Mitnick served time: 68 months for various computer crimes, such as breaking into corporate computer networks. It was never alleged that the benefited monetarily from theses actions, the exception being his obtaining free rides on the Los Angeles bus system by using a ticket punch.
The focus of this work is social engineering: obtaining information from insiders that can be used in furtherance of crimes. The bus system attack was an example. He did not use any force; he merely asked a bus driver how the system worked, purchased a ticket punch, and extracted discarded slips from bus depot trash cans.
The thrust of his book is this: much useful information is easily available for the taking and this information can be used to gain entrance to businesses and their computer systems. Most businesses are not prepared and do not train their staff counter social engineering efforts. The social engineer uses various methods, described below, to extract information and encourage actions that by themselves seem harmless but combined form an exploit.
Robert Cialdini has spoken of the six tactics one uses to persuade another:
- reciprocation
- liking
- authority
- scarcity
- commitment/consistency
- social proof
The first three figure prominently in the social engineer's arsenal. Reciprocation refers to the human tendency to keep "accounts" of favors. Most strong friendships are formed by high-activity, nearly balanced accounts of favors. Similarly, few people enjoy owing favors to others; also, few people enjoy frequently performing favors for others with little expectation of being "repaid". Many people enjoy being helpful and trusting because it results in credits to one's "account" and makes one seem competent. Social engineers frequently get needed information merely by asking because most people are wanting to help. It helps if the engineer presents as "likable".
"Authority" comes into play because people are naturally respectful and fearful of people in authority or apparent authority.
Engineering attack 1.
The engineer calls a local video store, says he is really pleased with the service, and wants to send a note of thanks. What is the store manager's name? And, the customer may want to send a note to headquarters as well, what is the this location's store number?
Over the next couple of weeks the engineer calls a different store location, impersonating the manager from the first store, asking innocent questions like "Do you have any copies of movie X? If yes, I'll send this customer over, we are out of movie X." Doing so establishes a rapport with the staff at that second location.
Then, the engineer calls that second store, again impersonating the manager from the first store, and claims that his computer system is down. He has a customer wanting to rent a movie, he knows the customer's name and address. Could they relay the customer's credit card number and expiration date they have on their computer system?
Analysis. The con works because our natural inclination to trust is further enhanced by the fact that the caller appears to be an insider. The fact that this "inside information" was in fact obtained from the outside is unknown to the victim.
Engineering attack 2.
It is 11am and a front-desk secretary is approached by a handsome, well-dressed gentleman who introduces himself as Rick Daggot and says he is here for his meeting with Larry. The secretary is puzzled: "Larry is out this week". Mr. Daggot looks at his calendar, slaps his forehead and says "My mistake, wrong week. I was supposed to speak with him about the C2Alpha project." He books a return flight for later in the day and says "I have time before my flight, may I take you and other key people out for lunch? Who should we invite? Perhaps staff from I.T., Marketing and Accounting?"
They pile into cars and drive to the restaurant. The table is not ready so they enjoy drinks at the bar. Rick Daggot is paying. At lunch he seems to know about the project and pumps the attendees for additional details: the I.T. person about how the system is architected; the marketing person about PR strategies and roll-out dates; the accountant about costs and pricing.
The next day Rick calls the I.T. person. Rick has just spoken with Larry and Larry wants Rick to send some materials via email. Larry cannot reach his normal email address, please send the materials to this address instead ....
"Rick" then sells the information obtained to a competitor (or is himself a competitor).
Analysis. Rick placed phone calls earlier to various staffers in the organization to find out when Larry would be on vacation. He also used those phone calls to learn a little bit about the product. He placed his reservations at the restaurant for the wrong time, ensuring "casual" discussion at the bar.
Posts
No comments:
Post a Comment