b a c k i n g c a n b e a c h i e v e d in a n e t w o r k o r w o r k s t a t i o n w h e r e a c c e s s t o c o m p u t e r s y s t e m s is l i m i t e d t o t h o s e i n d i v i d u a l s w h o h a v e t h e p r o p e r u s e r ID a n d p a s s w o r d . W h e n a u s e r f a i l s t o p r o p e r l y t e r m i n a t e a s e s s io n , t h e l o g o f f is u n s u c c e s s f u l o r t h e p e r s o n m a y a t t e n d t o o t h e r b u s i n e s s w h i l e s ti l l l o g g e d o n . In t h i s c a s e , t h e a t t a c k e r c a n t a k e a d v a n t a g e o f t h e a c t i v e s e s s io n .

M o d u le 0 9 P ag e 1329

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

W

Exam 3 1 2 -5 0 C ertified Ethical H acker

a t c h

t h e s e

M

o

v i e

s

le o n a r d o d ic a p r io

to m h a n k s

Copyright O by E&GMncil. All Rights Reserved. Reproduction is Strictly Prohibited.

W

a tc h

T h e re

a re

th e s e m any

M o v ie s

m o v ie s

in w h i c h

s o c ia l

e n g in e e r in g

is h i g h l i g h t e d .

W a tc h

th e s e

m o v i e s t o g e t b o t h e n t e r t a i n m e n t a n d t h e k n o w l e d g e o f s o c ia l e n g i n e e r i n g .

FIGURE 0 9 .2 : It a lia n Jo b M o v i e W a l l P ap e r

M o d u le 0 9 P ag e 1330

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

W a tc h th is M o v ie

C EH

UrtiM Itkml Mstkm

S o c ia l E n g in e e r in g In t h e 2 0 0 3 m o v ie " M a t c h s t ic k M e n " , N ic o la s

M A T C H S T IC K

C age p la y s a c o n a r t is t re s id in g in Los A n g e le s

l \ / 1 1= l \ I

a n d o p e ra te s a fa k e lo t te r y , s e llin g o v e r p r ic e d w a t e r f i l t r a t i o n s y s te m s t o u n s u s p e c tin g c u s to m e rs , in t h e p ro c e s s c o lle c tin g o v e r a m illio n d o lla rs

M a n ip u la t in g P e o p le

T h is m o v ie is a n e x c e lle n t s tu d y in t h e a r t o f s o c ia l e n g in e e r in g , th e a c t o f m a n ip u la t in g p e o p le in t o p e r f o r m in g a c tio n s o r d iv u lg in g c o n f id e n tia l in f o r m a tio n

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

u

W

a tc h

th is

M o v ie

In t h e 2 0 0 3 m o v i e " M a t c h s t i c k M e n , " N i c o l a s C a g e p la y s a c o n a r t i s t r e s i d i n g in Los

A n g e le s a n d o p e r a te s a fa k e lo tte r y , s e llin g o v e r p r ic e d w a t e r f i l t r a t i o n s y s te m s t o u n s u s p e c t in g c u s t o m e r s , in t h e p r o c e s s c o l l e c t i n g o v e r a m i l l i o n d o l l a r s . T h is m o v i e is a n e x c e l l e n t s t u d y in t h e a r t o f s o c ia l e n g i n e e r i n g , t h e a c t o f m a n i p u l a t i n g p e o p l e in to p e rfo r m in g a c tio n s o r d iv u lg in g c o n fid e n tia l in fo r m a tio n .

FIGURE 0 9 .3 : M A T C H STICK M E N M o v i e W a l l P a p e r

M o d u le 0 9 P ag e 1331

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Computer-based Social Engineering P o p -u p W i n d o w s W in d o w s th a t s u d d e n ly p o p up w h ile s u rfin g th e In te rn e t and ask fo r users' in fo r m a tio n to log in o r sign -in

S p a m E m a il

H oax L e tte rs

Irre le v a n t, u n w a n te d , and

H oax le tte rs are e m a ils th a t

u n s o lic ite d e m a il to c o lle c t

issue w a rn in g s to th e user

th e fin a n c ia l in fo rm a tio n ,

o n n e w viruse s, Trojans, o r w o rm s th a t m a y h a rm th e

so cia l s e c u rity n u m b e rs , and n e tw o r k in fo rm a tio n

user's system

In s ta n t C hat M essenger

C h a in L e tt e r s

G a th e rin g p e rs o n a l in fo r m a tio n by

Chain le tte rs are e m ails th a t o ffe r

c h a ttin g w ith a se le cte d o n lin e user

fre e g ifts such as m o n e y and

to g e t in fo rm a tio n such as b irth

s o ftw a re o n th e c o n d itio n th a t th e

d ates and m a id e n nam es

u s e r has to fo r w a r d th e m a il to th e said n u m b e r o f p e rso n s

Copyright © by EG-G(ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

C o m p u te r - b a s e d C o m p u te r-b a s e d

s o c ia l

S o c ia l E n g in e e r in g e n g in e e rin g

is

m o s tly

done

by

u s in g

d iffe re n t

m a lic io u s

p r o g r a m s a n d s o f t w a r e a p p l i c a t i o n s s u c h as e m a i l s , T r o j a n s , c h a t t i n g , e t c . T h e r e a r e m a n y t y p e s o f c o m p u t e r - b a s e d s o c i a l e n g i n e e r i n g a t t a c k s ; s o m e o f t h e m a r e as f o l l o w s : ©

P o p - u p W i n d o w s : A p o p - u p w i n d o w a p p e a rs a n d it d is p la y s an a le r t t h a t t h e n e t w o r k w a s d is c o n n e c te d a n d y o u n e e d t o re -lo g in . T h e n a m a lic io u s p r o g r a m in s ta lle d b y th e a tt a c k e r e x tr a c ts th e t a r g e t 's lo g in i n f o r m a t i o n a n d se n d s it t o th e a tta c k e r 's e m a il o r t o a r e m o t e s ite . T h is t y p e o f a t t a c k c a n b e a c c o m p l i s h e d u s i n g T r o j a n s a n d v i r u s e s .

9

Spam

E m a il: H e re t h e

a tta c k e r sends an e m a il t o th e ta r g e t t o

c o lle c t c o n fid e n tia l

i n f o r m a t i o n l ik e b a n k d e t a i l s . A t t a c k e r s c a n a ls o s e n d a m a l i c i o u s a t t a c h m e n t s u c h as v i r u s o r T r o j a n a l o n g w i t h e m a i l . S o c ia l e n g i n e e r s t r y t o h i d e t h e f i l e e x t e n s i o n b y g i v i n g th e a tt a c h m e n t a lo n g file n a m e . Q

In s ta n t C hat M e s s e n g e r: An a tta c k e r ju s t needs to ch a t w ith s o m e o n e and th e n tr y to e l i c i t i n f o r m a t i o n . By u s i n g a f a s c i n a t i n g p i c t u r e w h i l e c h a t t i n g , t h e a t t a c k e r c a n t r y t o lu re t h e v ic tim . T h e n , s lo w ly t h e a t t a c k e r can ask c e rta in q u e s tio n s by w h ic h th e ta r g e t can

e lic it

M o d u le 0 9 P ag e 1332

in fo rm a tio n .

T h e y ask d iffe r e n t q u e s tio n s

to

g e t th e

ta rg e t's

e m a il

and

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

p a ssw o rd . A tta c k e rs firs t cre a te d e e p tr u s t w ith th e ta r g e t and th e n

m a k e th e fin a l

a tta c k . Q

H o a x L e tte r s : H o a x le tte r s a re e m a ils t h a t issue w a r n in g s t o t h e u s e r o n n e w v iru s e s , T ro ja n s , o r w o r m s t h a t m a y h a r m t h e u s e r's s y s te m . T h e y d o n o t u s u a lly c a u se a n y p h y s i c a l d a m a g e o r lo ss o f i n f o r m a t i o n ; t h e y c a u s e a lo ss o f p r o d u c t i v i t y a n d a ls o u s e an o r g a n iz a tio n 's v a lu a b le n e t w o r k re s o u rc e s .

0

C h a i n L e t t e r s : C h a in l e t t e r s a r e e m a i l s t h a t o f f e r f r e e g i f t s s u c h as m o n e y a n d s o f t w a r e o n t h e c o n d i t i o n t h a t t h e u s e r h a s t o f o r w a r d t h e m a i l t o a s a id n u m b e r o f p e r s o n s .

M o d u le 0 9 P ag e 1333

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Com puter-based Social Engineering: Pop-Ups

CEH

Pop-ups trick users into clicking a h yp erlink th a t redirects them to fake w eb pages asking fo r personal inform ation, or downloads malicious programs such keyloggers, Trojans, or \ spyware

liitt'in t't A n tivirti* Piu W jin im jl

11 1

I Harmful <jr i rr «jlicluus •JuflwarL* delected

AWit V‫׳‬vl •J Irown lM.Wm3^>aker.o ■J V*u«.Wm32>0kcr.a V* 11‫׳‬ojonJ*bWJJA1.luntcr

A |

Ho* Hflh Hflh

____ * J

| B1wftn-AI | | [;nv-

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

J

l J

C o m p u te r - b a s e d

S o c ia l E n g in e e r in g :

P o p - u p s

T h e c o m m o n m e t h o d o f e n t i c i n g a u s e r t o c l ic k a b u t t o n in a p o p - u p w i n d o w is b y w a r n i n g a b o u t a p r o b l e m s u c h as d i s p l a y i n g a r e a l i s t i c o p e r a t i n g s y s t e m o r a p p l i c a t i o n e r r o r m e s s a g e , o r b y o ff e r in g a d d itio n a l s e rv ic e s .

A w in d o w a p p e a rs o n th e s c re e n re q u e s tin g th e

u s e r t o re -lo g in , o r t h a t th e h o s t c o n n e c tio n has b e e n in t e r r u p t e d a n d th e n e t w o r k c o n n e c tio n n e e d s t o be r e - a u th e n tic a te d . T h e p o p - u p p ro g r a m w ill th e n e m a il th e access in f o r m a t io n t o t h e i n t r u d e r . T h e f o l l o w i n g a r e t w o s u c h e x a m p l e s o f p o p - u p s u s e d f o r t r i c k i n g u s e rs : Internet Antivirus Pro W ttininy! I H arm ful an d m a llclu u s so ftw a re d e te c te d

g lrojan-IM.Wm32>aker.a V Vtrut.VAn32.Fakcr.a IrojjrvPSW.BAT.Cunter

FIGURE 09.4: Computer-based Social Engineering Pop-ups Screen shot

M o d u le 0 9 P ag e 1334

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Com puter-based Social Engineering: Phishing

t h e a t t a c k e r t o g e t t h e t a r g e t 's b a n k in g d e t a ils a n d o t h e r a c c o u n t d e ta ils . A t t a c k e r s use e m a ils t o g a in p e rs o n a l d e ta ils a n d r e s t r i c t e d i n f o r m a t i o n . A t t a c k e r s m a y se n d e m a il m e s s a g e s t h a t appear to

have

com e fro m

v a lid

o rg a n iz a tio n s , such

as b a n k s o r p a r t n e r c o m p a n i e s . T h e

r e a l i s t i c c o v e r - u p u s e d in t h e e m a i l m e s s a g e s i n c l u d e c o m p a n y lo g o s , f o n t s , a n d f r e e h e l p d e s k s u p p o r t p h o n e n u m b e r s . T h e e m a i l c a n a ls o c a r r y h y p e r l i n k s t h a t m a y t e m p t a m e m b e r o f a s t a f f t o b r e a c h c o m p a n y s e c u r i t y . In r e a l i t y , t h e w e b s i t e is a f a k e a n d t h e t a r g e t ' s i n f o r m a t i o n is s to le n a n d m is u s e d .

M o d u le 0 9 P ag e 1335

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

-J

J

*‫ ל‬O ♦ M eutfe

Exam 3 1 2-50 C ertified Ethical H acker

Urgent Atterticn Required CmDANK Update

rn*c

cptom

3 : ‫ז‬, ‫ >חגנ‬ccn^rwai’ c

Foimat re*t r,»:«gcitibank c

Review

M «j» 9 0 (HTML)

Developer

*ofl-lm

UntoW«flt/ll/»102S7P*J

cfFi

Urgent -Oenaon R-4jireC - ClT E-f.K Update

CITIBANK Update

We recently have discovered that multiple computers have attamepted to log into your CITIBANK Online Account, and multiple password failures were presented before the logons. We now require you to re‫־‬validate your account information to

««1

fair C*Q You! Acctuni Intuiniidui AIMCad Nuibei:‫־‬

If this is not completed by Sep 14,2010, we will be forced to suspend your account indefinitely‫ ״‬as it may have been used fraudulent purposes. tn ‫ «־‬n Typ•■toMUse• I>. Yaji Paftworc

To continue please Click Here or on the link below to re validate your account information:________________ | http://www.citibank.com/updatel" ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ‫!■■■■ י‬ Sincerely The CITIBANK Team

Please do not reply to this e-mail. Mail sent to this address cannot be answered.

3er<1;e@vt»3*r#ccn

0

*

FIGURE 09.5: Computer-based Social Engineering Phishing Screen shots

M o d u le 0 9 P ag e 1336

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Com puter-based Social Engineering: Phishing (cont’d) w uh•

‫»ז‬ V*Ml

owm ii!

9 ‫״‬ SM «M12ta1(U24UI

«a*»w

»*

■a

CEH SMC Wtd 12*4*1011MAM

R>

s>

HSBC O

Dear HSBC Online user, Dear V alued C ustom er.

J

Our new security system w ill help you to avoid frequently fraud transactions and to keep you r C redit/D ebit Card details in safety.

As part of our security measures, the HSBC Bank, has developed a security program against the fraudulent attempts and account thefts. Therefore, our system requires further account information. We request information from you for the following reason. We need to verify your account information in order to insure the safety and integrity o f our services.

Due to technical update w e recomm end you to reactivate your card. Please d ic k on th e link below to proceed: U pdate MasterCard

Please fo llow the link below to proceed.

W e appreciate your business. It's tru ly ou r pleasure to serve you.

Proceed to Account Verification

MasterCard Custom er Care.

Once you login, you w ill be provided w ith steps to complete the verification process. For your safety, we have physical, electronic, procedural safeguards that comply w ith federal regulations to protect the Information you to provide to us.

This email is fo r notificatio n purposes only, msg id: 1248471

J A -‫י‬

‫״‬m Your online banking is blocked We are recently reviewed your account, and suspect that your Natwest Bank online Banking account may have been accessed by an unauthorized third party. Protecting the secunty of your account is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features. To restore your account access, we need you to confirm your identity, to do so we need you to follow the hnk below and proceed to confirm your information

httPl:V/wwwnjtyK}UQ,tfk

Thanks for your patience as we work together to protect your account. Sincerely, Natwest Bank Online Bank Customer Service •Important* Please update your records on or before 48 hours, a failure to update your records will result in < temporal hold on your funds.

o»‫׳‬ir/M*d*n,

# BARCLAY'S

Barclays Bank PIC always looks forward for the high security of our clients. Some customer* have been receiving an email claiming to be from Barclays advising them to folow a link to what appear to be a Barclays web ute. where they are prompted to enter their personal Online Banking details. Barclays is m no way involved with this email and the web ute does not belong to us. Barclays is proud to announce about their new updated secure system. We updated our new SSLservers to give our customer better fast and secure online banking service. Due to the recent update of the server, you are requested to please update your account into at the folowmg Ink. https://updateAarclawcp.Uk/0lb/p/l0tln Member ■do We have asked few additional information which Isgoing to be the part of secure login process. These additional information wil be asked during your future login security so, please provide all these info completely and correctly otherwise due to security reasons we may have to dose your account

Source:htp://www.bonksafeonline.org.uk Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

C o m p u te r - b a s e d in

k

S o c ia l E n g in e e r in g :

P h is h in g

( C o n t’d )

In t h e p r e s e n t w o r l d , m o s t b a n k t r a n s a c t i o n s c a n b e h a n d l e d a n d c a r r i e d o u t o n t h e I n t e r n e t . M a n y p e o p l e u s e I n t e r n e t b a n k i n g f o r all t h e i r f i n a n c i a l n e e d s , s u c h as o n l i n e s h a r e t r a d i n g a n d e c o m m e r c e . P h is h in g in v o lv e s f r a u d u l e n t l y a c q u ir in g s e n s itiv e i n f o r m a t i o n

(e .g ., p a s s w o r d s ,

c r e d i t c a r d d e t a i l s , e t c . ) b y m a s q u e r a d i n g as a t r u s t e d e n t i t y . T h e t a r g e t re c e iv e s an e m a il t h a t a p p e a rs t o be s e n t f r o m t h e b a n k a n d it r e q u e s ts t h e u s e r t o c l ic k o n t h e U R L o r l i n k p r o v i d e d . If t h e u s e r b e l i e v e s t h e w e b p a g e t o b e a u t h e n t i c a n d e n t e r s h is o r

her user nam e,

p a ssw o rd , and

o th e r

in fo rm a tio n , th e n

all t h e

in fo rm a tio n

w ill

be

c o l l e c t e d b y t h e s i t e . T h is h a p p e n s b e c a u s e t h e w e b s i t e is a f a k e a n d t h e u s e r ' s i n f o r m a t i o n is s t o l e n a n d m i s u s e d . T h e c o l l e c t e d i n f o r m a t i o n f r o m t h e t a r g e t is d i r e c t e d t o t h e a t t a c k e r ' s e m a il.

M o d u le 0 9 P ag e 1337

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

L ic n p Bear HSBC Online user, Dear V alued C ustom er,

I l k j O V ^

As part of our security measures, the HSBC Bank, has

Our new security system w ill help you to avoid frequently

developed a secu rity p rogram against th e frau du len t a tte m p ts and account th e fts.

fraud transactions and to keep your Credit/Debit Card details in safety.

Therefore, o u r system req uires fu rth e r acco un t Inform atio n.

Due to technical update w e recommend you to reactivate your card.

We request information from you for the following reason. We need to verify your account information in order to Insure the safety and Integrity of our services.

Please dick on the link below to proceed: Update MasterCard W e appreciate your business. It's truly our pleasure to serve you.

Please follow the link below to proceed. Proceed to Account Verification

MasterCard Customer Care.

Once you login, you will be provided with steps to complete the verification process. For

This email is for notification purposes only,

you r s afety, w e have physical, e le ctro n ic, procedural safeguards th a t com p ly oath fe de ra l

msg id: 1248471

re g ulatio ns to pro te c t th e info rm a tio n you to provide to us.

♦ BARCLAYS ‫ף‬

<‫ ״י‬NatWest Y o u r o n lin e b a n k in g is b lo c k e d w e are r e c e n tly revie w e dyo uracco un t, and suspect th a t y o u r N atw est Bank o n lin e Bankingaccount may have been accessed by an un au th o rire d th ird party. P rotectm gthe s e c u rity o f you r account is ou r p rim ary conccm . Therefore, as a pre ven tative measure, w e have tem p orarily lim ite d access to sensitive account features. to resto re you r account x c ess, w e need you to con firm your id e n tity , to do so w e need you to fo llo w th e lin k b e low a nd proceed to con firm your in fo rm a tion h ttps://w w w .na tw est.co.u k Thanks fo r your patience as vw*• w ork to ge the r to p rotect your account.

Dear Sir/M adam , Barclays Bank p ic always looks to w a rd for the high security of our clients. Some customers have been receiving on email claiming to be from Barclays advising them to follow a knk to what appear to be a Barclays web sit?, where they are prompted to enter their perioral On l i e Banking details. Barclays is In no way involved with this email and the web site does not belong to us. Barclays s proud to announce about their new updotod secure system. We updated our new SSI servers to give our customer better fast and secure online banking service Due to the recent update of the server, you are lequasted to plaase update your account into at :be *0 lowing ink.

Sincerely.

*im portant‫״‬ We have asked few additional information which is going to be the part of secure login process. These additional information will be asked during your future login security , please provide all these *»fo completely and correctly otherwise due to security reasons we may have to close youi accojnt tem porary.

Natwest B*nk O nline Bank Customer Service *im po rta nt* ?lease update your records on or before4& hours, a fa ilu re to update your records w ill result in a te m p oral hold on you r funds.

10

FIG U R E 0 9 .6 : C o m p u te r - b a s e d S o c ia l E n g in e e r in g P h is h in g S c re e n s h o ts

M o d u le 0 9 P ag e 1338

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0l1nCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Com puter-based Social Engineering: Spear Phishing

CEH

S p e a r p h is h in g is a d ir e c t , t a r g e te d p h is h in g a tta c k a im e d a t s p e c ific in d i v id u a ls w i t h i n a n o r g a n iz a t io n

In c o n tra s t to n o rm a l p h is h in g a tta c k w h e re a tta c k e rs s e n d o u t h u n d re d s o f g e n e ric m essages to ra n d o m e m a il a d d re s s e s , a tta c k e rs use s p e a r p h is h in g to se nd a m essage w it h s p e c ia liz e d , s o c ia l e n g in e e r in g c o n te n t d ire c te d a t a s p e c ific p e rs o n o r a s m a ll g ro u p o f p e o p le

S p e a r p h is h in g g e n e r a te s h ig h e r r e s p o n s e r a te w h e n c o m p a r e d t o n o r m a l p h is h in g a tta c k

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

C o m p u te r - b a s e d

S o c ia l E n g in e e r in g :

S p e a r P h is h in g

S p e a r p h i s h i n g is a n e m a i l s p o o f i n g a t t a c k o n t a r g e t s s u c h as a p a r t i c u l a r c o m p a n y , an o rg a n iz a tio n , o r a g ro u p o r g o v e r n m e n t a g e n c y t o g e t access t o t h e i r c o n fid e n tia l in f o r m a tio n s u c h as f i n a n c i a l i n f o r m a t i o n , t r a d e s e c r e t s , o r m i l i t a r y i n f o r m a t i o n . T h e f a k e s p e a r - p h i s h i n g m e s s a g e s a p p e a r t o c o m e f r o m a t r u s t e d s o u r c e a n d a p p e a r as a c o m p a n y ' s o f f i c i a l w e b s i t e ; t h e e m a i l a p p e a r s as t o b e f r o m a n i n d i v i d u a l w i t h i n t h e r e c i p i e n t ' s o w n c o m p a n y a n d g e n e r a l l y s o m e o n e in a p o s i t i o n o f a u t h o r i t y . T h is t y p e o f a t t a c k i n c l u d e s : 0

T h e ft o f lo g in c re d e n tia ls

0

O b s e rv a tio n o f c r e d it c a rd d e ta ils

0

T h e ft o f tr a d e se cre ts a nd c o n fid e n tia l d o c u m e n t s

0

D is tr ib u tio n o f b o t n e t a n d D D oS a g e n ts

M o d u le 0 9 P ag e 1339

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

f

M obile-based Social Engineering: AppsM alicious Publishing 0

‫״‬ ,‫־‬

J

Attackers create m alicious apps w ith attractive features and sim ilar names to tha t o f popular apps, and publish them on m ajor app stores

J

Unaware users do w n lo a d these apps and get infected by m alware tha t sends credentials to attackers

0

0

0 Attacker publishes malicious mobile apps on app store

% DC

App S to r e

M a lic io u s G am ing

Attacker

A p p lic a tio n

User download and install the malicious mobile application

User credentials sends to the attacker

User Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

M o b ile - b a s e d M

a lic io u s

S o c ia l E n g in e e r in g :

P u b lis h in g

A p p s

In m o b i l e - b a s e d s o c ia l e n g i n e e r i n g , t h e a t t a c k e r c a r r i e s o u t t h e s e t y p e s o f a t t a c k s w i t h t h e h e l p o f m o b i l e a p p l i c a t i o n s . H e r e t h e a t t a c k e r f i r s t c r e a t e s m a l i c i o u s a p p l i c a t i o n s s u c h as g a m i n g a p p lic a tio n s w it h a t t r a c t iv e f e a t u r e s a n d n a m e s t h e m t h a t o f p o p u la r a p p s , a n d p u b lis h e s t h e m in m a j o r a p p l i c a t i o n s t o r e s . U s e r s w h o a r e u n a w a r e o f t h e m a l i c i o u s a p p l i c a t i o n b e l i e v e s t h a t it is a g e n u i n e a p p l i c a t i o n a n d d o w n l o a d a n d i n s t a l l t h e s e m a l i c i o u s m o b i l e a p p l i c a t i o n s o n t h e i r m o b ile d e v ic e s , w h ic h b e c o m e in fe c te d b y m a lw a r e t h a t s e n d s u s e r c r e d e n t ia ls (u s e r n a m e s , p a s s w o rd s ) t o a tta c k e rs .

M o d u le 0 9 P ag e 1340

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

A tta c k e r p u b lis h e s C re a te s m a lic io u s

m a lic io u s m o b ile

m o b ile a p p lic a tio n

app s o n a p p s to re

Š M a lic io u s G a m in g

A tta cke r

A p p lic a tio n

U s e r c r e d e n tia ls

U s e r d o w n lo a d a n d in s ta ll

s end s t o t h e a tta c k e r

t h e m a lic io u s m o b ile a p p lic a tio n

U se r FIGURE 09.7: Mobile-based Social Engineering Publishing Malicious Apps

M o d u le 0 9 P ag e 1341

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

M obile-based Social Engineering: Repackaging Legitim ate Apps

Malicious developer downloads a legitimate game and repackages it with malware

Developer creates a gaming app and uploads on app store

f

CEH

User credentials sends to the malicious developer *•*

t L e g itim a te D e v e lo p e r

End user downloads malicious gamming app

U ser

T h ird -P a rty A p p S to re

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

M o b ile - b a s e d L e g it im a t e

S o c ia l E n g in e e r in g :

R e p a c k a g in g

A p p s

A l e g i t i m a t e d e v e l o p e r o f a c o m p a n y c r e a t e s g a m i n g a p p l i c a t i o n s . In o r d e r t o a l l o w m o b i l e u sers

to

c o n v e n ie n tly

c e n tra liz e d d e v e lo p e rs

b ro w se

m a rk e tp la c e s . a re

s u b m itte d

and

U s u a lly to

th e s e

in s ta ll th e

th e s e

g a m in g

g a m in g

apps,

a p p lic a tio n s

m a rk e tp la c e s ,

p la tfo rm

th a t

m a k in g th e m

a re

ve n d o rs

d e v e lo p e d

a v a ila b le

to

cre a te by

th o u s a n d s

th e of

m o b i l e u s e rs . T h is g a m i n g a p p l i c a t i o n is n o t o n l y u s e d b y l e g i t i m a t e u s e rs , b u t a ls o b y m a l i c i o u s p e o p le . T h e m a lic io u s d e v e lo p e r d o w n lo a d s a le g it im a t e g a m e a n d re p a c k a g e s it w it h m a lw a r e a n d u p lo a d s th e g a m e to t h i r d - p a r t y a p p lic a tio n s to re f r o m

w h ic h e n d u sers d o w n lo a d th is

m a lic io u s a p p lic a tio n , b e lie v in g it t o be a g e n u in e o n e . As a re s u lt, t h e m a lic io u s p r o g r a m g e ts in s ta lle d o n t h e u s e r's m o b ile d e v ic e , c o lle c ts t h e u s e r's i n f o r m a t i o n , a n d s e n d s it b a c k t o t h e a tta c k e r.

M o d u le 0 9 P ag e 1342

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Malicious developer downloads a legitimate game and repackages It with malware

Developer creates a gamming app and uploads on app store

M o b ile A p p

M a lic io u s

S to re

D e v e lo p e r

User c re d e n tia ls sends to th e m a lic io u s d e v e lo p e r

L e g itim a te

/

D e v e lo p e r

0

End user downloads malicious gamming app

S

3 U ser

T h ir d P a rty A p p S to re

FIGURE 09.8: Mobile-based Social Engineering Repackaging Legitimate Apps

M o d u le 0 9 P ag e 1343

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

M obile-based Social Engineering: Fake Security Applications 1. Attacker infects the victim 's PC 2. The victim logs onto th e ir bank account 3. M alware in PC pop-ups a message telling the victim to d o w n loa d an application onto th e ir phone in order to receive security messages 4. Victim d o w n loa d th e m alicious application on his phone 5. Attacker can now access second a u th e n tica tio n fa cto r sent to the victim from the bank via SMS

User logs to bank account pop-ups a message appears telling th e user to dow nload an application o n to h is/h er phone

Attacker uploads malicious application on app store

A tta c k e r's A p p S tore

Copyright Š by EG-C(ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

M o b ile - b a s e d 0 1

S o c ia l E n g in e e r in g :

F a k e

S e c u r ity

A p p lic a tio n s

A f a k e s e c u r i t y a p p l i c a t i o n is o n e t e c h n i q u e u s e d b y a t t a c k e r s f o r p e r f o r m i n g m o b i l e - b a s e d s o c ia l e n g in e e r in g . For p e r f o r m in g th is a tta c k , th e a tta c k e r fir s t in fe c ts th e v ic tim 's c o m p u t e r b y s e n d i n g s o m e t h i n g m a l i c i o u s . W h e n t h e v i c t i m l o g s o n t o h is o r h e r b a n k a c c o u n t , a m a l w a r e in t h e s y s t e m d i s p l a y s a m e s s a g e w i n d o w t e l l i n g t h e v i c t i m t h a t h e o r s h e n e e d s t o d o w n l o a d a n a p p l i c a t i o n o n t o h is o r h e r p h o n e in o r d e r t o r e c e i v e s e c u r i t y m e s s a g e s . T h e v i c t i m t h i n k s t h a t it is a g e n u i n e

m essage

and

d o w n lo a d s

th e

a p p lic a tio n

o n to

h is

or

her

phone.

Once

th e

a p p l i c a t i o n is d o w n l o a d e d , t h e a t t a c k e r c a n a c c e s s t h e s e c o n d a u t h e n t i c a t i o n f a c t o r s e n t b y t h e b a n k t o t h e v i c t i m v ia S M S . T h u s , a n a t t a c k e r g a i n s a c c e s s t o t h e v i c t i m ' s b a n k a c c o u n t b y s te a lin g th e v ic t im 's c r e d e n tia ls (u s e r n a m e and p a s s w o rd ).

M o d u le 0 9 P ag e 1344

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

User logs to bank account

Infects user PC w ith m alw are

II

pop-ups a message appears te llin g th e user to d ow nlo ad an application o n to h is /h e r phone

U s e r cre d e n tia ls sends to th e a ttacker

A tt a c k e r

U se r g-

User dow nloads application

‫י‬ A tta c k e r uploads m alicious app lica tion on app store

fro m attacke r's app store

App S tore

©

<■........................................

Attacker's App Store FIG U R E 0 9 .8 : M o b ile - b a s e d S o c ia l E n g in e e r in g F a k e S e c u r ity A p p lic a tio n s

M o d u le 0 9 P ag e 1345

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

M obile-based Social Engineering: Using SMS J

c E l\

(•ttifwtf 1 lt»K4l Nm km

T ra c y re c e iv e d a n S M S t e x t m e s s a g e , o s te n s ib ly f r o m t h e s e c u r it y d e p a r t m e n t a t X IM B a n k . I t c la im e d t o b e u r g e n t a n d t h a t T ra c y s h o u ld c a ll t h e in c lu d e d p h o n e n u m b e r im m e d ia t e ly . W o r r ie d , s h e c a lle d t o c h e c k o n h e r a c c o u n t.

J

S h e c a lle d t h in k in g i t w a s a X IM B a n k c u s to m e r s e r v ic e n u m b e r , a n d i t w a s a r e c o r d in g a s k in g t o p r o v id e h e r c r e d it c a rd o r d e b i t c a rd n u m b e r .

J

U n s u r p r is in g ly , J o n n y r e v e a le d t h e s e n s it iv e i n f o r m a t i o n d u e t o t h e f r a u d u l e n t te x ts .

11111111111111111111 # ■

..............

A tta c k e r

User Cellphone

Tracy calling to

F ra u d X IM

(Jonny gets an SMS)

1-540-709-1101

(Bank C ustom er Service)

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

M o b ile - b a s e d

S o c ia l E n g in e e r in g :

U s in g

S M S

S M S is a n o t h e r t e c h n i q u e u s e d f o r p e r f o r m i n g m o b i l e - b a s e d s o c ia l e n g i n e e r i n g . T h e a t t a c k e r in t h i s a t t a c k u s e s a n S M S f o r g a i n i n g s e n s i t i v e i n f o r m a t i o n . L e t us c o n s i d e r T r a c y , w h o is a s o f t w a r e e n g i n e e r a t a r e p u t a b l e c o m p a n y . S h e r e c e i v e s a n S M S t e x t m e s s a g e o s t e n s i b l y f r o m t h e s e c u r i t y d e p a r t m e n t a t X I M B a n k . It c l a i m s t o b e u r g e n t a n d t h e m e s s a g e sa y s t h a t T r a c y s h o u l d c a ll t h e i n c l u d e d p h o n e n u m b e r ( 1 - 5 4 0 - 7 0 9 - 1 1 0 1 ) i m m e d i a t e l y . W o r r i e d , s h e c a lls t o c h e c k o n h e r a c c o u n t . S h e c a lls t h a t n u m b e r b e l i e v i n g i t t o b e a n X I M B a n k c u s t o m e r s e r v i c e n u m b e r a n d i t is a r e c o r d i n g a s k i n g h e r t o p r o v i d e h e r c r e d i t c a r d o r d e b i t c a r d n u m b e r as w e l l as p a s s w o r d . T r a c y f e e l s t h a t i t ' s a g e n u i n e m e s s a g e a n d r e v e a l s t h e s e n s i t i v e i n f o r m a t i o n t o th e fr a u d u le n t re c o rd in g . S o m e t i m e s a m e s s a g e c l a i m s t h a t t h e u s e r h a s w o n s o m e a m o u n t o r h a s b e e n s e l e c t e d as a l u c k y w i n n e r , t h a t h e o r s h e j u s t n e e d s t o p a y a n o m i n a l a m o u n t a n d p a s s a l o n g h is o r h e r e m a i l ID, c o n t a c t n u m b e r , o r o t h e r u s e f u l i n f o r m a t i o n .

M o d u le 0 9 P ag e 1346

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

I Q

(t

u A tta c k e r

U s e r C e llp h o n e

T ra cy c a llin g t o

F ra u d X IM

(J o n n y g e ts a n S M S )

1 -5 4 0 7 0 9 -1 1 0 1

(Bank Customer Service)

FIGURE 09.9: Mobile-based Social Engineering Using SMS

M o d u le 0 9 P ag e 1347

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

-

In s id e r A tta c k

CEH

If a c o m p e t it o r w a n ts to cause d a m a g e to y o u r o rg a n iz a tio n , s te a l c ritic a l s e c re ts , o r p u t y o u o u t o f b u sin e ss, th e y ju s t h a v e to fin d a jo b o p e n in g , p re p a re s o m e o n e to pass th e in te r v ie w , h ave th a t p e rs o n h ire d , a n d th e y w ill be in th e o rg a n iz a tio n

Revenge

It ta k e s o n ly o n e d is g r u n tle d p e r s o n to ta k e re v e n g e a n d y o u r c o m p a n y is c o m p r o m is e d

&

60% o f a tta cks o c c u r b e h in d th e fire w a ll

I n s id e r

a

A n insid e a tta c k is easy to lau n ch

Attack

«

P re v e n tio n is d iffic u lt

«

The insid e a tta c k e r can e asily succeed

0

MyM

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

I n s id e r A tt a c k An

in s id e r

is

any

e m p lo y e e

(tru s te d

p e rso n )

w ith

a d d itio n a l

access

o r g a n iz a t io n 's p r iv ile g e d a s s e ts . A n in s id e r

a tt a c k in v o lv e s u s in g p riv ile g e d access

ru le s o r cause t h r e a t to th e o r g a n iz a tio n 's

in fo r m a tio n o r in fo r m a tio n s y s te m s

in te n tio n a lly .

I n s i d e r s c a n e a s i ly b y p a s s s e c u r i t y r u l e s a n d

c o r r u p t v a lu a b le

to

an

to v io la te in a n y

fo rm

resources and

a c c e s s s e n s i t i v e i n f o r m a t i o n . It is v e r y d i f f i c u l t t o f i g u r e o u t t h i s k i n d o f i n s i d e r a t t a c k . T h e s e i n s i d e r a t t a c k s m a y a ls o c a u s e g r e a t l o s s e s f o r a c o m p a n y . 0

60% o f a tta c k s o c c u r fr o m b e h in d th e

fire w a ll

0

A n i n s i d e a t t a c k is e a s y t o l a u n c h

0

P r e v e n t i o n is d i f f i c u l t

0

A n i n s i d e a t t a c k e r c a n e a s i ly s u c c e e d

0

It c a n b e d i f f i c u l t t o i d e n t i f y t h e p e r p e t r a t o r

In s id e r a tta c k s a re d u e to :

M o d u le 0 9 P ag e 1348

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

F in a n c ia l g a in An

i n s i d e r t h r e a t is c a r r i e d

se n s itiv e

in fo rm a tio n

of

o u t m a in ly f o r fin a n c ia l g a in .

a com pany

to

its

c o m p e tito r

or

It is a t t a i n e d s te a lin g

a

b y s e llin g c o lle a g u e 's

fin a n c ia l d e ta ils f o r p e rs o n a l use o r by m a n ip u la t in g c o m p a n y o r p e rs o n n e l fin a n c ia l re c o rd s , fo r e x a m p le . C o llu s io n w i t h o u ts id e rs A c o m p e t it o r can in flic t d a m a g e s t o an o rg a n iz a tio n b y s te a lin g s e n s itiv e d a ta , and m a y e v e n tu a lly b rin g d o w n an o rg a n iz a tio n

b y g a in in g access to a

c o m p a n y th ro u g h a jo b

o p e n i n g , b y s e n d i n g a m a l i c i o u s p e r s o n as a c a n d i d a t e t o b e i n t e r v i e w e d , a n d â&#x20AC;&#x201D; w i t h l u c k â&#x20AC;&#x201D; h ire d . D is g ru n tle d e m p lo y e e s A tta c k s m a y c o m e f r o m u n h a p p y e m p lo y e e s o r c o n tr a c t w o rk e rs w h o h a ve n e g a tiv e o p i n i o n s a b o u t t h e c o m p a n y . T h e d i s g r u n t l e d e m p l o y e e s w h o w a n t s t o t a k e r e v e n g e o n his c o m p a n y firs t p la n s t o a c q u ire in f o r m a t io n a b o u t t h e t a r g e t a n d th e n w a its f o r rig h t t im e t o c o m p r o m is e th e c o m p u t e r s ys te m . C o m p a n ie s

in

w h ic h

in s id e r a tta c k s

c o m m o n ly

ta k e

p la ce

in c lu d e

c re d it

card

c o m p a n ie s ,

h e a l t h c a r e c o m p a n i e s , n e t w o r k s e r v i c e p r o v i d e r c o m p a n i e s , as w e l l as f i n a n c i a l a n d e x c h a n g e s e rv ic e p ro v id e rs .

M o d u le 0 9 P ag e 1349

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

D

i s

g

Exam 3 1 2 -5 0 C ertified Ethical H acker

r u

n

t l e

d

E

m

p

l o

y e

CEH

e

An e m p lo y e e m ay b e c o m e d is g ru n tle d to w a rd s th e c o m p a n y w h e n h e /s h e is d is re s p e c te d , fru s tra te d w ith th e ir jo b , h a vin g c o n flic ts w ith th e m a n a g e m e n t, n o t s a tis fie d w ith e m p lo y m e n t b e n e fits , issued an e m p lo y m e n t te rm in a tio n n o tic e , tra n s fe rre d , d e m o te d , etc.

J

D is g r u n tle d e m p lo y e e s m a y p a s s c o m p a n y s e c r e ts a n d in t e lle c t u a l p r o p e r t y t o c o m p e t it o r s f o r m o n e t a r y b e n e fits

Sends the data to competitors using steganography

G

........................... >

D is g ru n tle d

C o m p a n y 's

Com pany

E m p lo ye e

S e c re ts

N e tw o rk

C o m p e tito rs

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

D is g r u n t le d M ost

cases

of

E m p lo y e e s

in s id e r

abuse

can

be

tra c e d

to

in d iv id u a ls

who

a re

in tro v e rte d ,

i n c a p a b l e o f d e a l i n g w i t h s t r e s s o r c o n f l i c t , a n d f r u s t r a t e d w i t h t h e i r j o b , o f f i c e p o l i t i c s , la c k o f r e s p e c t o r p r o m o t i o n , e t c . D i s g r u n t l e d e m p l o y e e s m a y p a ss c o m p a n y s e c r e t s o r c o n f i d e n t i a l in f o r m a t io n a n d in te lle c tu a l p r o p e r ty t o c o m p e t it o r s fo r m o n e t a r y b e n e fits , th e r e b y h a rm in g th e o rg a n iz a tio n . D is g ru n tle d e m p lo y e e s can use s te g a n o g r a p h ic p r o g r a m s t o h id e th e c o m p a n y 's s e c re ts a n d send

it

as

an

in n o c u o u s - lo o k in g

message

such

as

a

p ic tu re ,

im a g e ,

or

sound

file s

to

c o m p e t it o r s . He o r she m a y use w o r k e m a il t o se n d s e c re t in fo r m a tio n . N o o n e can d e te c t t h a t t h i s p e r s o n is s e n d i n g c o n f i d e n t i a l d a t a t o o t h e r s , s i n c e t h e i n f o r m a t i o n is h i d d e n i n s i d e t h e p ic tu r e o r im a g e . Sends the data to com petitors using steganography

‫ץ‬

............................. » J

D is g r u n t le d

C o m p a n y 's

C om pany

E m p lo y e e

S e c re ts

N e tw o rk

C o m p e t it o r s

FIGURE 0 9 .1 0 : D is g r u n tle d E m p lo y e e s F ig u re

M o d u le 0 9 P ag e 1350

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

1

P r e v e n tin g In s id e r T h r e a ts

C EH

fertMM itfciul H«k«.

There is no single solution to p re v e n t an insider th re a t

Copyright © by EG-G0 1 acil. All Rights Reserved. Reproduction is Strictly Prohibited.

P r e v e n tin g

I n s id e r

T h r e a ts

P r e v e n t i o n t e c h n i q u e s a r e r e c o m m e n d e d in o r d e r t o a v o i d f i n a n c i a l lo s s a n d t h r e a t t o th e o r g a n iz a tio n 's s y s te m s f r o m in s id e rs o r c o m p e t it o r s . T h e fo llo w in g a re re c o m m e n d e d t o o v e rc o m e in s id e r th re a ts :

S e p a ra tio n a n d r o ta tio n R e s p o n s ib ilitie s

m ust

be

o f d u tie s

d iv id e d

am ong

v a rio u s

e m p lo y e e s ,

so

th a t

if

a

s i n g le

e m p l o y e e a t t e m p t s t o c o m m i t f r a u d , t h e r e s u l t is l i m i t e d in s c o p e . A p a r t ic u la r j o b m u s t be a llo t te d t o d i f f e r e n t e m p lo y e e s a t d i f f e r e n t tim e s so t h a t a m a lic io u s e m p lo y e e c a n n o t d a m a g e an e n tire s y s te m .

L e a s t p r iv ile g e s T h e le a s t n u m b e r o f p riv ile g e s m u s t be a s s ig n e d t o t h e

m o s t c r itic a l a s s e ts o f an

o r g a n iz a tio n . P riv ile g e s m u s t be a s s ig n e d b a se d o n h ie ra rc h y .

‫ם‬

C o n tr o lle d

a c c e s s

A c c e s s c o n t r o l s m u s t b e i m p l e m e n t e d in v a r i o u s p a r t s o f a n o r g a n i z a t i o n t o r e s t r i c t

u n a u t h o r iz e d u s e rs f r o m g a in in g access t o c r itic a l a sse ts a n d re s o u rc e s .

M o d u le 0 9 P ag e 1351

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

L o g g in g L o g g in g

Exam 3 1 2 -5 0 C ertified Ethical H acker

a n d a u d itin g

and

a u d itin g

m ust

be

p e rfo rm e d

p e rio d ic a lly

to

check

if a n y

com pany

re s o u rc e s a re b e in g m is u s e d .

T

L e g a l p o lic ie s Legal p o lic ie s m u s t b e e n fo r c e d t o p r e v e n t e m p lo y e e s f r o m m is u s in g t h e re s o u r c e s o f

an o r g a n iz a tio n , a n d f o r p r e v e n t in g t h e t h e f t o f s e n s itiv e d a ta .

â&#x2013;Ą

A rc h iv e

c r itic a l d a ta

A r e c o r d o f a n o r g a n i z a t i o n ' s c r i t i c a l d a t a m u s t b e m a i n t a i n e d in t h e f o r m o f a r c h i v e s

t o b e u s e d as b a c k u p r e s o u r c e s , i f n e e d e d .

M o d u le 0 9 P ag e 1352

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

C o m m on Social E n g in ee rin g Targets and D efense Strategies Social Engineering Targets

‘W f

Front office and help desk

A ttack Techniques

EH

Defense Strategies

Eavesdropping, shoulder surfing,

Train employees/help desk to never reveal

impersonation, persuasion, and intimidation

passwords or other information by phone

Impersonation, fake IDs, piggy backing, etc.

authentication, employee training, and security

Implement strict badge, token or biometric Perimeter security

4 1

a

Office

< * Mail room

Machine room/ Phone closet

Employee training, best practices and checklists for

Shoulder surfing, eavesdropping.

using passwords

Ingratiation, etc.

Escort all guests

Impersonation, Intimidation, and persuasion

£

Phone (help desk)

guards

on help desk calls

Employee training, enforce policies for the help desk

Theft, damage or forging of mails

Lock and monitor mail room, employee training

Attempting to gain access, remove

u •

Keep phone closets, server rooms, etc. locked at all

equipment, and/or attach a protocol

times and keep updated inventory on equipment

analyzer to grab the confidential data

Copyright © by EG-GlOOCil. All Rights Reserved. Reproduction is Strictly Prohibited.

C o m m o n

S o c ia l E n g in e e r in g

T a r g e ts

a n d

D e fe n s e

S tr a te g ie s S o c ia l e n g i n e e r i n g t r i c k s p e o p l e i n t o p r o v i d i n g c o n f i d e n t i a l i n f o r m a t i o n t h a t c a n b e u s e d t o b re a k

in to

a c o rp o ra te

n e tw o rk .

It w o r k s

on

th e

in d iv id u a l

who

have

som e

rig h ts t o

do

s o m e th in g o r k n o w s s o m e t h in g im p o r t a n t. T h e c o m m o n in s tr u c tio n ta c tic s use d b y th e a tta c k e r t o g a i n s e n s i t i v e i n f o r m a t i o n a n d t h e p r e v e n t i o n s t r a t e g i e s t o b e a d o p t e d a r e d i s c u s s e d as fo llo w s .

M o d u le 0 9 P ag e 1353

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Social Engineering Targets

Exam 3 1 2 -5 0 C ertified Ethical H acker

Attack Techniques

Defense Strategies

Fro n t office and help desk

‘‫־‬W r

h ave sdropping, shoulder surfing,

I rain em ploye es/h elp desk to never reveal

im p e rso n a tio n , persuasion, and intim ida tio n

passwords o r o th e r in fo rm a tio n by p ho ne

Perim eter security

*‫נ‬

Im p ers o n atio n , fake IDs, p ig g y b a ck in g , etc.

Office

Phone (he lp desk)

M a il ro o m

s t 4 * v a

Phone closet

security officers

D o n o t typ e in passw ords w ith a nyo ne else present

S h o u ld er surfing, eavesdropping.

(o r if y o u m u st, d o it quickly 1)

Ingratiation, etc.

Escort all guests

Im p ers o n atio n , In tim id a tio n , and persuasion

E m p lo y e e train in g , enforce policies for the help

on help desk calls

desk

Insertion of forged m ails

lo c k and m o n ito r m ail m o m , e m p lo ye e train in g

A tte m p tin g to gain access, rem o ve

M a c h in e ro o m /

g p

T ig h t badge security, e m p lo ye e tra in in g , and

e q u ip m e n t, a n d /or attach a p ro tocol a na lyze r to g rab the con fidential data

Keep p h o n e closets, server roo m s, etc. locked at all tim es and keep up d ated in ve n to ry on e q u ip m e n t

FIG U R E 0 9 .1 1 : C o m m o n S o c ia l E n g in e e r in g T a r g e ts a n d D e fe n s e S tr a te g ie s S c re e n s h o t

M o d u le 0 9 P ag e 1354

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Copyright Š by EC-G(Uncil. All Rights Reserved. Reproduction is Strictly Prohibited.

M o d u le

F lo w

So f a r , w e h a v e d i s c u s s e d v a r i o u s s o c ia l e n g i n e e r i n g c o n c e p t s a n d t h e t e c h n i q u e s u s e d t o p e r f o r m s o c ia l e n g i n e e r i n g . I n f o r m a t i o n a b o u t p e o p l e o r o r g a n i z a t i o n s c a n b e c o l l e c t e d n o t j u s t b y t r i c k i n g p e o p l e , b u t a ls o b y i m p e r s o n a t i o n o n s o c ia l n e t w o r k i n g s ite s .

S o c ia l E n g i n e e r i n g C o n c e p t s

Id e n tity th e f t

a

> S o c ia l E n g i n e e r i n g T e c h n i q u e s

S o c ia l E n g i n e e r i n g C o u n te rm e a s u re s

I m p e r s o n a t i o n o n S o c ia l N e t w o r k i n g S it e s

~ JiE E

P e n e tra tio n T e s tin g

T h is s e c t i o n d e s c r i b e s h o w t o p e r f o r m s o c i a l e n g i n e e r i n g t h r o u g h i m p e r s o n a t i o n o n v a r i o u s s o c ia l n e t w o r k i n g s i t e s s u c h as F a c e b o o k , L i n k e d l n , a n d so o n .

M o d u le 0 9 P ag e 1355

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

S o c ia l E n g in e e r in g T h r o u g h I m p e r s o n a t io n o n S o c ia l N e t w o r k in g

CEH

S ite s

M a lic io u s users g a th e r c o n fid e n tia l in fo r m a tio n fr o m so cia l n e tw o rk in g sites a nd c re a te a c c o u n ts in o th e rs ' nam es

A tta c k e rs use o th e rs ' p ro file s to c re a te large n e tw o rk s o f frie n d s and e x tra c t in fo r m a tio n using so cia l e n g in e e rin g te c h n iq u e s

Im p e rs o n a tio n m e an s im ita tin g o r c o p y in g th e b e h a v io r o r a c tio n s o f o th e rs

A tta c k e rs can also use c o lle c te d in fo rm a tio n to c a rry o u t o th e r fo rm s o f s o cia l e n g in e e rin g

P e rson a l D e ta ils

a tta c k s

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l E n g in e e r in g (y )

N e t w o r k in g

th r o u g h

I m p e r s o n a t io n

o n

S o c ia l

S ite s

I m p e r s o n a t i o n is t a k e n t o a h i g h e r le v e l b y a s s u m i n g t h e i d e n t i t y o f a n i m p o r t a n t e m p l o y e e in o r d e r t o a d d a n e l e m e n t o f i n t i m i d a t i o n . T h e r e c i p r o c a t i o n f a c t o r a ls o p l a y s a r o l e in t h i s s c e n a rio , w h e r e

lo w e r-le v e l

e m p lo y e e s

m ig h t go

out

o f th e ir w a y to

h e lp

e m p l o y e e , so t h a t t h e i r f a v o r g e t s p o s i t i v e a t t e n t i o n n e e d e d t o h e l p t h e m

a h ig h e r-le v e l

in t h e c o r p o r a t e

e n v i r o n m e n t . A n o t h e r b e h a v i o r a l t e n d e n c y t h a t a id s a s o c ia l e n g i n e e r is p e o p l e ' s i n c l i n a t i o n n o t t o q u e s t i o n a u t h o r i t y . A n a t t a c k e r p o s i n g as a n i m p o r t a n t i n d i v i d u a l s u c h as a v i c e p r e s i d e n t o r d i r e c t o r c a n o f t e n m a n i p u l a t e a n u n p r e p a r e d e m p l o y e e . T h is t e c h n i q u e a s s u m e s g r e a t e r s ig n ific a n c e w h e n th e a tta c k e r c o n s id e rs it a c h a lle n g e t o g e t a w a y w i t h

im p e rs o n a tin g an

a u th o r it y fig u re . O r g a n i z a t i o n D e t a i l s : M a l i c i o u s u s e r s g a t h e r c o n f i d e n t i a l i n f o r m a t i o n f r o m s o c ia l n e t w o r k i n g s i t e s a n d c r e a t e a c c o u n t s in o t h e r s ' n a m e s . P r o fe s s io n a l D e ta ils : A tt a c k e r s use o t h e r s ' p r o file s t o c r e a te la rg e n e t w o r k s o f f r ie n d s a n d e x t r a c t i n f o r m a t i o n u s i n g s o c ia l e n g i n e e r i n g t e c h n i q u e s . C o n t a c t s a n d C o n n e c t i o n s : A t t a c k e r s c a n a ls o u s e c o l l e c t e d

in fo rm a tio n to c a rry o u t o th e r

f o r m s o f s o c ia l e n g i n e e r i n g a t t a c k s . P e rs o n a l D e ta ils : Im p e r s o n a tio n m e a n s im it a tin g o r c o p y in g th e b e h a v io r o r a c tio n s o f o th e rs .

M o d u le 0 9 P ag e 1356

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Social E n g in e e rin g on Facebook

CEH

Attackers create a fake user group on Facebook identified as "Employees o f the target company Using a false identity, attacker then proceeds to "friend," or invite, employees to the fake group, " Employees of the company" Users join the group and provide their credentials such as date of birth, educational and employment backgrounds, spouses names, etc. Using the details of any one of the employee, an attacker can com prom ise a secured facility to gain access to the building

Basic Information

J o h n Ja m e s

Mole

interested in

Men

RrUhnm hip Sldtlft

Snjle

• Shaded 01 fhe University of flucHand it Lives in Christchurch, New Zealand SBBom on Key 5, 1992 *ft Add you‫ ׳‬current work rformabon Mr Add your hometown f Edt Prohle

td u c ilio n and Work lo n ta c t In form atio n Phone

A d d re ss

*61 5C80COOO (Mobilo) +04 508001 11 (uthsr) llq h School

XKXXXXX AuckJand, CA 7 0 1 7 ‫ש‬

S c r e e n N am e

John (Sk/P©)

Website

http://www.iuggybcy.com/

u

Ml Ru»kill G1 aniiiioi dr 1000

http://www.facebook.com Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l E n g in e e r in g

o n

F a c e b o o k

S ource: h t t p : / / w w w . f a c e b o o k . c o m F a c e b o o k is a s o c ia l n e t w o r k i n g s i t e w h e r e m a n y p e o p l e a r e c o n n e c t e d a n d e a c h o n e p e r s o n c a n c o m m u n i c a t e w i t h o t h e r s a c r o s s t h e w o r l d . P e o p l e c a n s h a r e p h o t o s , v i d e o s , l in k s , e t c . S o c ia l e n g i n e e r i n g is a t y p e o f a t t a c k w h e r e a t t a c k e r s t r y t o m i s g u i d e t h e t a r g e t b y p r e t e n d i n g t o b e s o m e o n e th e y a re n o t a n d g a t h e r in g s e n s itiv e in f o r m a t i o n . T o i m p e r s o n a t e , F a c e b o o k a t t a c k e r s u s e n i c k n a m e s i n s t e a d o f u s i n g t h e i r re a l n a m e s . A t t a c k e r s use fa k e a c c o u n ts . T h e a tta c k e r trie s a n d c o n tin u e s t o add fr ie n d s and uses o th e r s ' p r o file s t o g e t c ritic a l an d v a lu a b le in fo r m a tio n . 0

A t t a c k e r s c r e a t e a f a k e u s e r g r o u p o n F a c e b o o k i d e n t i f i e d as " e m p l o y e e s o f " t h e t a r g e t com pany

0

U s in g a f a l s e i d e n t i t y , a t t a c k e r t h e n p r o c e e d s t o " f r i e n d , " o r i n v i t e , e m p l o y e e s t o t h e fa k e g ro u p , " e m p lo y e e s o f th e c o m p a n y "

0

U s e rs j o i n t h e g r o u p a n d p r o v i d e t h e i r c r e d e n t i a l s s u c h as d a t e o f b i r t h , e d u c a t i o n a l a n d e m p l o y m e n t b a c k g ro u n d s , s p o u s e s ' n a m e s , e tc .

0

U s in g t h e d e t a i l s o f a n y o n e o f t h e e m p l o y e e , a n a t t a c k e r c a n c o m p r o m i s e a s e c u r e d fa c ility t o g a in access t o th e b u ild in g

M o d u le 0 9 P ag e 1357

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

FIG U R E 0 9 .1 2 : S o c ia l E n g in e e r in g o n F a c e b o o k S c re e n s h o t

M o d u le 0 9 P ag e 1358

Ethical H acking a n d C o u n te rm e a s u re s C opyright Š by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2 -5 0 C ertified Ethical H acker

Social E n g in e e rin g E xam ple: L in k e d ln P ro file Account &Suanoi I H e*>| Sign OjI

Linked | (7|i P e o p le »

CEH

Jobs »

A n sw e rs ‫״־‬

KrttrK r<1 SMfct

S e rv ice P ro v id e rs

People

_»]

c < ‫~־״‬ prom•

0

Eat My Proflte VwwU, Prafte

^

I Edit My Profile \ V4-‫ ״‬l/y Proffl*: I g

Contact*

a

Inbox

M

Groupt

IB

*

Forwardthis profc

C h ris S to n e ‫ ן‬e ««]

‫ר‬5

UX Designer a! ISHtobi | E<* ] Vancouver. Canada Area | Edit ] What are you working on?

11

Profile

O* A

UXD « gM ) ‫ ׳‬Ntobi

Whata‫׳‬oyouworkng01

Recommendations

Connecfeons

Official Web£x*v Site WebE* Is The Leader in Web Meeiings ‫ ־‬East Easy. Secure Try Free Nowl

‫ ׳‬JX Designer s\ Kitobi | fcJ:) Pml

fcdutNlion

Art* by Googla WebEK M88tW8N0w Unlimited online Meetings ‫ ־‬Free Web Conferencing Made Easy! w*mv.M«atfJeN(/wcom

> Principal D ev gne< at SeaSione Oe*mr* iSeto Pr0pnei0fV*p> • Infgrmjlier Artfatect. »l Deuarm s: CUcs B y lin ■ ‫ י‬Mjrvjgar. P oducl MvkoOng jt Ojrus System* IJtitvutMly ‫זיז‬

ChriftNoeommend• People

Diivtt.

Ruuummond collooflues, bu»ino»» puftner&.

Recommended 64 connections Induitry WnbsilOK Public Profile

Computer Sort*-** | Ed

Attackers scan details in profile pages. T h e y use these details for spear phishing, im personation, and identity theft.

• My Wdtele | E<M ] • http //ww* knkedn c«

)

htp://www.linkedin.com Copyright © by EG-Gauncil. All Rights Reserved. Reproduction is Strictly Prohibited.

£

S o c ia l E n g in e e r in g

E x a m p le :

L in k e d ln

P r o file

S ource: h t t p : / / w w w . lin k e d in .c o m A tta c k e rs can g a th e r in fo r m a tio n a b o u t th e ta r g e t's o r g a n iz a tio n , p ro file , p e rs o n a l p re fe re n c e s , a n d l i f e s t y l e h a b i t s . L i n k e d l n is m o s t l y u s e d b y e m p l o y e e s o f d i f f e r e n t o r g a n i z a t i o n s . S o c ia l e n g in e e r s can c o lle c t w o r k h is to r y in fo r m a t io n f r o m a th e t a r g e t 's L in k e d ln p r o f ile a n d use t h a t t o p la n a tta c k s , t r ic k ta r g e ts in t o c lic k in g m a lic io u s lin k s , o r d o w n lo a d i n g s o f t w a r e t h a t in fe c ts th e ir c o m p u te rs.

M o d u le 0 9 P ag e 1359

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

_ Account &S0P.r.#t | Help | S<gr1Out

L in k e d {^ • People ‫״‬

&

Jobs ‫״‬

Answors -

Service Providers

Advanced Search

Peoplo

_^J

P r o file

Horn•

42k Profit*

t:)

Ed* My Prcflo VtowMy Profito

1

Edit My Profile &

T

Edit Public Profile Settings

Fofwafd r !6 profle

■£

P3 Contact• 1^1 maox Groups 1

Profile Completeness

3

C h ris S to n e ‫ ן‬Ed*)

Add Corrections

UX Designer at Nitobi 1

[ Edit ]

Vancouver. Canada Area ( Edit ]

Ads by Google

What are you working on?

WebEx MeetMeMow Unlimited Online Meetings - Free Web Conferencing Made Easy! www.MeetMeNew.com

Chris Stone UX Designer at Ntotx Wvat arc you werkng 00?

Profile

Q&A Current Past

©

A ■

Recommendations

Connections

‫ ׳‬UX Designer at Nitobi ( Edit ]

WebEx Is The Leader m weo Meetings ‫ ־‬Fast I Secure Try Free Now!

1 Principal/Designer at SeaStone Designs (Sole Proprietorship) 1 Information Architect m Designer at Clarus Systems 1 Manager. Product Marketing at Clarus Systems

wwwWetEx com

Chris Recommends

see M

Education Recommended

• Unvprs Ity (V Cairnm ? navis 4 people ha/e recommended you 1

Connections Industry Websites Public Profile

People

nAriagoi.

3 co w crW t

64 connections

Rocommond coiloaguoc. bucinots partnors. and professional service providers and share your recommendations on your profile.

Recommend people

Computer Software ( Edit ]

• My Website ( Edit | • http7/wvww lnkodn.com/rVchrsstone | Edit ]

FIGURE 09.13: Social Engineering on Linkedln Profile Screen shot

M o d u le 0 9 Page 1360

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0l1nCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


Ethical Hacking a n d C o u n te rm e a s u re s Social E n g in eerin g

Exam 3 1 2-50 C ertified Ethical H acker

Social E n g in e e rin g on T w itte r

S.K.M

-•

A d d y o u r m o b ile p h o n e to y o u r a c c o u n t Expand your experience, get closer, and stay current

View m y profile page

Account

C EH

>

Download Twitter mobile app

Password

> |

Mobile

>

Email notifications

>

Profile

>

Avatebfe for iPhone. iPad. Android BlackBerry. and Windows Phone 7

Activate Twitter text messaging

1 1

It s fast and easy Get nevr features and help protect your account Country‫׳‬region

j Germany

Phone nunber

*‫ יי‬9 —

E|

Design ‫•׳‬

128

Apps Camei

Widgets

E-Plus (KPN)

© 2 0 l2 lw m e r About Help Terms Pnvacy Blog status Apps Resources joos Advertisers

Activate phone

Businesses Media Developers

http://twitter.com Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l E n g in e e r in g ^ = l

o n

T w it t e r

S ource: h t t p : / / t w i t t e r . c o m

T w i t t e r is a m u l t i - b l o g g e r a n d a s o c ia l n e t w o r k i n g s i t e t h a t h a s a h u g e d a t a b a s e o f u s e r s w h o c a n c o m m u n i c a t e w i t h o t h e r s a n d s h a r e m a n y t h i n g s as m e s s a g e s c a l le d t w e e t s . A t t a c k e r s c r e a te an a c c o u n t u s in g a fa ls e n a m e t o g a t h e r i n f o r m a t i o n f r o m ta r g e ts . T h e a t t a c k e r t r ie s a n d k e e p s a d d in g f r ie n d s a n d uses o th e r s ' p ro file s t o g e t c ritic a l a n d v a lu a b le in f o r m a t io n .

M o d u le 0 9 P ag e 1361

Ethical H acking a n d C o u n te rm e a s u re s C opyright © by EC-C0UnCil All Rights R eserved. R ep ro d u ctio n is Strictly P ro h ib ite d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

■ S.K.M View my profile page

A ccount

W

Add your mobile phone to your a cco u n t Expand your experience, get closer, and stay current Download Twitter mobile app Available (or IPnone iPad AnOroW BiackBerry. and Windows Pfione 7

Password A ctiva te Tw itter te xt m e ssa g in g

M obile

its fast ana easy Get new features and nelp protect your account Email notifications Country/region

Profile

Germany

0

Design Phone number

*

2

8

‫י־‬9

‫■יי‬

‫ז‬

Apps Carrier

W idgets

02012 Twitter About Help Terms Privacy Blog Status Apps Resources Jobs Advertisers Businesses Media Developers

E-Plus (KPN)

0

Activate p hone

FIGURE 09.14: Social Engineering on Twitter Screen shot

M o d u le 0 9 P a g e 1 3 6 2

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d , R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

R

i s k s

C

o

r p

o o

f

r a

S

o c i a l

t e

N

e

N

t w

e o

t w

o

r k

i n

g

t o

r k s

A social netw orking site is an in fo rm a tio n rep o sito ry accessed by m any users, enhancing the risk of inform ation exploitation

‫!־‬voluntary Dat Leakage

In th e absence o f a strong policy, em ployees m ay unknow ingly post sen sitive data about th eir com pany on social netw orking

f

t

Targeted A ttacks

Attackers use th e in fo rm a tio n available on social n etw orkin g sites to perform a targeted attack

N etw ork V ulnerability

VV✓‫־‬ f

•\

A ll social netw orking sites are subject to fla w s and bugs that in turn could cause vulnerabilities in the organization's netw ork

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

R

i s k s

o f S o c ia l

N

e t w

o r k i n g

t o

C o r p o r a t e

N

e t w

o r k s

A com pany should take a secure m ethod to put th e ir data on a social netw o rkin g site, or to enhance th e ir channels, groups or profiles. Private and co rp orate users should be aware o f the fo llo w in g social o r technical se curity risks. They are: ©

This type o f attack is m ostly done on social n e tw o rk in g sites as it contains huge database th a t can be accessed by m any users and groups so th e re is a risk o f data

D a ta T h e ft:

th e ft. Q

In v o lu n ta ry

D a ta

Leakage:

Targeted attacks can be launched on the organizational

w ebsites by the details provided on the social n e tw o rkin g sites. 0

T a rg e te d A tta c k s :

In fo rm a tio n on social n e tw o rkin g sites could be used as p re lim in a ry

reconnaissance, gathering in fo rm a tio n on size, stru cture , IT literacy degrees and more, fo r a m ore in-depth, targe te d attack on th e com pany. Q

N e tw o rk

V u ln e ra b ility :

All social n e tw o rkin g sites are subject to flaw s and bugs,

w h e th e r it concerns login issues, cross-site scripting p ote ntia l, or Java vu ln era b ilitie s th a t in tru de rs could exploit. This could, in tu rn , cause v u ln e ra b ilitie s in the com pany's n etw o rk.

M o d u le 0 9 P a g e 1 3 6 3

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

Copyright © by EG-Gouacil. All Rights Reserved. Reproduction Is Strictly Prohibited.

‫ ? ״‬IT

M

o d u l e

F l o w

So far, we have discussed various social engineering concepts and various techniques used fo r social engineering. Now we w ill discuss id e n tity th e ft, a m ajor th re a t o f social engineering.

Id e n tity th e ft

S o c ia l E n g in e e r in g C o n c e p ts

>

1

S o c ia l E n g in e e r in g T e c h n iq u e s

ST'

S o c ia l E n g in e e r in g C o u n te rm e a s u re s

I m p e r s o n a t io n o n S o c ia l N e t w o r k i n g S ite s

^

~

JiEE

P e n e tr a tio n T e s tin g

This section describes id e n tity th e ft in detail.

M o d u le 0 9 P a g e 1 3 6 4

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

IdentityTheftStatistics2011 CEH Urt1fw4

;

Loan frau d

\

^------------^

^ G o v e rn m e n t

X

|

}h;::

V ”

E m p lo y m e n t fra u d

B a n k fra u d

0 i'

\

W

\

x

\

.-•‫־‬

P h o n e o r u tilitie s

©

o

\

14%

*♦*#

‫׳•״״‬/.•.•.•.•.•.•.•.•/.•.•.•.•.•.•.•.•;.•.•.•.•.•.•.•.•;.•/.•/.•/.•//., ;.•/.•.•‫’*•■••י‬

#

9%

d o cu m e n ts /b e n e fits frau d

•fir:ffftffniTjffiriTTTTrmiiiiiti

27%

8%

:

ilh iu l lUthM

" W

\

'

****•-.

ftVIVAnViMmVtVlViVM'A'AViViVMWAyr,^

C re d it ca rd fra u d

fra u d

http://www.ftc.gov Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

I d e n t i t y

T h e f t

S t a t is t ic s

2 0 1 1

Source: h ttp ://w w w .ftc .g o v Id e n tity th e ft is a process o f stealing som eone's id e n tity in fo rm a tio n and m isusing the in fo rm a tio n to accom plish your goals. The goal may be to co m m it th e ft and crimes, spend money, and so on. Ide n tity th e fts are increasing exponentially due to the e-com m erce services people use, online services, e-transactions, share trading, etc. The fo llo w in g figure shows the id e n tity th e ft statistics fo r 2011: 0

G overnm ent d ocu m e n ts/b e ne fits fraud - 27%

©

Credit card fraud -14%

0

Phone or u tilitie s fraud -13%

0

Bank fraud - 9%

0

Em ploym ent fraud - 8%

0

Loan fraud - 3%

M o d u le 0 9 P a g e 1 3 6 5

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

G o v e rn m e n t d o c u m e n ts /b e n e fits fraud v t f f f t f / t f f f t f f f t f f t f f f f f / f t f f t f f f Tt f f f f f . ' rr. ’r:•■'

E m p lo y m e n t fra u d

• 4

B a n k F ra u d

P h o n e o r u t ilit ie s fra u d

c r e d it ca rd fra u d

F IG U R E 0 9 . 1 5 : I d e n t i t y T h e f t S t a t i s t i c s 2 0 1 1 F i g u r e

M o d u le 0 9 P a g e 1 3 6 6

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

IdentifyTheft

CEH â&#x2013;ş

It is a c rim e in w h ic h an im p o s te r o b ta in s p e rs o n a l id e n tify in g in fo r m a tio n su ch

Attackers can use identity theft to impersonate employees of a target organization and physically access the facility

as n a m e , c re d it ca rd n u m b e r, so c ia l s e c u r ity o r d riv e r 's

Identity theft occurs when someone steals your personally identifiable information for fraudulent purposes

&

if

lic e n s e n u m b e rs, e tc. to c o m m it fra u d o r o th e r c rim e s

1

.

IIIIIIU I

"O ne bit of p erso n al in fo rm atio n is all so m e o n e n e e d s to steal y o u r id en tity" Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

I d e n t i t y

T h e f t

S o u rce : w w w .a d p h ire .c o m /n e w s le tte r s T h e I d e n t i t y T h e f t a n d A s s u m p t i o n D e t e r r e n c e A c t o f 1 9 9 8 d e f in e s i d e n t i t y t h e f t as t h e ille g a l use o f s o m e o n e 's m e a n s o f id e n tific a tio n . I d e n t i t y t h e f t is a p r o b l e m

t h a t m a n y c o n s u m e r s f a c e t o d a y . In t h e

le g is la to rs

la w s

have

im p o s e d

re s tric tin g

e m p lo y e e s

fro m

U n ite d

fillin g

in

S ta te s , s o m e s ta te

SSNs

(s o c ia l

s e c u rity

N \ n u m b e r s ) d u r i n g t h e i r r e c r u i t m e n t p r o c e s s . I d e n t i t y t h e f t s f r e q u e n t l y f i g u r e in n e w s r e p o r t s . C o m p a n ie s

a ls o

need

to

have

e n d a n g e r th e ir a n ti-fra u d

p ro p e r

in itia tiv e s .

in fo rm a tio n S e c u rin g

about

p e rso n a l

id e n tity

th e fts

in fo rm a tio n

so th a t th e y

in t h e

w o rk p la c e

do

not

and

at

h o m e , a n d lo o k in g o v e r c r e d it c a rd r e p o r ts a re f e w w a y s t o m in im iz e t h e ris k o f id e n t it y t h e f t. T h e f t o f p e r s o n a l in f o r m a t i o n : I d e n t it y t h e f t o c c u rs w h e n s o m e o n e s te a ls y o u r n a m e a n d o t h e r p e rs o n a l in fo rm a tio n fo r fr a u d u le n t p u rp o s e s . Loss

of

s o c ia l

s e c u rity

n u m b e rs:

It

is

a

c rim e

in

w h ic h

an

im p o s te r

o b ta in s

p e rs o n a l

in f o r m a t io n , s u c h as s o c ia l s e c u r it y o r d r iv e r 's lic e n s e n u m b e r s . Easy m e th o d s : C yb e rsp a ce

has m a d e

it e a s ie r f o r a n

id e n tity th ie f to

use th e

in fo rm a tio n

fo r

fr a u d u le n t p u rp o s e s . " O n e b i t o f p e r s o n a l i n f o r m a t i o n is a l l s o m e o n e n e e d s t o s t e a l y o u r i d e n t i t y . "

M o d u le 0 9 P a g e 1 3 6 7

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

HowtoSteal anIdentity CEH O rig in a l id e n t it y - S te ve n C h a rles A d d re s s : San D ie g o CA 9 2 1 3 0

CLASSrC

EXPIRES

STEVEN CHARLES DEM BESTE SflN DIEGO CA 92130

Note: T he id e n tity th e ft illu stra tio n p re se n te d here is fo r d e m o n stra tin g a ty p ica l id e n tity th e ft sce n a rio. It m a y or m a y n o t b e u sed in all lo c a tio n and scenarios. Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

H

o w

t o

S t e a l

a n

I d e n t i t y

=

Identity thieves may use traditional as well as Internet methods to steal identity.

P h y s ic a l m e th o d s

The following are the physical methods for stealing an identity. |

j

S te a lin g C o m p u te r s , L a p to p s , a n d B a c k u p M e d ia

Stealing is a common method. The thieves steal hardware from places such as hotels and recreational places such as clubs or government organizations. Given adequate time, they can recover valuable data from these media. S o c ia l E n g in e e r in g

1 !R £

— This technique is the act of manipulating people's trust to perform certain actions or divulge private information without using technical cracking methods. P h is h in g

The fraudster may pretend to be a financial institution or from a reputed organization and send spam or pop-up messages to trick users into revealing their personal information.

M o d u le 0 9 P a g e 1 3 6 8

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

#

,,, | V

T h e ft o f P e rs o n a l B e lo n g in g s W a lle ts /p u rs e s

u s u a lly c o n ta in

a p e rs o n 's c r e d it c a rd s a n d

d r iv e r 's lic e n s e . A tta c k e r s

m a y s te a l t h e b e lo n g i n g s o n s t r e e t s o r in o t h e r b u s y a re a s .

H a c k in g A tta c k e rs

m ay

c o m p ro m is e

user

s y s te m s

and

ro u te

in fo rm a tio n

u s in g

lis te n in g

d e v ic e s s u c h as s n if f e r s a n d s c a n n e r s . A t t a c k e r s g a in a c c e s s t o a n a b u n d a n c e o f d a t a , d e c r y p t it ( if n e c e s s a r y ) , a n d u s e it f o r i d e n t i t y t h e f t .

V a! ^—‫^—'*׳‬

M a il T h e ft a n d R e ro u tin g M a ilb o x e s a re n o t o fte n

p ro te c te d a n d m a y c o n ta in

b a n k d o c u m e n ts (c re d it c a rd s o r

a c c o u n t s ta te m e n ts ), a d m in is tr a tiv e fo rm s , a n d m o r e . C rim in a ls m a y use th is in fo r m a tio n t o g e t c re d it c a rd s o r fo r r e ro u tin g th e m a il to a n e w a d d re s s .

00

S h o u ld e r S u rfin g C rim in a ls m a y fin d u s e r in fo r m a tio n b y g la n c in g a t d o c u m e n ts , p e rs o n a l id e n t if ic a tio n

n u m b e r s (P IN s ) t y p e d in t o a n a u t o m a t i c t e l l e r m a c h in e ( A T M ), o r o v e r h e a r in g c o n v e r s a tio n s .

u u a ‫ש ש‬

Q

S k im m in g S k im m in g

re fe rs

to

s te a lin g

c r e d it/d e b it

ca rd

n u m b e rs

by

u s in g

a

s p e c ia l

s to ra g e

d e v ic e w h e n p ro c e s s in g th e c a rd .

\ \

P re te x tin g F ra u d s te rs

m ay

pose

as e x e c u tiv e s f r o m

fin a n c ia l

in s titu tio n s , te le p h o n e

c o m p a n ie s ,

a n d o t h e r s o u r c e s t o o b t a i n p e r s o n a l i n f o r m a t i o n o f t h e u ser.

I n t e r n e t

m e th o d s

T h e fo llo w in g a re t h e I n te r n e t m e t h o d s o f s te a lin g an id e n tity .

P h a rm in g ----------------

P h a rm in g

is a n a d v a n c e d f o r m

o f p h is h in g

in w h i c h

th e

c o n n e c tio n

b e tw e e n

th e

IP

a d d r e s s a n d i t s t a r g e t s e r v e r is r e d i r e c t e d . T h e a t t a c k e r m a y u s e c a c h e p o i s o n i n g ( m o d i f y t h e I n t e r n e t a d d re s s w it h t h a t o f a r o g u e a d d re s s ) t o d o th is . W h e n t h e

u s e r t y p e s in t h e

In te rn e t

a d d r e s s , h e o r s h e is r e d i r e c t e d t o a r o g u e w e b s i t e t h a t is s i m i l a r t o t h e o r i g i n a l w e b s i t e .

f

t

K e y lo g g e rs a n d P a s s w o rd S te a le rs A n a t t a c k e r m a y in fe c t t h e u s e r's c o m p u t e r w it h T ro ja n s a n d t h e n c o lle c t t h e k e y w o r d

s tro k e s t o s te a l p a s s w o rd s , u s e r n a m e s , a n d o t h e r s e n s itiv e in f o r m a t io n . C r i m i n a l s m a y a l s o u s e e m a i l s t o s e n d f a k e f o r m s s u c h a s I n t e r n a l R e v e n u e S e r v i c e (IR S ) f o r m s t o g a th e r in fo r m a tio n fr o m th e v ic tim s .

M o d u le 0 9 P a g e 1 3 6 9

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

D R IV E R

^EXPIRES

_

L IC E N S E

S T E U E N

M

CLASS:C

B 8 6 C H A R L E S

D E N

B E S T E

SAN DIEGO CA 9 2 1 3 0 S E X H T :

: M

H A I R : R E D W T :

E Y E S : B R N D O B :

RSTR: CORR LENS DDR

F IG U R E 0 9 . 1 6 : S t e a l i n g a n I d e n t i t y S c r e e n s h o t

M o d u le 0 9 P a g e 1 3 7 0

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

STEP1 H

CEH

G et hold o f S te v e n 's te le p h o n e bill, w a te r bill, o r e lec tricity bill using d u m p s te r diving, sto le n e m a il, o r o n s ite ste a lin g

91•

0170n

S o u t h e r n B e il

V r

V«r,tcn Tliis north's 9 YOU HAVC ANY OUfSTiO** AAOU7 Tm«S BCl-CAU

H:»:1‫־‬I> eturcct Apr 13 to May fCC Sutncr.bV L ne C W 9• . . lo t* P o rt*? ilit‫׳‬/ Strc Urtv*r»»l S*!‫־‬v 1e• Fund 5*.rc‫־‬vj Addit ■<Atl charge!S•e P»j<

NISSAN FOREIGN CAR P 0 BOX 8 * RALEIGH NC 2 7604

832-3412

P /^ Z -fr AMOUNT LAST BILL

A D J USTMENTS

____ 19*6 8

11 19

/-A f- p •Ac ANC C‫׳‬

19 768

JAN 0 2

M N V K K FWOM

HJUtt

Tetjl V«‫־‬i 101‫ ׳‬cfur^»t S ill:* , S C41 1 to y 544 M l 1 Fr« 1 •utsid) 1 x j y 1049- <‫ מ‬. To crztr w m c « a l l 1 JOC*56^991' Fro* oat* <j 1 XD-/&-1049 F y r « « r t t l■ * S X - lK - lS ii

29 45

to

‫״‬

« O N MNVtCC

49

OMWtCTO#V A Q V K im iN O W*QM

qtmcs c k a w m

s c w to rrm i n c l t a x

■nnrMuoNoiuMaiKM

33 84

CHAW QH rw pM L « T o r C A L L • INCL TAX

i

M t tNCiomwi

127202

! total

-63 78

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

)U N

S T E P

q

Q

1

A tta c k e rs

can

g a in

s e a rc h in g , u s in g p a s s w o r d

access

to

a

ta rg e t's

p e rso n a l

in fo rm a tio n

r e c o v e r y s y s te m s , lo c a tin g te le p h o n e

w ith

a

little

G o o g le

b ills , w a t e r b ills , o r e l e c t r i c i t y

b ills u s in g d u m p s t e r d iv in g , s t e a lin g e m a il, o r o n s it e s t e a lin g . T h e s e a re t h e c o m m o n

re so u rce s

fro m

ID p r o o f s

w h ic h th e a tta c k e r can c o lle c t s e n s itiv e in fo r m a tio n

a n d c r e a t e h is o r h e r o w n

u s in g t h e ta r g e t s ' o r ig in a l a d d re s s e s . ---------------------------------

=1■ \

S o u th e rn Bed

/

v o r ijo n

9 TOU MAVt AMV

o j i s t o n s a®0 l 7‫׳‬

_ NISSAN FOREIGN CAR P 0 BOX 64 RALEIGH NC 27602

‫ ז‬HIS M l •CALL

632-3412

P A 1 -0 AMOUNT LAST ■ •L i.

19768 u i r v t c K rw O M T A * ON U K V I C r

I

^A V M C N T t

?< ?

= 3 ^

AOJUSTMCNTS

19768 JAN 02 |loc

!

W « IC T O A T AOVKVTtStMO r« O M

•A L A N C I

1

i re f■EB 02 1‫״‬

i

l '* o

41

TO

C H A W O M rW Q M LIST Q C C A L L S IN C L TAK QTXtW C K A N O t» » CWCO»T» IX CL TAK

H I KNCLOUW t

127202 F I G U R E 0 9 .1 7 : S t e a lin g a n I d e n t it y S T E P 1 S c r e e n s h o t

M o d u le 0 9 P a g e 1 3 7 1

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

STEP2 ■

G o to th e D e p a rtm e n t o f M o t o r V e h ic le s a n d te ll th e m y o u lo s t y o u r d r iv e r's lic e n s e

T h e y w ill a s k y o u fo r p r o o f o f id e n tit y such a s a w a te r b ill a n d e le c tr ic ity b ill

S h o w th e m th e s to le n b ills

Tell th e m y o u h a v e m o v e d fro m th e o rig in a l a d d re s s

T h e d e p a r tm e n t e m p lo y e e w ill a s k y o u to c o m p le te t w o fo r m s - o n e fo r th e r e p la c e m e n t o f th e d r iv e r's lic e n s e a n d th e s e c o n d fo r a c h a n g e in a d d re s s

You w ill n e e d a p h o t o fo r th e d r iv e r's lic e n s e

Y o u r re p la c e m e n t d r iv e r's lic e n s e w ill be is s u e d t o y o u r n e w h o m e a d d re s s

N o w y o u a re re a d y to h a v e s o m e s e rio u s fu n

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S T E P

2

Identity theft can be possible by many physical methods such as stealing a driver's license and using it to get a new license using the target's personal identity details and registering a vehicle. © Go to the Department of Motor Vehicles and tell them you have lost your driver's license © They will ask you for proof of identity, such as a water bill and electricity bill Q

Show them the stolen bills

Q

Tell them you have moved from the original address

Q

The department employee will ask you to complete two forms: one for the replacement of the driver's license and the second for a change in address

Q

You will need a photo for the driver's license

Q

Your replacement driver's license will be issued to yournew home address

M o d u le 0 9 P a g e 1 3 7 2

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

P ro d u ce p ro o f

R equest fo r n e w

o f id e n tity

< ....................

D r iv e r's lic e n s e

iii ii iij

j|j

' ‫יי‬

iii

‫יי‬

iii

i! ii ii < i., o o

O ffic e r

O ffic e r ask to

R e p la c e m e n t d riv e r's

fill 2 fo rm s

lic e n s e w i l l b e is s u e d

A tta c k e r

FIGURE 09.18: Stealing an Identity STEP 2 figure

FIGURE 09.18: Stealing an Identity STEP 2 Screen shot

M o d u le 0 9 P a g e 1 3 7 3

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

C

o m

p a r i s o n

DRIVER LICENSE B86 STEWEN CHARLES DEN BESTE

O rig in a l

SAN DIEGO CA 92130 HAIR:RED NT:

EYES:BRN

[XJB:

RSTR: CORfi LENS

m

m

m

D R I V E R LICENSE

B86 S a m e n a m e : S te v e n C harles

► STEVEN CHARLES DEN I SAN DIEGO CA 92130

Id e n tity T h e ft

SEX:M HT:

HAIR:RED NT:

DOB:

RSTR: CORR LENS

DOBR

F I G U R E 0 9 .1 8 : S t e a lin g a n I d e n t it y C o m p a r is o n S c r e e n s h o t s

M o d u le 0 9 P a g e 1 3 7 4

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

STEP3

CEH

G o to a bank in w hich th e o rig in al Steven Charles has an account and tell them you w ould like to apply for a

The bank w ill ask for your ID: Show them your d riv e r’s

new credit card

w ill be issued and ready for use

licen se as ID, and if the ID is accepted, your credit card

Tell them you do n ot rem em b e r the account num ber

Now you are ready for shopping

and ask them to look it up using Steven's nam e and address

q—q

Fake S tev en is R eady to :

Copyright © by EG-G0IICil. All Rights Reserved. Reproduction is Strictly Prohibited.

0

G o t o a b a n k a t w h ic h th e o rig in a l S te v e n C h a rle s has ana c c o u n t

a n d te ll th e m

y o u w o u ld lik e t o a p p ly f o r a n e w c r e d it c a rd 0

T e ll t h e m

you

do n o t re m e m b e r th e a c c o u n t n u m b e r and ask th e m

t o lo o k it

u p u s in g

S te v e n 's n a m e a n d a d d re s s 0

The

b a n k w ill ask fo r y o u r

ID : S h o w

th e m

y o u r d riv e r 's

lic e n s e

as ID , a n d

if t h e

I D is

a c c e p te d , y o u r c r e d it c a rd w ill b e is s u e d a n d r e a d y f o r u s e 0

N o w y o u a re re a d y fo r s h o p p in g

T h e f a k e S t e v e n is r e a d y t o : 0

M a k e p u r c h a s e s w o r t h t h o u s a n d s in U S D

0

A p p ly f o r a c a r lo a n

0

A p p ly fo r a n e w p a s s p o rt

0

A p p ly fo r a n e w b a n k a c c o u n t

0

S h u t d o w n y o u r u tility s e rv ic e s

M o d u le 0 9 P a g e 1 3 7 5

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

R

e

a

C

a

r d

R e a l

l

S

t e v e n

S

t a

S t e v e n

t e

G

m

G e t s

e t s

e n

a

H

u

g

e

C

r e

d

CEH

i t

t

H u g e

C

r e d i t

C

a r d

S t a t e m

e n t

W h e n y o u l o s e y o u r c r e d i t c a r d , t h e f i r s t t h i n g y o u n e e d t o d o is t o l o d g e a c o m p l a i n t t o t h e b a n k s e rv ic e s y o u u s e as s o o n as y o u m is s t h e c a r d . M a n y b a n k s p r o v id e o n lin e s e rv ic e s f o r c r e d it c a rd s , so y o u m a y b e a b le t o u se t h e w e b s ite t o r e p o r t t h a t or

s to le n

and

in c lu d e

th e

account

n u m b e r,

d a te

of

lo s s

or

th e ft,

y o u r c r e d it c a rd w a s lo s t firs t

d a te

th e

lo s s

was

r e p o r te d , a n d th e la s t a u t h o r iz e d tr a n s a c t io n y o u u s e d th e c a rd fo r.

M o d u le 0 9 P a g e 1 3 7 6

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

-

I d

e

n

t i t y

T

h

e

f t

-

S

e r i o u s

P

r o

b

l e

m

C

E

J

Id en tity th e ft is a s e rio u s p r o b le m a n d n u m b e r o f v io la t io n s a re in c re a s in g ra p id ly

tf

S o m e o f th e w ays to m in im iz e th e ris k o f id e n tit y th e ft in c lu d e ch e c k in g th e c re d it ca rd re p o rts p e rio d ica lly ,

H

s a fe g u a rd in g p e rso n a l in fo rm a tio n a t h o m e a n d in th e w o rk p la c e , v e rify in g th e le g a lity o f so u rce s, etc.

FIGHTING BACK AGAINST

w

AI TMOE COMMISSION

CONSUMERS

BUSINESSES

D€TER

LAW ENFORCEMENT

i s

‫ם‬

DETECT

MUTANT

DEFEND

MEDIA

REFERENCE OESK

WELCOME TO THE FTC'S IDENTITY THEFT SITE

CK-Ifc‫׳‬

AVOSD

vynfl1»Mnny

1 1 1andXV3 K*C1UW«flK/t!*tt

Th!» w*sM« a cnmt 04 d*r*tr t«r*. ■

0(TIN OITICt (Ml( NO

r» ::‫׳‬w ! »«, ‫ ״‬. «« !♦‫ ר־ג‬about ‫♦מ‬ ct:*. *<Jrtomatcnto h*lp you

1

On tfm tfl• conwTOt can I* am he* to *•ad 3*r:h J *lt - and Imm wtultodDiftiairidaattibitofen. BurinMMt can Im ri hcriv to M o 01611 customs Mai •>HJ1IcVi'j!, I »*. «> u*• n rxxr : :<c:vn» in m» Ursl place Law ©n10‫׳‬c»m«nl car 8«t >«c txjicat and *am ‫*©ח‬to rtotp ■M&m of140rtny non R«ad on to hnO out mor• about idantitr B»*r and wtiai rou can do asm! A

waichtntviatc

It your information ha» been aialon and used by an Oemfy *1!«f

tm■Pn»swnr5 inenwv men

been used by an identity thief FlkaCo-itiamiwnnmeFTC

Loarn mots about l<knU1> theft

http://www.ftc.gov Copyright © by EG-G(UllCil. All Rights Reserved. Reproduction is Strictly Prohibited.

J a.

I d e n t i t y

T h e f t

‫ ־‬S e r io u s

P r o b l e m

S o u rce : h ttp ://w w w .ftc .g o v

I d e n t i t y t h e f t is a s e r i o u s p r o b l e m consequences, you

need

to

a n d a n u m b e r o f v i o l a t i o n s a r e i n c r e a s i n g r a p i d l y . T o a v o i d its

re d u ce

th e

ris k

of

id e n tity

th e ft.

W ays

to

m in im iz e

th e

ris k

of

id e n t it y t h e f t in c lu d e : 0

S e c u rin g

p e rso n a l

in fo rm a tio n

in t h e

w o rk p la c e

and

at hom e

and

lo o k in g

o v e r c re d it

ca rd re p o rts Q

C re a te s tro n g a n d

u n iq u e

p a s s w o rd s w ith

a c o m b in a tio n

o f n u m b e r s , s p e c ia l s y m b o ls ,

a n d le tte rs th a t c a n n o t b e g u e ssed 9

G e t y o u r m a i l b o x l o c k e d o r r e n t a m a i l b o x in t h e p o s t o f f i c e

0

S e c u r e y o u r p e r s o n a l PC w i t h a f i r e w a l l , a n t i v i r u s , a n d k e y l o g g e r s

Q

N e v e r p ro v id e y o u r p e rs o n a l in fo r m a tio n to o th e rs

Q

C ross c h e c k y o u r fin a n c ia l a c c o u n ts a n d b a n k s ta te m e n ts re g u la rly

©

R e v ie w y o u r c r e d it r e p o r t a t le a s t o n c e a y e a r

M o d u le 0 9 P a g e 1 3 7 7

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

*•port D Th•ft I

FIGHTING BACK AGAINST

W* 1

[ , ]

FfMMlTM OfCOHM ttKNI

CONSUMERS BUSINESSES LAWENFORCEMENT

04

mM

f l i m I ***a !

| t TC •eer*

(•‫ •״‬I

5 9

MUURT

L

MEDIA

i

REFERENCEOESK

WELCOME TO THE FTC'S IDENTITY THEFT SITE 01Tift

oiuct

01>1*0

Tlas •*Dsd* »s a ona-stoc> nabonat rtsourc* to laam about Vw c n n « of lO tm r. r « « I prcMOtS rtormalon to natp you dmt.dMaci and datono a$a«at tdMMyv*•

1

UitPtfM tiaU tPTffiyg Conv>rHinit<

1

On t u t » t« con»u‫׳‬n * o can !•am how to a»o»d d * n » , - and la am « h afto d o rfV w n d a n «> 1sstoian B vsw ssas can * a m how to halp Vim customan daai •dh 1dan«• v * t as •a d as h o • to pra«ant proetans m v!• ftr*t piaca L a • •nlorcamvnl can oat w o u rcas and laam how to r » 1p •e lm s ot Ntonaty Vwd

Raad on toInd oul mora about »danat>vtad and *mal you can do about t

Nyourinformationha•boonMotonanduaodbyan*anMyMot NyourInformationmayh«v«boon■>01■n.butmayorMynothovo Loom•nor••bout*•mayIho*

Hit a u M H IfltnUt Ihri TaitFotca

Fit i Comciurt wfi Bn FTC

idtnaggTntft Siirvri Rtoort

FIGURE 09.19: Stealing an Identity Screen shot

M o d u le 0 9 P a g e 1 3 7 8

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

Copyright Š by EC-G(Uncil. All Rights Reserved. Reproduction is Strictly Prohibited.

M

o d u l e

So fa r,

we

F l o w have

d is c u s s e d

s o c ia l

e n g in e e rin g ,

v a rio u s

te c h n iq u e s

used

to

p e rfo rm

s o c ia l e n g in e e r in g , a n d t h e c o n s e q u e n c e s o f s o c ia l e n g in e e r in g . N o w , it's t i m e t o d is c u s s s o c ia l e n g in e e rin g c o u n te rm e a s u re s .

S o c ia l E n g in e e r in g C o n c e p ts

>

Id e n tity th e ft

1

S o c ia l E n g in e e r in g T e c h n iq u e s

^

I m p e r s o n a t io n o n S o c ia l

s e c tio n

h ig h lig h ts

th e

a g a in s t s o c ia l e n g in e e r in g a n d save y o u rs e lf fr o m

M o d u le 0 9 P a g e 1 3 7 9

~ P e n e tr a tio n T e s tin g

J iE E

N e t w o r k i n g S ite s

T h is

S o c ia l E n g in e e r in g C o u n te rm e a s u re s

ST'

c o u n te rm e a s u re s a tta c k s , a n d

th a t

g u id e s y o u

can on

m ake how

to

your

o rg a n iz a tio n

m o re

se cu re

d e t e c t s o c ia l e n g i n e e r in g t r ic k s

b e in g tric k e d .

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o

C

o

c i a

u

l

n

E

t e

n

g

r m

e

i n

e

a

s

e

r i n

u

r e

CEH

g

s

J

G o o d p o lic ie s and p ro ce d u re s a re in e ffe c tiv e if th e y are n o t ta u g h t a n d re in fo rc e d by th e e m p lo y e e s

J

A fte r re c e iv in g tra in in g , e m p lo y e e s s h o u ld sign a s ta te m e n t a c k n o w le d g in g th a t th e y u n d e rsta n d th e p o lic ie s

Periodic password

A voiding guessable

A cco u n t blocking

Length and com p le xity

change

passw ords

a fter failed attem pts

o f p assw ords

Secrecy o f passw ords

Password Policies

1* < Physical Security Policies

Identification o f

Escorting

A ccessing

e m p lo yees by issuing

the visitors

area restrictions

‫־‬7

/

Proper shredding

Em ploying

o f useless d o cu m e nts

security personnel

ID cards, uniform s, etc.

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l As c o n fid e n tia l in c lu d e

E

n g i n e e r i n g

m e n tio n e d

p re v io u s ly ,

in fo rm a tio n . T h e

fra u d ,

id e n tify

p ro p e r m e a su re s

th e ft

need

to

C

o u n t e r m

s o c ia l

e n g in e e rin g

a tta c k s th a t a re and

in d u s tria l

be ta k e n .

e a s u r e s is

an

c o n d u c te d

e s p io n a g e ,

a rt

of

tric k in g

p e o p le

to

g a in

u s in g s o c ia l e n g in e e r in g t e c h n iq u e s e tc .

F irs t a n d f o r e m o s t , t o

In

o rd e r to

a v o id

th e s e

a tta c k s ,

p r o t e c t a g a in s t s o c ia l e n g in e e r in g

a t t a c k s , p u t a s e t o f g o o d p o l i c i e s a n d p r o c e d u r e s i n p l a c e . J u s t d e v e l o p i n g t h e s e p o l i c e s is n o t e n o u g h . In o r d e r t o b e e f f e c t i v e : Q

T h e o r g a n i z a t i o n s h o u l d d i s s e m i n a t e t h e p o lic ie s t o a ll u s e r s o f t h e n e t w o r k a n d p r o v i d e p ro p e r

e d u c a tio n

and

tra in in g .

S p e c ia liz e d

tr a in in g

b e n e fits

e m p lo y e e s

in

h ig h e r-ris k

p o s it io n s a g a in s t s o c ia l e n g in e e r in g t h r e a t s . 0

A fte r

re c e iv in g

tra in in g ,

e m p lo y e e s

s h o u ld

s ig n

a s ta te m e n t a c k n o w le d g in g

th a t th e y

u n d e r s t a n d t h e p o lic ie s . Q

S h o u ld c le a r ly d e f in e c o n s e q u e n c e s f o r v io la t in g t h e p o lic ie s .

O ffic ia l s e c u rity

p o lic ie s

and

p ro ce d u re s

h e lp

e m p lo y e e s

o r u s e rs t o

m ake

th e

rig h t s e c u rity

d e c is io n s . S u ch p o lic ie s in c lu d e t h e f o llo w in g :

\

/I

P a s s w o r d

P o lic ie s

T h e p a s s w o r d p o lic ie s s h o u ld a d d r e s s t h e f o l l o w i n g is s u e s :

M o d u le 0 9 P a g e 1 3 8 0

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

0

P a s s w o rd s m u s t be c h a n g e d fr e q u e n tly so th a t th e y a re n o t e a sy to guess.

0

P a ssw o rd s th a t a re a n sw e rs to

easy to

g u e s s s h o u ld

s o c ia l e n g in e e r in g

q u e s tio n s

b e a v o id e d . such

as,

P a ssw o rd s can

"W h e re

w e re

beguessed fro m

you

b o rn ? "

"W h a t

is

y o u r f a v o r i t e m o v i e ? " o r " W h a t is t h e n a m e o f y o u r p e t ? " 0

U s e r a c c o u n ts m u s t b e b lo c k e d if a u s e r m a k e s a n u m b e r o f fa ile d a t t e m p t s t o g u e s s

a

p a s s w o rd . 0

I t is i m p o r t a n t t o k e e p t h e p a s s w o r d l e n g t h y a n d c o m p l e x .

0

M a n y p o lic ie s ty p ic a lly r e q u ir e a m in im u m

0

I t is h e l p f u l t o a l s o r e q u i r e t h e u s e o f s p e c i a l c h a r a c t e r s a n d n u m b e r s , e . g . a r l f 2 3 # $ g .

0

P a s s w o r d s m u s t n o t b e d is c lo s e d t o a n y o t h e r p e rs o n .

p a s s w o rd le n g th o f 6 o r 8 c h a ra c te rs .

P a s s w o r d p o lic ie s o f t e n in c lu d e a d v ic e o n p r o p e r p a s s w o r d m a n a g e m e n t s u c h as: 0

A v o id s h a rin g a c o m p u t e r a c c o u n t.

0

A v o id u s in g t h e s a m e p a s s w o r d f o r d if f e r e n t a c c o u n ts .

0

D o n 't s h a re y o u r p a s s w o rd w ith a n y o n e .

0

A v o id s to rin g p a s s w o rd s o n m e d ia o r w r it in g o n a n o te p a d o r s tic k y n o te .

0

A v o id c o m m u n ic a tin g p a s s w o rd s o v e r th e p h o n e , e m a il, o r S M S .

0

D o n 't f o r g e t t o lo c k o r s h u t d o w n t h e c o m p u t e r b e fo r e le a v in g t h e d e s k .

0

C h a n g e p a s s w o rd s w h e n e v e r y o u s u s p e c t a c o m p r o m is e d s itu a tio n .

P h y s ic a l

S e c u r ity

P o lic ie s

P h y s ic a l s e c u r it y p o lic ie s s h o u ld a d d r e s s t h e f o l l o w i n g is s u e s : 0

E m p lo y e e s o f a p a r tic u la r o rg a n iz a tio n

m ust

be

is s u e d

id e n tific a tio n

c a rd s

(ID c a rd s ) ,

a n d p e rh a p s u n ifo r m s , a lo n g w it h o t h e r a cce ss c o n tr o l m e a s u re s . Š

V is ito rs

to

an

o rg a n iz a tio n

m ust

be

e s c o rte d

in to

v is ito r

ro o m s

or

lo u n g e s

by

o ffic e

s e c u rity o r p e rs o n n e l. 0

C e rta in

a re a s o f an

u se rs fr o m 0

o rg a n iz a tio n

m u st be

re s tric te d

in

o rd e r to

a c c e s s in g t h e m .

O ld d o c u m e n t s t h a t m i g h t s till c o n t a i n s o m e v a lu a b le i n f o r m a t i o n by

u s in g

p re v e n t u n a u th o riz e d

e q u ip m e n t

such

as

paper

s h re d d e rs

and

b u rn

b in s .

m u s t b e d is p o s e d o f T h is

can

p re v e n t

th e

d a n g e rs p o s e d b y s u c h h a c k e r te c h n iq u e s as d u m p s t e r d iv in g . 0

S e c u rity p ro p e rty .

p e rs o n n e l

m ust

T ra in e d

s e c u rity

be

e m p lo y e d

p e rso n n e l

can

in

an be

o rg a n iz a tio n

a s s is te d

by

to

a la rm

p ro te c t s y s te m s ,

p e o p le

and

s u rv e illa n c e

c a m e ra s , e tc .

M o d u le 0 9 P a g e 1 3 8 1

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

C

o

u

n

E

t e

n r m

g

i n e

a

e

e

s u

r i n r e

g

s

( c o n t ’d )

r

An efficient training program should consist of all security policies and m eth o d s to increase aw aren ess on social engineering

Training

O perational G uidelines

M ake su re sensitive inform ation is secu red and reso u rces a re accessed only by au th o rized users

Access Privileges

There should be adm inistrator, user, and guest accounts with proper authorization

Classification of Inform ation

Categorize the information as top secret, proprietary, for internal use only, for public use, etc.

There should be p roper guidelines for reacting in case of a social engineering a tte m p t

P ro p er Incidence R esponse Time

L/J

B ackground Check of Em ployees an d P roper T erm ination Process

Insiders with a criminal background and terminated employees are easy targets for procuring information

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

S o c ia l

E

n g i n e e r i n g

C

o u n t e r m

e a s u r e s

( C

o n t ’ d )

The following are the countermeasures that can be adopted to protect users or organizations against social engineering attacks: T ra in in g

Periodic training sessions must be conducted to increase awareness on social engineering. An effective training program must include security policies and techniques for improving awareness. O p e ra tio n a l G u id e lin e s

Confidential information must always be protected from misuse. Measures must be taken to protect the misuse of sensitive data. Unauthorized users must not be given access to these resources. A c c e s s P riv ile g e s

Access privileges must be created for groups such as administrators, users, and guests with proper authorization. They are provided with respect to reading, writing, accessing files, directories, computers, and peripheral devices.

M o d u le 0 9 P a g e 1 3 8 2

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

C la s s ific a tio n o f I n f o r m a tio n In fo rm a tio n

has

to

be

c a te g o riz e d

on

a

p rio rity

b a s is

as

to p

s e c re t,

p ro p rie ta ry ,

fo r

in te r n a l u s e o n ly , f o r p u b lic u s e , e tc .

[W |j

H P

P r o p e r In c id e n c e R e s p o n s e S y s te m T h e r e s h o u l d b e p r o p e r g u i d e l i n e s t o f o l l o w in c a s e o f a s o c ia l e n g i n e e r i n g a t t e m p t .

B a c k g r o u n d C h e c k s o f E m p lo y e e s a n d P r o p e r T e r m in a tio n P ro ce ss B e fo re

h irin g n e w

p ro ce ss fo r te rm in a te d

e m p lo y e e s , c h e c k th e ir b a c k g ro u n d

e m p lo y e e s , s in c e t h e y

fo r c r im in a l a c tiv ity .

m ay pose a fu tu re

th re a t to

th e

F o llo w

a

s e c u rity o f an

o rg a n iz a tio n . B e ca u se th e e m p lo y e e s w ith a c r im in a l b a c k g ro u n d a n d a t e r m in a t e d

e m p lo y e e

a re e a sy ta rg e ts fo r p ro c u rin g in fo rm a tio n .

M o d u le 0 9 P a g e 1 3 8 3

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

C

o

u

n

E

t e

n r m

g

i n e

a

e

e

s u

r i n r e

CEH

g

s

( c o n t ’d )

Anti-Virus/Anti-Phishing Defenses Use multiple layers of anti-virus defenses such as at end-user desktops and at mail gateways to minimize social engineering attacks

f

© ‫ג‬ Two-Factor Authentication

Change Management

Instead of fixed passwords, use two-factor authentication for high-risk network services such as VPNs and modem pools

A documented change-management process is more secure than the ad-hoc process Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l

E n g i n e e r i n g

C

o u n t e r m

T w o - F a c to r A u t h e n t ic a t io n

e a s u r e s ( T F A

o r

( C

o n t ’ d )

2 F A )

H

In the two-factor authentication (TFA) approach, the user or the person needs to present two different forms of proof of identity. If the attacker is trying to break in to a user account, then he or she needs to break the two forms of user identity, which is a bit difficult. Hence, TFA is also known as a defense in depth security mechanism. It is a part of the multifactor authentication family. The two security pieces of evidence that a user should provide may include: a physical token, like a card, and typically something the person can commit to memory, such as a security code, PIN, or password. A n tiv ir u s /A n ti- P h is h in g D e fe n s e s

Use of multiple layers of antivirus defenses at end-user desktops and at mail gateways minimizes the threat against phishing and other social engineering attacks. Change M anagem ent

A documented change-management process is more secure than an ad-hoc process.

M o d u le 0 9 P a g e 1 3 8 4

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

-

H

o

w

t o

D

e

t e

c t

It in clu d e s links th a t le ad to sp o o fe d

P

j

J

m

m

h

i s h

^

i n

7

Menage

g

E

m

a

i l s

C

E

H

< ‫ ש‬23

Msec Account verification • Message (HTML)

o

Developer Sent

w e b site s asking to en te r personal

Q

Won 12/13/2010 5:29 PM

in fo rm a tio n w h en clicked HSBC Account verficacion

The phishing e m ail seem s to be fro m a

Dear HSBC Online ts a r

bank, fin a n c ia l in s titu tio n , com pany,

As part 01 cur security measures, tne HSBC Ban*, has deveiooed a security program against the iraudulert aterrpts and account thefts Tharaforo. our syst6m requires furlhar account information A e reqjesi informalon from you fcr tne roilcwing reason w e neec to verity your account information n ordertc insure t ie safety and integrity of cur services

o r so cial n e tw o rkin g site S eem s to be fro m a person w h o is listed in y o u r e m a il ad d re ss b o o k

P*ease follow tne In * 3elc‫־‬.v to roceed Proceed :0 Account Verificaticr tttc /w,v.vhshc ecrn/usarvenfication asox

‫־‬£

D irects to ca ll a p h o n e n u m b e r in

Once you login you w ll be provided ■vith steps to complete J $ verification process For your safety we ha/e physical, electronic, orocedural safeguards that comply with ecerai regulations 10 protect the inform ation you )0 provide to us

o rd e r to give up accou n t num ber, person al id e n tifica tio n num ber,

Thanks and Regards.

passw ord, o r co n fid e n tia l in fo rm a tio n Includes o ffic ia l-lo o k in g lo gos and o th e r in fo rm a tio n taken d ire c tly fro m le g itim a te w eb site s co nv in cin g you to d isclo se y o u r person al d etails

n

Link that seems to be legitimate but leads to spoofed website

A

Copyright @ by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

H

o w

t o

D e t e c t

P h i s h i n g

E m

a i l s

In a n a t t e m p t t o d e t e c t p h i s h i n g m a i l s , t h e f i r s t t h i n g y o u a d d re s s ." S o m e tim e s a tta c k e rs se n d p h is h in g m a ils f r o m

n e e d t o c h e c k is t h e " f r o m

an a c c o u n t th a t s e e m s to be g e n u in e

b u t is n o t a c t u a l l y . I f t h e e m a i l c o n t a i n s a n y l i n k s , f i r s t " h o v e r " t h e m o u s e c u r s o r o v e r t h e l i n k t o see w h a t th e

l i n k is b e f o r e y o u

a c t u a l l y c l i c k i t . I f i t is t h e

s a m e as th e

lin k d e s c r ip tio n

in t h e

e m a i l , t h e n i t is l i k e l y n o t a p h i s h i n g e m a i l . S o m e a t t a c k e r s m a n a g e t o d i s p l a y t h e s a m e U R L a n d t h e a p p e a r a n c e a ls o a l m o s t s e e m s s i m i l a r t o t h a t o f a g e n u i n e s it e . In s u c h c a s e s , y o u c a n c h e c k w h e t h e r t h e l i n k is g e n u i n e o r a p h i s h i n g l i n k b y l o o k i n g a t t h e s o u r c e c o d e . Y o u c a n d o t h i s b y rig h t-c lic k in g o n th e e m a il a n d s e le c tin g V ie w S o u rc e .

T h is s h o w s t h e c o d e u s e d t o d is p la y t h e

e m a il. B ro w s e th e c o d e a n d s e a rc h f o r th e

a re n o t a b le t o fin d t h e

p h is h in g

lin k .

D o n 't

p ro v id e

any

k in d

of

lin k . If y o u in fo rm a tio n

on

such

lin k s .

The

lin k , t h e n

fo llo w in g

a re

it's a th e

s y m p to m s o f a p h is h in g e m a il: Q

It in c lu d e s lin k s t h a t le a d t o s p o o f e d w e b s it e s a s k in g y o u t o e n t e r p e r s o n a l i n f o r m a t i o n w h e n c lic k e d .

Q

The

p h is h in g

e m a il s e e m s t o

be fro m

a b a n k , f in a n c ia l in s t i t u t i o n , c o m p a n y , o r s o c ia l

n e t w o r k i n g s ite . ©

It s e e m s t o b e f r o m

M o d u le 0 9 P a g e 1 3 8 5

a p e r s o n w h o is l i s t e d i n y o u r e m a i l a d d r e s s b o o k .

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

Q

It d i r e c t s y o u t o c a ll a p h o n e n u m b e r in o r d e r t o

p ro v id e an a c c o u n t n u m b e r, p e rs o n a l

id e n tific a tio n n u m b e r, p a s s w o rd , o r c o n fid e n tia l in fo rm a tio n , Q

It in c l u d e s

o ffic ia l-lo o k in g

lo g o s

and

o th e r

in fo rm a tio n

ta k e n

d ire c tly

fro m

le g itim a te

w e b s ite s , c o n v in c in g y o u t o d is c lo s e y o u r p e r s o n a l d e ta ils , T h e s c r e e n s h o t t h a t f o ll o w s lo o k s v e r y m u c h lik e a n e m a il f r o m

H S B C B a n k . T h e m a i l is

re g a r d in g a c c o u n t v e r ific a tio n a n d c o n ta in s a lin k f o r v e r ific a tio n . W h e n t h e m o u s e h o v e rs o n t h e l i n k p r o v i d e d i n m a i l , i t is d i s p l a y i n g s o m e o t h e r a d d r e s s . H e n c e , i t c a n b e c o n s i d e r e d a p h i s h i n g m a i l . T h e p e r s o n w h o is n o t a w a r e o f p h i s h i n g m a y c l i c k o n t h e l i n k a n d p r o v i d e t h e c o n f id e n t ia l c r e d e n t ia ls , t r e a t i n g it as a g e n u in e e m a il f r o m t h e b a n k .

T h is m e a n s t h a t t h e

a t t a c k e r s u c c e e d e d in t r i c k i n g t h e u s e r a n d t h e u s e r m a y f a c e a g r e a t m o n e t a r y lo s s . T o a v o i d s u c h a t t a c k s , e v e r y u s e r m u s t c o n f i r m w h e t h e r i t is a g e n u i n e e m a i l o r n o t b e f o r e c l i c k i n g t h e l i n k a n d p r o v i d i n g i n f o r m a t i o n . O n e w a y t o d e t e c t p h i s h i n g e m a i l s is t o t a k e a l o o k a t t h e a c t u a l U R L p o i n t e d t o b y a n y w e b s i t e lin k s in t h e t e x t o f t h e e m a i l . F o r e x a m p l e , t h e lin k h t t p : / / w w w . h s b c . c o m / u s e r / v e r i f i c a t i o n . a s p x is a c t u a l l y l i n k e d t o h t t p : / / w w w . 1 0 8 . 2 1 4 . 6 5 . 1 4 7 . c o m / f o r m . a s p x . w h i c h is n o t t h e b a n k ' s o r i g i n a l w e b s i t e . T h e a t t a c k e r u s u a lly h id e s a p h i s h i n g l i n k in t h e f o r m

o f a U R L. W h e n t h e u s e r c lic k s o n t h e p h is h in g

l i n k , h e o r s h e is r e d i r e c t e d t o a f a k e w e b s i t e a n d a l l t h e d e t a i l s p r o v i d e d b y t h e u s e r a r e s t o l e n a n d m is u s e d .

d l H

*0

‫ויייייו‬

(J

♦ 1“

Message

From:

‫כ‬a

HSBC Account Verification - Message (HTML)

S3

<‫ ־־‬G

Developer if

Sent:

M on 12/13/2010 5:29 PM

*■paw Cc Subject:

HSBC Account Verification

$

Dear H S B C Online user. As part of our security measures, the H S 6 C Bank, has developed a security program against the fraudulent attempts and account thefts Therefore, our system requires further account information. We request information from you for the following reason. We need to verify your account information in order to insure the safety and integrity of our services. http: 'www.103.214.65.147.com form.asp* Click to fo llo w link

Please follow the link below to roceed

1.‫׳‬w ww hsbccorTV usenVerification aso x Proceed to Account Verificatior htto1■ ______________________________h

____________________________________________

Once you login, you will be provided with steps to complete J f verification process For your safety, we have physical, electronic, procedural safeguards that comply with ederal regulations to protect the information you to provide to us.

Thanks and Regards.

L in k t h a t s e e m s t o b e l e g it im a t e b u t le a d s t o s p o o f e d w e b s it e

FIGURE 09.20: Phishing Email Screen shot

M o d u le 0 9 P a g e 1 3 8 6

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

A

n

t i - P

h

i s h

i n

g

T

o o

l b

a

r :

N

e

t c r a

f t

C

E

H

T h e N e tc ra ft T o o lb a r p ro v id e s c o n s ta n tly u p d a te d in fo rm a tio n a b o u t th e s ite s you v is it as w e ll as b lo c k in g d a n g e ro u s s ite s

Hacker Halted nacKer nanea

i j

us A 2012

®ct 25-31, 2 0 1 2 intercontinental Hot*. Miami. F1

I U n ra v e l

th e

E n ig m a

o f

*uguit

h ttp ://to o lb a r .n e tc r a ft. c o m

To protect your savings from phishing attacks

‫ט‬

To see the hosting lo catio n and risk rating of every site visited

«

To help defend the Internet co m m u nity from

to to

Mo'onbw 000)1•Int.

to utB

(Mot•( GoojlrIn‫׳‬

to

‫י‬

F e a tu re s: «

Goa)••int.

D»<ort>* Mtana TedroMpw

fraudsters

Copyright © by EG-G(ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

A n t i - P h i s h i n g

T o o l b a r :

N

e t c r a f t

Source: http://toolbar.netcraft.com

The Netcraft Toolbar provides updated information about the sites you visit regularly and blocks dangerous sites. The toolbar provides you with a wealth of information about the sites you visit. This information will help you make an informed choice about the integrity of those sites. It protects you from phishing attacks, checks the hosting location and risk rating of each and every website you visit, and helps to secure the Internet community from fraudsters.

M o d u le 0 9 P a g e 1 3 8 7

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

I s J f i t C«rt!fltd I1h1<4l HkImt, 1C Ccun<11. CL.. | 4• j

cl Q' M /SM /f\*1rrh . *ocUUs

ftbXQ} *W - 1»r! i

Courses

Training

Marker

Centertn:•

H a lte d

rid C K e r n d llC U

u s

PmU»

CC Ccura‫׳‬

vrtttmb

Ctrvces

CerWterton

Resources

A O ct 2 5 -3 1 , 2 0 1 2

2 0 l2

Intercontinental Hotel. Miami. Florida

i*r . - < ‫ני * ז‬

<i£1

-

kt i i«

I

, ‫־י‬ 1 5 1‫ז‬ /

‫'* ' ׳‬ /

-‫!*־־־‬

t

r \ ‫ ׳‬: . I \ \

*

Unravel the Enigma of

You m* hw• ‫ »י‬Abmil Us * Global Silw. <• A m li^uNZ

lay St*pt«rob«1 ?4 ?01?

FIGURE 09.21: Netcraft Tool Screen shot

M o d u le 0 9 P a g e 1 3 8 8

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

I A

n

t i - P

P

h

i s h

h T

i s h a

n

i n

g

T

l b

a

r :

k

j 0 PhishTank | Join the fight

PhishTank is a collaborative clearing house for data and information about phishing on the Internet. It provides an open API for developers and researchers to integrate anti-phishing data into their applications

o o

C U D

‫___ ץ‬

www.phishtarlccorr Internet safer, fast®

P h is h T a n k

Out 01 the Net into the Tank.

Join the fight against phishing

What is phishing?

Submit suspected phishes Track the status of your submissions Verify other users' submissions Develop software with our free API

Ptuchino 1c a fraudulent •IX•‫ ״‬tt usually rrtade through cmml, •9 « your pesBonal Information.

- m« * A t in th« Tank:

What is PhishTank?

b i t jphUh?!

PhishTank is a eel labor■*** eiearr$ house for data and information 4tout phwhing on th« 3rtt«rn«t. Alto, PhishTank provide* an ope‫ ״‬apj for developer3 ana reoearchars v> integrate anti-phishingdal■ into thnr aopiicacons »‫ ז‬no cha'pe. Read the FAQ...

Recent Submissions You can help‫ ׳‬Skin In o‫ ׳‬rro iM rr [free1fast1) to veirfy these suspected phwhes.

1s73?ss

hnp://ww*.paypai.ea.50l6.seajra7u.nm/‫׳‬n>»see.'ca>.b.

1573254 hn0://moroansel6£.ccrr\fotd_aol.:..2a)u1try ',t 0Q1n-&..

bill*aka

1573253 hnp://n6w88msf■deidadtla ~ .com/cad/sm&'dcuarfi/pro.. 1573252 http://eollv.tor.ayaol.oom.11tm 1573251 mtt>:/7pao!na£l23^km1.«£.‘b0(lrterr«C'

http://www. phishtank.com Copyright © by EC-CfUIICil. All Rights Reserved. Reproduction Is Strictly Prohibited.

A n t i - P h i s h i n g

‫ע‬ H ‫־‬e - s

T o o l b a r :

P h i s h T a n k

Source: http://www.phishtank.com

PhishTank is a community site where any individual or group can submit, track, and verify phishing sites. It is a collaborative clearinghouse for data and information about phishing on the Internet. In addition, an open API is provided for the developers and researchers by PhishTank for integrating anti-phishing data into their applications.

M o d u le 0 9 P a g e 1 3 8 9

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

PtmhTcnk | Join Utc fight

W f

O

ti

\

D www.phishtank.com PhishTank io o perated bv OoonDNS , a fre o o e rvicc th a t rnakos you r In te rn e t oafar, •a :to r, and om a rto r. ;

P h is h T a n k Add A Ptifc.11

Out of the Net. into the Tank.

Verify A RlilsJi

Pl1i*.h Search

St4L*>

FAQ

D«vtfJ0 |»er>

KtAayLbb

Ny AliourI

J o in th e fig h t a g a in s t p h is h in g

What is phishing? Phishing is a frau du len t a ttem p t, usually m ade th rough em ail, to steal y o u r personal info rm a tion .

Submit suspected phishes. Track the status of your submissions. Verify other users' submissions. Develop software with our free API.

L e a r n m o r e .,,

F o u n d a p h is h in g s ite ? G e t s ta r t e d n o w — s e e if it's in th e T a n k : h ttp ://

What is PhishTank?

Is i t a p h is h ? {

PhishTank is a colla bo ra tive clearing house fo r data and in fo rm a tion about phishing on the In te rn e t. Also, PhishTank provides an open API fo r de velopers and researchers to inte gra te anti-phishing data into th eir applications a t no charge. R ead th e FAQ ...

Recent Submissions Y o u c a n helD ! S k m in o r r e u fo t e r ( fr e e ! fa s t!) to v e rify th e s e s u s o e c te d o h ts h e s ID

URL

1573255

http ://w w w .p a y p a l.c a .5 0 1 6 .c«c u r# 7 u .m x /im a g *c/cg i b ...

S u b m itte d b y EhshBsasiSsu

157325**

h ttp ://m o rg a n s e le c .e o m /o ld _ a o l.l.3 c o u n try /7Log1n - 61...

bil w ake

15/3253

h ttp://n ew s s m s hd ei1d a d e ta m .com /cad /sm s/atua l1/p r o ...

ckacota

• S737S?

h ttn ://c n l 1v . Ifi r .rc fa n l.r n m . htm

hil w ake

1573251

h ttp ://p a g in a c l2 3 .c k 1 w i.4 c /b o d in ta rn a t/

Cmt

1S73250

h ttp s //tu c e.c y c u .c d u.tw /toe t/p ro m o c oo a/8tu al/

ggnarti.n

1573249

http://a td w w .c o m /lo g in /a u tlV h o m c a w a y /lo g in /5 e rvice ...

RG5e30tTU 1C ah7NjZ46A

157324C

h ttp s ://u s .b a ttle .n e t/lo g in /e r/? re f» h ttp % 3 A */« 2 F '& 2 rj...

k ji

1573Z47

h ttp ://w w w .pa y pa l.c a.7 40 9.s ec u re 3g .m x /im a ge s/cgi.b...

P h shR eocrter

FIGURE 09.22: PhishTank Tool Screen shot

M o d u le 0 9 P a g e 1 3 9 0

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

I d

e

n

t i t y

T

h

e

f t

C

o

u

n

t e

r m

e

a

s u

r e

s

c

E H

S e cu re o r s h re d a ll d o c u m e n ts c o n ta in in g p riv a te in fo rm a tio n

To k e e p y o u r m a il s e c u re , e m p ty th e m a ilb o x q u ic k ly

Ensure y o u r n a m e is n o t p re se n t in th e m a rk e te rs ' h it lists

S usp ect and v e rify a ll th e re q u ests fo r p e rso n a l data

Review y o u r credit card rep orts regularly and never let it go o u t o f sight

P ro te ct y o u r p e rso n a l in fo rm a tio n fro m b e in g p u b lic ize d

N e v e r give a n y p e rso n a l in fo rm a tio n o n th e p h o n e

Do n o t d is p la y a cc o u n t/co n ta c t n u m b e rs u n less m a n d a to ry

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

I d e n t i t y

T h e f t

C

o u n t e r m

e a s u r e s

Identity theft occurs when someone uses your personal information such as your name, social security number, date of birth, mother's maiden name, and address in a malicious way, such as for credit card or loan services or even rentals and mortgages without your knowledge or permission. Countermeasures are the key to avoid identity theft. These measures help to prevent and respond to identity theft. The chances of identity theft occurring can be reduced easily by following these countermeasures: © Secure or shred all documents containing private information © To keep your mail secure, empty your mailbox quickly © Ensure your name is not present on marketers' hit lists © Be suspicious of and verify all requests for personal data © Review your credit card reports regularly and never let your cards out of your sight © Protect your personal information from being publicized © Never give out any personal information on the phone © Do not display account/contact numbers unless mandatory

M o d u le 0 9 P a g e 1 3 9 1

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

M

o d u l e

F l o w

Considering th a t you are now fa m ilia r w ith all the necessary concepts o f social engineering, tech n iq ue s to p erfo rm social engineering, and counterm easures to be applied fo r various threats, we w ill proceed to p en e tratio n testing. Social engineering pen testing is the process o f testin g th e ta rg e t's se curity against social engineering by sim ulating the actions o f an attacker. S o c ia l E n g in e e r in g C o n c e p ts

â&#x20AC;˘

Id e n tity th e ft

1

S o c ia l E n g in e e r in g T e c h n iq u e s

S o c ia l E n g in e e r in g C o u n te rm e a s u re s

j^ P * l

I m p e r s o n a t io n o n S o c ia l N e t w o r k i n g S ite s

â&#x20AC;&#x201D; Ix T I 5E=

P e n e tra tio n Testing

This section describes social engineering pen testing and th e steps to be fo llo w e d to conduct the test.

M o d u le 0 9 P a g e 1 3 9 2

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

E

n

g

i n

e

e

r i n

g

P

e n

T

e

s t i n

g

c

E H

The objective of social engineering pen testing is to test th e strength of human factors in a security chain within the organization Social engineering pen testing is often used to raise level of security aw areness among employees Tester should dem onstrate extrem e care and professionalism for social engineering pen test as it might involve legal issues such as violation of privacy and may result in an embarrassing situation for the organization

Good

Good

In te rp e rs o n a l

C o m m u n ic a tio n

Skills

Skills

‫׳‬

,>

j

T a lk a t iv e a n d

n

C r e a t iv e

F rie n d ly N a tu re

v

y

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

S o c ia l

M

E

n g i n e e r i n g

P e n

T e s t i n g

-‫י‬ 1— The main objective of social engineering pen testing is to test the strength of human factors in a security chain within the organization. Social engineering pen testing is often used to raise the level of security awareness among employees. The tester should demonstrate extreme care and professionalism in the social engineering pen test as it might involve legal issues such as violation of privacy and may result in an embarrassing situation for the organization. The pen tester should educate the critical employees of an organization about social engineering tricks and consequences. As a pen tester, first you should get proper authorization from the organization administrators and then perform social engineering. Collect all the information that you can and then organize a meeting. Explain to employees the techniques you used to grab information and how the information can be used against the organization and also the penalties that the people responsible for information leakage need to bear. Try to educate and give practical knowledge to the employees about social engineering as this is the only great preventive measure against social engineering. A good pen tester must possess the following qualities: Q

Pen tester should poses good communication

©

He or she should be talkative and have afriendly nature

Q

Should be a creative person

0

Should have good interpersonal skills

M o d u le 0 9 P a g e 1 3 9 3

skills

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

E

n

g

i n

e

e

r i n

g

P

e n

T

e

s t i n

g

C

E

H

The objective of social engineering pen testing is to test th e strength of human factors in a security chain within the organization Social engineering pen testing is often used to raise level of security aw areness among employees Tester should dem onstrate extrem e care and professionalism for social engineering pen test as it might involve legal issues such as violation of privacy and may result in an embarrassing situation for the organization

Good

Good

In te rp e rs o n a l

C o m m u n ic a tio n

Skills

Skills

‫׳‬

,>

j

T a lk a t iv e a n d

n

C r e a t iv e

F rie n d ly N a tu re

v

y

Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l

E

n g i n e e r i n g

P e n

T e s t i n g

( C

o n t ’ d )

’ “ Collecting all possible information sources and testing them against all possible social engineering attacks is a bit of a difficult task. Hence, social engineering pen testing requires a lot of effort and patience to test all information sources. Even after putting a lot of effort in, if you miss any one information source that can give valuable information to the attacker, then all your efforts are worth nothing. Therefore it is recommended that you list and follow the standard steps of social engineering. This ensures the maximum scope of pen testing. The following are the steps involved in typical social engineering testing: S te p 1:

Obtain authorization

The first step in social engineering penetration testing is obtaining permission and authorization from the management to conduct the test. S te p 2:

Define scope of pen testing

Before commencing the test, you should know for what purpose you are conducting the test and to what extent you can test. Thus, the second step in social engineering pen testing is to define the scope. In this step, you need to gather basic information such as list of departments, employees that need to be tested, or level of physical intrusion allowed, etc. that define the scope of the test. M o d u le 0 9 P a g e 1 3 9 4

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S te p 3: O b t a in a lis t o f e m a ils a n d c o n ta c ts o f p r e d e f in e d ta r g e ts N e x t t r y t o o b t a i n e m a i l s a n d c o n t a c t d e t a i l s o f p e o p l e w h o h a v e b e e n t r e a t e d a s t a r g e t s in t h e second

s te p ,

i.e ., d e f i n e

th e

scope

of

pen

te s tin g .

B ro w se

a ll

in fo rm a tio n

s o u rce s

to

check

w h e t h e r t h e i n f o r m a t i o n y o u a r e l o o k i n g f o r ( e m a i l a d d r e s s , c o n t a c t d e t a i l s , e t c . ) is a v a i l a b l e o r n o t. If in f o r m a t io n

is a v a i l a b l e , t h e n c r e a t e a s c r i p t w i t h s p e c i f i c p r e t e x t s . I f i n f o r m a t i o n

is n o t

a v a i l a b l e , t h e n c o l l e c t e m a i l s a n d c o n t a c t d e t a i l s o f e m p l o y e e s in t h e t a r g e t o r g a n i z a t i o n . S te p 4 : C o lle c t e m a ils a n d c o n t a c t d e ta ils o f e m p lo y e e s in t h e t a r g e t o r g a n iz a t io n If y o u

a re

not

a b le

to

fin d

in fo rm a tio n

about

th e

ta rg e t

p e o p le ,

th e n

try

a d d r e s s e s a n d c o n t a c t d e t a i l s o f o t h e r e m p l o y e e s in t h e t a r g e t o r g a n i z a t i o n

to

c o lle c t

e m a il

u s in g te c h n iq u e s

s u c h as e m a il g u e s s in g , U S E N E T a n d w e b s e a rc h , e m a il s p id e r t o o ls lik e E m a il E x tr a c to r , e tc . S te p 5: C o lle c t in f o r m a t io n u s in g f o o t p r in t in g t e c h n iq u e s O nce you

c o lle c t e m a il a d d re s s e s a n d

c o n d u c t e m a il fo o t p r in t in g

and

c o n ta c t d e ta ils o f th e

o th e r te c h n iq u e s

to

t a r g e t o r g a n iz a tio n 's e m p lo y e e s ,

g a t h e r as m u c h

in fo rm a tio n

as

p o s s ib le

a b o u t t h e t a r g e t o r g a n i z a t i o n . C h e c k w h a t i n f o r m a t i o n is a v a i l a b l e a b o u t t h e i d e n t i f i e d t a r g e t s . If y o u

a re

a b le

to

c o lle c t

in fo rm a tio n

th a t

is

h e lp fu l

fo r

h a c k in g ,

th e n

c re a te

a s c rip t

w ith

s p e c ific p re te x ts . If y o u s te p

a re 4

n o t a b le t o

and

try

to

c o lle c t u s e fu l in fo r m a tio n

c o lle c t

e m a ils

and

c o n ta c t

a b o u t th e d e ta ils

id e n tifie d ta rg e ts , th e n

of

o th e r

e m p lo y e e s

in

go

back to

th e

ta rg e t

o rg a n iz a tio n . S te p 6: C re a te a s c r ip t w i t h s p e c ific p r e te x ts C re a te

a s c rip t

based

on

th e

c o lle c te d

in fo rm a tio n ,

c o n s id e rin g

b o th

p o s itiv e

and

n e g a tiv e

re s u lts o f an a tte m p t.

M o d u le 0 9 P a g e 1 3 9 5

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

U

s i n

g

E E

n

g

i n

m

a

i l s

e

e

r i n

g

P

e n

T

e s t i n

g

: â&#x201E;˘

E

! :

D o cu m en t a ll th e recovered

Em ail em ployees askin g for

in fo rm a tio n and respective

personal in form ation

victim s

Send and m o n ito r em ails w ith m alicio u s attachm ents to target victim s

Send phishing em ails to target victim s

Response is received?

YES ...............

D o cu m en t a ll th e responses and respective victim s

Email employees asking for personal inform ation such as their user names and passwords by disguising as network administrator, senior manager, tech support, or anyone from a different department on pretext of an emergency Send emails to targets with malicious attachments and monitor their treatment with attachments using tools such as ReadNotify

Vulnerable Targets

Send phishing emails to targets as if from a bank asking about their sensitive information (you should have requisite permission for this)

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

^ a

S o c ia l y

E n g i n e e r i n g

P e n

T e s t i n g :

U s i n g

E m

a i l s

a

Once you obtain email addresses and contact details of employees of the target organization, you can conduct social engineering pen testing in three possible ways. They are using emails, using the phone, and in person. The following are the steps for social engineering pen testing using emails: S te p 7:

Email employees asking for personal information

As you already have email addresses of the target organization's employees, you can send emails to them asking for personal information such as their user names and passwords by disguising yourself as a network administrator, senior manager, tech support, or anyone from a different department using the pretext of an emergency. Your email should like a genuine one. If you succeed in luring the target employee, your job is done easily. Extractthepersonal information of the victim from the reply and document all the recoveredinformation and respective victims. But if you fail, then don't worry; there are other ways to mislead the victim. If you get no reply from the target employee, then send emails with malicious attachments and monitor his or her email.

M o d u le 0 9 P a g e 1 3 9 6

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S te p 8: S e n d a n d m o n it o r e m a ils w it h m a lic io u s a tta c h m e n ts t o ta r g e t v ic tim s

Send emails with malicious attachments that launch spyware or other stealthy informationretrieving software on the victim's machine on opening the attachment. And then monitor the victim's email using tools such as ReadNotify to check whether the victim has opened the attachment or not. If the victim opens the document, you can extract information easily. Document the information extracted and all the victims. If victim fails to open the document, then you cannot extract any information. But you can can still carry out other techniques such as sending phishing emails to lure the user. S te p 9: S e n d p h is h in g e m a ils t o ta r g e t v ic tim s

Send phishing emails to targets that looks as if it is from a bank asking about their sensitive information (you should have requisite permission for this). If you receive any response, then extract the information and document all the responses and respective victims. If you receive no response from the victim, then continue the pen testing with telephonic methods.

M o d u le 0 9 P a g e 1 3 9 7

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

U

s i n

g

E P

n

g

i n

e

e

r i n

g

P

e n

T

e s t i n

g

:

h o n e

Call a target posing as a

C all a target and o ffer th em

co lle ague and ask fo r th e

rew ards in lieu o f personal in fo rm a tio n

s en sitiv e in form ation

Th reaten th e ta rg e t w ith dire

Call a target user posing as an im p o rta n t user

C all a target posing as tech n ical sup p o rt and ask for th e sen sitive in form ation

con se q u e n ce s (for e xa m p le acco u n t w ill be d isa b le d ) to get

Use reverse social engineering techniques so th at the targets yield inform ation them selves

Refer to an im p o rta n t person in th e organization and try to co lle ct data

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

Jg

S o c ia l

E

n g i n e e r i n g

P e n

T e s t i n g :

U s i n g

P h o n e

The following are steps to conduct social engineering pen testing using the phone to ensure the full scope of pen testing using phones.

Call a target and introduce yourself as his or her colleague and then ask for the sensitive information. S te p

10:

S te p 11:

Call a target user posing as an important user.

S t e p 1 2 : C a ll a t a r g e t p o s in g a s t e c h s u p p o r t a d m i n

Call a target and introduce yourself as technical support administrator. Tell the person that you need to maintain a record of all the employees and their system information and times during which they use the system, etc.; therefore, you need a few details of employees. In this way, you can ask for sensitive information of employees. Call a target and introduce yourself as one of the important people in the organization and try to collect data,

S te p 13:

S te p 14:

Call a target and offer him or her rewards in lieu for exchange of personal information.

Threaten the target with dire consequences (for example, account will be disabled) to get information. S te p 15:

Use reverse social engineering techniques so that the targets yield information themselves. S te p

16:

M o d u le 0 9 P a g e 1 3 9 8

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

S

o c i a l

E

n

g

i n

e

e

r i n

g

P

e n

T

e s t i n

g

: C

I n

P

e

r s o

E

H

n

Q Befriend em ployees in cafeteria and try to extract

a tester can en act th e testing script and his in te rp erson a l skills

in fo rm a tio n

>*

> Try to en ter fa c ility posing as an external a u d ito r

Success of any social engineering technique depends on how well

Try to tailgate w ea rin g a fake ID badge o r piggyback

0

Try ea vesdrop pin g and

There could be countless oth er social engineering techniques based on available inform ation

s h o u ld e r surfing on system s and users

and scope o f test. A lw a ys scru tin ize y o u r testin g steps fo r legal issues

>f

>f

Try to en ter fa c ility posing as a te chnician

D o cu m en t a ll th e findings in a fo rm a l report

o

Copyright Š by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

S o c ia l

E

n g i n e e r i n g

P e n

T e s t i n g :

I n

P e r s o n

The success of any social engineering technique depends on how well a tester can enact the testing script and his or her interpersonal skills. There could be countless other social engineering techniques based on available information and the scope of the test. Always scrutinize your testing steps for legal issues. The following steps to conduct social engineering pen testing in person ensure the full scope of pen testing. S te p 17:

Befriend employees in the cafeteria and try to extract information.

S te p 18:

Try to enter the facility posing as an external auditor.

S te p 19:

Try to enter the facility posing as a technician.

S te p 2 0 :

Try to tailgate wearing a fake ID badge or piggyback.

S te p 2 1 :

Try eavesdropping and shoulder surfing on systems and users.

S te p 2 2 :

Document all the findings in a formal report.

M o d u le 0 9 P a g e 1 3 9 9

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t Š b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

J

S o c i a l

E

n g i n e e r i n g

P e n

T e s t i n g :

S o c i a l

E

n g i n e e r i n g

T o o l k i t

f

C U

!z

( S E T )

The Social-Engineer Toolkit (SET) is an open-source P ython-driven tool aim ed at p en etratio n testing around social engineering

E

!‫־‬

imomm —

The f i r s t •etbod w i ll allow SET to isport a l i s t of pre d e fii apo licatio ni that i t con u t iliz e within the attack.

root@ bt:-# ro o tg b t: / p e n t e s t / e x p l o i t s / s e t # . / s e t

ms *etcne ae:hod * * ill completely clone a w ebilte o f ycor choosing and allow you 19 jtiU z e t*e attack vectors w itnio tre completely sane wet application you were attenpting to clone.

. . ######..########--------------------.##___##.##................... ##... .##........... ##.................

The th ir d ■etfcod allows yon to iaport your own website, role tha:_i ihoclrt only have an ind ei.h tal Wien using the inport website ftrtc t lo c a lity

, .######. .######....... ##.

##.##...................## ... . # # ______# # . # # ..................................... # # . . .

#fftltttftlt . 1tttft1t1t1t1t1t . . .## {--‫־‬I

-T h e S o c ia l- E n a in e e r o o l k i t (SET) I c c p a t p d h V L - p l / u l Ke n e < j^ R c U IC L

<!< En5RM»iuvSB( [— ] [— j [••-]

[—

j

D evelopm ent Team: Th mas W erth D evelopm ent Team: G a rla n d V e r s io n : 3 .6 Codename: MMHMhhhhmmmmmmmmm ‫י‬ R e p o rt bugs: d a ve k @ tru ste d se c .c o m F o llo w me on T w it t e r : dave r e l l k Homepage: h t t p s : //w w w .t r u s t e d s e c . com

I• ) Credential harvester w ill allow you to u t l l l t e the clone <apat>llltles w ithin SET I • ] to harvest credentials or parameters froa a website as w ell as place the• In ta a report 2. Gao 11

1‫ ׳‬Clcnin^ The weosite: 1 ttp s://g M 1 l.cca >| This could take a l i t t l e b i t . . .

I tr7

\ c V

css (rct*r«) to continue. ) Social Eag.neer ro o lk u Credential Harvester Attack ,j credential Har/ester is rurwing on pert 80 1‫ ׳‬m roraatio• w ill be displayed to ycu as i t arrives below:

https://www. trustedsec. com Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited.

S o c ia l

E n g i n e e r i n g

T o o l k i t

P e n

T e s t i n g :

S o c ia l

E n g i n e e r i n g

( S E T )

Source: https://www.trustedsec.com The Social-Engineer Toolkit (SET) is an open-source Python-driven tool aimed at penetration testing around social engineering. The attacks built into the toolkit are designed to be targeted against a person or organization during a penetration test. rootgbt:-# m»h i »n11<4AIV-VI root@ bt: /p e n te s t/e x p lo its /s e t# . / s e t

......... ##.##.......... . * # . . . . # # . # # ..................

.

**do**, .***tt****. froa o ■c»»lt«

-T h e S o c ia l-E n a in e e r T o o lk it (SET) C i p a t^ri hv• p l . id Kej ,fteLIK,

Development Team: Th mas Werth Development Team: Garland Version: 3.6 codename: (TfflhhhhmnmmMnriim Report b u g s : davek@trustedsec.con Follow me on T w itte r: dave r e t lk Homepage: https://www.trustedsec.com

i l

•1 •1 well

*lace the■

1

!S a c k I t r a c k ^

F I G U R E 0 9 .2 3 : S o c ia l E n g in e e r in g T o o lk it (S E T ) S c r e e n s h o t

M o d u le 0 9 P a g e 1 4 0 0

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


E t h ic a l H a c k in g a n d C o u n t e r m e a s u r e s

E x a m 3 1 2 - 5 0 C e r t if ie d E t h ic a l H a c k e r

S o c ia l E n g in e e r in g

Module Summary □

Social engineering is th e a rt of convincing people to reveal confidential inform ation

Social engineering involves acquiring sensitive inform ation or inappropriate access privileges by an o utsider

Attackers a tte m p t social engineering attacks on office w orkers to extract sensitive data

H um an-based social engineering refers to person-to-person interaction to retrieve th e desired inform ation

C om puter-based social engineering refers to having co m p u ter softw are th a t a tte m p ts to retrieve th e desired inform ation

Identity th eft occurs w hen so m eo n e steals your nam e and o th e r personal inform ation for fraudulent purposes

A successful defense d ep en d s on having good policies and th eir diligent im plem entation

Copyright © by EG-G(ancil. All Rights Reserved. Reproduction Is Strictly Prohibited.

I f

M

o d u l e

S u m

m

a r y

Q Social engineering is the art of convincing people to reveal confidential information. © Social engineering involves acquiring sensitive information or inappropriate access privileges by an outsider. Q Attackers attempt social engineering attacks on office workers to extract sensitive data. © Human-based social engineering refers to person-to-person interaction to retrieve the desired information. 0

Computer-based social engineering refers to having computer software that attempts to retrieve the desired information.

Q Identity theft occurs when someone steals your name and other personal information for fraudulent purposes. © A successful defense implementation.

M o d u le 0 9 P a g e 1 4 0 1

depends

on

having good

policies

and their diligent

E t h i c a l H a c k i n g a n d C o u n t e r m e a s u r e s C o p y r i g h t © b y E C - C 0 U n C il A l l R ig h t s R e s e r v e d . R e p r o d u c t i o n is S t r i c t l y P r o h i b i t e d .


Cehv8 module 09 social engineering