Social Engineering Training
Training Goals
Increase Laboratory Awareness. Provide the tools required to identify, avoid
and report advanced Social Engineering attempts. Spot sophisticated e-mail phishing attempts. Avoid phone-based information elicitation. Detect “baiting” attacks via USB keys, CDs,
and other physical media.
Why Social Engineering Training?
DOE Red Team Tests The Red Team used Social Engineering tactics to attempt
to infiltrate the laboratories in Spring 2008. They were successful in gaining access and maneuvering
without detection at two DOE laboratories and one Site Office.
Increased use and sophistication of Social Engineering tactics.
Overview
Definition Attacker Motivation Techniques Tests Summary
Definition
What is social engineering?
Art of manipulating people into performing actions or divulging confidential information.
Using trickery to gather information or computer system access.
In most cases the attacker never comes face-to-face with the victim.
What motivates social engineers?
Obtaining personal information.
Gaining unauthorized access.
Circumventing established procedures.
Because they can.
Pretexting Invented scenario
Can use any communication medium. Phone Calls E-mail Physical media
General Prevention Think about motivation – how could this be used maliciously? Be polite (it could be legitimate). Record available contact information. Ask a question for which the answer is not publicly available.
Tools Used in Pretexting
Any publicly available information Postings on public web pages. Phone book information. Professional information.
Personal and professional relationships Association with ISU. Association with DOE. Conferences and collaborations in field of
expertise.
Specific Techniques
Phone Cold Calls / Scams
E-Mail Phishing1
Trojan Horse1
Physical Media Baiting1,2
1The DOE Red Team used these techniques in their latest successful attacks on two DOE laboratories and one site office.
2The DOE Red Team was successful using these methods to infiltrate DOE laboratories in the past.
Phone Scams Unexpected / Unsolicited Phone Calls
Attempt to elicit personal or organizational information.. Example Pretexts
Offer to perform a service. Ask for information about organization (i.e. reporters,
prospective students). Claim to be calling for a friend or family members that need
access to something.
Prevention Be polite. Ask for a number to call *them* back; may allow tracing later. Ask a question for which the answer is not publicly available.
E-Mail Unsolicited / Unexpected E-Mail - entice user to:
Click on a link to a fraudulent web page. View or execute an attachment. Reply to message.
Example Pretexts Standard Viagra, off-shore lottery, etc…spam. Notice from DOE, ISU or other requiring a quick
response and personal information. Unsolicited CVs, proposals, professional requests.
E-Mail – Trojan Horse
Malicious software delivered via e-mail Attachment Web link
Pretext Cool screen saver. Important anti-virus or
system upgrade. Latest gossip about a
celebrity.
E-Mail - Prevention
Verify Web Links Known Site. URL and text match. Copy and paste rather than click.
Verify sender prior to opening attachments or clicking on web links. Contact through different medium (i.e. call sender). Verify via an associate of sender, if known.
Examine e-mail headers Forward suspect e-mail to [email protected]
Email Example - Links
Email Example - Headers
Email Example - Headers
Email Example - Attachments
Email Example - Attachments
What you see: What you don’t see:
Attacker’s Server
Physical Media - Baiting Deliver malware via
infected CD ROM or USB flash drive.
Pretexts “Lost” in a location sure to be
found (bathroom, elevator, sidewalk, parking lot).
Delivered with a legitimate looking curiosity-piquing label and simply waits for the victim to use the device.
Physical Media - Prevention
Verify unexpected mailings with sender.
Never put anything into your computer if you don’t know where it’s been.
Bring found USB keys, CD-ROMs, or other digital media to IS for examination.
Quick TestsName 3 clues in this e-mail that should make you suspicious
Quick Tests – Solution
Quick TestsWhich of these emails is legitimate? Which is fake?
Quick TestsThe left email is a Red Team attack.The right email is from DOE.
Quick Tests
Can you think of ways the information on Ames Laboratory’s public web page could be exploited to execute a social engineering attack?
Can you think of an unsolicited e-mail, phone call, or physical mail attack which would be impossible to verify or handle safely?
When to report Social Engineering
What to report Spam emails with local information. Unusual DOE/Ames Laboratory emails. Unsolicited phone calls digging for
information/contacts. What not to report
General spam.
How to report Social Engineering
If Social Engineering techniques are attempted while at work…
If you believe you might have revealed sensitive information about the Ames Laboratory…
Report it to the IS office at: Phone: 4-8348 Email: [email protected]
This will alert us to any suspicious or unusual activity.
Summary
Be suspicious. Think about motivation when revealing
information. Verify identity. Be careful what you click on. No one will catch everything – Be willing to
ask for help.
Thanks for Attending