Social engineering attacks have been around since well since before the Internet.
Now in this episode what I want to do is go through a lot of social engineering attacks and if you get
on the Internet you've probably seen a number of these personally.
Now for personal organization I like to separate them into two types.
First what I call physical attacks which basically means to real people being either face to face or
very close to being face to face.
And then we have another group which I call virtual attacks which is usually e-mails Web sites stuff
like that so this is my own personal separation.
Don't look for this on the exam.
Now to show you physical attacks.
We actually shot a wonderful video a couple of years back that covers it absolutely perfectly.
And they had a lot of fun too.
So these are all the guys at total seminars including my buddy Scott Jernigan.
So they shot this wonderful video on what I'm going to call physical attacks.
Hello.
This is to attack the white speaking.
I Dwight.
This is Jim from the IQ department doing a company wide password reset.
So we need to get everyone's old password in order to reset them.
You'll get a password reset notification when you log in tomorrow.
Sure thing Jim my old password is Baer's beats Battlestar Galactica.
That's all lowercase with no spaces.
Thanks so much Dwight.
We'll get that change right away.
There's
beats a man tells his password to his company's I.T. department.
Seems harmless enough.
They say that a trusting nature is a virtue but they also say that a sucker born every minute.
We'd all like to think that male hackers typing way in dank basements pose the greatest threat to our
networks.
It's an evil we can understand a threat that feels contained but we live in a world where evil doers
prey on our virtues turning them against us telephone scams like the one you just witnessed or phishing
attacks using e-mail pervert.
Our willingness to be agreeable and trusting malicious elements pretend to be trusted authorities in
the hopes that users will willingly hand over precious passwords and users do.
It turns out that we are the greatest threat to our networks.
It's just the sort of twist you'd expect in the social engineering.
So
no one likes to be cooped up indoors all day but the unwary may fall victim to the predictions of devious
tailgaters these malicious malcontents follow legitimate employees through locked doors pretending that
they belong to thwart them.
Make sure no one's following you through a locked door.
If someone tries make them show you some form of ID or even produce a key for the door you're going
through.
You might feel comfortable leaving your office computer unattended and unlocked.
After all your coworkers are trustworthy aren't they.
However on gaining access to a secure building all a tailgater has to do is wait for someone to take
a bathroom break to gain complete access to an otherwise impenetrable network.
Consider it vital to lock your computer when you walk away from it.
Even if it's just for a short time.
Also make sure your user account is password protected.
If you think that locking your computer is a sure protection against wrongdoers think again why wait
for you to get up for a break when it's just as easy to stand behind you and watch over your shoulder.
They'll watch you as you type passwords access secure documents and communicate with other employees.
Always make sure there's not a stranger's shoulder surfing behind you.
If the prospect of looking over your shoulder all day sounds Honoris invest in a screen filter which
makes it impossible to see what's on your screen unless you're right in front of it.
Even the most tightly controlled offices often have an Achilles heel.
Dumpster diving criminals are as shameless and stinky lot.
Not at all above digging through trash to find sensitive information.
Companies have toppled individuals have had identity stolen all by being careless with their refuse.
Make sure to shred any trash that you don't want prying eyes to see.
After all one man's trash is another man's treasure.
We often find it comforting to ignore the dangers that surround us on all sides.
The world we live in however will brook no such fictions.
The unaware and the naive become victims of widely ruthless criminals who forever stalk the social engineering
zone
those guys had a lot of fun shooting that.
And did you notice I in a part of it too.
Anyway the other thing I want to talk about now is what I organize into virtual attack so virtual attacks
generally mean that we're having some type of Internet media e-mail Web sites or something like that
that come into play.
So let's go ahead and march through the different types of what I call virtual social engineering attacks
that you're going to see on the exam.
First is fishing fishing and our e-mails that are used to steal personal information.
Are incredibly common.
So let's take a look at this example.
First of all notice that it's not addressed to me it's more generally addressed.
Secondly it straight up asked for a username and password for me to type in right there.
All legitimate sources now know that we never directly asked for usernames and passwords.
Next is spearfishing in spearfishing.
What we're talking about is phishing that is directed towards a specific person or organization.
Here's an example that I recently got in my own personal e-mail.
Whaling is spearfishing specifically directed towards senior management and executives.
A good Spearfish works hard to look like something important.
These folks like a subpoena or maybe a critical memorandum.
This thing uses the telephone system to steal private information.
We've probably all got one of these types of calls they often use automated systems.
Have you ever got a phone call that sounds something like this.
No we have an important message for you from the IRS your tax return has been audited and below two
thousand three hundred seventeen dollars and seventy four cents in back taxes.
You need to make a payments immediately.
Banks will receive a notice of levy on your account please and to the last four digits of your social
security number to pay the full amount.
Speak with an IRS agent.
Next is a hoax a hoax attack warns that something bad is happening that really is it most commonly virus
warnings.
Here's an example of a very common web based hoax.
A bet you've seen this one before.
A watering hole attack looks for places usually Web sites that a group of specific people frequent.
It exploits the Web site or tries to redirect them to another server to infect the visiting systems
computers.
From there they can do just about anything they want.
Make sure you're comfortable with the definition of each one of these social engineering attacks.
The exam goes into great detail challenging you to make sure you can recognize them.