Social Engineering and Identity Theft Flashcards

Social Engineering Statistics and Scope

• Email Volume and Security Risks

  • Total annual email volume: $107 \text{ Trillion}$.

  • Daily email volume: $294 \text{ Billion}$.

  • Approximately $90\%$ of all email is classified as either spam or contains a virus.

• Phishing Statistics

  • Phishing represents $77\%$ of all socially based attacks.

  • $88\%$ of individuals reported clicking links within phishing emails.

  • Primary targets: Most common phishing attacks mimic financial institutions.

  • In 2013, there were $13.3 \text{ Million}$ user-reported phishing attacks.

• Vishing (Voice Phishing)

  • In 2012, $2.4 \text{ Million}$ customers were targeted for phone fraud.

  • In the first half of 2013, $2.3 \text{ Million}$ customers were targeted for phone fraud.

  • Financial Impact: The average loss for a targeted business is $\$42,546$ per account.

• Smishing (SMS Phishing)

  • In 2012, $60\%$ of U.S. adults who send and receive text messages received mobile spam.

  • Requests made by Smishers:

    • $60\%$ ask the victim to click on a link.

    • $26\%$ ask the victim to call a specific number.

    • $14\%$ ask the victim to reply to the text.

• Impersonation Data

  • Medical Theft: In 2013 alone, there were $1.8 \text{ Million}$ victims of medical theft caused by websites impersonating medical providers.

  • Data Vulnerability: $88\%$ of reported stolen assets were personal data.

  • Victim Demographics: Average age of an impersonation victim is $41.7 \text{ years old}$.

  • Financial Loss: The average loss per victim is $\$4,187$.

  • Common Theft Location: The top place for a thief to operate is the work area.

Social Engineering (SE) Concepts and Behavioral Basis

• Definition: Social Engineering is the art of convincing people to reveal confidential information.

• Primary Targets:

  • Help desk personnel.

  • Technical support executives.

  • System administrators.

• The Human Element

  • Social engineers rely on the fact that people are often unaware of the value of the information they possess and are careless about protecting it.

  • Behaviors Vulnerable to Attack:

    • Trust: The basic human nature of trust serves as the foundation for any SE attack.

    • Ignorance: A lack of knowledge about SE techniques and their potential effects among a workforce.

    • Fear: Victims may comply with requests out of fear of severe losses or repercussions for non-compliance.

    • Greed: Attackers lure targets by promising "something for nothing."

    • Moral Obligation: Targets are often asked for help and comply out of a desire to be helpful or a sense of duty.

Organizational Vulnerabilities and Attack Phases

• Factors Making Companies Vulnerable:

  • Insufficient security training for staff.

  • Unregulated or unrestricted access to information.

  • Complexity arising from having several distinct organizational units.

  • A lack of formal security policies.

• Efficacy of Social Engineering:

  • Security policies are only as strong as their weakest link; humans are the most susceptible link in the chain.

  • SE attempts are notoriously difficult to detect.

  • There is no single method to ensure complete security from such attacks.

  • No specific software or hardware exists that can fully defend against social engineering.

• Phases in a Social Engineering Attack:

  1. Research on Target Company: Utilizing methods like dumpster diving, searching websites, and observing employees.

  2. Select Victim: Identifying vulnerable individuals, such as frustrated or disgruntled employees.

  3. Develop Relationship: Establishing a rapport with the selected employees.

  4. Exploit the Relationship: Collecting sensitive account details, financial information, and data regarding current technologies used by the firm.

Human-Based Social Engineering Techniques

• Impersonation: The most common human-based technique. Attackers pretend to be legitimate or authorized individuals (e.g., technicians, executives). This can occur in person or via phone/email.

• Eavesdropping: Unauthorized listening to conversations or reading of messages. This involves intercepting communication across telephone lines, email, or instant messaging.

• Shoulder Surfing: Using direct observation to steal passwords, PINs, or card numbers. It can be done from a distance using vision-enhancing devices like binoculars.

• Dumpster Diving: Searching through a target's trash for sensitive documents or information.

• Reverse Social Engineering: An attacker sets themselves up as an authority. The victim, believing the attacker can help, seeks them out and voluntarily provides the requested information. This usually involves three steps:

  1. Sabotage.

  2. Marketing.

  3. Tech Support.

• Piggybacking: An authorized person intentionally or unintentionally allows an unauthorized person to pass through a secure door (e.g., "I forgot my ID badge.").

• Tailgating: An unauthorized person (often wearing a fake ID) enters a secured area by closely following an authorized person through a key-access door.

Computer-Based and Mobile-Based Techniques

• Computer-Based SE:

  • Pop-up Windows: Windows that appear during web surfing asking for login or sign-in credentials.

  • Hoax Letters: Emails warning users about non-existent viruses or worms to induce panic/action.

  • Chain Letters: Emails offering gifts or money on the condition that the mail is forwarded to others.

  • Instant Chat Messenger: Chatting with users to extract personal details like birth dates or maiden names.

  • Spam Email: Unsolicited mail used to collect SSNs, financial data, and network information.

  • Phishing: Illegitimate emails mimicking trustworthy sites to acquire account information.

  • Spear Phishing: A targeted version of phishing aimed at specific individuals or small groups within an organization. It results in a much higher response rate than generic phishing.

• Mobile-Based SE:

  • Malicious Apps: Attackers publish apps with attractive features and names similar to popular apps on major stores to infect devices and steal credentials.

  • Fake Security Applications (Workflow):

    1. Attacker infects the victim's PC.

    2. Victim logs into a bank account on the PC.

    3. Malware on the PC triggers a pop-up telling the victim to download a security app on their phone.

    4. Victim downloads the malicious mobile app.

    5. Attacker intercepts the second authentication factor (SMS) sent by the bank to the phone.

  • SMS Fraud Case Study: A victim (Tracy) receives a "urgent" SMS from a bank's security department. She calls the number provided, which is a recording that asks for her credit or debit card numbers, leading her to reveal sensitive data.

Insider Threats and Organizational Defense

• Insider Attacks:

  • They are easy to launch and difficult to prevent because the attacker already has legitimate access.

  • Motivations:

    • Spying: Competitors plant moles via job openings to steal secrets or damage the business.

    • Revenge: A single disgruntled person can compromise an entire company.

  • Prevention Strategies:

    • Separation and rotation of duties.

    • Principle of Least Privilege.

    • Controlled access and strict logging/auditing.

    • Formal legal policies.

    • Archiving all critical data.

• Targets and Specific Defense Strategies:

  • Front Office/Help Desk: Threatened by eavesdropping/impersonation; defend by training staff NEVER to reveal passwords over the phone.

  • Perimeter Security: Threatened by fake IDs/piggybacking; defend with strict badge, token, or biometric authentication.

  • Office Area: Threatened by shoulder surfing/ingratiation; defend with best practices, checklists, and escorting all guests.

  • Mail Room: Threatened by theft/forging; defend by locking and monitoring the room.

  • Machine Room/Phone Closet: Threatened by equipment removal or protocol analyzers; defend by keeping rooms locked at all times and maintaining updated equipment inventories.

Social Networking Risks and Identity Theft

• Social Networking Site (SNS) Risks:

  • Impersonation: Attackers create accounts in others' names to extract information from friends and colleagues.

  • Involuntary Data Leakage: Employees posting sensitive corporate data due to a lack of strong policy.

  • Data Theft: SNS act as repositories of information vulnerable to exploitation.

  • Network Vulnerability: Flaws/bugs in SNS platforms can expose the corporate network.

• Identity Theft:

  • Defined as the theft of personally identifiable information (Name, SSN, Credit Card Number, Driver's License) for fraudulent purposes.

  • Attackers may use stolen identities to physically access facilities or impersonate employees.

Social Engineering Countermeasures

• Policy and Procedure:

  • Policies are only effective if taught and reinforced. Employees should sign acknowledgments of their understanding.

  • Password Policies: Include periodic changes, complexity requirements, account blocking after failures, and strict secrecy.

  • Physical Security Policies: ID cards, uniforms, visitor escorts, restricted access areas, and proper document shredding.

• Training and Operations:

  • Training: Comprehensive programs to increase awareness of SE techniques.

  • Access Privileges: Clearly defined Guest, User, and Administrator accounts with appropriate authorizations.

  • Information Classification: Categorize data (e.g., Top Secret, Proprietary, Internal Use, Public).

  • Background Checks: Perform checks on new hires and implement proper termination processes for exiting employees.

  • Technical Defenses: Use multi-layer Anti-Virus/Anti-Phishing at end-user and gateway levels. Use Two-Factor Authentication (2FA) for high-risk services like VPNs.

• Detecting Phishing Emails (Red Flags):

  • Generic greetings.

  • Appears to be from a known contact or reputable company.

  • Creates a sense of urgency or threats.

  • Grammatical or spelling errors.

  • Contains spoofed links or malicious attachments.

  • Offers that seem "too good to be true."

• Anti-Phishing Toolbars:

  • Netcraft: Provides risk ratings and site reports.

  • PhishTank: A collaborative clearinghouse for phishing data with an open API for developers.

• Social Engineering Toolkit (SET):

  • An open-source, Python-driven tool designed for penetration testing specifically around social engineering vectors.