2KKUU7ita

70
Part II: Putting Ethical Hacking in Motion
exist, recovery and protection are difficult after the attack. Furthermore, the
hard, crunchy outside of firewalls and intrusion prevention systems often creates
a false sense of security, making the problem even worse.
With social engineering, you never know the next method of attack. The best
things you can do are to remain vigilant, understand the social engineer’s
methodology, and protect against the most common attacks through ongoing
security awareness in your organization. I discuss how you can do this in the
rest of this chapter.
Performing Social Engineering Attacks
The process of social engineering is actually pretty basic. Generally, social
engineers discover the details of organizational processes and information
systems to perform their attacks. With this information, they know what to
pursue. Hackers typically perform social engineering attacks in four simple
steps:
1. Perform research.
2. Build trust.
3. Exploit relationships for information through words, actions, or technology.
4. Use the information gathered for malicious purposes.
These steps can include numerous substeps and techniques, depending on
the attack being performed.
Before social engineers perform their attacks, they need a goal. This is the
first step in these attackers’ processes for social engineering, and this goal is
most likely already implanted in their minds. What do they want to accomplish?
What are the social engineers trying to hack? Why? Do they want
intellectual property, server passwords, or access to control badges, or do
they simply want to prove that the company’s defenses can be penetrated?
In your efforts as an ethical hacker performing social engineering, determine
this overall goal before you move forward.
Seeking information
After social engineers have a goal in mind, they typically start the attack by
gathering public information about their victim(s). Many social engineers
acquire information slowly over time so they don’t raise suspicion. Obvious
information gathering is a tip-off when defending against social engineering. I
mention other warning signs to be aware of throughout the rest of this chapter.