2KKUU7ita

68
Part II: Putting Ethical Hacking in Motion
You can use the information in this chapter to perform specific tests or improve
information security awareness in your organization. Social engineering can
harm people’s jobs and reputations, and confidential information could be
leaked. Proceed with caution, and think before you act.
You can perform social engineering attacks in millions of ways. From walking
through the front door purporting to be someone you’re not to launching an
all-out phishing campaign using a tool such as the Simple Phishing Toolkit
(www.sptoolkit.com), the world is your oyster. For this reason, and
because training specific behaviors in a single chapter is next to impossible, I
don’t provide how-to instructions for carrying out social engineering attacks.
Instead, I describe specific social engineering scenarios that have worked for
other hackers — both ethical and unethical. You can tailor these same tricks
and techniques to your specific situation.
An outsider to the organization might perform these social engineering techniques
best. If you perform these tests against your organization, acting as
an outsider might be difficult if everyone knows you. This risk of recognition
might not be a problem in larger organizations, but if you have a small, closeknit
company, people might catch on to your antics.
You can outsource social engineering testing to a trusted consulting firm or
even have a trusted colleague perform the tests for you. The key word here
is trusted. If you involve someone else, you must get references, perform
background checks, and have the testing approved by management in writing
beforehand. I cover the topic of outsourcing security and ethical hacking in
Chapter 18.
Why Attackers Use Social Engineering
Many bad guys use social engineering to break into systems because it’s often
the simplest way for them to get what they’re looking for. They want someone
to open the door to the organization so that they don’t have to break in and
risk being caught. Security technologies such as firewalls, access controls, and
authentication devices won’t stop a determined social engineer.
Most social engineers perform their attacks slowly to avoid suspicion. Social
engineers gather bits of information over time and use the information to create
a broader picture of the organization they’re trying to manipulate. Alternatively,
some social engineering attacks can be performed with a quick phone call or
e-mail. The methods used depend on the attacker’s style and abilities.
Social engineers know that many organizations don’t have formal data classification
programs, access control systems, incident response plans, or security
awareness programs, and they take advantage of these weaknesses.