"... the process of using social skills to convince people to reveal access credentials"

TR adds, usually done under stress and with the threat of an implied time limitation

"... I need this in 7 minutes before our V.P. logs in before the board meeting....he's be very appreciative of your co-operation... how do you spell your name again...."

Social
Engineering
 
 
 
 
 
 

Black Hats
Tricks

Social
Engineering

This link below explains at length the variations on social engineering techniques
http://packetstorm.decepticons.org/docs/social-engineering/soc_eng2.html

Social
Engineering
 
 
 
 
 
 

Black Hats
Tricks

Social
Engineering

 The attacks attempt to trick Internet chat users into downloading what purports to be antivirus protection, improved music downloads or  pornography but is actually malicious code, the center reported.   While use of social engineering among virus writers and hackers is nothing new, the IRC and IM tricks have allowed thousands of computers to be taken over and used in distributed denial-of-service (DDoS) attacks or infected with Trojan horse or backdoor programs, according to  CERT."

"... another trend in social engineering with IRC networks involves picking out individuals, spamming them with unsolicited messages, then offering a bogus spam solution that is actually malicious code."

an example

In the 4th week of January 2006, I received the following email from one of my UTM students in MGD415.

This company probably didn’t exist, but just used a popular name.  Such things like this are scary because you think you’re talking to the right person, but then things get a bit fishy later.  Information needs to be confidential and secured.  Isn’t this an example of information intelligence? – trying to steal peoples information!"

Yes, it is a good example, you should always be circumspect and suspicious when people ask you to clarify information they are already supposed to have on file.

an 
example
of 
obtaining
passwords

Anielyn emailed to say

In the 1st week of February 2007, I received the following email from one of my UTM students in MGD415, Anielyn B.

WTGR replies
Yes, it is an interesting example of how sometimes you can obtain things simply by asking !! I read the article and it suggests thatone of the ways you could get passwords is to ask colleagues.

The article explains
"Of the 152 office workers surveyed many explained the origin of their passwords. 
The most common password was "password" (12 per cent) and the most popular category was their own name (16 per cent) followed by their football team (11 per cent) and date of birth (8 per cent). Two thirds of workers have given their password to a colleague and three quarters knew their co-workers passwords. In addition to using their password to gain access to their company information two thirds of workers use the same password for everything, including their personal banking, website access, etc."

an 
example
of exploiting curiosity

Sean emailed to say

In the 2nd week of February 2008, I received the following email from one of my UTM students in MGD415, Sean C.

I read an article on Social Engineering and found it very interesting  because it talked about social engineering and the use of USB keys.  

The article talks about a study that was conducted inside a bank. They  wanted to exploit the banks security with a focus on social  engineering. The security company placed usb drives around the parking  lots and smoking areas for people to pick up at their leisure.

The  drives were embedded with a virus to take all of the users information  from their computer once it was plugged in. The study found that people are are always going to be curious and want  to pick up those usb drives and see what is on them. The article  proves that "All the technology and filtering and scanning in the  world won?t address human nature. But it remains the single biggest  open door to any company?s secrets". I found this article interesting and showed how social engineering is  a very powerful tool for breaking through security. 

WTGR replies
Yes, it is an interesting example of how sometimes you can trick people simply by placing something in their path and replying on human curiosity. The principle of this technique you describe is similar ot how Trojan Horse viruses get launched.

an 
example
of exploiting people's
trust of
"men in uniform"

A British documentary TV show called, "The Real Hustle" demonstrates  social engineering techniques like confidence tricks, distraction  scams performed on the general public. I remembered during the class for this topic, you mentioned about a  character in a movie easily gets through security doors by wearing the  security uniform. An episode I found from the show demonstrates how a  woman intends to go to a Manhatten bank's night deposit drop box and  ends up giving money to the two phony security guards."

As "victims" come to make deposits, the security guys tell them to put the envelope in the strong box on the pavement.

an 
example
of exploiting people's
trust of
"men in uniform"

The trick is done first (1960s) by social engineering icon, Frank  Abagnale. At an interview, he suggests that especially with today's  technology and with some companies' lack of training, it is not that  much harder to surpass security compared to 40 years ago.

He said, "Today banks don’t want to pay benefits, so they don’t hire  full time employees, they hire part time help, and there’s very little  training. So if a bank teller can’t tell me the difference between a  good bill and a bad bill, then what can they tell me in the hotel  lobby, or in the retail store? And because of lack of training and the  ability to make the document look so good, it’s very simple to do  today."

Abagnale also comments "when does it become a matter of you’re giving  away way too much information." People are giving too much information  to banks including social security number, and in the near future,  your fingerprint.

For e-commerce, Abagnale suggests that it is just another form of  payment, and it’s as dangerous as cash, credit card or over the phone  because every system is not foolproof. He used a quote from Sherlock  Holmes, ‘What one invents, one will discover.’ "