2KKUU7ita

72
Part II: Putting Ethical Hacking in Motion
Shredding documents is effective only if the paper is cross-shredded into tiny
pieces of confetti. Inexpensive shredders that shred documents only in long
strips are basically worthless against a determined social engineer. With a
little time and tape, a social engineer can piece a document back together if
that’s what he’s determined to do.
Hackers often gather confidential personal and business information from
others by listening in on conversations held in restaurants, coffee shops, and
airports. People who speak loudly when talking on their cellphones are also a
great source of sensitive information for social engineers. (Poetic justice, perhaps?)
While I’m out and about in public places, I hear others divulge amazing
information even if I’m not actively trying to listen.
The bad guys also look in the trash for CD-ROMs and DVDs, old computer
cases (especially those with hard drives still intact), and backup tapes.
See Chapter 6 for more on trash and other physical security issues, including
countermeasures for protecting against dumpster divers.
Phone systems
Attackers can obtain information by using the dial-by-name feature built in to
most voicemail systems. To access this feature, you usually just press 0 after
calling the company’s main number or after you enter someone’s voice mailbox.
This trick works best after hours to ensure no one answers.
Attackers can protect their identities if they can hide where they call from.
Here are some ways they can hide their locations:
✓ Residential phones sometimes can hide their numbers from caller ID by
dialing *67 before the phone number.
This feature isn’t effective when calling toll-free numbers (800, 888, 877,
866) or 911.
✓ Business phones in an office using a phone switch are more difficult
to spoof. However, all the attacker usually needs is the user guide and
administrator password for the phone switch software. In many switches,
the attacker can enter the source number — including a falsified number,
such as the victim’s home phone number. Voice over Internet Protocol
(VoIP) phone systems are making this a non-issue, however.
✓ VoIP Servers such as the open source Asterisk (www.asterisk.org)
can be used and configured to send any number they want.
Phishing e-mails
The latest criminal hacking craze is phishing — criminals sending bogus
e-mails to potential victims in an attempt to get them to divulge sensitive
information or click malicious links. Phishing has actually been around for