Wireless Security.pdf - PDF Archive

202 Chapter 8
with other activities, they have been able to break into many corporations as a result. In
this type of attack, the attacker chooses a mark he or she can scam to gain a password,
user ID, or other usable information. Because most administrators and employees of
companies are more concerned with providing efficiency and helping users, they may be
unaware that the person they are speaking to is not a legitimate user. And because there
are no formal procedures for establishing whether an end user is legitimate, the attacker
often gains a tremendous amount of information in a very short time, and often with no
way to trace the information leak back to the attacker.
Social engineering begins with a goal of obtaining information about a person or business
and can range in activities from dumpster diving to cold calls or impersonations. As
acknowledged in the movies, many hackers and criminals have realized that a wealth
of valuable information often lays in the trash bins waiting to be emptied by a disposal
company. Most corporations do not adequately dispose of information, and trash bins
often contain information that may identify employees or customers. This information is
not secured and is available to anyone who is willing to dive into the dumpster at night
and look for it—hence, the term dumpster diving .
Other information is readily available via deception. Most corporations do not contain
security measures that address deception adequately. What happens when the protocol
is followed properly, but the person being admitted is not who he says he is? Many
groups utilize members of their group in a fashion that would violate protocols to gather
information about a corporate admittance policy. Often, the multiperson attack results
in gaining admittance to the company and ultimately the information desired. Using
the bathroom or going for a drink of water is always a great excuse for exiting from a
meeting, and you often will not have an escort. Most corporations do not have terminal
locking policies, and this is another way an attacker can gain access or load software that
may pierce the company’s firewall. So long as the people entering the corporation can
act according to the role they have defined for their access and they look the part, it is
unlikely that they will be detected.
Remotely, social engineering actually becomes less challenging. There are no visual
expectations to meet, and people are very willing to participate with a little coaxing. As
is often the case, giving away something free can always be a method for entry. Many
social engineering situations involve sending along a free piece of software or something
of value for free. Embedded within free software, Trojans, viruses, and worms can go
www.newnespress.com