Download

on a hyperlink appearing in a SMS message will cause the cell phone to surf to the Web siteaddressed by that hyperlink.The problem with this is that the Web site could downloadmalicious content to the cell phone, which could cause a number of problems (e.g.,revealing the phone’s contact list or allowing someone to place expensive calls using thisphone and charging them to this phone’s account).World Wide Web,E-mail, and Instant MessagingInternet technologies can inadvertently aid scams.The simplest attack is to spoof the sender’saddress in an e-mail message. A recipient with little knowledge may not notice phonyheaders that were inserted to make a message look legitimate. A truly knowledgeable recipientcan easily tell when headers are phony.Trojan Horses and BackdoorsIn another scam, the attacker sends a Trojan horse, which is a benign program that carries amalicious program.The benign program usually appears as something entertaining (e.g., agame, electronic greeting card, and so forth), and works as advertised so that the recipient isnot suspicious.The benign program also contains a wrapper program that launches both thebenign program and a malicious program.The malicious program might vandalize the recipient’ssystem, or it might create a backdoor to the system, which is a means for gaining accessto a system while circumventing identification and authentication. Backdoors introducedthrough Trojan horses are known as remote access Trojans (RATs).Typically, a RAT makesentries in the registry or configuration files of the operating system, so that it is initializedevery time the system is booted.Disguising ProgramsSocial Engineering • Chapter 12 397Another trick used to get targets to accept malicious attachments is to disguise programs. Afeature of Windows that hides the filename extension is controlled from WindowsExplorer | Tools | Folder Options… | View | Hide.The default setting in WindowsXP is to hide these extensions. Knowing this, the attacker can create a malicious programand name it syngress.jpg.exe or something similar. When Windows hides the .exe filenameextension, syngress.jpg appears to have a filename extension, but is considered to be a filenamewithout an extension. Because the bogus extension does not indicate an executablefile, the recipient feels safe in opening it.The recipient would have been safer if he or shedidn’t download any attachments he or she wasn’t expecting.