Kevin Mitnick is a world renowned hacker who has gained unauthorized access to many secure computer networks, including that of Pacific Bell, Chesapeake and Potomac Telephone Company, DEC, TRW, GTE, and many others. He was eventually convicted and sentenced to 12 months in prison. Upon questioning as to how he was able to successfully break into so many protected networks, he revealed that in many cases he simply called the company and asked for the password.
That's right; he simply called the company and asked for the password. This type of hacking has become know as "Social Engineering". Social engineering means tricking people into performing actions or divulging confidential information. Kevin Mitnick is now a security consultant who advises companies on how to secure their systems, including securing them from social engineering attacks.
Three common methods of fooling or manipulating people into divulging confidential information are; Pretexting, Baiting, and Phishing.
Pretexting
Pretexting is creating a false reason or false story (the pretext) for needing the confidential information. One part of it might be convincing the target that you have the authority to access the information. Pretexting might require the hacker to contact the business several times to gather non-confidential information which can be used in a later attack to establish credibility.
Common pretexting scenarios are: Claiming to be a member of the company's help desk or a service company needing the target's username and password to login to troubleshoot a computer problem; Claiming to be a member of the police, Internal Revenue Service, or other government agency needing the victim's username and password to login to gather information for an investigation.
Baiting
In a baiting attack, the hacker leaves a CD, DVD or USB flash drive, with a legitimate looking company label, in a location where it looks like it was inadvertently left. The label should have a curiosity-piquing title, like "Executive Salary Summary". An employee finds it and either turns it in to a manager who inserts it into a computer, or the employee them self inserts it into a computer. In either case, the CD, DVD or USB flash drive places a virus on the system which will give the hacker a back-door into the company's computer network.
Phishing
In phishing, the hacker sends an email that appears to come from a legitimate business indicating that, for some very important reason (sometimes even claiming the target's account has been hacked) the target must click on a link in the email to update or verify their account information. The link takes them to a web page that seems legitimate - with company logo, and a form into which they enter their credit card information.
A common phishing scenario is receiving an email sent from eBay indicating that the user's account will be suspended unless they they click on the link provided to update their credit card information. The link takes them to a web page with eBay's logo that looks legitimate. It's very easy for a hacker to get an individuals email address from a user's eBay auction information.
Preventing Social Engineering Attacks
Since social engineering attacks involve people, a company's employees must be trained to recognize and not fall victim to an attack. They should be trained that if someone calls from the company's help desk or a service company asking for a username, password, or other confidential information, the employee should call the help desk first to verify their identity.
If someone calls asking for a username, password, or other confidential information, claiming to be a member of the police, Internal Revenue Service, or other government agency, the employee should inform them that they are required to call the companies legal office or security department first before releasing any confidential information.
Most computers CD, DVD drives should be removed and "auto-run" should be disabled. Login screens should display reminder information about social engineering attacks. Any attempts at social engineering attacks should be reported. Communicate to employees that if they inadvertently give out a username / password, they should contact the IT department immediately, allowing them to secure the network by changing passwords etc.
At least once a year a company should use the services of an outside security firm to test the company's ability to resist social engineering attacks. The fact that these tests are going on should never be announced.
More Windows Administration Information:
• Turn On Your Browser's Phishing Filter
• Avoid the Indigestion of Cookies
• How to Remove Virus Without Internet Access
• Botnets - What Are They?
• Encryption, Designed to Protect Data, is Internet Criminal's Best Tool
• Five Things You Can Do To Improve Your Company's Security
• The Seven Most Common Methods of Cyber Attacks
• Disable Remote Access
• Phishing Attacks
• Firefox Security Options