Social engineering (security)

From Wikipedia, the free encyclopedia

Jump to: navigation, search

Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information.[1] While similar to a confidence trick or simple fraud, the term typically applies to trickery for information gathering or computer system access and in most cases the attacker never comes face-to-face with the victim.

Social engineering techniques and terms

All social engineering techniques are based on flaws in human logic known as cognitive biases.[2] These bias flaws are used in various combinations to create attack techniques, some of which are listed here:

[edit] Pretexting

Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is usually done over the telephone. It’s more than a simple lie as it most often involves some prior research or set up and the use of pieces of known information (e.g., for impersonation: date of birth, Social Security Number, last bill amount) to establish legitimacy in the mind of the target.

This technique is often used to trick a business into disclosing customer information, and is used by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. The information can then be used to establish even greater legitimacy under tougher questioning with a manager (e.g., to make account changes, get specific balances, etc).

As most U.S. companies still authenticate a client by asking only for a Social Security Number, date of birth, or mother’s maiden name — all of which are easily obtained from public records[citation needed]the method is extremely effective and will likely continue to work well until a more stringent identification method is adopted.

Pretexting can also be used to impersonate co-workers, police, bank, tax authorities or insurance investigators — or any other individual who could have perceived authority or right-to-know in the mind of the target. The pretexter must simply prepare answers to questions that might be asked by the target. In some cases all that is needed is a voice of the right gender, an earnest tone and an ability to think on one’s feet.

Voice over IP programs are starting to become a standard in pretexting, as the absence of a traceable number makes the pretexter less vulnerable to being caught

Publié dans Non classé