Social Engineering….
This article is about the introduction of social engineering.
Mostly we are not familiar with the term Social Engineering. Hope this article will give u some basic ideas about SE’ing .
Social Engineering is a process, a tactic or a strategy to gain access to private information or to public events. One needs to be skilled when he does social engineering. It is a practice which one interrupts other personal activity on the web. Usually it involves tricking other people to break normal security procedures. One does social engineering to obtain confidential information by manipulating users. It has something to do with the computer security. It’s a kind of invasion that involves tricking other people to break normal security procedures.
Social Engineering definitions:
“Social Engineering is the online criminals can use sophisticated technology to try to gain access to your company, or they can use something simpler and more insidious.”
Wiki:” Social engineering, in the context of security, is understood to mean the art of manipulating people into performing actions or divulging confidential information.”
Many consider social Engineering to be the greatest risk to Security.
Many people are afraid of it, or they feel they will never be able to accomplish a successful social engineering test.
However, every time u try to get someone to do something i.e. in your interest, you are engaging in social engineering.
Eg: From Children trying to get a toy from their parents to adults trying to land a job or score the big promotion all are form of Social Engineering.
Social Engineering is both incredibly complex and amazingly simple. It includes positive form of communication such as parents, therapists, children, spouse and others.
Hackers utilize Social Engineering many times because human weakness factor is so much easier to penetrate than the network weakness.
Hackers win mostly in battle because they are not limited by time or lack of motivation.
A True Story
“ One morning a few years back, a group of strangers walked into a large shipping firm and walked out with access to the firm’s entire corporate network. How did they do it? By obtaining small amounts of access, bit by bit, from a number of different employees in that firm. First, they did research about the company for two days before even attempting to set foot on the premises. For example, they learned key employees’ names by calling HR. Next, they pretended to lose their key to the front door, and a man let them in. Then they “lost” their identity badges when entering the third floor secured area, smiled, and a friendly employee opened the door for them.
The strangers knew the CFO was out of town, so they were able to enter his office and obtain financial data off his unlocked computer. They dug through the corporate trash, finding all kinds of useful documents. They asked a janitor for a garbage pail in which to place their contents and carried all of this data out of the building in their hands. The strangers had studied the CFO’s voice, so they were able to phone, pretending to be the CFO, in a rush, desperately in need of his network password. From there, they used regular technical hacking tools to gain super-user access into the system.
In this case, the strangers were network consultants performing a security audit for the CFO without any other employees’ knowledge. They were never given any privileged information from the CFO but were able to obtain all the access they wanted through social engineering. (This story was recounted by Kapil Raina, currently a security expert at Verisign and co-author of mCommerce Security: A Beginner’s Guide, based on an actual workplace experience with a previous employer.)
While reading about SE’ing i came across these sites.
http://www.slideshare.net/NoIdeasOriginal/sqa-websec
http://www.social-engineer.org/
google dork
http://www.hackersforcharity.org/ghdb/
http://www.exploit-db.com/google-dorks/
http://tipstrickshack.blogspot.in/2012/11/some-cool-google-dork.html
http://www.slideshare.net/kinish_kumar/google-dorks
http://www.slideshare.net/hacklessons/introductiontogooglehacking-part1-15737456
may be same
http://www.slideshare.net/martin345t/ki-4656146
http://www.slideshare.net/OcimNationalism/google-hacking-basic
http://www.slideshare.net/amiable_indian/google-hacking-basics
http://www.slideshare.net/zeroscience/information-gathering-with-google
http://itknowledgeexchange.techtarget.com/business-technology/
http://www.webopedia.com/TERM/S/social_engineering.html
http://www.schneier.com/blog/archives/2011/05/aggressive_soci.html
http://www.schneier.com/blog/archives/2008/07/social_engineer_5.html
https://www.us-cert.gov/cas/tips/ST04-014.html
http://www.networkworld.com/newsletters/sec/2010/100410sec1.html
http://itknowledgeexchange.techtarget.com/IT-watch-blog/social-networking-and-the-blended-environment-what-is-being-done-in-the-name-of-your-domain/
http://books.google.co.in/books/about/I_T_Wars.html?id=Mu9T-kd56rwC
http://www.darkreading.com/security/news/225702468
http://www.computerworld.com/s/article/9183498/Women_did_well_on_Defcon_social_engineering_test
http://csrc.nist.gov/groups/SMA/fasp/documents/incident_response/SSAIRBSP/SSAIRBSPD4.htm
http://www.microsoft.com/security/resources/socialengineering-whatis.aspx
http://www.reddit.com/r/SocialEngineering
http://www.symantec.com/connect/articles/social-engineering-fundamentals-part-i-hacker-tactics
http://www.symantec.com/connect/articles/social-engineering-fundamentals-part-ii-combat-strategies
http://www.computerworld.com/s/article/9236871/Facebook_targeted_by_hackers_says_no_user_data_compromised
http://www.computerworld.com/s/article/9028960/Study_IRS_security_vulnerable_to_social_engineering
Click to access emailscams_0905.pdf
http://www.csoonline.com/article/514063/social-engineering-the-basics
http://www.pcworld.com/article/182180/top_5_social_engineering_exploit_techniques.html
Anti-Phishing Working Group Phishing Archive
http://www.antiphishing.org/phishing_archive/phishing_archive.html
FTC Consumer Alert: 12 Scams Most Likely To Arrive Via Bulk Email
http://www.ftc.gov/opa/1998/07/dozen.shtm
FTC Consumer Alert: How Not to Get Hooked by a ‘Phishing’ Scam
http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm
Recognize and avoid fraudulent email to Microsoft customers
http://www.microsoft.com/protect/yourself/phishing/msemail.mspx
United States Secret Service Advance Fee Fraud Advisory
http://www.secretservice.gov/faq.shtml#faq13
US-CERT Cyber Security Tip ST04-007: Reducing Spam
http://www.us-cert.gov/cas/tips/ST04-007.html
US-CERT Cyber Security Tip ST04-010: Using Caution with Email Attachments
http://www.us-cert.gov/cas/tips/ST04-010.html
US-CERT Technical Cyber Security Alert TA05-189A: Targeted Trojan Email Attacks
http://www.us-cert.gov/cas/techalerts/TA05-189A.html
videos
kevin mitnick
http://www.youtube.com/channel/HCOC7poFekB34
http://www.slideshare.net/maxisoler/information-gathering-with-google-c0c0n-india
http://tipstrickshack.blogspot.in/2012/11/some-cool-google-dork.html
http://tipstrickshack.blogspot.in/2013/02/how-to-get-windows-passwords-in-plain.html
One of the most discussions about SE’ing is“Is Social Engineering legal?”Will have some basic details about this in the next blog.
fixnix 