Issa Seattle 5 09 Social Engineering
•
1 like•339 views
This document discusses the history and evolution of social engineering attacks. It begins by noting that as technical vulnerabilities have decreased due to improvements in software and security, human vulnerabilities have become a larger target. The document then covers historical examples of early social engineering and hacking. It discusses how the rise of the internet created a target-rich environment that shifted the focus to attacks exploiting human interactions like phishing. The document defines social engineering and notes it relies on exploiting human nature through communication, awareness, and frame control. It outlines the basic skill set used and techniques like pretexting. It concludes by emphasizing the need for measurable security awareness training to protect against social engineering.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Issa Seattle 5 09 Social Engineering
Similar to Issa Seattle 5 09 Social Engineering (20)
Recently uploaded
Recently uploaded (20)
Issa Seattle 5 09 Social Engineering
- 1. Everything Old is New Again Back to the Social Engineering Future © 2008 – Foreground Security. All rights reserved
- 2. Only two things are infinite: the universe and human stupidity. And I'm not sure about the former. - Albert Einstein 2
- 3. Only two things are infinite: the universe and human stupidity, And I'm not sure about the former. Albert Einstein 3
- 4. Agenda • The Changing Threat Environment • What is Social Engineering – The usual suspects – What it really looks like • How does it work? – The art of exploiting humans – The 3 Skills of Social Engineering • How do you protect yourself? © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 6. The History of Security Commercial Vulnerability Assessment Sasser Nimda Commercial Blaster Firewalls Loveletter Slammer Commercial Data Leakage Kevin Vulnerability Management Prevention Mitnick Snort Melissa Spyware Code Red SATAN Commercial Commercial Morris IDS Anti-Spyware Worm Nessus Phishing Kevin Commercial IPS & UTM Poulsen SIM/SEM You Are Here 1985 1995 2005 Human Network Server Web App Client Organization 6
- 7. The Vulnerability Cycle Human / Network Organization Service / Client Server Application 7
- 8. The Early Years • Those were the days – Software Vulnerabilities weren‟t significant - most based on configuration weakness – Only a handful of people understood how to exploit technologies – Small Target Surface - Few internet-connected computers – Focus was on phone phreaking and academia • Social Engineering reigned supreme – Most successful attacks involved social engineering – Unsophisticated controls environments – Few understood the jargon – Policies encouraged trust over security © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 9. The Kevins 9 © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 10. The Internet Era • Two Vital Dates – October 13, 1994 • Mosaic Netscape 0.9 released • The web becomes easy to navigate – August 24, 1995 • Windows 95 Released • Home computer use proliferates massively • The Internet Experiences exponential growth – Money starts to change hands – Internet connected computers become a viable target • This creates a target rich environment... 10 © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 11. Attacking Computers Directly • Phrack 49 - November 8, 1996. – Aleph1 - Smashing the Stack for Fun and Profit • Readily available exploit code actually makes breaking in to computers easier – The “golden age” of server hacking begins. • 1996-2003 - More of the same – Memory attacks become more sophisticated – Polymorphic shell-code designed to evade detective controls – More advanced use of memory spaces (format strings, integer exploits) 11 © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 12. August 4, 2004 • Windows XP Service Pack 2 Appears – Microsoft finally hardens their operating systems – The world changes overnight – Security is now baked in to the computer. • Server based vulnerabilities disappear – As massive server-based vulnerabilities disappear, client interaction becomes key – The number of issues continues to increase, but the type of issues starts to Source: IBM/ISS X-Force: http://blogs.iss.net/archive/2007XFReport-Day1.html change radically © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 13. Difficulty of Exploitation Human Vulnerabilities Difficulty of Exploit Technical Vulnerabilities 1985 1995 2005
- 14. The New Vulnerable Element • Since 2005 – No major direct-exploitation worm outbreaks – Less than a handful of “remote root” direct exploitation vulnerabilities • Major Classes of Attacks – Drive-by Download – Exploitation through Email, Web and Social Networking Sites – Phishing / Pharming / Spear-Phishing • What‟s the similarity? – If you said “human interaction”, you get a gold star. 14 © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 15. The human is the main exploit target again. Back to that comment about human stupidity...
- 16. Social Engineering • Defined (by Wikipedia): – “The practice of obtaining confidential information by manipulating users.” • The Art of Exploiting Human Weakness – Humans are social creatures – Human nature makes us vulnerable to each other – Social engineers exploit weaknesses in human nature to obtain information or access to computer systems. • A Confidence Trick – Social Engineering is the age-old art of the “Confidence Man” – Wikipedia: “For confidence tricks dealing with information theft or computers see social engineering.” – Studying the con man gives us insight into social engineers © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 17. When I say „Social Engineering‟, that‟s not what you think about, is it? I hate movies at this point in the talk.
- 18. Hollywood Style • Most people have 3 concepts of social engineering... – The Technical Social Engineering Attack – The “Pretext” – The “Sneakers” Attack • These only scratch the surface – What we read in the media only serves to reinforce these perceptions – Sophisticated social engineering is significantly more dangerous – Those who get caught are the ones who we hear most about. • Two examples to expand your mind... © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 19. 19
- 20. Hypnotic Robbery • Humorous example of face-to-face human exploitation – Convenience store robbery performed by “hypnosis” – Ideal example of social engineering • From a news report (http://www.wmur.com/news/14212889/detail.html): Police said that two Indian Punjabi men stole more than $1,000 from the Marlborough Country Convenience Store on Monday. The men told the storeowner that they were guruji, a type of Hindu priest, and that they could read his mind, police said.... Patel said the scam began with a simple mind game. The men asked him what his favorite flower was, and they opened a paper with the correct answer on it: quot;Rose.quot; They then told him to think of a wild animal, and they again had written down his choice.... quot;They also said my wife's name that not too many people know,quot; Patel said. quot;My mom's name, they told me. And they told me what was my future goal.quot; © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 21. Not funny at all: Choicepoint Over 163,000 identities compromised. Cost to the company: approx. $40M USD SEC Fines levied: $15M USD 21
- 23. How it works • The limit of imagination – Social engineering takes a huge number of forms – Common theme: the use of influence and misdirection to obtain inappropriate information and access • Knowing your enemy – Generally part of criminal enterprise – Somewhat risk averse – Well-developed social skills © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 24. The Basic Skill Set • 3 Parts to Exploiting Humans – Communication – Awareness – Frame Control • Most think only of the first – Ears, Eyes and other senses are in proportion – Most instructors focus on communication and leave the success of the other two elements to chance and natural talent – Some believe that social engineers can not be taught – Unfortunately, the bad guys are training on these skills. © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 25. Language can both represent reality and shape it. Chris Keeler and Linda Ferguson
- 27. Communication • The art of communication – Language is the first skill of the social engineer – Ability to craft words is first step in influence • Language is not real – Incomplete representation of reality – Incompleteness creates opportunity • Dual Purpose of Language – Information Transfer – Influence © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 29. Awareness • Words are meaningless without awareness of what is working – Your awareness of others acts as a compass – You need to see and hear the effect of your words • Two main types of awareness – Body language – Facial expressions • Creating Rapport – The feeling of being “in sync” with someone else – Putting ourselves in the same state as our target © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 30. Frame Control • Cognitive Frames – Wikipedia: ”the inevitable process of selective influence over the individual's perception of the meanings attributed to words or phrases. Framing defines the packaging of an element of rhetoric in such a way as to encourage certain interpretations and to discourage others” – The frame is the context in which the content of an interaction occurs • Frame control – Transformation – Extension / Contraction – Combination – Amplification / Compression © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 31. The Elements of Influence • Creating a frame with certain elements can enhance influence – Reciprocity – Authority – Social Proof – Confirmation – Emotional / Amygdala hijack – Confusion • Inserting these elements within a frame can strengthen influence – These are natural human responses – We use these responses to create a context for influence © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 33. Protecting Yourself • Question: How do you protect your organization against social engineering? – Far too often, the answer is a vague “security awareness” – Unfortunately, “awareness” isn‟t easily attained – Most “awareness training” is a complete waste of time • The Key Word: Measurability – How do you know whether your security awareness exercises are getting through to your people? – Is your awareness training tracking against actual metrics? – Do you follow up your awareness exercises with real tests of your people and of the effectiveness of your training cycle? © 2008 – Foreground Security, Michael Murray & Associates, LLC. All rights reserved
- 34. Questions? Feel free to email: mike@foregroundsecurity.com
Editor's Notes
- The information security world exists on an incredibly short (20 year) timeframe - Even taking a *REALLY* long view, the entire Infosec industry extends only back as far as the mid-80s - AROUND 20 YEARS.Those were the daysVulnerabilities weren’t significantOnly a handful of people understood how to exploit technologiesMost vulnerabilities were based on weaknesses in configurationFew internet-connected computersFocus was on phone phreaking and academia Social Engineering reigned supremeMost successful attacks involved social engineeringUnsophisticated controls environmentsFew understood the jargonPolicies encouraged trust over securityTwo Vital DatesOctober 13, 1994Mosaic Netscape 0.9 releasedThe web becomes easy to navigateAugust 24, 1995Windows 95 ReleasedHome computer use proliferates massivelyThe Internet Experiences exponential growthMoney starts to change handsInternet connected computers become a viable targetThis created a target rich environment...Phrack 49 - November 8, 1996.Aleph1 - Smashing the Stack for Fun and ProfitThe first real sophisticated vulnerabilities start to emergeA buffer overflow required knowledge of assembly and coding skillHackers now had to be more technicalReadily available exploit code actually makes breaking in to computers easierThe “golden age” of server hacking begins.1996-2003 - More of the sameMemory attacks become more sophisticatedPolymorphic shell-code designed to evade detective controlsMore advanced use of memory spaces (format strings, integer exploits) Windows XP Service Pack 2 AppearsMicrosoft finally hardens their operating systemsThe world changes overnightSecurity is now baked in to the computer.Server based vulnerabilities disappearAs massive server-based vulnerabilities disappear, client interaction becomes keyThe number of issues continues to increase, but the type of issues starts to change radicallySince 2005No major direct-exploitation worm outbreaksLess than a handful of “remote root” direct exploitation vulnerabilitiesMajor Classes of AttacksDrive-by DownloadExploitation through EmailExploitation through Social Networking SitesPhishing / Pharming / Spear-PhishingWhat’s the similarity?If you said “human interaction”, you get a gold star.