Chapter 10 Social Engineering

Question 1

Behaviors or signs useful in extracting info from ppl (5)

Answer 1

1) Moral Obligation - some ppl feel compelled to provide assistance out of a sense of duty
2) Trust - humans have inherent tendency to trust others; attacker may use buzzwords to gain trust
3) Threats - social engineer may threaten a victim
4) Something for Nothing - attacker may promise victim that for little to no work, they will reap tremendous rewards
5) Ignorance - a lot of ppl don’t recognize social engineering as a huge threat

Question 2

Why does Social Engineering work? (5)

Answer 2

1) LACK OF TECHNOLOGICAL FIX - technology can be configured incorrectly by ppl
2) INSUFFICIENT SECURITY POLICIES - policies that state how information, resources, & other related items should be handled are often incomplete or insufficient at best
3) DIFFICULT DETECTION SOCIAL ENGINEERING - hard to detect; technology may leave tracks in log file or trip an IDS, but social engineering probably won’t
4) LACK OF TRAINING
5) HUMAN HABIT & NATURE - easy for an attacker to follow & see what your routine is

EC-COUNCIL likes to say “ THERE IS NO PATCH FOR HUMAN STUPIDITY” (although you can patch technology, you can’t patch human beings)

Question 3

How to stop social engineering

Answer 3

Simple Training and Awareness

Question 4

Phases of Social Engineering (4 or 3)

Answer 4

Research, Develop, Exploit

1) Gather info about target through research & observation (this can include dumpster diving, phishing, etc)
* *Phishing - defrauding by posing as legit company

2) Select specific individual or group that have what you need (look for people who are overconfident, frustrated, arrogant, etc)
3) Forge a relationship
4) Exploit the relationship & extract information

Question 5

Types of Threats (5) ***

Answer 5

1) Malware - key loggers, spyware, trojan, etc
2) Shoulder Surfing
3) Eavesdropping
4) Dumpster Diving - one man’s trash is another man’s teasure
5) Phishing - posing as legit to get info

Question 6

Ingress Filtering

Answer 6

This is a preventive measure to avoid social engineering attacks

technique used to make sure incoming packets are legit

Question 7

Egress Filtering

Answer 7

This is a preventive measure to avoid social engineering attacks

the practice of monitoring & potentially restricting the flow of info outbound from one NW to another

Typically internet from TCP/IP to the internet that is controlled (such as blocking websites)