2KKUU7ita

Chapter 5: Social Engineering
In some well-publicized incidents, hackers e-mailed their victims a patch purporting
to come from Microsoft or another well-known vendor. Users think it
looks like a duck and it quacks like a duck — but it’s not the right duck! The
message is actually from a hacker wanting the user to install the “patch,”
which installs a Trojan-horse keylogger or creates a backdoor into computers
and networks. Hackers use these backdoors to hack into the organization’s
systems or use the victims’ computers (known as zombies) as launching pads
to attack another system. Even viruses and worms can use social engineering.
For instance, the LoveBug worm told users they had a secret admirer.
When the victims opened the e-mail, it was too late. Their computers were
infected (and perhaps worse, they didn’t have a secret admirer).
The Nigerian 419 e-mail fraud scheme attempts to access unsuspecting
people’s bank accounts and money. These social engineers — I mean scamsters
— offer to transfer millions of dollars to the victim to repatriate a
deceased client’s funds to the United States. All the victim must provide is
personal bank-account information and a little money up front to cover the
transfer expenses. Victims then have their bank accounts emptied. This
trap has been around for a while, and it’s a shame that people still fall for it.
Many computerized social engineering tactics can be performed anonymously
through Internet proxy servers, anonymizers, remailers, and basic
SMTP servers that have an open relay. When people fall for requests for confidential
personal or corporate information, the sources of these social engineering
attacks are often impossible to track.
Social Engineering Countermeasures
You have only a few good lines of defense against social engineering. Even with
strong security systems, a naïve or untrained user can let the social engineer
into the network. Never underestimate the power of social engineers.
Policies
Specific policies help ward off social engineering in the long term in the following
areas:
✓ Classifying information so that users don’t have access to certain levels
of information they don’t need
✓ Setting up user IDs when hiring employees or contractors
✓ Establishing acceptable computer usage
77