Operating as a social engineer June 2, 2013
Hacking experts – who usually focus on technical intrusions
by black hat hackers – call what she apparently did “Social Engineering” –
different from the political stuff we see churned out in colleges as education.
“Social Engineering takes advantage of what’s likely the
weakest link in any organization’s information security defenses: people,” one
expert concluded recently. “Social Engineering is people hacking; it is
maliciously exploiting the trusting nature of human beings to obtain information
that can be used for persona and often political gain.”
Social engineering, this expert says, is one of the toughest
hacks to pull off.
“It takes bravado and skill to come across as trustworthy to
a stranger,” the expert wrote. “By far, it is the toughest things to protect
against because, again, people are involved and they’re often making their own
security decisions.”
In social engineering, those with ill intent pose as someone
else to gain information or position in a company that they cannot gain
otherwise. Sometimes social engineers act like confident, knowledgeable managers
or executives; at other times, they play the roles of extremely uninformed or naïve
employees – such as being a cub reporter.
“Social engineers are great at adapting to their audience,”
this expert wrote. “It takes a special type of personality to pull this trick
off, often resembling that of a sociopath.”
Many social engineers perform their attacks slowly to avoid
suspicion, although many begin their operation against a person through emails,
phone calls or texts.
“The methods used depend on the attacker’s stye and
abilities,” the writer said. “Either way, you’re at a disadvantage.”
Social engineers often know a little about a lot of things,
often using social media to gather information about their target. Social
engineers’ knowledge and determination give them the upper hand over management
and employees, who don’t realize they are under attack and trust their
attackers.
They often operate in an environment where a company has multiple
locations, taking advantage of distance between employees.
The target can be anybody in an organization from receptionist
to security guards to executives – trickling up.
People who operate the phones and interact with the public
are often vulnerable targets since they like to be helpful and share
information.
“Because the objective of social engineering is to coerce
someone to provide information that leads to ill-gotten gains, anything is
possible,” this writer points out.
Social engineering attacks are difficult to detect or
protect against. Often, they aren’t well documented. And social engineers are
limited only by their imaginations. Many such attacks don’t become obvious
until after they have concluded.
“With social engineering, you never know the next method of
attack,” the writer says.
Trust is the essence of social engineering.
“Most people trust others until a situation forces them not
to,” this writer says. “People want to help one another, especially if trust
can be built and the request seems reasonable.”
Most people want to be team players.
“This trust allows social engineers accomplish their goals,”
the writer says. “Building deep trust often takes time, but crafter social
engineers can gain it within minutes or hours.”
The friendlier social engineers are – without going
overboard – the better their chances of getting what they want.
“Social engineers often begin to build a relationship by
establishing common interests,” he says.
They often use information they get to determine what the
victim likes and then the social engineer pretends to like those things, too.
“They can phone victims or meet them in person and based on
information the social engineers have discovered about the person, start talking
about local sports teams or how wonderful it is to be single again. A few low
key and well-articulated comments can be the start of a nice new relationship.”
The whole hack depends upon believability, which is based in
part of the knowledge social engineers have and how likeable they are.”
They often come into an organization as new employees.
“Often they modestly claim authority to influence people,”
the writer said. “The most common social engineering trick is to do something
nice so that the victim feels obligated to be nice in return or to be a team
player for the organization.”
After the social engineers obtain trust of their
unsuspecting victims, they coax the victim into providing them with what they
wanted in the first place.
“Social engineers do this through face-to-face or electronic
communication that victims feel comfortable with, or they use other technology,”
the writer says.
Careless or overly anxious social engineers, however,
sometimes give themselves away. They act overly friendly or eager. They brag
about their growing authority, act nervous when questioned, appear rushed,
using insider slang they haven’t achieved yet, asking strange questions, and
other things.
“A good social engineer isn’t obvious,” this writer says. “Social
engineers often do a favor for someone and then turn around and ask that person
whether they mind helping them. This common social engineering trick works
pretty well.”
Social engineers also engage in reverse social engineering.
They offer to help if a specific problem arises (sometimes something they
themselves orchestrated) and helps fix the problem.
“They may come across as heroes, which can further their
cause,” he writes. “Social engineers may ask an unsuspecting employee for a
favor. Yes – they outright ask for a favor. Many people fall for this trap.”
Technology makes things easier for the social engineer.
“The process of social engineering is pretty basic,” this expert
says. “Generally, social engineers discover details about people, organization
processes and information systems to perform their attacks. With this information
they know what to pursue.”
There are four basic steps to social engineering: doing
research on the target person, building trust with that person, exploiting the
relationship through words, actions or technology, then use this information or
status for personal gain.
“When social engineers have a goal in mind, they typically
start the attack by gathering public information about their victim,” he
writes. “Many social engineers acquire information slowly over time so that
they don’t raise suspicion. However, obvious information gathering it the tip
off.”
Sometimes, social engineers gather information about their
victim by listening in on conversations or asking others about their victim.
They sometimes listen into their victim’s voice mail when their victim I out of
the office.
“Never underestimate the power of social engineers and the gullibility
of your uses in helping them get their way,” he writes.
Now, a whole year or more later, it becomes obvious that she
operated as a social engineer in our office.
The question remains, did she do it on her own behalf (trickling
up) or was she operating on behalf of RR or some of the other political people
who wanted to control the content of our editorial?
This leads to the next question. Does she still have
influence over us in our office? And if so, will she and A, use that influence in
the upcoming election.
Comments
Post a Comment