Hacking Archives - Social Engineering Blogs

2600 Magazine Offers $10K for Access to Donald Trump’s Tax Return

Social Hax Blog — Wed, 28 Sep 2016 21:04:13 +0000

The Twitter account that represents 2600 Magazine – The Hacker Quarterly says they will offer $10K for first access to Donald Trump’s tax return. They also say that identities will be protected and provide a PGP key.

We are offering $10K for 1st access to @realDonaldTrump’s tax return. Identity protected, PGP key at https://t.co/oU079zJ4YV [email protected]

— 2600 Magazine (@2600) September 28, 2016

Twitter users responded with several funny comments:

Assange rn@2600 @realDonaldTrump @wikileaks pic.twitter.com/IyNz2cFbvV

— Eating Machine (@emmajaniejones) September 28, 2016

@2600 Please tell me that when you release it, you’ll tell the press that it was obtained by “the hacker known as 4chin”

— John Shade (@John5hade) September 28, 2016

@2600 @realDonaldTrump. How about $10K for Hillary’s deleted e-mails?

— Jim (@TypeError_) September 28, 2016

“Hi IRS this is the real actual Donald Trump. I just wanted to make sure that my refund’s gonna be YOOOGE”

— r000t (@rootworx) September 28, 2016

There have been many recent attacks on the Democratic National Committee including the Guccifer 2.0/Wikileaks release of DNC emails and more recently a possible hack of some of the party member’s phones. Some say that hackers have been focusing too much on exposing the DNC and not enough on the RNC. Perhaps this is the opportunity they have been waiting for.

2600 has also extended the offer to Trump himself:

Incidentally, we will also pay @realDonaldTrump $10K if he gives us his tax return first. Or anyone in his campaign or family. Fair is fair.

— 2600 Magazine (@2600) September 28, 2016

The post 2600 Magazine Offers $10K for Access to Donald Trump’s Tax Return appeared first on Social Hax.

The post 2600 Magazine Offers $10K for Access to Donald Trump’s Tax Return appeared first on Social Engineering Blogs.

Hackers Find Exploit and Reactivate LizardSquad’s Twitter Account

Social Hax Blog — Sat, 03 Sep 2016 18:54:00 +0000

On September 2, hackers calling themselves “Spain Squad” used an exploit to take control of several previously suspended Twitter accounts. Among these accounts were usernames like @Hitler, @botnet, @LizardSquad and @1337. Twitter re-suspended all of the breached accounts shortly after the hack, but it is unclear whether or not they are still vulnerable to this exploit.

One of the hackers aligned with Spain Squad tweets about reactivated accounts.

“It could be a vulnerability in Twitter’s software, a compromised staff account, or some other explanation. It’s also unclear whether the exploit is still active, or was patched concurrently with the banning of the hijacked accounts.” (Business Insider)

A spokesperson for the hacking group has stated they can do even more than recover old accounts with the exploit they found:

“The new exploit allows Spain Squad to change to suspend active accounts, change a user’s Twitter handle and even take control of active accounts. So far, the group has only demonstrated the ability to recover officially suspended accounts — though all of those have already been re-suspended by the social media company.” (Engadget)

Twitter actively suspends accounts that violate their Terms of Service (TOS). Sometimes these suspensions can be temporary and the user is able to restore their account after acknowledging broken rules and promising not to violate TOS again. Often, the user must delete offending tweets before the account will be restored. Alternatively, a Twitter account can become permanently suspended, which means the account is never to be restored under any circumstances. Restoring access to accounts that were thought to be never again accessible could prove to be profitable for hackers selling screen names that may be valuable. However Spain Squad claims to be non-malicious. Whatever their intent, they were definitely doing some of it for the lulz when they took control of the LizardSquad account:

The post Hackers Find Exploit and Reactivate LizardSquad’s Twitter Account appeared first on Social Hax.

The post Hackers Find Exploit and Reactivate LizardSquad’s Twitter Account appeared first on Social Engineering Blogs.

Are The Shadow Brokers Like Snowden? Theory Suggests Insider Hack

Social Hax Blog — Tue, 23 Aug 2016 14:48:12 +0000

By now, most of our readers have heard of the Shadow Brokers, the hacker group who obtained a large trove of data from the National Security Agency (NSA) and leaked information about the NSA’s cyber tools. The cyber tools were apparently stolen from the Equation Group, a cyber attack operation who experts believe are part of the NSA.

(Watch a quick overview about the NSA hack – “NSA Reportedly Hacked By Group Called The Shadow Brokers”):

Initially, evidence suggested that the Shadow Brokers were Russian, but a new theory is emerging that whoever is leaking this data might be “a second Edward Snowden… albeit one with different motives” (Fortune). James Bamfield, a journalist who is well known for his publications about United States intelligence agencies, believes that Russia would not want to publish these hacks if they obtained them, because companies would quickly patch their vulnerabilities and the information would soon be worthless to anyone trying to sell the data. He also brings up that the bad English used by the hackers seems to be phony. Furthermore, he suggests that the hacker(s) could be linked to the NSA’s Tailored Access Operations (TAO) which is a unit of the surveillance agency that gathers intelligence related to cyber-warfare. He states:

“Rather than the NSA hacking tools being snatched as a result of a sophisticated cyber operation by Russia or some other nation, it seems more likely that an employee stole them. Experts who have analyzed the files suspect that they date to October 2013, five months after Edward Snowden left his contractor position with the NSA and fled to Hong Kong carrying flash drives containing hundreds of thousands of pages of NSA documents.

So, if Snowden could not have stolen the hacking tools, there are indications that after he departed in May 2013, someone else did, possibly someone assigned to the agency’s highly sensitive Tailored Access Operations” (Reuters).

As of now, the “second Snowden” theory is just that – a theory. Most experts still say Russia is behind the hacks. Nevertheless, as Bamford puts it in his commentary – the “NSA may prove to be one of Washington’s greatest liabilities rather than assets.”

The post Are The Shadow Brokers Like Snowden? Theory Suggests Insider Hack appeared first on Social Hax.

The post Are The Shadow Brokers Like Snowden? Theory Suggests Insider Hack appeared first on Social Engineering Blogs.

Hacker Steals User Data from Epic Games Forums

Social Hax Blog — Tue, 23 Aug 2016 02:07:11 +0000

The usernames and email addresses of over 800,000 Epic Forums users were stolen by a hacker. According to Leakedsource.com, the attack happened on August 11. The hacker obtained the data by exploiting “a known SQL injection vulnerability found in an older vBulletin forum software, which allowed the hacker to get access to the full database” (ZDNet). In addition to the usernames and email addresses, the database contains scrambled passwords, IP addresses, birth dates, and activity such as posts, comments and private messages. Access tokens for Facebook were also breached. Epic Games has stated that the scrambled passwords will not be not easily crackable.

An Epic Games Spokesperson says that passwords do not need to be changed for the Unreal Engine and Unreal Tournament forum but a “compromise of our legacy forums covering Infinity Blade, UDK, previous Unreal Tournament games, and archived Gears of War forums revealed email addresses, salted hashed passwords and other data entered into the forums. If you have been active on these forums since July 2015, we recommend you change your password on any site where you use the same password.”

Epic’s Forums were also hacked last year.

The post Hacker Steals User Data from Epic Games Forums appeared first on Social Hax.

The post Hacker Steals User Data from Epic Games Forums appeared first on Social Engineering Blogs.

A Seized Silk Road Wallet is Moving Bitcoin to the NSA Hackers

Social Hax Blog — Mon, 22 Aug 2016 14:48:17 +0000

Last week, a group called the “Shadow Brokers” claimed to have hacked the NSA – stealing their code, exploits and spy tools. They leaked bits of information on GitHub and claimed the information was stolen from the Equation Group, a group who most believe is a computer surveillance wing of the NSA. The Shadow Brokers says they will auction off the data to the highest bidder. Leaks from Edward Snowden have demonstrated that this hack is legit. (The Register) Security experts believe that the hacker group is Russian.

Now it appears that there are some Bitcoin moving from a seized Silk Road wallet to the Shadow Broker’s auction. This leads some experts to believe that “the US government is potentially bidding to prevent stolen NSA exploits and tools from ending up in the wrong hands”. It could also mean that the government might be making an attempt to trace where the Bitcoins are going. Additionally, it must be noted that the co-founder of a major Bitcoin investigation company says that payments are also going in the other direction. This could simply indicate that spam is being sent in very small payments to famous addresses. (ZDNet)

So far, the Shadow Brokers have collected around $1000 in Bitcoin payments – a far cry from the 1 million Bitcoins they have demanded (which would be worth just over a half a billion $USD at the time of this writing). The U.S. government seized several thousand Bitcoin when shutting down Silk Road, so this may be their source of funds when dealing with the Shadow Broker hackers.

Learn more about the Shadow Brokers hack of the NSA here:

The post A Seized Silk Road Wallet is Moving Bitcoin to the NSA Hackers appeared first on Social Hax.

The post A Seized Silk Road Wallet is Moving Bitcoin to the NSA Hackers appeared first on Social Engineering Blogs.

NSA Hoards Zero Days; Doesn’t Disclose Them all to Vendors

Social Hax Blog — Mon, 22 Aug 2016 01:13:19 +0000

The NSA does not always disclose the zero day vulnerabilities it finds to unprotected vendors. Some security flaws are kept secret “when they can be used to serve a clear national security or law enforcement need” (Wired).

The US National Security Agency (NSA) was hacked by a suspected Russian hacker group and many of their exploits and hacking tools were archived. Leaked information was made public that showed the NSA collects exploits and does not always disclose them to vulnerable vendors. When vulnerabilities are not disclosed, problems do not get fixed. The NSA appears to operate “on the premise that secrets will never get out. That no one will ever discover the same bug. That no one will ever use the same bug. That there will never be a leak” (Business Insider).

Unfortunately, as we are currently witnessing with this recent leak, other types of hackers are able to find the same bugs and those hackers could have more malicious intent than the NSA. When hackers obtain a trove of U.S. secrets, that could put the government and corporations worldwide in a susceptible position. For example, the leaked data includes information on breaching popular commercial firewalls. Emergency service providers, governments, financial systems and many businesses all rely on these firewall technologies.

Global networking company, Cisco Systems, confirmed last week that the NSA exploited an undetected severe vulnerability that allows remote attackers “who have already gained a foothold in a targeted network to gain full control over a firewall” (Ars Technica). The NSA knew about this vulnerability since 2013 and did nothing to stop it. Now that the data is leaked, Cisco fears that the information “could be used to breach its Adaptive Security Appliance (ASA) software used in its firewalls. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system”. It can be argued that these exploits would have been patched had the NSA disclosed the vulnerabilities instead of collecting them for their own use.

(Watch – Snowden discusses NSA hack, Cisco to cut 5,500 jobs, NASA preps an asteroid rocket):

The post NSA Hoards Zero Days; Doesn’t Disclose Them all to Vendors appeared first on Social Hax.

The post NSA Hoards Zero Days; Doesn’t Disclose Them all to Vendors appeared first on Social Engineering Blogs.

A Hacking Scenario: How Hackers Choose Their Victims

Security Metrics Blog — Wed, 30 Dec 2015 17:32:00 +0000

See the step-by-step ways the average hacker looks for valuable data.

By: David Ellis

Business owners who have suffered a data breach at the hands of some hacker often say, “Why me? Why did the hacker choose our business?” Many people think hackers selectively pick each business they hack. However, I suspect that in 90% or more of the businesses that are hacked, it all began based with the random discovery of a hackable vulnerability.

Hackers typically begin a data breach scenario by conducting port scans across large ranges of IP addresses, specifically looking for certain open ports that may provide them a place to start digging.

Let me take you through a typical hacking scenario.

1) Scan for open ports

The hacker starts by running a port scan to probe a large range of IP addresses, and then he heads off to bed and lets the scan run all night.

The goal is to find particular open ports to exploit a known or potential vulnerability.

In the morning the hacker peruses the results of last night’s port scan, looking for certain ports that are actively “listening” (meaning they’re open). He likely has some automation at work that gives him a list of IP addresses with port numbers, 20, 21, 23, 513, 3389, 5631, 5632, and so on.

He’s interested in these exact ports (and a handful of others) because they all relate to some form of remote access into their networks.

For example, if a hacker sees ports 5631 and 5632 are open, he knows the remote access application pcAnywhere is installed and active. Or if he sees port 3389 is open, he knows Windows Remote Desktop is likely configured. If he can hack the remote access credentials, he doesn’t have to worry at all about complex firewall configurations or other perimeter protections.

If the remote access application was not configured to require two-factor authentication, he can probably guess the username and crack the password, and once he’s done that, he’s in.

Everything on your system that you can see, he can see as well.

2) Try out default passwords

Many users fail to change or delete the default username or password that was configured with their remote access product when it was first installed. So, the hacker merely begins by trying the known pcAnywhere (or Windows Remote Desktop, or VNC, or FTP or whatever other remote tool) default username and password.

At this point, does the hacker know that he’s attacking Acme Hardware? No. And he doesn’t care. He’s simply attacking a potential vulnerability via port 5631. The IP address might be for a business or it could be my grandmother’s ten-year-old PC.

If the default password was left on the system, the attacker has now successfully gained access to the system.

If the default password tactic doesn’t work, it’s just a minor inconvenience. Password cracking tools are plentiful and are getting more powerful all the time. At this point, the hacker runs his password-cracking tool and takes off for lunch while the tool does the heavy lifting. When he returns in an hour, or a couple of days, his tools have often detected the needed password, and he’s in.

There are other, even less technical ways to breach perimeter security like imbedding malware in online games or other legitimate website activities and waiting for users to inadvertently download a RAT to their system. (RATS are remote access trojans, and can be purchased online for just $40. They give the hacker covert remote access and establish persistent backdoor access to your system.) These types of malware can also be accidentally installed by the user through an email phishing scam.

Follow for more data security articles like this

3) Once he has control

Whether the hacker cracked your remote access credentials or you opened a malicious email link, you’re now in the hacker’s clutches and he begins prospecting. Up to this point the hacker still doesn’t know if he’s hacked a business or a personal computer.

Now, he looks for evidence that the system holds information of value, such as credit card account numbers, banking, real estate, or healthcare records (since these often contain social security numbers or other data that he can turn into a payday). To discover the nature of the environment where he has landed, the hacker will often run keyword searches.

For example, if his keyword searches discover the system he’s hacked is a Micros system, he knows he’s in a business that accepts credit cards. (Micros is a provider of POS hardware and software used by many hotels, restaurants and other small businesses.) He will probably try Micros default passwords to try to get into their server.

4) Install malware

If the hacker is successful in breaching a commerce environment, he will attempt to install data-capturing malware on the POS system. His malware will seek to detect credit card data, capture it, and export it out of the system. He then either reproduces the stolen credit cards or sells the stolen account data on the black market.

Depending on the malware installed, from the point of malware installation through the moment that the breach is detected and eradicated, every single customer credit card transaction made on that computer (and perhaps on the entire network) would be at risk.

5) Search for affiliated IP addresses

By now, the hacker has probably sifted through enough company data to realize he’s hacked Acme Hardware. The hacker realizes he’s hit a potential jackpot, because Acme Hardware is a national chain (in this scenario).

Since the hacker doesn’t know the IP addresses of the other chain locations, hacking them could be difficult. However, if he finds remnant data on the system that includes the other IP addresses, or connections to the corporate servers, Acme Hardware could be in some serious trouble (we’ve seen many cases where the breach of a single locale lead the hacker to the corporate environment and all of the stores in the chain).

Remnant data left on systems does occur. In a forensic investigation we conducted, a POS installer inadvertently left a partial client list on a POS system that contained the names and IP addresses of 28 other clients. All 28 were also hacked because of a careless installer.

6) Leave no trace

At this point, the hacker has a couple of choices: he can leave the malware in place and harvest customer credit card data until the breach is discovered and/or the vulnerability is closed (the most common alternative in commerce breaches), or he can choose to clean up his tracks and get out of the hacked system (seen in cases of corporate espionage or theft of corporate secrets).

Most attackers cover their tracks to avoid detection. They encrypt card data before transferring it out of a system, erase or modify security logs, run malware from RAM instead of the hard drive, which often goes undetected by most antivirus software, and employ many other “anti-forensic” tactics in order to escape unseen.

Hackers don’t care who you are. They just care how rich you can make them.

Now that you understand hackers don’t pick and choose their hacking victims out of the phone book, you should also understand the flaw in the common belief held by small businesses, “I’m too small for a hacker to care about me!”

A hacker doesn’t care if you’re small. He just cares if you have data from which he can profit.

Tweet

So it’s more crucial than ever to implement data security!

Need help securing your data? Talk to one of our consultants!

David Ellis (GCIH, QSA, PFI, CISSP) is Director of Forensic Investigations at SecurityMetrics with over 25 years of law enforcement and investigative experience. Check out his other blog posts.

The post A Hacking Scenario: How Hackers Choose Their Victims appeared first on Social Engineering Blogs.

How To Crack WPS with Pixie Dust … Offline Attacking

Subliminal Hacking Blog — Mon, 21 Sep 2015 10:50:01 +0000

In this post we are looking at how vulnerable WPS makes your Access Point. WiFi Protected Setup makes it nice and easy for you to connect to your wireless devices by using a simple pin number, instead of your hard to guess passphrase. The issue is that this means your secure 32 character passphrase is about as much use a chocolate fireguard, as instead of taking potentially years to crack, you can attack the pin number which only has 11,000 iterations and this can be cracked in hours (even with timeouts and other controls in place).

In this video we will show how a vulnerability in some of the chipsets of Wireless Access Points allows you to crack the WPS code in less than a second as well as revealing the WPA pin number. This attack is called the PixieDust attack, and it currently works on certain firmware on Broadcom, Realtek, Ralink and MediaTek chipsets. In the video this is demonstrated on an older BT HomeHub 3 which is using a Realtek chipset.

The way this works is that the Enrollee Hashes (E-Hash1 / E-Hash2) are supposed to be secret hashes, but when they are disclosed we can use them along with the Enrolle and Registrar Public Keys, along with the E & R Nonces and the Auth Key to decipher the WPS PIN Key.

Just to provide some comparison, using the WPS PixieDust attack we got the PIN and then the WPA2 Passphrase in less than a second. Stealing the WPA2 Hash and attacking this directly with a single GPU the time estimated to crack based on knowing its Alpha Numeric with no special characters is 853,399 days, 2 hours and 44 minutes, so year WPS add some weakness to your hardened access point

Below is the code used during the above video, you can use this easily copy and paste with your own information.

iwconfig

airmon-ng start wlan1

airmon-ng check kill

airodump-ng wlan1mon –wps

reaver -i wlan1mon -c -b -vv

pixiewps -e -r -s -z -a -n

reaver -i wlan1mon -c -b -vv -K 1

If you are looking to do this on Ubuntu and not Kali, you will need the following packages (cheers Matt):

apt-get install install build-essential libnl-3-dev libnl-genl-3-dev

wget http://download.aircrack-ng.org/aircrack-ng.1.2-rc2.tar.gz

git clone https://github.com/t6x/reaver-wps-fork-t6x

git clone https://github.com/wiire/pixiewps

Finally, in the WPS column you need to be checking for one of the following to make sure the Access Point has WPS enabled, if it isnt its not supported on the device, or you have successfully disabled it. 1.0, LAB, PBC, NFC, PIN,

The post How To Crack WPS with Pixie Dust … Offline Attacking appeared first on Social Engineering Blogs.

How Do Hackers Hack?

Security Metrics Blog — Wed, 22 Jul 2015 15:54:00 +0000

Crimes of opportunity lead the average hacker to valuable data.

By: Steve Snelgrove

You might think hackers selectively pick each business they hack. While this may be true in high profile or hacktivism cases, I estimate 90% of hacking is done based on a system’s general lack of security. Hackers don’t think, “Today I’m going to hack Acme Hardware across the street.” They scan for the most vulnerable system and start digging.

To defend against attacks, it is important to understand that hackers have different motivations and capabilities.

The Opportunist Hacker

A crime of opportunity

These hackers stay up-to-date on security news. Once a vulnerability is made public, it’s fairly easy to conduct a large-scale network scan for systems which exhibit symptoms of the vulnerability. After the hacker gets the list of vulnerable machines, he will do additional research on the vulnerability and attempt to enter the system. Once inside, it is often easy to pivot and reach other, less hardened machines.

A great example of opportunist hackers in action arose when news of the Heartbleed vulnerability was released in April 2014. The vulnerability was publically exposed on many news publications. Very shortly thereafter, hackers scanned the Internet for looking machines using OpenSSL, and then attempted to exploit that vulnerability and enter the system. Piece of cake.

But hackers don’t necessarily require huge newsworthy vulnerabilities in order to hack. There are thousands of other publically-known vulnerabilities they could take advantage of. For example, website forms often have validation flaws. An attacker may submit potentially malicious data on a form, which then might be echoed back to the user's browser and rendered to the screen. The screen displays a mix of server content and the attacker's malicious data. This could result in unsuspecting users being redirected to another site where credentials or session information might be captured.

Does the hacker know which business or person he’s hacking? No. And he doesn’t care. He’s attacking a system because it’s vulnerable. Once the vulnerability is identified, the hacker will then attempt to profit from the exposure.

How do I defend against this attack?

The obvious defense against the public vulnerability attack is to scan your systems in an attempt to discover vulnerabilities beforehand. Keep up-to-date on security news. Partner with a company that keeps abreast of publicly disclosed vulnerabilities. Regularly maintain and update your systems.

If a vulnerability similar to Heartbleed is released, do everything in your power to close the vulnerability ASAP. Do your best to maintain updates on all other operating systems, browsers, and servers to avoid the possibility of being a victim of a zero-day attack.

The Layabout Hacker

Brute forcing

Somewhat less effective, but still pervasive, are brute force attacks. In these attacks, attackers control an army of computers infected with malware (known as botnets or zombie computers). The attacker is able to control this network of computers, and these do the attacker’s dirty work for them.

The attacker uses botnets to access systems by guessing usernames and passwords in millions of combinations until the right combination is guessed. It’s not very effective. But, as my dad always said, “even a blind squirrel will find a nut every once and a while.”

Hackers use botnets so each hack attempt is nearly impossible to trace back to the actual hacker.

How do I defend against this attack?

The two best ways to avoid this attack is by monitoring your logs and regularly creating new passwords.

If a botnet tries to access your system through a brute force attack, your logs should record these actions. If your logs record 1,000’s of failed login attempts on your system, you’re probably being attacked.

The reason brute force attacks work so well is because millions of user credentials (usernames and passwords) have been dumped online in publicly available lists. Password lists are effective because the majority of people do not change their passwords, and use the same passwords on multiple sites/systems. To avoid this attack, change your personal and business passwords every 90 days, and never reuse passwords.

Hackers have different motivations and capabilities. But these are their main methods.

Tweet

What do hackers do after they get into a system?

Now the hacker starts prospecting. Remember, before this point the hacker still doesn’t know if he’s hacked a business or a personal computer. Now, he looks for evidence that the system is doing commerce, which means credit cards, healthcare information, or other valuable data might be present. To find this data, he starts running keyword searches on the file systems and memory of the system.

For example, if his keyword searches discover that the system he’s hacked is a Micros system, he knows he has gained access to a business that accepts credit cards. (Micros is a point of sale software used by many restaurants and hotels.) He will probably try Micros default passwords to try to get into their server and thus expand the range of the attack.

Install malware

If the hacker is successful in breaching the point of sale system, he can possibly install malware. The whole point of malware is to gain access to valuable and sensitive information, such as credit card numbers, early on in the data processing stream, and attempt to divert this sensitive information so cybercriminals can reproduce cards or sell the stolen data on the black market.

Depending on the malware installed, every single customer credit card transaction made on that computer (and perhaps on the entire network) could be at risk.

Pivot

By now, the hacker in this scenario has probably filtered through enough company data to realize who he’s hacked.

Perhaps the hacker has managed to attack and gain access to a national business with a chain of stores. If he finds remnant data on the system that includes the IP addresses of other chain locations, that chain will be in some serious trouble as these chain locations may have less security measures in place, and access to these associated networks could provide valuable information to the attacker.

Remnant data left on systems does occur in real world examples. In a forensic investigation my colleague David Ellis conducted, a point-of-sale equipment installer left a partial client list on each and every point-of-sale system he had installed during that year. Some 28 businesses were hacked because of the poor security awareness of that careless installer.

Leave no trace

At this point, it’s time for the hacker to get out of the hacked system. Most hackers cover their tracks to avoid detection. They encrypt card data before transferring it out of a system, erase or modify security logs, and run malware from RAM instead of the hard drive, which often goes undetected by most anti-virus software.

Social Engineering – It’s OK To Be a Little Paranoid

Security Metrics Blog — Mon, 21 Jul 2014 17:00:00 +0000

After all, gullible employees lead to security breaches.

By: Brand Barney

Humans want to trust other humans. If I struck up a conversation with a gentleman in a suit at the bus stop who explained his life story, why would I distrust him?

We all have a natural tendency to believe what trustworthy-looking people tell us. And that’s what gets us in trouble.Tweet

What is social engineering?

Social engineering is a way of manipulating people socially so that they trust the social engineer and eventually provide some sort of useable data. For instance, instead of trying to find software vulnerabilities to exploit for sensitive data, a social engineer might try to trick someone into divulging an administrative password without realizing it.

Have you ever seen the crime drama Catch Me If You Can? Frank Abagnale, the main character, is a master of social engineering. He convinces people he’s an airline pilot, doctor, and attorney by forging documents and acting like he belongs. The scary thing is, it’s a true story.

What’s the problem with social engineering?

Hey guys and welcome back to the SecurityQ, your source for business data security Today on the SecurityQ, we're back with part two of social engineering. Alright guys. Last time on the SecurityQ, we talked a little about social engineering and I showed you a pretty sweet example. But today I interviewed two security experts: an auditor and forensics investigator. Here's what they had to say about social engineering. Social engineering, the part that frustrated us was how easy it was to do this with customers. We'd say, hey we're here to work on your network or work on your computers, can you show me to your server room? And they'd lead us right back there. They wouldn't ask us, you should know the password, and I'm gonna give it to you. They'd just give us the password. We would send a letter later on and tell them how easy it was to get inside. They're always quite surprised. Usually when you go to a company they feel like their people are trained very well. I've worked at customer sites where they've been really secure and they've done a much better job. Bu by far, most companies are lax on their rules and people need better training. There's another way that it's kind of unusual. That merchants really need to be on guard for the social engineer. For example, there was a an investigation we were involved in where this guy had very limited IT skills, but he knew how to talk. He simply opened up the yellow pages and started calling all the restaurants in a particular chain that were in this area. He said, I have to do some system maintenance and I can walk you right through it. We'll do it together over the phone. Enabled a remote session with them, and virtually while he was on the phone with the manager, installed malware. Alright guys, I've said it before and I'm gonna say it again. You may have the best technology on the face of the planet, but if you don't protect yourself from the social threat, you're leaving your business wide open. Our advice? Train your employees against the social threat and remember to always prepare because your security matters. Well guys that's all the time we have today on the SecurityQ. But as always, we want to hear from you. So post your questions in the comments below and don't forget to subscribe. See ya next time on the SecurityQ.

Here are some common ways social engineers try to socially engineer us

Steal badges and credentials in unlocked cars
Go to the local donation store and buy old company T-shirts
Pose as janitorial staff to get into a building
“Can you hold the door for me? I don’t have my badge.”
Pose as an IT person that needs to fix the network
Try unlocked doors around the backside of buildings
Pose as law enforcement conducting an inspection
Dumpster dive for sensitive documents

Here’s what happens when I try to socially engineer someone.

Hey guys, welcome back to the SecurityQ, your source for business data security. Today on the SecurityQ, we're gonna discuss one topic. The social threat to your business. Here's the game if you don't mind if I try. Out of the things you have inside, would you say would be most valuable? The thing inside your pockets We'll take your front pocket here, do you have something inside? You don't mind if I bring this out in public do you? I believe that's really strange. So you have anything else? Okay guys, so we just saw a pretty sweet video of a social engineer, or a con man, stealing personal items from a guy. I have to tell you I'm quite impressed with his skill. Now a lot of businesses ask me, what is a social engineer and how does that apply to my business? The truth is, a social engineer is somebody that uses social interaction to steal data. It could be personal, that data could be physical, that data could be coming from your trash can. It's data they want. And they're gonna use any and all tactics to get that data. Now I'm gonna show you what social engineering looks like at an actual business and I'm personally going to do it. Jive Communications, Voice over IP made affordable and reliable, has graciously given us permission to run a simulation. Everyone involved is an actor. Hi how are you? My name is Brandon Barney and I'm the IT director upstairs. I was monitoring our logs this weekend, and it looked like your Wi-Fi was bleeding into ours. If I could jump onto your computer systems real quick and make sure that's not the case, I'd sure appreciate it. This employee has one have two choices. They're either going completely fold and give me access to the network, or they're gonna shut me down. The question is, what are you and your employees going to do? If you're looking for information or tactics used by these criminals, check out the link for information from PC world. Our advice? Train your employees and test them. There are lots of professionals out there that can assist you in doing this. Remember, your security matters. Well guys, that's all the time we have for today on the SecurityQ. If you're looking for detailed information on social engineering, I'm going to be posting a pretty sweet video response. Remember, we want to hear from you so post your questions in the comments below, and don't forget to subscribe. See you next time on the SecurityQ.

How to avoid being a victim of social engineering

The best way to avoid being socially engineered is by educating yourself and your employees. Here are some points you should touch on during training:

You should be slightly paranoid (better to be safe than sorry)
Social engineers don’t sneak around. They’re confident and friendly. They look like they belong. Don’t be pressured by their convincing ways.
Never give out your username/password, badge, PIN, ID number, credit card, or schedule. In essence, never give out sensitive information about you or your company.
Ask for a contact to verify why the person needs the information they’re asking for
Don’t hold secure doors open for people you don’t know

The only way to identify if your employees have soaked in all that social engineering knowledge is to test them. You can don a disguise and test them yourself, or enlist the help of a social engineering professional (also called a pen tester), to come onsite and test your employees, experiment with your physical security, and see what interesting information they can find in your trash cans.

Have a business security question? Tweet me and you may see your question answered on the next SecurityQ.

Brand Barney (CISSP) is an Associate Security Analyst at SecurityMetrics and has over 10 years of compliance, data security, and database management experience. Follow him on Twitter and check out his other blog posts.

The post Social Engineering – It’s OK To Be a Little Paranoid appeared first on Social Engineering Blogs.