Social engineering attacks can occur in person, over the phone, while surfing the Internet, and via email. If you’re planning on taking the Security+ exam, you should have a good understanding of the common attacks.
For example, can you answer this question?
Q. A security administrator at a shopping mall discovered two wireless cameras pointing at an automatic teller machine. These cameras were not installed by mall personnel and are not authorized. What is the MOST likely goal of these cameras?
A. Tailgating
B. Dumpster diving
C. Vishing
D. Shoulder surfing
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
It’s important to understand some common attacks. Social engineering includes several techniques attackers use to trick users. Additionally, many attackers use email, instant messaging, and the phone to deliver attacks.
Impersonating
Some social engineers often attempt to impersonate others. The goal is to convince an authorized user to provide some information, or help the attacker defeat a security control.
As an example, an attacker can impersonate a repair technician to gain access to a server room or telecommunications closet. After gaining access, the attacker can install hardware such as a rogue access point to capture data and send it wirelessly to an outside collection point. Identity verification methods are useful to prevent the success of impersonation attacks. Similarly, attackers impersonate legitimate organizations over the phone and try to gain information.
Shoulder Surfing
Shoulder surfing is simply looking over the shoulder of someone to gain information. The goal is to gain unauthorized information by casual observation, and it’s likely to occur within an office environment. This can be to learn credentials, such as a username and password, or a PIN used for a smart card or debit card. Recently, attackers have been using cameras to monitor locations where users enter PINs, such as at automatic teller machines (ATMs).
A simple way to prevent shoulder surfing is to position monitors and other types of screens so that unauthorized personnel cannot see them. This includes ensuring people can’t view them by looking through a window or from reception areas.
Remember this
A social engineer can gain unauthorized information just by looking over someone’s shoulder. This might be in person, such as when a user is at a computer, or remotely using a camera.
Tricking Users with Hoaxes
A hoax is a message, often circulated through email, that tells of impending doom from a virus or other security threat that simply doesn’t exist. Users may be encouraged to delete files or change their system configuration.
An older example is the teddy bear virus (jdbgmgr.exe), which was not a virus at all. Victims received an email saying this virus lies in a sleeping state for 14 days and then it will destroy the user’s system. It then told users that they can protect their system by deleting the file (which has an icon of a little bear), and provided instructions on how to do so. Users who deleted the file lost some system capability.
More serious virus hoaxes have the potential to be as damaging as a real virus. If users are convinced to delete important files, they may make their systems unusable. Additionally, they waste help-desk personnel’s time due to needless calls about the hoax or support calls if users damaged their systems in response to the hoax.
Q. A security administrator at a shopping mall discovered two wireless cameras pointing at an automatic teller machine. These cameras were not installed by mall personnel and are not authorized. What is the MOST likely goal of these cameras?
A. Tailgating
B. Dumpster diving
C. Vishing
D. Shoulder surfing
Answer is D. Shoulder surfing is the practice of peering over a person’s shoulder to discover information. In this scenario, the attacker is using the wireless cameras to discover PINs as users enter them.
Tailgating is the practice of following closely behind someone else without using credentials.
Dumpster diving is the practice of searching trash dumpsters for information.
Vishing is a form of phishing using the phone.
