-: Social engineering attacks. 2 2
In this lesson, we're going to focus on 3 3
the different types of social engineering attacks, 4 4
including phishing, tailgating, piggy-backing, 5 5
shoulder surfing, eavesdropping and dumpster diving. 6 6
Now, before we get into the specific attacks, 7 7
let's define social engineering. 8 8
Social engineering is any attempt to manipulate users 9 9
into revealing confidential information 10 10
or performing other actions 11 11
that are detrimental to that user 12 12
or the security of our systems. 13 13
Social engineering is always focused on the human element 14 14
and trying to find a way to bypass 15 15
our systems' technical controls by simply hacking the human 16 16
instead of hacking the technology. 17 17
For example, 18 18
if I wanted to break into your wireless network, 19 19
and I found that you had implemented a long, 20 20
strong password for your WPA2 AES encrypted network, 21 21
it could take me years upon years 22 22
to brute force that password. 23 23
But if I instead figure out a way to trick you or your users 24 24
into sharing that password with me, 25 25
I might be able to access that network 26 26
by the end of the day, 27 27
that's the idea of social engineering. 28 28
In most of our networks, 29 29
the weakest link in our security is our end users 30 30
and our employees. 31 31
This is why conducting 32 32
good annual user cybersecurity training 33 33
is so important to the security of your organization. 34 34
So let's take a look at a few social engineering attacks. 35 35
The first one we have is phishing. 36 36
A phishing attack occurs when an attacker sends an email 37 37
in an attempt to get a user to click a link. 38 38
For example, if an attacker is going to send an email 39 39
claiming they're from PayPal 40 40
and they're asking you to confirm your account information, 41 41
this is a prime example of a phishing attack. 42 42
In this example, the attacker may include PayPal's logo, 43 43
the same format that PayPal uses in their emails normally, 44 44
and other things that make it appear legitimate. 45 45
But if you or your users click on that link, 46 46
it would instead take you to a PayPal login page 47 47
hosted on the attacker site, 48 48
where they're going to try to get you to login 49 49
by entering your username and your password 50 50
and now they have your account details 51 51
and can steal any money you may have in your account. 52 52
Now, how many people do you think fall for this? 53 53
Well, you'd actually be really surprised 54 54
because the answer is a lot of people. 55 55
In phishing attempts that I've done 56 56
as part of a penetration test, 57 57
I've personally seen response rates 58 58
as high as 60 or 70% of users 59 59
clicking the links inside those emails. 60 60
Even when I include things like bad grammar, poor spelling, 61 61
improper logos, and other things like that, 62 62
users still end up clicking the links 63 63
at a rate about 30 to 40%. 64 64
This means phishing works really well for an attacker, 65 65
and it's really hard for us to prevent. 66 66
Now, phishing is a bad thing 67 67
and the best thing you can do to prevent it 68 68
is really train all of your end users 69 69
and make them aware of it. 70 70
Now phishing itself takes one of three forms. 71 71
This is either known as phishing, spear phishing or whaling. 72 72
In phishing, this is the most broad type of these three. 73 73
In a phishing campaign, an attacker isn't really targeting 74 74
any particular person or group, 75 75
but instead sends out emails 76 76
that are likely to capture the most people. 77 77
For example, the PayPal phishing email I mentioned earlier 78 78
is a great form of phishing 79 79
because there's over 377 million users of PayPal. 80 80
So if I just send out that email to every email address 81 81
I had, most likely, a lot of those people 82 82
are going to have PayPal accounts 83 83
and they'll possibly click the links in my email. 84 84
Spear phishing on the other hand is more targeted. 85 85
For example, let's pretend that you are a member 86 86
of a small local bank called DT Savings and Loan. 87 87
Now, unfortunately, DT Savings and Loan 88 88
had a data breach last year. 89 89
And that resulted in all the names and emails 90 90
of all their account holders 91 91
being downloaded by that attacker. 92 92
That list is now on the dark web. 93 93
Now an enterprising young hacker 94 94
decides to craft a spear phishing email 95 95
that targets a hundred of the users on that list. 96 96
In that email they create, 97 97
they pretend to be from DT savings and loan, 98 98
and they only sent this email to people they know 99 99
have accounts at DT savings and loan. 100 100
You see the difference? 101 101
Instead of trying to send the email to a million people 102 102
and hoping some of them have a PayPal account, 103 103
instead, we are now targeting people we know 104 104
have a banking relationship with DT savings and loan. 105 105
The final type of phishing we have is known as whaling. 106 106
Whaling is like spear phishing, 107 107
but it's focused on key executives within an organization, 108 108
such as your CEO, COO, CFO, CIO, and many other key leaders, 109 109
executives, and managers within your company. 110 110
Now the second type of social engineering attack we have 111 111
is known as tailgating. 112 112
Tailgating is going to occur when an attacker 113 113
attempts to enter a secure portion 114 114
of the organization's building 115 115
by following an authorized person into that area 116 116
without their knowledge or consent. 117 117
For example, if I just went up to the server room door 118 118
and I swipe my access badge and I entered my pin, 119 119
the door would beep and unlock and I can walk in 120 120
because I'm part of the authorized personnel list. 121 121
Now, as I open the door and walk through, 122 122
but before the door shuts behind me, 123 123
somebody could sneak in and get in there 124 124
without my knowledge, that would be tailgating. 125 125
For this reason, you should always train your employees 126 126
to pull the door shut behind them 127 127
and not simply walk away in hopes the force of gravity 128 128
is going to shut the door for them. 129 129
Now, the other side of this is known as piggybacking. 130 130
This is something that is similar to tailgating, 131 131
but it occurs with the employee's knowledge or consent. 132 132
Now, piggybacking might occur when an attacker 133 133
walks up to a secure area carrying a bunch of boxes 134 134
and they ask somebody to nicely open the door for them 135 135
because their hands are full. 136 136
If the employee trying to be nice, 137 137
opens the door and lets the attacker walk into the building, 138 138
this is known as piggy-backing 139 139
because two people are entering on one swipe 140 140
of the employee's access card. 141 141
The next social engineering attack we have to talk about 142 142
is known as shoulder surfing. 143 143
Now, shoulder surfing occurs 144 144
when an attacker comes up behind an employee 145 145
and tries to use direct observation 146 146
to obtain authentication information. 147 147
For example, you're sitting at your desk 148 148
and you're logging into your computer in the morning. 149 149
If I were to walk up near you and look over your shoulder, 150 150
as you typed in your password, 151 151
I might see your finger start going 152 152
P-A-S-S-W-O-R-D, password. 153 153
Now I know what your password is. 154 154
Now, this is the idea of shoulder surfing 155 155
because I've looked at your hands as you were doing it. 156 156
Now, usually it won't be as obvious 157 157
as me standing right behind you 158 158
and looking over your shoulder, 159 159
but it can take a lot of different forms. 160 160
Maybe I work at the desk next to yours 161 161
and I glance over your computer screen 162 162
and I see your bank balance or your credit card number 163 163
or something like that. 164 164
Any kind of information that someone's able to see 165 165
that they're not really authorized to see, 166 166
could be gained using shoulder surfing. 167 167
In the same way I can use eyes to conduct shoulder surfing, 168 168
I can also use my ears to conduct eavesdropping. 169 169
Now, maybe I'm going to stand around 170 170
while you're talking with your boss 171 171
and I overhear you telling him some information 172 172
about the projections for next quarter's profits. 173 173
By listening to your conversation 174 174
and doing that direct observation with my ears, 175 175
I'm now able to listen in on that conversation 176 176
and get the information that I might want to get. 177 177
The final method of social engineering we have 178 178
is known as dumpster diving. 179 179
Now, dumpster diving occurs when an attacker 180 180
actually scavenges for personal or confidential information 181 181
inside the garbage or recycling containers. 182 182
Yes, I know it sounds dirty, but guess what? 183 183
This works really well and so hackers are willing to do it 184 184
because they will find some really great information 185 185
inside those dumpsters. 186 186
If the attacker needs to break into an organization, 187 187
they're first going to look through your trash for clues. 188 188
For example, maybe I can perform dumpster diving 189 189
against an organization before I do a pen test. 190 190
And from there I can find a phone list. 191 191
Now, I have people's names and their positions 192 192
and their phone numbers, and maybe even their emails. 193 193
All of this is great information for me to use. 194 194
So how do you prevent an attacker from gaining access 195 195
to your information using dumpster diving? 196 196
Well, you either need to shred your paperwork 197 197
prior to throwing it away using a cross-cut shredder, 198 198
or you need to use a lock trashcan 199 199
that only your organization 200 200
and the waste management company have access to.