SlideShare a Scribd company logo
1 of 130
Download to read offline
ENGENHARIA
SOCIAL
A DOCE ARTE DE HACKEAR MENTES




Rafael Jaques                   #FISL13
@rafajaques                     28.07.2012
“Se algum de vocês tem falta de
sabedoria, peça-a a Deus, que a
    todos dá livremente, de boa
 vontade; e lhe será concedida.”
                         Tiago 1.5
Atenção!
As informações contidas nesta apresentação são apenas de caráter
informativo. O conhecimento e as técnicas abordadas não visam ensinar
como enganar as pessoas ou obter qualquer tipo de vantagem sobre
outrem.

O objetivo é apenas demonstrar os pontos fracos que existem nas
corporações e sistemas para que seja possível sanar estas debilidades.
Antes de começar é necessário

        saber algumas coisas...
Vai falar de casos extremos?




   SIM!
Vou sair daqui paranoico?




  SIM!
Posso usar essas técnicas para o mal?




  Não é a ideia...
Todos prontos? Então vamos lá!
60%
Admitem ter roubado
   algum tipo de informação
           ao sair do emprego.
Safados!




2          em cada
                        10
têm acesso às informações

           após sair da empresa.
Hoje em dia os



 ALVOS
       são as



PESSOAS
 e não mais sistemas.
1. O que é Engenharia Social?
O que é Engenharia Social?


A hábil manipulação da

         tendência humana

                 natural de confiar.
Mas por que atacar uma pessoa

        e não um sistema?
Mas como atacar utilizando

Engenharia Social?
Conquistar a confiança do alvo
Fazer sentir-se seguro
Mesclar as perguntas
Sensação de dever cumprido
Quem usa Engenharia Social?
Mas por que Engenharia Social funciona?
Diante de uma larga frente de batalha,

       procure o ponto mais fraco, e, ali,

                ataque com a sua maior força.




             Sun Tzu - A Arte da Guerra
E qual é o ponto mais fraco?
PESSOAS!
Pessoas tendem a acreditar
Pessoas querem ajudar
Pessoas são complacentes
... e impacientes também!
Engenheiros sociais são bons com emoções!
Algumas estatísticas da terra do Tio Sam...
Só no ano de 2009...



11 milhões
de pessoas foram vítimas

           de roubo de identidade.
Só no ano de 2009...


O total de fraudes

      movimentou aproximadamente




US$ 54 bilhões
Só no ano de 2009...
 As vítimas gastaram em média




      21           horas

                     e
U$373            resolvendo o crime!
13%
das fraudes de identidade

   foram cometidas por alguém
              que a vítima conhecia.
2. Características de um Engenheiro Social
Bem apresentável
Bom observador
Aproveita-se da inocência
Comunica-se bem
Usa bem a voz
Faz a vítima entregar o ouro voluntariamente
Kevin D. Mitnick
Vamos aprender um pouco com
                a história dele!



                 Hackers 2:
            Operation Takedown
Se ficar com vontade de assistir,
 tem o filme todo no YouTube!


   http://youtu.be/nVPV5dzM0yY
3. Como se Manifesta a Engenharia Social?
E-mails
Tem um Fusca
gelo na frente
 da tua casa?




                 Telefone
Carta
Pessoalmente
4. Técnicas de Engenharia Social
Dumpster Diving
Shoulder Surfing
Impersonate
http://www.silicon.com/technology/hardware/2007/12/10/criminals-posing-as-police-burgle-
                             verizon-data-centre-39169416/
Rush/No Authentication
Phone Phising
Data Collection
Phishing/SCAM
74%
...dos SPAMs relatados em 2010

    eram de produtos farmacêuticos.
VIAGRA!
Como identificar?
Se o link terminar em “.php”,

         então é vírus. :P (brincadeira)
http://fidelidade.promocaoscielo.com
http://info.abril.com.br/noticias/seguranca/brasilieiros-sao-os-que-mais-sofrem-phishing-19042011-30.shl
A técnica do CD-R
Hackers 2:
    Operation Takedown



Trecho demonstrando algumas

     técnicas em ação!
5. Objetivos da Engenharia Social
Fugir de problemas
Ganhar dinheiro roubando ou
vendendo dados da vítima
Espionagem industrial
Satisfação pessoal
Pura sacanagem
6. Fatores de Risco




Fatores de Risco
Você anota suas senhas?
Sempre as mesmas senhas?
Minha senha
   é 123!




              Fala por telefone?
Deixa logado quando sai?
Ameaças Internas
7. Quer Ver o Quanto Você se Expõe?
Como você se
comporta nas redes
    sociais?
E no mundo real?
8. Engenharia Social e as Redes Sociais
Recheadas de dados
Não necessita de grandes habilidades
As informações são públicas
Autenticação falsa
Fácil influenciar
9. Aprenda a se Proteger!
Torne-se familiar
com as técnicas!
Eduque quem
está ao seu redor.
Formalize os procedimentos
    de acesso a dados.
AS
     7   FRAQUEZAS
            MORTAIS
                by Cisco
1. Sex Appeal
2. Ganância
3. Vaidade
4. Confiança
5. Preguiça
6. Compaixão
7. Urgência
Mas e agora...

Onde aprendo mais?
Livros
Sites
Social Engineering Framework (en_US)
http://www.social-engineer.org/framework/

Symantec Security Articles (en_US)
http://www.symantec.com/connect/security/articles

Social Engineering Toolkit (pt_PT)
http://ptcoresec.eu/SET.pdf
Dúvidas?
Nem entendi
   nada!
Obrigado!
    Rafael Jaques

     rafa@php.net

      phpit.com.br

      @rafajaques

slideshare.net/rafajaques
Referências
+ Fontes consultadas

- Palestras
Entendendo a Engenharia Social : Daniel Marques : http://www.slideshare.net/danielcmarques/entendendo-a-engenharia-social
Engenharia Social : Marcelo Lau : http://www.slideshare.net/datasecurity1/engenharia-social
Social Engineering - Exploiting the Human Weakness : Wasim Halani : http://www.slideshare.net/washal/social-engineeringcase-
study
Social engineering & social networks : Sharon Conheady : http://www.slideshare.net/infosec10/social-engineering-social-
networks-public-version

- Sites
http://www.us-cert.gov/cas/tips/ST04-014.html
http://www.cisco.com/web/about/security/intelligence/mysdn-social-engineering.html
http://www.social-engineer.org/framework/Social_Engineers:_Disgruntled_Employees#Statistics
http://www.fraudes.org/showpage1.asp?pg=7
http://www.symantec.com/business/threatreport/topic.jsp?id=highlights
http://www.massachusettsnoncompetelaw.com/
http://en.wikipedia.org/wiki/Social_engineering_(security)
http://www.spendonlife.com/blog/2010-identity-theft-statistics
http://mashable.com/2011/01/20/black-hat-hacking-stats/
http://www.consumerfraudreporting.org/internet_scam_statistics.htm
http://informatica.terra.com.br/virusecia/spam/interna/0,,OI126626-EI2403,00.html
http://press.pandasecurity.com/wp-content/uploads/2011/01/The-Cyber-Crime-Black-Market.pdf
http://monografias.brasilescola.com/computacao/seguranca-informacao-vs-engenharia-social-como-se-proteger.htm
http://www.iwar.org.uk/comsec/resources/sa-tools/Social-Engineering.pdf
http://www.esha.be/fileadmin/esha_files/documents/SHERPA/Report_on_mechanism_of_social_engineering.pdf
http://www.cisco.com/en/US/prod/vpndevc/annual_security_report.html
http://www.securingthehuman.org/blog/2011/01/22/social-engineering-deadly-weaknesses
http://info.abril.com.br/noticias/seguranca/brasilieiros-sao-os-que-mais-sofrem-phishing-19042011-30.shl
http://www.infosectoday.com/Norwich/GI532/Social_Engineering.htm
http://www.pcworld.com/article/182180/top_5_social_engineering_exploit_techniques.html
http://info.abril.com.br/noticias/seguranca/brasilieiros-sao-os-que-mais-sofrem-phishing-19042011-30.shl
http://www.symantec.com/connect/articles/social-engineering-fundamentals-part-i-hacker-tactics
Mídias
Images:

Capa - Master of Puppets - http://www.flickr.com/photos/50417132@N00/2178362181
Person Icon http://edge-img.datpiff.com/ma336d2d/DeeZee_Too_Be_Continued_-back-large.jpg
Calling http://www.flickr.com/photos/37475356@N00/5740461432
Suit and Tie http://www.flickr.com/photos/55046645@N00/475680145
Pierce Brosnan http://osolimpianos.files.wordpress.com/2009/05/jamesbond.jpg
Computer Geek http://www.flickr.com/photos/18519023@N00/3498738259
Seller http://www.flickr.com/photos/larskflem/93753458/in/photostream/
Multiple Faces http://www.flickr.com/photos/56695083@N00/4470486685/
Drunk Guys http://www.flickr.com/photos/82605142@N00/86601569
Puss in Boots http://www.jpegwallpapers.com/images/wallpapers/Puss-In-Boots-Shrek-497126.jpeg
Mother http://www.flickr.com/photos/brandoncwarren/5088547448/in/photostream/
Dumpster Diving http://www.flickr.com/photos/75054419@N00/460133621
Distrustful http://www.flickr.com/photos/37354253@N00/388468654
Climb on giant tubes http://www.flickr.com/photos/squeakywheel/379078841/in/photostream/
Shang Tsung http://www.umk3.net/images/portrait/shang_tsung.gif
Shoulder Surfing http://www.flickr.com/photos/16258917@N00/2785190754
Fisherman http://www.flickr.com/photos/41346951@N05/5187103981
Red Telephone http://www.flickr.com/photos/pulpolux/151179802/
Spam http://www.ciromota.net/wp-content/uploads/2008/10/spam.jpg
Setting Up Email Account http://www.flickr.com/photos/pieterouwerkerk/698618765/in/photostream/
Viagra http://www.n24.de/media/_fotos/bildergalerien/002011/valentinstag_1/7611575.jpg
Pic of Email Screen (SPAM) http://www.fastactiontraining.com/wp-content/uploads/2010/10/Pic-of-Email-Screen.jpg
Jornal Hoje http://4.bp.blogspot.com/_OZcgbN6AowE/S7uYcZuhbqI/AAAAAAAAAWQ/SKOM0o-_mIQ/s1600/jornal
+hoje_globoc%C3%B3pia.jpg
Baby at Computer http://www.flickr.com/photos/65315936@N00/5511409574
Impressed http://www.flickr.com/photos/64114868@N00/1019654125
Security Guy http://www.flickr.com/photos/51035555243@N01/268524287
Head in Hand http://www.flickr.com/photos/34120957@N04/4199675334
White Ninja http://www.flickr.com/photos/cverdier/3893327741/
Lady Cat http://sweettater.files.wordpress.com/2010/03/cimg3458.jpg
God of War http://wallpapers.freewallpapers.im/images/2011/02/1024x600/god-of-war-2-game-1935.jpg
Maísa e Sílvio http://4.bp.blogspot.com/__UIUXK-sJhk/TOpBsG7XJwI/AAAAAAAABKM/DPuyUeFuTXk/s1600/maisa-e-
silvio.jpg
Engineer at Work http://www.flickr.com/photos/hammershaug/4494291610/
Password Security http://www.getadvanced.net/images/uploads/Computer_Password_-_Security_Breach.jpg
Bum Shot http://www.flickr.com/photos/63423942@N00/497052735
Written Password http://www.flickr.com/photos/22871132@N00/4051530414
Japanese Guys http://img23.imageshack.us/img23/4451/1304026587.jpg
Talk at Phone http://www.flickr.com/photos/colorblindpicaso/2717409111
Call From Home http://www.flickr.com/photos/91672050@N00/257496969
Handshake http://www.flickr.com/photos/65484951@N00/252924532
Uncle Sam http://pslawnet.files.wordpress.com/2011/04/uncle-sam.jpg
Mr. Box Man http://www.flickr.com/photos/ollesvensson/3686050837/
Mails http://www.flickr.com/photos/comedynose/5666793668/
V for Vendetta http://www.flickr.com/photos/edans/5400848923/
Thinking http://www.flickr.com/photos/jakecaptive/3205277810/
Soldiers http://www.flickr.com/photos/19743256@N00/2223783127
Pés pra cima http://www.flickr.com/photos/81785266@N00/125463026
Chat http://www.flickr.com/photos/62597560@N00/258434606
Why you Meme http://clipartsy.com/FAVS/FAVICONIC.NET/April/y_u_no_guy_y_u_no-1331px.png
Hand in hand http://www.flickr.com/photos/26993091@N08/4718225577
Police Car in the Snow http://www.flickr.com/photos/64844023@N00/4198908464
Friends http://www.flickr.com/photos/43081986@N00/115112704
Impatient http://www.flickr.com/photos/45842803@N00/4795997639
Thinking http://www.flickr.com/photos/7320299@N08/3283431745
Social Media http://2.bp.blogspot.com/_m5OYm6Jx05Q/TVK1A53STtI/AAAAAAAAAZk/2iuw4Io838k/s1600/
social_networks.jpg
Band of Brothers http://www.flickr.com/photos/17149966@N00/460670492
Weakest Link http://www.flickr.com/photos/53611153@N00/465459020
Crowd http://www.flickr.com/photos/84856173@N00/3786725982
Lazy http://www.flickr.com/photos/superfantastic/3010891914/
Coins http://www.flickr.com/photos/restlessglobetrotter/3824486278/
Wireless Fail http://www.flickr.com/photos/bnilsen/2880929094/
The Thinker http://www.flickr.com/photos/53611153@N00/5827849044
My Files http://www.flickr.com/photos/84172943@N00/5352825299
CD-R http://www.flickr.com/photos/45382171@N00/1515739697
Inside Outside http://www.flickr.com/photos/followtheseinstructions/5571697149/
Pole Dance http://www.flickr.com/photos/46854683@N04/4547706741
Seller http://www.flickr.com/photos/17768970@N00/4485455723
Thumbs up http://www.flickr.com/photos/37961843@N00/6265449
Greed http://www.flickr.com/photos/calliope/2207307656/
Dress Table http://www.flickr.com/photos/centralasian/5968327542/
Trust http://www.flickr.com/photos/43132185@N00/196015953
Sloth http://www.flickr.com/photos/28442702@N00/279470157
Compassion http://www.flickr.com/photos/29553188@N07/3573969837/
Running http://www.flickr.com/photos/51035555243@N01/287666827
Files http://www.flickr.com/photos/juniorvelo/3267647833/
Goofy http://www.flickr.com/photos/42dreams/73838574/
Library http://www.flickr.com/photos/51035555243@N01/85441961
Talking Business http://www.flickr.com/photos/brymo/272834885/
Mask http://www.flickr.com/photos/18548550@N00/5313987
Young Gentleman http://www.flickr.com/photos/64031910@N00/422547724
Goomba VS Mario and Yoshi http://www.flickr.com/photos/77161041@N00/2266201047
Mother http://www.flickr.com/photos/54304913@N00/17647469
Private Place http://www.flickr.com/photos/76151808@N00/6100020538
Kevin David Mitnick http://www.starnostar.com/data/images/who-is-Kevin-Mitnick-is-star-or-no-star-Kevin-David-Mitnick-
celebrity-vote.jpg
The Jersey Devil http://www.flickr.com/photos/79874304@N00/285367520
A little better than the last group http://www.flickr.com/photos/81881849@N00/3222035439
Operation Takedown http://filmescomlegenda.net/wp-content/uploads/2009/03/operation-takeodown-300x422.jpg
I Have You Now http://www.fotopedia.com/items/flickr-3500989490
Spying Turquoise http://www.flickr.com/photos/jdhancock/7439564750/
Office Prank http://www.sprichie.com/wp-content/uploads/2012/01/office_pranks_05.jpg
Crachás (sinto muito se sentiram-se ofendidos):

http://farm4.static.flickr.com/3289/2295308772_cecfd160ea.jpg
http://i279.photobucket.com/albums/kk160/lukstuning/DSC04358.jpg?t=1282497031
http://2.bp.blogspot.com/_mKoEIJZM0sk/SCDHHKtX2qI/AAAAAAAAAdU/OXDvNt9iqqU/s320/Foto-0336.jpg

Backgrounds:

Azul http://wallshq.com/wp-content/uploads/original/2011_06/80_blue-abstract-background_WallsHQ.com_.jpg
Verde http://srv4.imghost.ge/out.php/i212027_greenabstractbackground.jpg
Laranja http://wallpapers.free-review.net/wallpapers/19/Orange_abstract_wallpaper.jpg

Videos:

Jedi Mind Trick http://www.youtube.com/watch?v=bJiqrVWLfdw

More Related Content

What's hot

Perigo nas redes sociais
Perigo nas redes sociaisPerigo nas redes sociais
Perigo nas redes sociais
Paula Lopes
 
Desvantagens das redes sociais
Desvantagens das redes sociaisDesvantagens das redes sociais
Desvantagens das redes sociais
PAFB
 
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da PenhaONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
UNIFEM Brasil
 
Cartilha combate á violência contra a mulher
Cartilha combate  á  violência contra a mulherCartilha combate  á  violência contra a mulher
Cartilha combate á violência contra a mulher
CEDDHSC-ESTADUAL-RJ
 
O que é bully
O que é bullyO que é bully
O que é bully
yasmin150
 

What's hot (20)

Weapons of Mass Deception by David Moosa Pidcock, Leader of Islamic Party of ...
Weapons of Mass Deception by David Moosa Pidcock, Leader of Islamic Party of ...Weapons of Mass Deception by David Moosa Pidcock, Leader of Islamic Party of ...
Weapons of Mass Deception by David Moosa Pidcock, Leader of Islamic Party of ...
 
Perigo nas redes sociais
Perigo nas redes sociaisPerigo nas redes sociais
Perigo nas redes sociais
 
Cyber-Safety and Digital Citizenship
Cyber-Safety and Digital CitizenshipCyber-Safety and Digital Citizenship
Cyber-Safety and Digital Citizenship
 
Violência
ViolênciaViolência
Violência
 
Cartilha Agosto Lilás - SMDS.pdf
Cartilha Agosto Lilás - SMDS.pdfCartilha Agosto Lilás - SMDS.pdf
Cartilha Agosto Lilás - SMDS.pdf
 
Apresentação bullying
Apresentação bullyingApresentação bullying
Apresentação bullying
 
Desvantagens das redes sociais
Desvantagens das redes sociaisDesvantagens das redes sociais
Desvantagens das redes sociais
 
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da PenhaONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
ONU Mulheres - Quebre Esse Ciclo - Lei Maria da Penha
 
Cartilha combate á violência contra a mulher
Cartilha combate  á  violência contra a mulherCartilha combate  á  violência contra a mulher
Cartilha combate á violência contra a mulher
 
Ingenieria Social
Ingenieria SocialIngenieria Social
Ingenieria Social
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
Social engineering
Social engineeringSocial engineering
Social engineering
 
Social Engineering - Are You Protecting Your Data Enough?
Social Engineering - Are You Protecting Your Data Enough?Social Engineering - Are You Protecting Your Data Enough?
Social Engineering - Are You Protecting Your Data Enough?
 
Social Engineering Attacks & Principles
Social Engineering Attacks & PrinciplesSocial Engineering Attacks & Principles
Social Engineering Attacks & Principles
 
O que é bully
O que é bullyO que é bully
O que é bully
 
Web security
Web securityWeb security
Web security
 
Abuso sexual.01
Abuso sexual.01Abuso sexual.01
Abuso sexual.01
 
Cyber Crime
Cyber CrimeCyber Crime
Cyber Crime
 
Social engineering: A Human Hacking Framework
Social engineering: A Human Hacking FrameworkSocial engineering: A Human Hacking Framework
Social engineering: A Human Hacking Framework
 
Social engineering hacking attack
Social engineering hacking attackSocial engineering hacking attack
Social engineering hacking attack
 

Similar to Engenharia Social: A Doce Arte de Hackear Mentes

Off the Grid: Is anonymity possible?
Off the Grid: Is anonymity possible?Off the Grid: Is anonymity possible?
Off the Grid: Is anonymity possible?
Mathias Klang
 
People the biggest cyber risk
People the biggest cyber riskPeople the biggest cyber risk
People the biggest cyber risk
University of Hertfordshire
 

Similar to Engenharia Social: A Doce Arte de Hackear Mentes (20)

Engenhariasocial
EngenhariasocialEngenhariasocial
Engenhariasocial
 
LATEC - UFF. MATÉRIA - ENGENHARIA SOCIAL - Rafael Jaques
LATEC - UFF. MATÉRIA - ENGENHARIA SOCIAL - Rafael JaquesLATEC - UFF. MATÉRIA - ENGENHARIA SOCIAL - Rafael Jaques
LATEC - UFF. MATÉRIA - ENGENHARIA SOCIAL - Rafael Jaques
 
Engenharia Social: Amiguinhos Virtuais, Ameaças Reais
Engenharia Social: Amiguinhos Virtuais, Ameaças ReaisEngenharia Social: Amiguinhos Virtuais, Ameaças Reais
Engenharia Social: Amiguinhos Virtuais, Ameaças Reais
 
Unlocking the Hidden Potential
Unlocking the Hidden PotentialUnlocking the Hidden Potential
Unlocking the Hidden Potential
 
Joanna Drake, Global SVP, Technology Services Group - Wood Mackenzie
Joanna Drake, Global SVP, Technology Services Group - Wood MackenzieJoanna Drake, Global SVP, Technology Services Group - Wood Mackenzie
Joanna Drake, Global SVP, Technology Services Group - Wood Mackenzie
 
BSidesPGH - Never Surrender - Reducing Social Engineering Risk
BSidesPGH - Never Surrender - Reducing Social Engineering RiskBSidesPGH - Never Surrender - Reducing Social Engineering Risk
BSidesPGH - Never Surrender - Reducing Social Engineering Risk
 
Social Engineering Basics
Social Engineering BasicsSocial Engineering Basics
Social Engineering Basics
 
Social Networks And Phishing
Social Networks And PhishingSocial Networks And Phishing
Social Networks And Phishing
 
NTXISSACSC3 - 7 Security Mindsets to Adopt Today by Ted Gruenloh
NTXISSACSC3 - 7 Security Mindsets to Adopt Today by Ted GruenlohNTXISSACSC3 - 7 Security Mindsets to Adopt Today by Ted Gruenloh
NTXISSACSC3 - 7 Security Mindsets to Adopt Today by Ted Gruenloh
 
Social engineering
Social engineeringSocial engineering
Social engineering
 
Social engineering
Social engineeringSocial engineering
Social engineering
 
Emerging Patterns of Social Media Use
Emerging Patterns of Social Media UseEmerging Patterns of Social Media Use
Emerging Patterns of Social Media Use
 
Off the Grid: Is anonymity possible?
Off the Grid: Is anonymity possible?Off the Grid: Is anonymity possible?
Off the Grid: Is anonymity possible?
 
The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering The Art of Human Hacking : Social Engineering
The Art of Human Hacking : Social Engineering
 
Yehia Mamdouh @ DTS Solution - The Gentleman Thief
Yehia Mamdouh @ DTS Solution - The Gentleman ThiefYehia Mamdouh @ DTS Solution - The Gentleman Thief
Yehia Mamdouh @ DTS Solution - The Gentleman Thief
 
[EN]THS22_AMM_ishing.pptx
[EN]THS22_AMM_ishing.pptx[EN]THS22_AMM_ishing.pptx
[EN]THS22_AMM_ishing.pptx
 
Jason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 PredictionsJason Samide - State of Security & 2016 Predictions
Jason Samide - State of Security & 2016 Predictions
 
People the biggest cyber risk
People the biggest cyber riskPeople the biggest cyber risk
People the biggest cyber risk
 
Artificial Intelligence in InfoSec
Artificial Intelligence in InfoSecArtificial Intelligence in InfoSec
Artificial Intelligence in InfoSec
 
EMBD2018 | Humanos y máquinas: Un futuro con inteligencia artificial.
EMBD2018 | Humanos y máquinas: Un futuro con inteligencia artificial.EMBD2018 | Humanos y máquinas: Un futuro con inteligencia artificial.
EMBD2018 | Humanos y máquinas: Un futuro con inteligencia artificial.
 

More from Rafael Jaques

More from Rafael Jaques (8)

[FISL 16] PHP no Campo de Batalha: Segurança Avançada e Programação Defensiva...
[FISL 16] PHP no Campo de Batalha: Segurança Avançada e Programação Defensiva...[FISL 16] PHP no Campo de Batalha: Segurança Avançada e Programação Defensiva...
[FISL 16] PHP no Campo de Batalha: Segurança Avançada e Programação Defensiva...
 
PHP na Tela Escura: Aplicações Poderosas em Linha de Comando
PHP na Tela Escura: Aplicações Poderosas em Linha de ComandoPHP na Tela Escura: Aplicações Poderosas em Linha de Comando
PHP na Tela Escura: Aplicações Poderosas em Linha de Comando
 
Segurança na Era Digital: ensinando novos hábitos aos indivíduos digitais - F...
Segurança na Era Digital: ensinando novos hábitos aos indivíduos digitais - F...Segurança na Era Digital: ensinando novos hábitos aos indivíduos digitais - F...
Segurança na Era Digital: ensinando novos hábitos aos indivíduos digitais - F...
 
Utilizando a Internet de Maneira Consciente
Utilizando a Internet de Maneira ConscienteUtilizando a Internet de Maneira Consciente
Utilizando a Internet de Maneira Consciente
 
PHP Sob Ataque - Técnicas de Programação Defensiva - FISL 12 - Rafael Jaques
PHP Sob Ataque - Técnicas de Programação Defensiva - FISL 12 - Rafael JaquesPHP Sob Ataque - Técnicas de Programação Defensiva - FISL 12 - Rafael Jaques
PHP Sob Ataque - Técnicas de Programação Defensiva - FISL 12 - Rafael Jaques
 
Construindo uma Aplicação PHP à Prova de Balas - 2010
Construindo uma Aplicação PHP à Prova de Balas - 2010Construindo uma Aplicação PHP à Prova de Balas - 2010
Construindo uma Aplicação PHP à Prova de Balas - 2010
 
Construindo uma Aplicação PHP à Prova de Balas
Construindo uma Aplicação PHP à Prova de BalasConstruindo uma Aplicação PHP à Prova de Balas
Construindo uma Aplicação PHP à Prova de Balas
 
Explorando O Potencial Das Linguagens De Programação Open Source
Explorando O Potencial Das Linguagens De Programação Open SourceExplorando O Potencial Das Linguagens De Programação Open Source
Explorando O Potencial Das Linguagens De Programação Open Source
 

Recently uploaded

Recently uploaded (20)

Working together SRE & Platform Engineering
Working together SRE & Platform EngineeringWorking together SRE & Platform Engineering
Working together SRE & Platform Engineering
 
TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024TopCryptoSupers 12thReport OrionX May2024
TopCryptoSupers 12thReport OrionX May2024
 
1111 ChatGPT Prompts PDF Free Download - Prompts for ChatGPT
1111 ChatGPT Prompts PDF Free Download - Prompts for ChatGPT1111 ChatGPT Prompts PDF Free Download - Prompts for ChatGPT
1111 ChatGPT Prompts PDF Free Download - Prompts for ChatGPT
 
BT & Neo4j _ How Knowledge Graphs help BT deliver Digital Transformation.pptx
BT & Neo4j _ How Knowledge Graphs help BT deliver Digital Transformation.pptxBT & Neo4j _ How Knowledge Graphs help BT deliver Digital Transformation.pptx
BT & Neo4j _ How Knowledge Graphs help BT deliver Digital Transformation.pptx
 
Designing for Hardware Accessibility at Comcast
Designing for Hardware Accessibility at ComcastDesigning for Hardware Accessibility at Comcast
Designing for Hardware Accessibility at Comcast
 
How we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdfHow we scaled to 80K users by doing nothing!.pdf
How we scaled to 80K users by doing nothing!.pdf
 
Enterprise Knowledge Graphs - Data Summit 2024
Enterprise Knowledge Graphs - Data Summit 2024Enterprise Knowledge Graphs - Data Summit 2024
Enterprise Knowledge Graphs - Data Summit 2024
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
 
IESVE for Early Stage Design and Planning
IESVE for Early Stage Design and PlanningIESVE for Early Stage Design and Planning
IESVE for Early Stage Design and Planning
 
Using IESVE for Room Loads Analysis - UK & Ireland
Using IESVE for Room Loads Analysis - UK & IrelandUsing IESVE for Room Loads Analysis - UK & Ireland
Using IESVE for Room Loads Analysis - UK & Ireland
 
Powerful Start- the Key to Project Success, Barbara Laskowska
Powerful Start- the Key to Project Success, Barbara LaskowskaPowerful Start- the Key to Project Success, Barbara Laskowska
Powerful Start- the Key to Project Success, Barbara Laskowska
 
PLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. StartupsPLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. Startups
 
Syngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdfSyngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdf
 
Easier, Faster, and More Powerful – Notes Document Properties Reimagined
Easier, Faster, and More Powerful – Notes Document Properties ReimaginedEasier, Faster, and More Powerful – Notes Document Properties Reimagined
Easier, Faster, and More Powerful – Notes Document Properties Reimagined
 
What's New in Teams Calling, Meetings and Devices April 2024
What's New in Teams Calling, Meetings and Devices April 2024What's New in Teams Calling, Meetings and Devices April 2024
What's New in Teams Calling, Meetings and Devices April 2024
 
WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024WebRTC and SIP not just audio and video @ OpenSIPS 2024
WebRTC and SIP not just audio and video @ OpenSIPS 2024
 
Microsoft CSP Briefing Pre-Engagement - Questionnaire
Microsoft CSP Briefing Pre-Engagement - QuestionnaireMicrosoft CSP Briefing Pre-Engagement - Questionnaire
Microsoft CSP Briefing Pre-Engagement - Questionnaire
 
Long journey of Ruby Standard library at RubyKaigi 2024
Long journey of Ruby Standard library at RubyKaigi 2024Long journey of Ruby Standard library at RubyKaigi 2024
Long journey of Ruby Standard library at RubyKaigi 2024
 
Google I/O Extended 2024 Warsaw
Google I/O Extended 2024 WarsawGoogle I/O Extended 2024 Warsaw
Google I/O Extended 2024 Warsaw
 
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdfThe Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
 

Engenharia Social: A Doce Arte de Hackear Mentes

  • 1. ENGENHARIA SOCIAL A DOCE ARTE DE HACKEAR MENTES Rafael Jaques #FISL13 @rafajaques 28.07.2012
  • 2. “Se algum de vocês tem falta de sabedoria, peça-a a Deus, que a todos dá livremente, de boa vontade; e lhe será concedida.” Tiago 1.5
  • 3. Atenção! As informações contidas nesta apresentação são apenas de caráter informativo. O conhecimento e as técnicas abordadas não visam ensinar como enganar as pessoas ou obter qualquer tipo de vantagem sobre outrem. O objetivo é apenas demonstrar os pontos fracos que existem nas corporações e sistemas para que seja possível sanar estas debilidades.
  • 4. Antes de começar é necessário saber algumas coisas...
  • 5. Vai falar de casos extremos? SIM!
  • 6. Vou sair daqui paranoico? SIM!
  • 7. Posso usar essas técnicas para o mal? Não é a ideia...
  • 9. 60% Admitem ter roubado algum tipo de informação ao sair do emprego.
  • 10. Safados! 2 em cada 10 têm acesso às informações após sair da empresa.
  • 11. Hoje em dia os ALVOS são as PESSOAS e não mais sistemas.
  • 12. 1. O que é Engenharia Social?
  • 13. O que é Engenharia Social? A hábil manipulação da tendência humana natural de confiar.
  • 14. Mas por que atacar uma pessoa e não um sistema?
  • 15. Mas como atacar utilizando Engenharia Social?
  • 21. Mas por que Engenharia Social funciona?
  • 22. Diante de uma larga frente de batalha, procure o ponto mais fraco, e, ali, ataque com a sua maior força. Sun Tzu - A Arte da Guerra
  • 23. E qual é o ponto mais fraco?
  • 25. Pessoas tendem a acreditar
  • 28. ... e impacientes também!
  • 29. Engenheiros sociais são bons com emoções!
  • 30. Algumas estatísticas da terra do Tio Sam...
  • 31. Só no ano de 2009... 11 milhões de pessoas foram vítimas de roubo de identidade.
  • 32. Só no ano de 2009... O total de fraudes movimentou aproximadamente US$ 54 bilhões
  • 33. Só no ano de 2009... As vítimas gastaram em média 21 horas e U$373 resolvendo o crime!
  • 34. 13% das fraudes de identidade foram cometidas por alguém que a vítima conhecia.
  • 35. 2. Características de um Engenheiro Social
  • 40. Usa bem a voz
  • 41. Faz a vítima entregar o ouro voluntariamente
  • 43. Vamos aprender um pouco com a história dele! Hackers 2: Operation Takedown
  • 44. Se ficar com vontade de assistir, tem o filme todo no YouTube! http://youtu.be/nVPV5dzM0yY
  • 45. 3. Como se Manifesta a Engenharia Social?
  • 46.
  • 48. Tem um Fusca gelo na frente da tua casa? Telefone
  • 49. Carta
  • 51. 4. Técnicas de Engenharia Social
  • 56.
  • 57.
  • 62.
  • 63. 74% ...dos SPAMs relatados em 2010 eram de produtos farmacêuticos.
  • 66. Se o link terminar em “.php”, então é vírus. :P (brincadeira)
  • 67.
  • 68.
  • 69.
  • 70.
  • 71.
  • 73.
  • 74.
  • 75.
  • 78. Hackers 2: Operation Takedown Trecho demonstrando algumas técnicas em ação!
  • 79.
  • 80. 5. Objetivos da Engenharia Social
  • 82. Ganhar dinheiro roubando ou vendendo dados da vítima
  • 86. 6. Fatores de Risco Fatores de Risco
  • 87. Você anota suas senhas?
  • 88. Sempre as mesmas senhas?
  • 89. Minha senha é 123! Fala por telefone?
  • 92. 7. Quer Ver o Quanto Você se Expõe?
  • 93. Como você se comporta nas redes sociais?
  • 94.
  • 95.
  • 96.
  • 97.
  • 98.
  • 99. E no mundo real?
  • 100.
  • 101. 8. Engenharia Social e as Redes Sociais
  • 103. Não necessita de grandes habilidades
  • 104. As informações são públicas
  • 107. 9. Aprenda a se Proteger!
  • 109. Eduque quem está ao seu redor.
  • 110. Formalize os procedimentos de acesso a dados.
  • 111. AS 7 FRAQUEZAS MORTAIS by Cisco
  • 119. Mas e agora... Onde aprendo mais?
  • 120. Livros
  • 121. Sites Social Engineering Framework (en_US) http://www.social-engineer.org/framework/ Symantec Security Articles (en_US) http://www.symantec.com/connect/security/articles Social Engineering Toolkit (pt_PT) http://ptcoresec.eu/SET.pdf
  • 123. Obrigado! Rafael Jaques rafa@php.net phpit.com.br @rafajaques slideshare.net/rafajaques
  • 125. + Fontes consultadas - Palestras Entendendo a Engenharia Social : Daniel Marques : http://www.slideshare.net/danielcmarques/entendendo-a-engenharia-social Engenharia Social : Marcelo Lau : http://www.slideshare.net/datasecurity1/engenharia-social Social Engineering - Exploiting the Human Weakness : Wasim Halani : http://www.slideshare.net/washal/social-engineeringcase- study Social engineering & social networks : Sharon Conheady : http://www.slideshare.net/infosec10/social-engineering-social- networks-public-version - Sites http://www.us-cert.gov/cas/tips/ST04-014.html http://www.cisco.com/web/about/security/intelligence/mysdn-social-engineering.html http://www.social-engineer.org/framework/Social_Engineers:_Disgruntled_Employees#Statistics http://www.fraudes.org/showpage1.asp?pg=7 http://www.symantec.com/business/threatreport/topic.jsp?id=highlights http://www.massachusettsnoncompetelaw.com/ http://en.wikipedia.org/wiki/Social_engineering_(security) http://www.spendonlife.com/blog/2010-identity-theft-statistics http://mashable.com/2011/01/20/black-hat-hacking-stats/ http://www.consumerfraudreporting.org/internet_scam_statistics.htm http://informatica.terra.com.br/virusecia/spam/interna/0,,OI126626-EI2403,00.html http://press.pandasecurity.com/wp-content/uploads/2011/01/The-Cyber-Crime-Black-Market.pdf http://monografias.brasilescola.com/computacao/seguranca-informacao-vs-engenharia-social-como-se-proteger.htm http://www.iwar.org.uk/comsec/resources/sa-tools/Social-Engineering.pdf http://www.esha.be/fileadmin/esha_files/documents/SHERPA/Report_on_mechanism_of_social_engineering.pdf http://www.cisco.com/en/US/prod/vpndevc/annual_security_report.html http://www.securingthehuman.org/blog/2011/01/22/social-engineering-deadly-weaknesses http://info.abril.com.br/noticias/seguranca/brasilieiros-sao-os-que-mais-sofrem-phishing-19042011-30.shl http://www.infosectoday.com/Norwich/GI532/Social_Engineering.htm http://www.pcworld.com/article/182180/top_5_social_engineering_exploit_techniques.html http://info.abril.com.br/noticias/seguranca/brasilieiros-sao-os-que-mais-sofrem-phishing-19042011-30.shl http://www.symantec.com/connect/articles/social-engineering-fundamentals-part-i-hacker-tactics
  • 127. Images: Capa - Master of Puppets - http://www.flickr.com/photos/50417132@N00/2178362181 Person Icon http://edge-img.datpiff.com/ma336d2d/DeeZee_Too_Be_Continued_-back-large.jpg Calling http://www.flickr.com/photos/37475356@N00/5740461432 Suit and Tie http://www.flickr.com/photos/55046645@N00/475680145 Pierce Brosnan http://osolimpianos.files.wordpress.com/2009/05/jamesbond.jpg Computer Geek http://www.flickr.com/photos/18519023@N00/3498738259 Seller http://www.flickr.com/photos/larskflem/93753458/in/photostream/ Multiple Faces http://www.flickr.com/photos/56695083@N00/4470486685/ Drunk Guys http://www.flickr.com/photos/82605142@N00/86601569 Puss in Boots http://www.jpegwallpapers.com/images/wallpapers/Puss-In-Boots-Shrek-497126.jpeg Mother http://www.flickr.com/photos/brandoncwarren/5088547448/in/photostream/ Dumpster Diving http://www.flickr.com/photos/75054419@N00/460133621 Distrustful http://www.flickr.com/photos/37354253@N00/388468654 Climb on giant tubes http://www.flickr.com/photos/squeakywheel/379078841/in/photostream/ Shang Tsung http://www.umk3.net/images/portrait/shang_tsung.gif Shoulder Surfing http://www.flickr.com/photos/16258917@N00/2785190754 Fisherman http://www.flickr.com/photos/41346951@N05/5187103981 Red Telephone http://www.flickr.com/photos/pulpolux/151179802/ Spam http://www.ciromota.net/wp-content/uploads/2008/10/spam.jpg Setting Up Email Account http://www.flickr.com/photos/pieterouwerkerk/698618765/in/photostream/ Viagra http://www.n24.de/media/_fotos/bildergalerien/002011/valentinstag_1/7611575.jpg Pic of Email Screen (SPAM) http://www.fastactiontraining.com/wp-content/uploads/2010/10/Pic-of-Email-Screen.jpg Jornal Hoje http://4.bp.blogspot.com/_OZcgbN6AowE/S7uYcZuhbqI/AAAAAAAAAWQ/SKOM0o-_mIQ/s1600/jornal +hoje_globoc%C3%B3pia.jpg Baby at Computer http://www.flickr.com/photos/65315936@N00/5511409574 Impressed http://www.flickr.com/photos/64114868@N00/1019654125 Security Guy http://www.flickr.com/photos/51035555243@N01/268524287 Head in Hand http://www.flickr.com/photos/34120957@N04/4199675334 White Ninja http://www.flickr.com/photos/cverdier/3893327741/ Lady Cat http://sweettater.files.wordpress.com/2010/03/cimg3458.jpg God of War http://wallpapers.freewallpapers.im/images/2011/02/1024x600/god-of-war-2-game-1935.jpg
  • 128. Maísa e Sílvio http://4.bp.blogspot.com/__UIUXK-sJhk/TOpBsG7XJwI/AAAAAAAABKM/DPuyUeFuTXk/s1600/maisa-e- silvio.jpg Engineer at Work http://www.flickr.com/photos/hammershaug/4494291610/ Password Security http://www.getadvanced.net/images/uploads/Computer_Password_-_Security_Breach.jpg Bum Shot http://www.flickr.com/photos/63423942@N00/497052735 Written Password http://www.flickr.com/photos/22871132@N00/4051530414 Japanese Guys http://img23.imageshack.us/img23/4451/1304026587.jpg Talk at Phone http://www.flickr.com/photos/colorblindpicaso/2717409111 Call From Home http://www.flickr.com/photos/91672050@N00/257496969 Handshake http://www.flickr.com/photos/65484951@N00/252924532 Uncle Sam http://pslawnet.files.wordpress.com/2011/04/uncle-sam.jpg Mr. Box Man http://www.flickr.com/photos/ollesvensson/3686050837/ Mails http://www.flickr.com/photos/comedynose/5666793668/ V for Vendetta http://www.flickr.com/photos/edans/5400848923/ Thinking http://www.flickr.com/photos/jakecaptive/3205277810/ Soldiers http://www.flickr.com/photos/19743256@N00/2223783127 Pés pra cima http://www.flickr.com/photos/81785266@N00/125463026 Chat http://www.flickr.com/photos/62597560@N00/258434606 Why you Meme http://clipartsy.com/FAVS/FAVICONIC.NET/April/y_u_no_guy_y_u_no-1331px.png Hand in hand http://www.flickr.com/photos/26993091@N08/4718225577 Police Car in the Snow http://www.flickr.com/photos/64844023@N00/4198908464 Friends http://www.flickr.com/photos/43081986@N00/115112704 Impatient http://www.flickr.com/photos/45842803@N00/4795997639 Thinking http://www.flickr.com/photos/7320299@N08/3283431745 Social Media http://2.bp.blogspot.com/_m5OYm6Jx05Q/TVK1A53STtI/AAAAAAAAAZk/2iuw4Io838k/s1600/ social_networks.jpg Band of Brothers http://www.flickr.com/photos/17149966@N00/460670492 Weakest Link http://www.flickr.com/photos/53611153@N00/465459020 Crowd http://www.flickr.com/photos/84856173@N00/3786725982 Lazy http://www.flickr.com/photos/superfantastic/3010891914/ Coins http://www.flickr.com/photos/restlessglobetrotter/3824486278/ Wireless Fail http://www.flickr.com/photos/bnilsen/2880929094/ The Thinker http://www.flickr.com/photos/53611153@N00/5827849044
  • 129. My Files http://www.flickr.com/photos/84172943@N00/5352825299 CD-R http://www.flickr.com/photos/45382171@N00/1515739697 Inside Outside http://www.flickr.com/photos/followtheseinstructions/5571697149/ Pole Dance http://www.flickr.com/photos/46854683@N04/4547706741 Seller http://www.flickr.com/photos/17768970@N00/4485455723 Thumbs up http://www.flickr.com/photos/37961843@N00/6265449 Greed http://www.flickr.com/photos/calliope/2207307656/ Dress Table http://www.flickr.com/photos/centralasian/5968327542/ Trust http://www.flickr.com/photos/43132185@N00/196015953 Sloth http://www.flickr.com/photos/28442702@N00/279470157 Compassion http://www.flickr.com/photos/29553188@N07/3573969837/ Running http://www.flickr.com/photos/51035555243@N01/287666827 Files http://www.flickr.com/photos/juniorvelo/3267647833/ Goofy http://www.flickr.com/photos/42dreams/73838574/ Library http://www.flickr.com/photos/51035555243@N01/85441961 Talking Business http://www.flickr.com/photos/brymo/272834885/ Mask http://www.flickr.com/photos/18548550@N00/5313987 Young Gentleman http://www.flickr.com/photos/64031910@N00/422547724 Goomba VS Mario and Yoshi http://www.flickr.com/photos/77161041@N00/2266201047 Mother http://www.flickr.com/photos/54304913@N00/17647469 Private Place http://www.flickr.com/photos/76151808@N00/6100020538 Kevin David Mitnick http://www.starnostar.com/data/images/who-is-Kevin-Mitnick-is-star-or-no-star-Kevin-David-Mitnick- celebrity-vote.jpg The Jersey Devil http://www.flickr.com/photos/79874304@N00/285367520 A little better than the last group http://www.flickr.com/photos/81881849@N00/3222035439 Operation Takedown http://filmescomlegenda.net/wp-content/uploads/2009/03/operation-takeodown-300x422.jpg I Have You Now http://www.fotopedia.com/items/flickr-3500989490 Spying Turquoise http://www.flickr.com/photos/jdhancock/7439564750/ Office Prank http://www.sprichie.com/wp-content/uploads/2012/01/office_pranks_05.jpg
  • 130. Crachás (sinto muito se sentiram-se ofendidos): http://farm4.static.flickr.com/3289/2295308772_cecfd160ea.jpg http://i279.photobucket.com/albums/kk160/lukstuning/DSC04358.jpg?t=1282497031 http://2.bp.blogspot.com/_mKoEIJZM0sk/SCDHHKtX2qI/AAAAAAAAAdU/OXDvNt9iqqU/s320/Foto-0336.jpg Backgrounds: Azul http://wallshq.com/wp-content/uploads/original/2011_06/80_blue-abstract-background_WallsHQ.com_.jpg Verde http://srv4.imghost.ge/out.php/i212027_greenabstractbackground.jpg Laranja http://wallpapers.free-review.net/wallpapers/19/Orange_abstract_wallpaper.jpg Videos: Jedi Mind Trick http://www.youtube.com/watch?v=bJiqrVWLfdw