e * x 0 9 Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering S o c i a l E n g i n e e r i n g M odule 09 Engineered by Hackers. Presented by Professionals. C E H «■* E th ic a l H a c k in g C o u n te rm e a s u re s v8 Module 09: Social Engineering Exam 312-50 Module 09 Page 1293 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering S e c u r i t y N e w s C E H Cybercriminals Use Social Engineering Emails to Penetrate Corporate Networks September 25, 2012 FireEye, Inc. has announced the release of "Top Words Used in Spear Phishing Attacks to Successfully News Compromise Enterprise Networks and Steal Data," a report that identifies the social engineering techniques cybercriminals use in email-based advanced cyber attacks. According to the report, the top Product words cybercriminals use create a sense of urgency to trick unsuspecting recipients into downloading Services malicious files. The top word category used to evade traditional IT security defenses in email-based attacks relates to express shipping. Contact According to recent data from the FireEye "Advanced Threat Report," for the first six months of 2012, About email-based attacks increased 56 percent. Email-based advanced cyber attacks easily bypass traditional signature-based security defenses, preying on naive users to install malicious files. "Cybercriminals continue to evolve and refine their attack tactics to evade detection and use techniques that work. Spear phishing emails are on the rise because they work," said Ashar Aziz, Founder and CEO, FireEye. "Signature-based detection is ineffective against these constantly changing advanced attacks, so IT security departments need to add a layer of advanced threat protection to their security defences." "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data," explains that express shipping terms are included in about one quarter of attacks, including "DHL", "UPS", and "delivery.11 http://biztech2. in. com Copyright © by EG-G(ancil. All Rights Reserved. Reproduction Is Strictly Prohibited. S e c u rity N e w s C y b e rc rim in a ls U se S o c ia l E n g in e e rin g E m a ils to P e n e tra te C o rp o ra te N e tw o rk s Source: http://biztech2.in.com FireEye, Inc. has announced the release of "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data," a report that identifies the social engineering techniques cybercriminals use in email-based advanced cyber-attacks. According to the report, there are a number of words cybercriminals use to create a sense of urgency to trick unsuspecting recipients into downloading malicious files. The top word category used to evade traditional IT security defenses in email-based attacks relates to express shipping. According to recent data from the FireEye "Advanced Threat Report," for the first six months of 2012, email-based attacks increased 56 percent. Email-based advanced cyber-attacks easily bypass traditional signature-based security defenses, preying on naive users to install malicious files. "Cybercriminals continue to evolve and refine their attack tactics to evade detection and use techniques that work. Spear phishing emails are on the rise because they work," said Ashar Aziz, Founder and CEO, FireEye. "Signature-based detection is ineffective against these Module 09 Page 1294 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering constantly changing advanced attacks, so IT security departments need to add a layer of advanced threat protection to their security defenses." "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data," explains that express shipping terms are included in about one quarter of attacks, including "DHL," "UPS," and "delivery." Urgent terms such as "notification" and "alert" are included in about 10 percent of attacks. An example of a malicious attachment is "UPS- Delivery-Confirmation-Alert_April-2012.zip." The report indicates that cybercriminals also tend to use finance-related words, such as the names of financial institutions and an associated transaction such as "Lloyds TSB - Login Form.html," and tax-related words, such as "Tax_Refund.zip." Travel and billing words including "American Airlines Ticket" and "invoice" are also popular spear phishing email attachment key words. Spear phishing emails are particularly effective as cybercriminals often use information from social networking sites to personalize emails and make them look more authentic. When unsuspecting users respond, they may inadvertently download malicious files or click on malicious links in the email, allowing criminals access to corporate networks and the potential exfiltration of intellectual property, customer information, and other valuable corporate assets. The report highlights that cybercriminals primarily use zip files in order to hide malicious code, but also ranks additional file types, including PDFs and executable files. "Top Words Used in Spear Phishing Attacks to Successfully Compromise Enterprise Networks and Steal Data" is based on data from the FireEye Malware Protection Cloud, a service shared by thousands of FireEye appliances around the world, as well as direct malware intelligence uncovered by its research team. The report provides a global view into email-based attacks that routinely bypass traditional security solutions such as firewalls and next-generation firewalls, IPSs, antivirus, and gateways. Copyright © 2011, Biztech2.com - A Network 18 Venture Author: Biztech2.com Staff http://biztech2.in.com/r1ews/securitv/cvbercriminals-use-social-er1Eineerir1g-emails-to-penetrate- corporate-networks/144232/0 Module 09 Page 1295 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering M o d u l e O b j e c t i v e s C E H י J What Is Social Engineering? J Mobile-based Social Engineering J Factors that Make Companies J Social Engineering Through Impersonation on Social Networking Vulnerable to Attacks Sites J Warning Signs of an Attack Identify Theft k J J Phases in a Social Engineering Attack B J Social Engineering Countermeasures J Common Targets of Social Engineering J How to Detect Phishing Emails J Human-based Social Engineering « Identity Theft Countermeasures J Computer-based Social Engineering J Social Engineering Pen Testing Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited. M o d u le O b je c tiv e s The information contained in this module lays out an overview on social engineering. While this module points out fallacies and advocates effective countermeasures, the possible ways to extract information from another human being are only restricted by the ingenuity of the attacker's mind. While this aspect makes it an art, and the psychological nature of some of these techniques make it a science, the bottom line is that there is no defense against social engineering; only constant vigilance can circumvent some of the social engineering techniques that attackers use. This module will familiarize you with: S What Is Social Engineering? Computer-based Social Engineering S Factors that Make Companies Mobile-based Social Engineering Vulnerable to Attacks Social Engineering Through Impersonation on 8 Warning Signs of an Attack Social Networking Sites 5 Phases in a Social Engineering Identify Theft Attack Social Engineering Countermeasures S Common Targets of Social How to Detect Phishing Emails Engineering Identity Theft Countermeasures S Human-based Social Engineering Module 09 Page 1296 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering Copyright © by EC-G(Uncil. All Rights Reserved. Reproduction is Strictly Prohibited. J L l M o d u le F lo w } As mentioned previously, there is no security mechanism that can stop attackers from performing social engineering other than educating victims about social engineering tricks and warning about its threats. So, now we will discuss social engineering concepts. Social Engineering Concepts Identity theft a Social Engineering • Social Engineering Techniques Countermeasures /*■ ־ Impersonation on Social Penetration Testing Networking Sites JiEE This section describes social engineering and highlights the factors vulnerable to attacks, as well as the impact of social engineering on an organization. Module 09 Page 1297 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering W h a t I s S o c ia l E n g i n e e r i n g ? C E H UrtrfW* ttfciul lUilwt 0 0 J Social engineering is the art of convincing people to reveal confidential information J Social engineers depend on the fact that people are unaware of their valuable information and are careless about protecting it 0 0 Copyright © by IG-Gtuncil. All Rights Reserved. Reproduction is Strictly Prohibited. W h a t Is S o c ia l E n g in e e r in g ? Social engineering refers to the method of influencing and persuading people to reveal sensitive information in order to perform some malicious action. With the help of social engineering tricks, attackers can obtain confidential information, authorization details, and access details of people by deceiving and manipulating them. Attackers can easily breach the security of an organization using social engineering tricks. All security measures adopted by the organization are in vain when employees get "social engineered" by strangers. Some examples of social engineering include unwittingly answering the questions of strangers, replying to spam email, and bragging in front of co-workers. Most often, people are not even aware of a security lapse on their part. Chances are that they divulge information to a potential attacker inadvertently. Attackers take special interest in developing social engineering skills, and can be so proficient that their victims might not even realize that they have been scammed. Despite having security policies in place, organizations can be compromised because social engineering attacks target the weakness of people to be helpful. Attackers are always looking for new ways to gather information; they ensure that they know the perimeter and the people on the perimeter security guards, receptionists, and help desk workers in order to exploit human oversight. People have been conditioned not to be overly suspicious; they associate certain behavior and appearances with known entities. For Module 09 Page 1298 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering instance, upon seeing a man dressed in a uniform and carrying a stack packages for delivery, any individual would take him to be a delivery person. Companies list their employee IDs, names, and email addresses on their official websites. Alternatively, a corporation may put advertisements in the paper for high-tech workers who are trained on Oracle databases or UNIX servers. These bits of information help attackers know what kind of system they are tackling. This overlaps with the reconnaissance phase. Module 09 Page 1299 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering Behaviors Vulnerable to Attacks CEH UrtNM ItkNjI lUilwt | Human nature of trust is the basis of any social engineering attack ־■־■־ Ignorance about social engineering and its effects among the workforce -*־־*־ makes the organization an easy target H I Social engineers might threaten severe losses in case of non- compliance -*“*-*־ with their request & Social engineers lure the targets to divulge information by promising IV something for nothing V Targets are asked for help and they comply out of a sense of moral obligation Copyright © by EG-G*ancil. All Rights Reserved. Reproduction Is Strictly Prohibited. B e h a v io r s V u ln e r a b le to A t t a c k s An attacker can take advantage of the following behaviors and nature of people to commit social engineering attacks. These behaviors can be vulnerabilities of social engineering attacks: Q Human nature of trust itself becomes the main basis for these social engineering attacks. Companies should take the proper initiative in educating employees about possible vulnerabilities and about social engineering attacks so that employees will be cautious. Sometimes social engineers go to the extent of threatening targets in case their requests are not accepted. When things don't work out with threatening, they lure the target by promising them various kinds of things like cash or other benefits. In such situations, the target might be lured and there is the possibility of leaking sensitive company data. At times, even targets cooperate with social engineers due to social obligations. Ignorance about social engineering and its effects among the workforce makes the organization an easy target. The person can also reveal the sensitive information in order to avoid getting in trouble by not providing information, as he or she may think that it would affect the company's business. Module 09 Page 1300 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited. Ethical Hacking and Countermeasures Exam 312-50 Certified Ethical Hacker Social Engineering Factors that M ake Companies CEH Vulnerable to Attacks Insufficient Easy Security Access of Training Information Lack of Security Organizational Policies Units Copyright © by EG-G*ancil. All Rights Reserved. Reproduction is Strictly Prohibited. F a c to r s th a t M a k e C o m p a n ie s V u ln e r a b le to A t t a c k s Social engineering can be a great threat to companies. It is not predictable. It can only be prevented by educating employees about social engineering and the threats associated with it. There are many factors that make companies vulnerable to attacks. A few factors are mentioned as follows: In s u ffic ie n t S e c u rity T r a in in g It is the minimum responsibility of any organization to educate their employees about various security aspects including threats of social engineering in order to reduce its impact on companies. Unless they have the knowledge of social engineering tricks and their impact, they don't even know even if they have been targeted and. Therefore, it is advisable that every company must educate or train its employees about social engineering and its threats. L a c k o f S e c u rity P o lic ie s Security standards should be increased drastically by companies to bring awareness Module 09 Page 1301 Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.