1.2 Compare and contrast types of attacks. Flashcards
Social Engineering - Phishing
Phishing is the attempt at fraudulently obtaining private information. A phisher usually masquerades as someone else, perhaps another entity. There are two main differences between phishing and pretexting.
First, phishing is usually done by electronic communication, not in person.
Second, little information about the target is necessary. A phisher may target thousands of individuals without much concern as to their background. An example of phishing would be an e-mail that requests verification of private information. The e-mail probably leads to a malicious website designed to lure people into a false sense of security to fraudulently obtain information. The website often looks like a legitimate website. A common phishing technique is to pose as a vendor (such as an online retailer or domain registrar) and send the target email confirmations of orders that they supposedly placed.
This is a triple-whammy.
First, the orders are obviously fake; a person might say “Hey, wait! I didn’t place these orders!” and perhaps click the link(s) in the e-mail, leading the person to the false web page.
Second, if a person thinks it’s a legitimate order (perhaps the person does many orders, and the fraudulent one looks like another legitimate one), the person might click a link to track the order, again leading to the bogus web page.
Third, once at the web page, the person is asked to enter her credentials for her account (which then leads to credit card fraud and ID theft), and in addition to that the page might have Trojans and other malicious scripts that are delivered to the unsuspecting person on exit. Sheesh, talk about cyber-bullying!
Social Engineering - Spear Phishing
(Cont. after Phishing)
Generally, no information about the target is necessary for a phishing attack. However, some “phishermen” actually target specific groups of people or even specific individuals. This is known as spear phishing.
Social Engineering - Whaling
(Cont. after Phishing and Spear Phishing)
And when an attacker targets senior executives (CEOs, CFOs, and so on) it is known as whaling. Whaling attacks are much more detailed and require that the attacker know a good deal of information about the target (much of which is freely available on the Internet).
Social Engineering - Vishing
The concept of phishing is also accomplished by telephone. Phone phishing, known as vishing, works in the same manner as phishing but is initiated by a phone call (often using VoIP systems).
The phone call often sounds like a prerecorded message from a legitimate institution (bank, online retailer, donation collector, and so on). The message asks the unsuspecting person for confidential information such as name, bank account numbers, codes, and so on; all under the guise of needing to verify information for the person’s protection. It’s really the opposite, of course, and many people are caught unawares by these types of scams every day.
By using automated systems (such as the ones telemarketers use), vishing can be perpetuated on large groups of people with little effort.
Social Engineering - Tailgating
A favorite method of gaining entry to electronically locked systems is to follow someone through the door they just unlocked, a process known as tailgating. Many people don’t think twice about this event—it happens all the time—as they hold the door open for someone behind them who is carrying heavy boxes or is disabled in some way
Social Engineering - Impersonation
As mentioned at the beginning of the chapter, impersonation involves any act of pretending to be someone you are not. This can be a service technician, a pizza delivery driver, a security guard, or anyone else who might be allowed unfettered access to the grounds, network, or system. Impersonation can be done in person, over the phone, by email, and so forth.
Social Engineering - Dumpster Diving
Dumpster diving is a common physical access method. Companies normally generate a huge amount of paper, most of which eventually winds up in dumpsters or recycle bins.
Dumpsters may contain information that is highly sensitive in nature. In high-security and government environments, sensitive papers are either shredded or burned. Most businesses don’t do this. In addition, the advent of “green” companies has created an increase in the amount of recycled paper, which can often contain all sorts of juicy information about a company and its employees.
Social Engineering - Shoulder Surfing
Shoulder surfing is when the hacker tries to view confidential information or information that may help the attacker compromise security by looking over employees’ shoulders to view information either on their desk or on the computer screen.
The best defense against this type of attack is to survey
your environment before entering personal data. It is a good idea for users not to have their monitors positioned in ways that make it easy for this act to occur, but they also need to understand and appreciate that such an attack can occur away from the desk as well: in any public location where they sit with their laptops, at business travel centers in hotels, at ATMs, and so on.
Social Engineering - Hoax
A hoax is the attempt at deceiving people into believing something that is false. The differences between hoaxes and phishing can be quite gray.
However, hoaxes can come in person, or through other means of communication, whereas phishing is generally relegated to e-communication and phone. Although phishing can occur at any time, and with the specific goal of obtaining private information, a hoax can often be perpetuated on holidays or other special days and could be carried out simply for fun.
Regardless, hoaxes can use up valuable organization resources: e-mail replies, Internet bandwidth used, time spent, and so on. An example of a “harmless” hoax was Google’s supposed name change to “Topeka” on April Fools’ Day 2010. An example of a financially harmful hoax was the supposed assassination of Bill Gates on April Fools’ Day 2003. This hoax led to stock market fluctuations and loss of profit in Asia. Some companies place a time limit on jokes and hoaxes indicating that the affected person has become nonproductive; for example, 3% of the workday.
Pretexting, malicious insider attempts, diversion theft, phishing, and hoaxes are all known as confidence tricks, thus the term con, and are committed by “bunko” artists.
Social Engineering - Water Hole Attack
A watering hole attack can sound a lot more
complicated than it really is. The strategy the attacker takes is simply to identify a site that is visited by those they are targeting, poisoning that site, and then waiting for the results.
As an example, suppose an attacker wants to gain unauthorized access to the servers at Spencer Industries, but Spencer’s security is really good. The attacker discovers that Spencer does not host its own email but instead outsources it to a big cloud provider. Thus, they focus their attention on the weaker security of the cloud provider. On the cloud provider’s email site, they install the malware du jour, wait until a Spencer employee gets infected, and suddenly have the access they coveted.
The best defense against a watering hole attack is to make certain that all of your partners are secure. Identify weak links, and bring them up to the same level of security as the rest of your infrastructure. From an exam perspective, one of the best things about most of these
types of attacks is that the name telegraphs the predicament.
As an IT administrator, you have no way of preventing someone from trying these tactics against your company, but educating users about them is the best way to prevent them from being successful. The more people are aware of their presence and potential harm, the more likely they can help thwart such attacks since the ultimate objective is to gain unauthorized access to information.
Social Engineering - Principles (Reasons for Effectiveness) - Authority
If it is possible to convince the person you are attempting to trick that you are in a position of authority, they may be less likely to question your request. That position of authority could be upper management, tech support, HR, or law enforcement.
Social Engineering - Principles (Reasons for Effectiveness) - Intimidation
Although authority can be a source of intimidation, it is
possible for intimidation to occur in its absence as well. This can be done with threats, with shouting, or even with guilt.
Social Engineering - Principles (Reasons for Effectiveness) - Consensus/Social Proof
Putting the person being tricked at ease by putting the
focus on them—listening intently to what they are saying, validating their thoughts, charming them—is the key to this element. The name comes from a desire that we all have to be told that we are right, attractive, intelligent, and so forth, and we tend to be fond of those who confirm this for us. By being so incredibly nice, the social engineer convinces the other party that there is no way their intentions could possibly be harmful.
In other words, the hacker usually presents some facts known to the victim (and hacker) to act as proof that what the hacker is saying is true and can be trusted.
Social Engineering - Principles (Reasons for Effectiveness) - Scarcity
Convincing the person who is being tricked that there is a limited supply of something can often be effective if carefully done.
For example, convincing them that there are only 100 vacation requests that will be honored for the entire year and that they need to go to a fictitious website now and fill out their information (including username and password, of course) if they want to take a vacation anytime during the current year can dupe some susceptible employees.
In other words, scarcity is when the attack comes in the form of an e-mail, web site, or even a call, where the hacker makes you feel you need to click the order link now as you have a limited amount of time to take advantage of a great deal!
Social Engineering - Principles (Reasons for Effectiveness) - Familiarity/Liking
Mental guards are often lowered, many times subconsciously, when we are dealing with other individuals that we like. The “like” part can be gained by someone having, or pretending to have, the same interests as we do, be engaged in the same activities, or otherwise working to gain positive attention.
The hacker may use a friendly tone and be very sociable, which makes the victim tend to like them and want to help.
Social Engineering - Principles (Reasons for Effectiveness) - Trust
One of the easiest ways to gain trust is through reciprocation. When someone does something for you, there is often a feeling that you owe that person something. For example, to gain your trust, someone may help you out of a troublesome situation or buy you lunch.
It is in our nature to trust people who appear to be in need of help.
Social Engineering - Principles (Reasons for Effectiveness) - Urgency
The secret for successfully using the urgency element is for the social engineer to convince the individual whom they are attempting to trick that time is of the essence so the victim doesn’t really think of the security impact. If they don’t do something right away, the money will be lost, a nonexistent intruder will get away, the company will suffer irreparable harm, or a plethora of other negative possibilities may occur.
Application/Service Attacks - DoS
A denial of service (DoS) attack involves the hacker overloading a system with requests so that the system is so busy servicing the hacker’s requests that it cannot service valid requests from other clients
Application/Service Attacks - DDoS
A distributed denial of service (DDoS) attack is when the hacker uses a number of systems to perform the attack, which helps the hacker create a large number of requests. With a DDoS attack, the hacker first compromises and takes control of a number of systems and then uses those systems to help with the attack. The compromised systems are known as zombie systems because they have no mind of their own and will do whatever the hacker tells them to do
Application/Service Attacks - Man-in-the-middle (MITM)
A form of eavesdropping that intercepts all data between a client and a server, relaying that information back and forth.
Application/Service Attacks - Buffer Overflow
Most attacks are buffer overflows. A buffer is an area of memory used to store information sent to an application. A buffer overflow is when a hacker sends too much information to the application, causing the information to fill both the buffer and memory outside the buffer
If the hacker can store information in memory beyond the buffer area, the hacker can run whatever code they want with administrative privileges. The software that is susceptible to this attack could be an application or a background service loaded in the operating system.
Application/Service Attacks - Injection
SQL Injection
SQL (Structured Query Language) is the de facto language used for communicating with online (and other relational) databases. With a SQL injection attack (also known as a SQL insertion attack), an attacker manipulates the database code to take advantage of a weakness in it.
LDAP Injection
Just as SQL injection attacks take statements that are input by users and exploit weaknesses within, an LDAP injection attack exploits weaknesses in LDAP (Lightweight Directory Access Protocol) implementations. This can occur when the user’s input is not properly filtered, and the result can be executed commands, modified content, or results returned to unauthorized queries. The best way to prevent LDAP injection attacks is to filter the user input and to use a validation scheme to make certain that queries do not contain exploits.
XML Injection
When users enter values that query XML (known as XPath) with values that take advantage of exploits, it is known as an XML injection attack. XPath works in a similar manner to SQL, except that it does not have the same levels of access control, and taking advantage of weaknesses within can return entire documents. The best way to prevent XML injection attacks is to filter the user’s input and sanitize it to make certain that it does not cause XPath to return more data than it should.
Application/Service Attacks - Cross-site Scripting (XSS)
In cross-site scripting (XSS), the hacker inserts script code into a form on a site so that when the page is displayed by another user, the browser reads the script and executes it.
Application/Service Attacks - Cross-site Request Forgery (CSRF)
Cross-site request forgery, CSRF or XSRF for short, is an attack that targets a user who is already authenticated to a web site, such as a bank site to do online banking. The user is then tricked by a hacker to run a web page; for example, the hacker sends an e-mail message to the user and tricks the user into clicking a link. The malicious web page loads and sends commands (form submission) to the bank site that the user is already logged in to. The end result is the user unknowingly could be transferring money to the hacker’s account.
