segunda-feira, 22 de janeiro de 2024

CEH: Fundamentals Of Social Engineering


Social engineering is a nontechnical method of breaking into a system or network. It's the process of deceiving users of a system and convincing them to perform acts useful to the hacker, such as giving out information that can be used to defeat or bypass security mechanisms. Social engineering is important to understand because hackers can use it to attack the human element of a system and circumvent technical security measures. This method can be used to gather information before or during an attack.

A social engineer commonly uses the telephone or Internet to trick people into revealing sensitive information or to get them to do something that is against the security policies of the organization. By this method, social engineers exploit the natural tendency of a person to trust their word, rather than exploiting computer security holes. It's generally agreed that users are the weak link in security; this principle is what makes social engineering possible.

The most dangerous part of social engineering is that companies with authentication processes, firewalls, virtual private networks, and network monitoring software are still wide open to attacks, because social engineering doesn't assault the security measures directly. Instead, a social-engineering attack bypasses the security measures and goes after the human element in an organization.

Types of Social Engineering-Attacks

There are two types of Social Engineering attacks

Human-Based 

Human-based social engineering refers to person-to-person interaction to retrieve the desired information. An example is calling the help desk and trying to find out a password.

Computer-Based 

​Computer-based social engineering refers to having computer software that attempts to retrieve the desired information. An example is sending a user an email and asking them to reenter a password in a web page to confirm it. This social-engineering attack is also known as phishing.

Human-Based Social Engineering

Human-Based further categorized as follow:

Impersonating an Employee or Valid User

In this type of social-engineering attack, the hacker pretends to be an employee or valid user on the system. A hacker can gain physical access by pretending to be a janitor, employee, or contractor. Once inside the facility, the hacker gathers information from trashcans, desktops, or computer systems.

Posing as an Important User

In this type of attack, the hacker pretends to be an important user such as an executive or high-level manager who needs immediate assistance to gain access to a computer system or files. The hacker uses intimidation so that a lower-level employee such as a help desk worker will assist them in gaining access to the system. Most low-level employees won't question someone who appears to be in a position of authority.

Using a Third Person

Using the third-person approach, a hacker pretends to have permission from an authorized source to use a system. This attack is especially effective if the supposed authorized source is on vacation or can't be contacted for verification.

Calling Technical Support

Calling tech support for assistance is a classic social-engineering technique. Help desk and technical support personnel are trained to help users, which makes them good prey for social-engineering attacks.

Shoulder Surfing 

Shoulder surfing is a technique of gathering passwords by watching over a person's shoulder while they log in to the system. A hacker can watch a valid user log in and then use that password to gain access to the system.

Dumpster Diving

Dumpster diving involves looking in the trash for information written on pieces of paper or computer printouts. The hacker can often find passwords, filenames, or other pieces of confidential information.

Computer-Based Social Engineering

Computer-based social-engineering attacks can include the following:
  • Email attachments
  • Fake websites
  • Pop-up windows


Insider Attacks

If a hacker can't find any other way to hack an organization, the next best option is to infiltrate the organization by getting hired as an employee or finding a disgruntled employee to assist in the attack. Insider attacks can be powerful because employees have physical access and are able to move freely about the organization. An example might be someone posing as a delivery person by wearing a uniform and gaining access to a delivery room or loading dock. Another possibility is someone posing as a member of the cleaning crew who has access to the inside of the building and is usually able to move about the offices. As a last resort, a hacker might bribe or otherwise coerce an employee to participate in the attack by providing information such as passwords.

Identity Theft

A hacker can pose as an employee or steal the employee's identity to perpetrate an attack. Information gathered in dumpster diving or shoulder surfing in combination with creating fake ID badges can gain the hacker entry into an organization. Creating a persona that can enter the building unchallenged is the goal of identity theft.

Phishing Attacks

Phishing involves sending an email, usually posing as a bank, credit card company, or other financial organization. The email requests that the recipient confirm banking information or reset passwords or PINs. The user clicks the link in the email and is redirected to a fake website. The hacker is then able to capture this information and use it for financial gain or to perpetrate other attacks. Emails that claim the senders have a great amount of money but need your help getting it out of the country are examples of phishing attacks. These attacks prey on the common person and are aimed at getting them to provide bank account access codes or other confidential information to the hacker.

Online Scams

Some websites that make free offers or other special deals can lure a victim to enter a username and password that may be the same as those they use to access their work system.
The hacker can use this valid username and password once the user enters the information in the website form. Mail attachments can be used to send malicious code to a victim's system, which could automatically execute something like a software keylogger to capture passwords. Viruses, Trojans, and worms can be included in cleverly crafted emails to entice a victim to open the attachment. Mail attachments are considered a computer-based social-engineering attack.Related articles
  1. Kik Hack Tools
  2. Pentest Tools Find Subdomains
  3. Computer Hacker
  4. Tools 4 Hack
  5. Best Hacking Tools 2019
  6. Hacker Tools Hardware
  7. Hacker Tools Free
  8. Hacker Tools For Pc
  9. Hack Tools
  10. Tools Used For Hacking
  11. Hacker Tools Online
  12. Best Pentesting Tools 2018
  13. Pentest Tools For Mac
  14. Pentest Automation Tools
  15. Github Hacking Tools
  16. What Is Hacking Tools
  17. Usb Pentest Tools
  18. Hacker Tools List
  19. Hacker Tool Kit
  20. Pentest Tools Android
  21. Hacking Tools Windows
  22. Hacking Tools Name
  23. Hacking Apps
  24. Hacking Tools Name
  25. Hacking Tools Online
  26. Hacking Tools For Games
  27. Hacking Tools For Beginners
  28. New Hacker Tools
  29. Hacking Tools For Windows
  30. Nsa Hack Tools
  31. Hacking Tools Usb
  32. Ethical Hacker Tools
  33. Pentest Tools
  34. Nsa Hacker Tools
  35. What Is Hacking Tools
  36. Pentest Tools Github
  37. Hacking Tools For Windows Free Download
  38. Hacking Tools For Games
  39. Hackers Toolbox
  40. Hacker Search Tools
  41. Hacker Tools 2020
  42. Pentest Tools Github
  43. Pentest Tools Apk
  44. Kik Hack Tools
  45. Github Hacking Tools
  46. Hacking Tools Software
  47. Pentest Tools Subdomain
  48. Hacker Tools Windows
  49. Hacker Tools Free Download
  50. Black Hat Hacker Tools
  51. Pentest Tools Bluekeep
  52. Hacker Tools Mac
  53. Hacker
  54. Hacks And Tools
  55. Nsa Hacker Tools
  56. New Hack Tools
  57. Growth Hacker Tools
  58. Top Pentest Tools
  59. Hacker Techniques Tools And Incident Handling
  60. Hacker Tool Kit
  61. Pentest Tools Free
  62. Pentest Tools Tcp Port Scanner
  63. Hacking Tools
  64. Hacking Tools For Kali Linux
  65. World No 1 Hacker Software
  66. Pentest Tools Nmap
  67. Hack Tools 2019
  68. Hack Tools
  69. Hacking Tools Kit
  70. Pentest Tools Port Scanner
  71. Tools 4 Hack
  72. Computer Hacker
  73. Hacker Tools Github
  74. Pentest Tools For Ubuntu
  75. Best Hacking Tools 2019
  76. Hacker Tools Software
  77. Hacker Tools List
  78. Usb Pentest Tools
  79. Hacking Tools Free Download
  80. Hackers Toolbox
  81. Hack Tools Download
  82. Hacker Tools Linux
  83. Hacker Tools For Ios
  84. Best Hacking Tools 2019
  85. Wifi Hacker Tools For Windows
  86. Pentest Tools Apk
  87. Pentest Tools For Mac
  88. Beginner Hacker Tools
  89. Pentest Tools Website
  90. Hacking Tools For Pc
  91. How To Install Pentest Tools In Ubuntu
  92. Computer Hacker
  93. Hacker Tools Windows
  94. Tools 4 Hack
  95. Pentest Tools List
  96. Pentest Tools Download
  97. Hacker Tools 2020
  98. Hacking Tools 2019
  99. Pentest Tools Kali Linux
  100. Pentest Tools Website
  101. Hacking Tools For Windows
  102. Hack Tools 2019
  103. Pentest Tools Windows
  104. Hacks And Tools
  105. Pentest Box Tools Download
  106. Hacking Tools For Windows 7
  107. Pentest Recon Tools
  108. Hacking Tools Free Download
  109. Hack Tools Mac
  110. Hack Tools For Ubuntu
  111. Pentest Tools For Mac
  112. Hacking Tools 2020
  113. Hacker Tools For Ios
  114. Top Pentest Tools
  115. How To Install Pentest Tools In Ubuntu
  116. Tools Used For Hacking
  117. Hacker Hardware Tools
  118. Pentest Tools For Ubuntu
  119. Best Pentesting Tools 2018
  120. Hack Tools Pc
  121. Nsa Hacker Tools
  122. Pentest Tools Github
  123. What Are Hacking Tools
  124. Pentest Tools For Windows
  125. Hacking Tools For Mac
  126. Hak5 Tools
  127. Hacker Tools
  128. Hacking Tools Pc
  129. Hacks And Tools
  130. Pentest Tools Download
  131. Hack Tools For Mac
  132. Hacker Security Tools
  133. What Are Hacking Tools
  134. Hacking Tools For Games
  135. Hak5 Tools
  136. Top Pentest Tools
  137. Hack Tools 2019
  138. Hacking Tools Online
  139. What Is Hacking Tools
  140. Hacking Tools
  141. Hacking Tools Download
  142. Best Pentesting Tools 2018
  143. Hacker Tools Software
  144. Hacking Tools Mac
  145. Hacking Tools Kit
  146. Hacking Tools Mac
  147. Hacking Apps
  148. Pentest Tools For Mac
  149. Hacking Tools And Software
  150. Github Hacking Tools
  151. How To Make Hacking Tools
  152. Hacker Tools Apk
  153. Pentest Tools Free
  154. Hacking Tools Windows 10
  155. Pentest Tools Kali Linux
  156. Termux Hacking Tools 2019
  157. Pentest Tools For Windows
  158. Game Hacking
  159. Pentest Tools Free
  160. Hacking Tools Mac
  161. Hacker

Sem comentários: