Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information.
[1] While similar to a
confidence trick or simple
fraud, the term typically applies to trickery for information gathering or computer system access and in most cases the attacker never comes face-to-face with the victim.
Social engineering techniques and terms
All social engineering techniques are based on flaws in human logic known as cognitive biases.[2] These bias flaws are used in various combinations to create attack techniques, some of which are listed here:
Pretexting
Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is usually done over the telephone. It's more than a simple lie as it most often involves some prior research or set up and the use of pieces of known information (e.g., for impersonation: date of birth, Social Security Number, last bill amount) to establish legitimacy in the mind of the target.
This technique is often used to trick a business into disclosing customer information, and is used by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. The information can then be used to establish even greater legitimacy under tougher questioning with a manager (e.g., to make account changes, get specific balances, etc).
As most U.S. companies still authenticate a client by asking only for a Social Security Number, date of birth, or mother's maiden name — all of which are easily obtained from public records — [citation needed]the method is extremely effective and will likely continue to work well until a more stringent identification method is adopted.
Pretexting can also be used to impersonate co-workers, police, bank, tax authorities or insurance investigators — or any other individual who could have perceived authority or right-to-know in the mind of the target. The pretexter must simply prepare answers to questions that might be asked by the target. In some cases all that is needed is a voice of the right gender, an earnest tone and an ability to think on one's feet.
Voice over IP programs are starting to become a standard in pretexting, as the absence of a traceable number makes the pretexter less vulnerable to being caught.[citation needed]
Phishing
Phishing applies to email appearing to come from a legitimate business — a bank, or credit card company — requesting "verification" of information and warning of some dire consequence if it is not done. The letter usually contains a link to a fraudulent web page that looks legitimate — with company logos and content — and has a form requesting everything from a home address to an ATM card's PIN.
IVR/phone phishing
This technique uses a rogue Interactive voice response (IVR) system to recreate a legitimate sounding copy of a bank or other institution's IVR system. The victim is prompted (typically via a phishing email) to call in to the "bank" (via a provided toll free number) and verify information. A typical system will continually reject logins ensuring the victim enters PINs or passwords multiple times. More advanced systems will even transfer the victim to the attacker posing as a customer service agent for further questioning.
Trojan horse/gimmes
Gimmes take advantage of curiosity or greed to deliver malware. Also known as a Trojan Horse, gimmes can arrive as an email attachment promising anything from a "cool" or "sexy" screen saver, an important anti-virus or system upgrade, or even the latest dirt on an employee. The recipient is expected to give in to the need to see the program and open the attachment. In addition, many users will blindly click on any attachments they receive that seem even mildly legitimate.
Road apple
A road apple is a real-world variation of a Trojan Horse that uses physical media and relies on the curiosity of the victim. The attacker leaves a malware infected floppy disc, CD ROM or USB flash drive in a location sure to be found (bathroom, elevator, sidewalk), gives it a legitimate looking and curiosity piquing label, and simply waits.
For example: An attacker might create a disk featuring a corporate logo, readily available off the target's web site, and write "Executive Salary Summary Q1 2007" on the front. The attacker would then leave the disk on the floor of an elevator or somewhere in the lobby of the target company.
An unknowing employee might find it and subsequently insert the disk into a computer to satisfy their curiosity, or a good samaritan might find it and turn it in to the company.
In either case as a consequence of merely inserting the disk to see the contents, the user would unknowingly install malware on their computer, likely giving an attacker unfettered access to the target company's internal computer network.
Note that the term 'Road Apple' has been re purposed from an older use meaning horse manure.
Quid pro quo
Something for something:
- An attacker calls random numbers at a company claiming to be calling back from technical support. Eventually they will hit someone with a legitimate problem, grateful that someone is calling back to help them. The attacker will "help" solve the problem and in the process have the user type commands that give the attacker access and/or launch malware.
- In a 2003 information security survey, 90% of office workers outside of their building gave away what they claimed was their password in answer to a survey question in exchange for a cheap pen [1].
Notable social engineers
[edit] Kevin Mitnick
Reformed computer criminal and security consultant Kevin Mitnick popularized the term, and points out that it's much easier to trick someone into giving you his or her password for a system than to spend the effort to hack in.[1] He claims it to be the single most effective method in his arsenal.
Others
Other social engineers include Frank Abagnale, David Bannon, Peter Foster, Steven Jay Russell and Michael Bafatakis.
United States law
Pretexting of phone records
In December 2006, United States Congress approved a Senate sponsored bill making the pretexting of telephone records a Federal Felony with fines of up to $250,000 and 10 years in prison for individuals (or fines of up to $500,000 for companies). It was signed by president George W. Bush on January 12, 2007.[3]
Signed into U.S. law in 1999 specifically addresses pretexting of banking records as an illegal act punishable under federal statutes. Under the common law, pretexting is an invasion of privacy tort of appropriation; see Restatement 2d of Torts § 652C.
When a business entity such as a private investigator, SIU insurance investigator or an adjuster conducts any type of deception, it falls under the authority of the Federal Trade Commission (FTC). This federal agency has the obligation and authority to ensure that consumers are not subject to any unfair or deceptive business practices.
US Federal Trade Commission Act, Section 5 of the FTCA states, in part: "Whenever the Commission shall have reason to believe that any such person, partnership, or corporation has been or is using any unfair method of competition or unfair or deceptive act or practice in or affecting commerce, and if it shall appear to the Commission that a proceeding by it in respect thereof would be to the interest of the public, it shall issue and serve upon such person, partnership, or corporation a complaint stating its charges in that respect...."
The statute states that if you are securing any personal, non-public information from a financial institution or the consumer, the action is covered by the statute. It relates to the consumer's relationship with the financial institution. For example, the pretexter is using false pretenses to get from the consumer's bank the consumer's address, that would be covered. Or, if the pretexter is going to the consumer and getting the name of his or her bank through false pretenses, that would be covered. The determining principle is that it is only pretexting if the information is obtained through false pretenses.
While the sale of cell phone records has gained significant media attention, and telecommunications records are the focus of the two bills currently before the United States Senate, many other types of private records are being bought and sold in the public market. Alongside many advertisements for cell phone records, wireline records and the records associated with calling cards are advertised. As individuals shift to VoIP telephones, it is safe to assume that those records will be offered for sale as well.
It is currently legal to sell phone records, but illegal to obtain them.[4]
U.S. Rep. Fred Upton {R-Kalamazoo, Michigan}, chairman of the Energy and Commerce Subcommittee on Telecommunications and the Internet, expressed concern over the easy access to personal cell phone records on the Internet during Wednesday's E&C Committee hearing on “Phone Records For Sale: Why Aren't Phone Records Safe From Pretexting?”
Illinois became the first state to sue an online records broker when Attorney General Lisa Madigan sued 1st Source Information Specialists, Inc., on 20 January, a spokeswoman for Madigan's office said. The Florida-based company operates several Web sites that sell cell phone records, according to a copy of the suit.
The attorneys general of Florida and Missouri quickly followed Madigan's lead, filing suit on 24 January and 30 January, respectively, against 1st Source Information Specialists and, in Missouri's case, one other records broker - First Data Solutions, Inc.
Several wireless providers, including T-Mobile, Verizon and Cingular, filed earlier lawsuits against records brokers, with Cingular winning an injunction against First Data Solutions and 1st Source Information Specialists on 13 January.
US Senator Charles Schumer(D-New York) introduced legislation in February of 2006 aimed at curbing the practice. The Consumer Telephone Records Protection Act of 2006 would create felony criminal penalties for stealing and selling the records of mobile phone, landline, and Voice over Internet Protocol (VoIP) subscribers.
Hewlett Packard's Former Chairman, Patricia Dunn, reported that the HP board hired a private investigation company to delve into who was responsible for leaks within the board. Dunn acknowledged that this company used the practice of pretexting to solicit the phone records of board members and journalists. Chairman Dunn later apologized for this act and offered to step down from the board if it was desired by board members.[5] Unlike Federal law, California law specifically forbids such pretexting, and this case is being investigated by the California Attorney General.
Social engineering in popular culture
- In the film Hackers, the protagonist used a form of social engineering, where the main character accessed a TV network's control system by phoning the security guard for a modem number, posing as an important executive. Although the film is not highly accurate, the particular method demonstrates the power of social engineering.
- A form of social engineering can frequently be found in the online Internet gaming community. Befriending a user with the intent of extorting account passwords and game serial numbers can give previously banned cheaters access to online play. Insecure personal password policies amongst gamers will often give the unscrupulous user access to gamer’s other types of account, e.g.: forum accounts or e-mail accounts. It is advised that gamers should secure their accounts with strong passwords and never share their serial numbers or they may face sharing the server/forum bans that the unscrupulous users earn.
source
