2KKUU7ita

76
Part II: Putting Ethical Hacking in Motion
Even professionals can be socially engineered
Here’s how I fell prey to a social engineer
because I didn’t think before I spoke. One day, I
was having trouble with my high-speed Internet
connection. I contacted my ISP and told the
tech-support guy that I couldn’t remember my
password. This sounds like the beginning of a
social engineering stunt that I could’ve pulled
off, but I got taken instead. The slick tech-support
guy paused for a minute, as if he were pulling
up my account info, and then asked, “What
password did you try?”
Stupid me, I proceeded to repeat all the passwords
it could’ve been. The phone went quiet
for a moment. He reset my password and told
me what it was. After I hung up, I thought,
“What just happened? I think just got social
engineered!” It may not have been intentional
on his part. His question could’ve just been
part of their procedures for resetting accounts.
Either way, it was a dumb mistake on my part.
I changed all the passwords that I divulged
related to my Internet account in case he used
that information against me. Lesson learned:
Never, under any circumstances, divulge
your password to someone else — another
employee, your boss, a support technician,
whomever — even if they ask for it. The consequences
just aren’t worth the perceived benefit.
Deceit through technology
Technology can make things easier — and more fun — for the social engineer.
Often, a malicious request for information comes from a computer or
other electronic entity that the victims think they can identify. But spoofing
a computer name, an e-mail address, a fax number, or a network address is
easy. Fortunately, you can take a few countermeasures against this type of
attack, as described in the next section.
Hackers can deceive through technology by sending e-mail that asks victims
for critical information. Such an e-mail usually provides a link that directs
victims to a professional- and legitimate-looking website that “updates” such
account information as user IDs, passwords, and Social Security numbers.
They might also do this on social networking sites, such as Facebook and
Myspace.
Many spam and phishing messages also use this trick. Most users are inundated
with so much spam and other unwanted e-mail that they often let their
guard down and open e-mails and attachments they shouldn’t. These e-mails
usually look professional and believable. They often dupe people into disclosing
information they should never give in exchange for a gift. These social
engineering tricks also occur when a hacker who has already broken into the
network sends messages or creates fake Internet pop-up windows. The same
tricks have occurred through instant messaging and cellphone messaging.