The document discusses social engineering and phishing scams. It defines social engineering as manipulation to gain information through deception. Phishing involves using fake websites, emails or SMS to steal personal information. Common phishing techniques include email phishing, website spoofing, IM links to phishing sites, URL shorteners used to disguise malicious links, exploiting Java apps or browser flaws to gain full access to a target's computer, and caller ID spoofing to pose as legitimate companies. The document provides examples of these techniques and advises on how to protect yourself from social engineering attacks.

1. Harold Giddings
Social Engineering
and Phishing Scams
Avoiding Social Engineering
Online

2. Security II: Turn off the Message Bar and run
code safely
Overview
• What is social engineering
• What is phishing
• What types of phishing are there
• What do social engineers do
• How do you protect yourself
Feel free to ask questions

3. What Is Social Engineering?
Security II: Turn off the Message Bar and run
code safely
•Manipulation
•Method to gain information
•The Art of Deception

4. What Is Phishing?
• A fake website, email, or sms used to obtain information
Security II: Turn off the Message Bar and run
code safely
• A method to obtain information
• A form of deception
• Used to commit ID theft (financial or social)

5. What Do Social Engineers Do | Tools Used
Security II: Turn off the Message Bar and run
code safely
•Manipulation
•Theft
•Information
•Corporate Spies
•Social Engineer Toolkit
•Caller ID Spoofing
•SMS Spoofing
•Modified Web Servers
•TinyURL Services
•Fake IDS

6. Email Phishing
Security II: Turn off the Message Bar and run
code safely
An email from Wachovia,
Wonder whats up with my
account
Be aware of emails like this, banks will never ask for your login
details online. If concerned call your bank and NEVER respond to
such emails
“Your account access will
remain limited until the issue
has been resolved please
login to your account by
Note: A good tip off (but not always accurate) is to see if it was marked as clicking on the link below”
spam, usually these users use unverified smtp servers that will be marked as
spam, use a more secure email service like Google’s Gmail service.

7. Website Phishing
Security II: Turn off the Message Bar and run
code safely
What is wrong with this
picture?
It appears to be the paypal
login page…….right?
Above you see the paypal login page, but look at the blown
up image to right right and you’ll notice that the address bar
does not read paypal.com
This is a fake paypal spoof or clone (phish) that appears to
be paypal in order to steal your money and account details

8. IM Phishing
Security II: Turn off the Message Bar and run
code safely
Fake IM’s can link you to
phished websites to gain
your login info
1
2
The user send the victim a fake IM, telling him he uploaded
some photos online
The victim, concerned checks out the site, thinking he needs
to login to the (fake) site to see the images, gives the social
engineer his login details

9. TinyURL
Security II: Turn off the Message Bar and run
code safely
URL shorteners like
Tinyurl.com can be useful
to make long urls shorter
for you to send in emails or
im’s.
But they can also be useful
to Social Enginners and
Phishers
This site makes long urls short
Ex: http://google.com/long_address_that_is_long is changed to http://tinyurl.com/shorter_url
But that means the phisher can make a suspisous url look safe
Ex: 489.45.145.156/facebook.php look like http://tinyurl.com/my_new_fb_pics

10. Phishing For More
Security II: Turn off the Message Bar and run
code safely
Fake or Phished websites
can include java or browser
exploits that give the social
engineer full access to your
pc
To the right is an attacker using an iPhone 4 to
make a fake facebook login page, shown above.
Instead of taking the users login info, he uses a
java exploit to access the entire machine

11. The Java Applet
Security II: Turn off the Message Bar and run
code safely
Some phished WebPages will
use java applications to allow
them FULL access to your
computer
Sometimes they are
persistent, that’s a sign of an
exploited java app
1
2
Does the publisher match the site? Does the From address?
Does the site have a good reason to run java?
Ask yourself questions
before doing something to
save yourself trouble

12. Call Spoofing
Security II: Turn off the Message Bar and run
code safely
Some social engineers will call
you using fake information
trying to verify your account
information
Using free software or cheap
online services anyone can
fake their caller id
1
2
Never talk about personally identifiable information unless you are
sure you know who your talking to, preferably only if you called
them.
Ask yourself if you know
the person, if they sound
right.
If you have an iPhone use apps like unhide to show the true caller id
of the user

13. Resources
Security II: Turn off the Message Bar and run
code safely
http://www.secmaniac.com/
http://www.offensive-security.com/
http://www.backtrack-linux.org/
http://www.hak5.org
http://www.remote-exploit.org
http://www.metasploit.com
http://www.exploit-db.com/
http://www.social-engineer.org/
http://www.darkreading.com/
http://www.spoofcard.com