Social Engineering :

                         ***Social Engineering***

Social engineering is a nontechnical method of breaking into a system or network. It’s the

process of deceiving users of a system and convincing them to perform acts useful to the

hacker, such as giving out information that can be used to defeat or bypass security mechanisms.

Social engineering is important to understand because hackers can use it to attack the human element of a system and circumvent technical security measures. This method can be used to gather information before or during an attack. A social engineer commonly uses the telephone or Internet to trick people into revealing sensitive information or to get them to do something that is against the security policies of the organization. By this method, social engineers exploit the natural tendency of a person to trust their word, rather than exploiting computer security holes. It’s generally agreed that users are the weak link in security; this principle is what makes social engineering possible.

Types of Social Engineering-Attacks:

Social engineering can be broken into two common types:

Human-Based :- Human-based social engineering refers to person-to-person interaction to

retrieve the desired information. An example is calling the help desk and trying to find out

a password.

Computer-Based :- Computer-based social engineering refers to having computer software

that attempts to retrieve the desired information. An example is sending a user an email

and asking them to reenter a password in a web page to confirm it. This social-engineering

attack is also known as phishing.

Human-Based Social Engineering:

            Human-based social engineering techniques can be divided into following types:

1. Impersonating an Employee or Valid User:- In this type of attack, the hacker pretends to be an employee or valid user on the system. A hacker can gain physical access by pretending to be a  employee, or security in charge to gain physical access of computer system.

                           

                              2. Posing as an Important User:-  In this type of attack, the hacker pretends to be an important user such as an executive or high-level manager who needs immediate assistance to  gain access to a computer system or files. The hacker uses intimidation so that a lower-level employee such as a help desk worker will assist them in gaining access to the system. Most low-level employees won’t question someone who appears to be in a position of authority.

                            3.Using a Third Person:- Using the third-person approach, a hacker pretends to have permission from an authorized source to use a system.

                            4. Calling Technical Support:- Calling tech support for assistance is a classic social-engineering technique. Help desk and technical support personnel are trained to help users, which makes them good prey for social-engineering attacks.

                     5. Shoulder Surfing:- Shoulder surfing is a technique of gathering passwords by watching over a person’s shoulder while they log in to the system. A hacker can watch a valid user log in and then use that password to gain access to the system.

6. Dumpster Diving:- In this type of social engineering hacker can often find passwords, file names,or other pieces of confidential information by searching in the trash, for information written

on pieces of paper or printouts.

Computer-Based Social Engineering

Computer-based social-engineering attacks can include the following types :

            1.Email attachments

            2.Fake websites

            3. Pop-up windows

Insider Attacks: If a hacker can’t find any other way to hack an organization, the next best option is to infiltrate the organization by getting hired as an employee or finding a disgruntled employee to assist in the attack. Insider attacks can be powerful because employees have physical access and are able to move freely about the organization.

Identity Theft

A hacker can pose as an employee or steal the employee’s identity to for an attack.

Information gathered in dumpster diving or shoulder surfing in combination with creating

fake ID badges can gain the hacker entry into an organization. Creating a persona that can

enter the building unchallenged is the goal of identity theft.

Phishing Attacks

Phishing involves sending an email, usually posing as a bank, credit card company, or other

financial organization. The email requests that the recipient confirm banking information

or reset passwords or PINs. The user clicks the link in the email and is redirected to a fake

website. The hacker is then able to capture this information and use it for financial gain or

to perpetrate other attacks.

for e.g.- Emails that claim the senders have a great amount of money but need your help getting it out of the country are examples of phishing attacks.

Online Scams:- Some websites that make free offers or other special deals can lure a victim to enter a username and password that may be the same as those they use to access their work system.

The hacker can use this valid username and password once the user enters the information

in the website form.

Mail attachments can be used to send malicious code to a victim’s system, which could

automatically execute something like a software keyloggers to capture passwords.