Social Engineering as the Art of "Human OS" hacking Main points of the presentation (1) Overall introduction on social engineering (2) Case studies (3) Defending against Social Engineering. for: http://armsec.org/

1. Social Engineering
Art of "Human OS" hacking
Hovhannes Aghajanyan
hovhannesagh

2. Topics covered
 What is Social Engineering?
 Techniques and Case studies of Social
Engineering
 Defending against Social Engineering

3. Objectives
 Understand the principles of social engineering
 Define the goals of social engineering
 Recognize the signs of social engineering
 Increase awareness conserving social engineering
 Identify ways to protect yourself from social engineering
3

4. What is Social Engineering
At its core it is manipulating a person into knowingly or unknowingly giving up
information; essentially 'hacking' into a person to steal valuable information.
 Psychological manipulation
 Trickery or Deception for the purpose of information gathering. One of the most effective
routes to stealing confidential data from organizations
85% of office workers were duped by engineering
4

5. What is Social Engineering
The purpose of social engineering is secretly install spyware, other malicious
software or to trick persons into handing over passwords and/or other
sensitive financial or personal information
5

6. 48% of enterprises have been victims of social engineering
attacks, experiencing 25% or more such attacks in the past two years at a
average cost of over $ 18,000 per incident
Source: Check Point (http://www.net-security.org/secworld.php?id=11665)
6

7.  Phishing emails were ranked the most common source of
social engineering threats (47%), followed by social networking
sites that can expose personal and professional information
(39%) and insecure mobile devices (12%).
 New employees are at high risk to social engineering risks,
followed by contractors (44%), executive assistants (38%),
human resources (33%), business leaders (32%) and IT
personnel (23%).
Source: Check Point (http://www.net-security.org/secworld.php?id=11665)
7

8. Who are Social Engineers ?
 Lone hackers and or organized cybercriminals
 Script kiddies
o Unskilled hackers who use simple techniques.
 Hacktivists
o Adding the online activity of hacking to political activism
gives us hacktivism.
 Nation-state hackers:
o These actors pose the highest, consistent cyberthreat to state
and territorial governments, and an unknown level of risk to
local and tribal governments.
 Media, Commercial Organizations, Private investigators

9. What motivates social engineers?
 Obtaining personal information.
 Gaining unauthorized access.
 Circumventing established procedures.
 Because they can.

10. Kevin Mitnick
Famous Social Engineer Hacker
• Went to prison for hacking
• Became computer security consultant
"The weakest link in the security chain is the human element."

11. Social Engineering can take on many forms. It can
be malicious and it can be friendly.

12. Phases in a Social Engineering Attack
• Research on a target
o Websites, Employees, Search Engine, News ..etc.
• Select a victim
o Identify the frustrated person.
• Develop a Relationship
o Develop Relationship with the selected person.
• Exploit the Relationship
o Manipulate, Collect Sensitive information, financial information, and.

13. Why Social Engineering is effective
and very dangerous?
 Security Polices are strong, but as their, and humans factor is the
weakest link.
 It is difficult to detect social engineering attempts.
 There is no method to ensure complete security from social
engineering attacks.
 There is no specific software or hardware for defending against a
social engineering attack.

14. Types of Social Engineering
• Quid Pro Quo
o Something for something
• Phishing
o Fraudulently obtaining private information
o Send out bait to fool victims into giving away their information
• Baiting
o Real world trojan horse
• Pretexting
o Invented Scenario
• Diversion Theft, Tailgating
o delivery is requested elsewhere

15. Human-based Social
Engineering
• Posing as a legitimate end user
o Give identity and ask for sensitive-information.
Example “Hi This is Hovhannes, From Marketing Department, I have forgotten my password, Can I
get it ?“
• Posing as an Important user
o Posing as a VIP of a Target company, valuable customer, etc.
Example " Hi! This is Lilit, CEO Secretary. I'm working on an urgent project and lost my system
password, Can you help me out? “
• Posing as Technical Support
o Call as technical support staff and request IDs and passwords.
Example "Sir, this is Gurgen, Technical Support, our company, last night we had a system crash, and
we are checking for the lost data, Can you give me your ID and password? "

16. Computer-based Social
Engineering
 Pop-Ups trick users into clicking a hyperlink that redirects them to fake
web pages asking for personal information, or downloads malicious
programs such Key-loggers, Trojans, or Spyware.
 An illegitimate email falsely claiming to be from legitimate company
attempts to acquire the user’s personal or account information's.

17. Mobile-based social
engineering
 Tracy Received SMS, notifications
 Tracy calls, Recordings, IVR

18. CASE STUDIES
RSA SecurID Breach - $66 million
 "The attacker in this case sent two different phishing emails over a
two-day period. The email subject line read '2011 Recruitment
Plan.'
 "The email was crafted well enough to trick one of the employees to
retrieve it from their Junk mail folder, and open the attached excel
file. It was a spreadsheet titled '2011 Recruitment plan.xls.'
 "The spreadsheet contained a zero-day exploit that installs a
backdoor through an Adobe Flash vulnerability (CVE-2011-0609)."

19. CASE STUDIES
ABN Amro bank- $27.9 million
 Posing as a successful businessman, the thief visited the bank
frequently, befriending staff and gradually winning their
confidence.
 Use charm and brought them chocolates,
 Got the original of keys to make copies and got information on
where the diamonds were.

20. CASE STUDIES
CIA Director John Brennan - email
 Call Verizon
 Take Brennan’s account number, his four-digit PIN, the backup
mobile number on the account, Brennan’s AOL email address and
the last four digits on his bank card.
 Call AOL

21. Ways to Prevent Social Engineering
 For Individuals
o Do not provide personal information
o Always be suspicious, Read mails and don’t click
o Take ownership for corporate security
o Password management/Two factor authentication
o Understand what information you are putting on the Web/Social
networks
 For Companies
o 3rd Party tests
o Policies
o Trainings/User Awareness
o Email/Web fliting and Strong authentication
o Customer notification
34% of businesses do not have any employee training or security policies.

22. THANKS AND PROTECT YOURSELF !
Hovhannes Aghajanyan
hovhannesagh