Posted at 8:30 a.m. - Friday, April 24
As I mentioned in my last posting, the ChicagoCon Ethical Hacking Conference returns on May 8-9th, 2009 with a focus on 'Social Engineering.'
Yesterday, Donald C. Donzal, Editor-In-Chief of The Ethical Hacker Network & the founder and organizer of ChicagoCon, explained what Social Engineering was. Now he helps non-nerds understand what they can do to prevent getting scammed by 'human hackers':
G2M: What are some of the things that people need to be aware of?
Donald Donzal: I’m glad you used the word aware. Awareness is the most powerful tool against these types of attacks. Now that you simply know of some examples from the above answers, do you think you are less susceptible? I would think so.
G2M: Is 'social engineering' always a bad thing?
DD: No. If the same techniques are used by an organization to test their own security, then they can plug the holes that will eventually be used by the bad guys. This method goes by many names including ethical hacking, penetration testing or if you’re an accounting firm, it’s an audit. There are even courses that teach corporations how to incorporate the thinking of the bad guys into their own audits of the internal networks, wireless networks and web-enables applications. One such class even exists for SE. The Social Engineering Master Class instructs students on how attacking humans is actually a repeatable process suitable for inclusion in their audits. I thought this was such a fantastic idea, that I brought the class to my local security event, ChicagoCon May 4 – 9.
G2M: What are some of the most famous/infamous cases of social engineering?
DD: (Bernard) Madoff is the best example
right now. He took advantage of people based on three very human
traits: 1. Our ability and need to trust 2. Our desire to make money
3. Our need to feel good about ourselves and give to charitable
organizations. He later added a fourth which is our desire to be
part of the ‘in’ crowd. You couldn’t just go to Bernie Madoff and
ask to be part of his investment group. You had to be recommended
by a current client… er… victim. Now that’s slick. As far as a
popular attack not necessarily linked to a single case, there’s
phishing. Phishing and its variants are huge right now. In fact,
there’s so much information of individual people online these days
that Spear Phishing, direct attacks on specific individuals, is
much easier. If you can target one person or a smaller group of
people who have what you want, your rate of success is much
greater. And if an email message looks like it came from your bank,
the link looks like your banks web site and the graphics match your
banks logo and envelopes, then it must be from your bank, right?
And now for the final push over the edge, why don’t we just add a
small threat like, “If you don’t act now, your account will be
frozen.” That’s pretty slick, too. And it again preys on our
natural fears as human beings.
G2M: What are some simple things that people can do to protect
themselves?
DD: There are many answers to
this, but the simplest answer should come first. The use of common sense works like a charm. These
attacks were here long before computers, so the best defenses are
the same that they were 2000 years ago. If a Nigerian Politician
needs you to send him $30,000 to get him out of the country, and I
turn he’ll give you $1,000,000, just delete the email! When people
got this in their snail mailboxes 50 years ago, throwing it away
was the best answer. That remains true today. Awareness as
mentioned above is also a great protection.
******************
For more information on ChicagoCon09, visit the event website and also be sure to check out the Ethical Hackers Network site!
