Understanding Web Spiders
Spammers and anyone else interested in collecting email addresses from the Internet can
use web spiders. A web spider combs websites collecting certain information such as email
addresses. The web spider uses syntax such as the @ symbol to locate email addresses and
then copies them into a list. These addresses are then added to a database and may be used
later to send unsolicited emails.
Web spiders can be used to locate all kinds of information on the Internet. A hacker can
use a web spider to automate the information-gathering process. A method to prevent web
spidering of your website is to put the robots.txt file in the root of your website with a
listing of directories that you want to protect from crawling.
Social Engineering
Social engineering is a nontechnical method of breaking into a system or network. It’s the
process of deceiving users of a system and convincing them to perform acts useful to the
hacker, such as giving out information that can be used to defeat or bypass security mechanisms.
Social engineering is important to understand because hackers can use it to attack
the human element of a system and circumvent technical security measures. This method
can be used to gather information before or during an attack.
A social engineer commonly uses the telephone or Internet to trick people into revealing
sensitive information or to get them to do something that is against the security policies of
the organization. By this method, social engineers exploit the natural tendency of a person
to trust their word, rather than exploiting computer security holes. It’s generally agreed
that users are the weak link in security; this principle is what makes social engineering
possible.
The following is an example of social engineering recounted by Kapil Raina, currently
a security expert at VeriSign, based on an actual workplace experience with a previous
employer:
One morning a few years back, a group of strangers walked into a large
shipping firm and walked out with access to the firm’s entire corporate
network. How did they do it? By obtaining small amounts of access, bit
by bit, from a number of different employees in that firm. First, they did
research about the company for two days before even attempting to set
foot on the premises. For example, they learned key employees’ names by
calling HR. Next, they pretended to lose their key to the front door, and a
man let them in. Then they “lost” their identity badges when entering the
third floor secured area, smiled, and a friendly employee opened the door
for them.
The strangers knew the CFO was out of town, so they were able to enter
his office and obtain financial data off his unlocked computer. They dug
through the corporate trash, finding all kinds of useful documents. They
asked a janitor for a garbage pail in which to place their contents and
carried all of this data out of the building in their hands. The strangers
had studied the CFO’s voice, so they were able to phone, pretending to be
the CFO, in a rush, desperately in need of his network password. From
there, they used regular technical hacking tools to gain super-user access
into the system.
In this case, the strangers were network consultants performing a security
audit for the CFO without any other employees’ knowledge. They were
never given any privileged information from the CFO but were able to
obtain all the access they wanted through social engineering.
The most dangerous part of social engineering is that companies with authentication
processes, firewalls, virtual private networks, and network-monitoring software are still
wide open to attacks, because social engineering doesn’t assault the security measures
directly. Instead, a social-engineering attack bypasses the security measures and goes after
the human element in an organization.
Types of Social Engineering-Attacks
Social engineering can be broken into two common types:
Human-Based Human-based social engineering refers to person-to-person interaction to
retrieve the desired information. An example is calling the help desk and trying to find out
a password.
Computer-Based Computer-based social engineering refers to having computer software
that attempts to retrieve the desired information. An example is sending a user an email
and asking them to reenter a password in a web page to confirm it. This social-engineering
attack is also known as phishing.
We’ll look at each of these more closely in the following sections.
Human-Based Social Engineering
Human-based social engineering techniques can be broadly categorized as follows:
Impersonating an Employee or Valid User In this type of social-engineering attack, the
hacker pretends to be an employee or valid user on the system. A hacker can gain physical
access by pretending to be a janitor, employee, or contractor. Once inside the facility, the
hacker gathers information from trashcans, desktops, or computer systems.
Posing as an Important User In this type of attack, the hacker pretends to be an important
user such as an executive or high-level manager who needs immediate assistance to
gain access to a computer system or files. The hacker uses intimidation so that a lower-level
employee such as a help desk worker will assist them in gaining access to the system. Most
low-level employees won’t question someone who appears to be in a position of authority.
Using a Third Person Using the third-person approach, a hacker pretends to have permission
from an authorized source to use a system. This attack is especially effective if the supposed
authorized source is on vacation or can’t be contacted for verification.
Calling Technical Support Calling tech support for assistance is a classic social-engineering
technique. Help desk and technical support personnel are trained to help users, which
makes them good prey for social-engineering attacks.
Shoulder Surfing Shoulder surfing is a technique of gathering passwords by watching over
a person’s shoulder while they log in to the system. A hacker can watch a valid user log in
and then use that password to gain access to the system.
Dumpster Diving Dumpster diving involves looking in the trash for information written
on pieces of paper or computer printouts. The hacker can often find passwords, filenames,
or other pieces of confidential information.
A more advanced method of gaining illicit information is known as reverse social engineering.
Using this technique, a hacker creates a persona that appears to be in a position
of authority so that employees ask the hacker for information, rather than the other way
around. For example, a hacker can impersonate a help desk employee and get the user to
give them information such as a password.
Computer-Based Social Engineering
Computer-based social-engineering attacks can include the following:
Email attachments Û n
Fake websites Û n
Pop-up windows Û n
Insider Attacks
If a hacker can’t find any other way to hack an organization, the next best option is to infiltrate
the organization by getting hired as an employee or finding a disgruntled employee to
assist in the attack. Insider attacks can be powerful because employees have physical access
and are able to move freely about the organization. An example might be someone posing
as a delivery person by wearing a uniform and gaining access to a delivery room or loading
dock. Another possibility is someone posing as a member of the cleaning crew who has
access to the inside of the building and is usually able to move about the offices. As a last
resort, a hacker might bribe or otherwise coerce an employee to participate in the attack by
providing information such as passwords.
Identity Theft
A hacker can pose as an employee or steal the employee’s identity to perpetrate an attack.
Information gathered in dumpster diving or shoulder surfing in combination with creating
fake ID badges can gain the hacker entry into an organization. Creating a persona that can
enter the building unchallenged is the goal of identity theft.
Phishing Attacks
Phishing involves sending an email, usually posing as a bank, credit card company, or other
financial organization. The email requests that the recipient confirm banking information
or reset passwords or PINs. The user clicks the link in the email and is redirected to a fake
website. The hacker is then able to capture this information and use it for financial gain or
to perpetrate other attacks. Emails that claim the senders have a great amount of money
but need your help getting it out of the country are examples of phishing attacks. These
attacks prey on the common person and are aimed at getting them to provide bank account
access codes or other confidential information to the hacker.
Online Scams
Some websites that make free offers or other special deals can lure a victim to enter a username
and password that may be the same as those they use to access their work system.
The hacker can use this valid username and password once the user enters the information
in the website form.
Mail attachments can be used to send malicious code to a victim’s system, which could
automatically execute something like a software keylogger to capture passwords. Viruses,
Trojans, and worms can be included in cleverly crafted emails to entice a victim to open the
attachment. Mail attachments are considered a computer-based social-engineering attack.
Here is an example of an email that which tries to convince the receiver to open an
unsafe attachment:
Mail server report.
Our firewall determined the e-mails containing worm copies are being sent from
your computer.
Nowadays it happens from many computers, because this is a new virus type (Network
Worms).
Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail
addresses and sends the copies of itself to these e-mail addresses
Please install updates for worm elimination and your computer restoring.
Best regards,
Customer support service
Pop-up windows can also be used in computer-based engineering attacks, in a similar
manner to email attachments. Pop-up windows with special offers or free stuff can encourage
a user to unintentionally install malicious software.
URL Obfuscation
The URL (uniform resource locator) is commonly used in the address bar of a web browser
to access a particular website. In lay terms, it is the website address. URL obfuscation consists
of hiding a fake URL in what appear to be a legitimate website address. For example,
a website of 204.13.144.2/Citibank may appear to be a legitimate web address for Citibank
but in fact is not. URL obfuscation is used in phishing attacks and some online scams to
make the scam seem more legitimate. A website address may be seen as an actual financial
institution name or logo, but the link leads to a fake website or IP address. When users
click the link, they’re redirected to the hacker’s site.
Addresses can be obfuscated in malicious links by the use of hexadecimal or decimal notations.
For example, the address 192.168.10.5 looks like 3232238085 as a decimal. The same
address looks like C0A80A05 in IP hex. This conversion requires that you divide 3232238085
by 16 multiple times. Each time the remainder reveals the address, starting from the least significant
value.
Here’s the explanation:
3232238085/16 = 202014880.3125 (.3125 × 16 = 5)
202014880/16 = 12625930.0 (.0 × 16 = 0)
12625930/16 = 789120.625 (.625 × 16 = 10 = A)
789120/16 = 49320.0 (.0 × 16 = 0)
49320.0/16 = 3082.5 (.5 × 16 = 8)
3082/16 = 192.625 (.625 × 16 = 10 = A)
192/16 = 12 = C
Social-Engineering Countermeasures
Knowing how to combat social engineering is critical for any certified ethical hacker. There
are a number of ways to do this.
Documented and enforced security policies and security awareness programs are the
most critical component in any information security program. Good policies and procedures
aren’t effective if they aren’t taught and reinforced to employees. The policies need to
be communicated to employees to emphasize their importance and then enforced by management.
After receiving security awareness training, employees will be committed to supporting
the security policies of the organization.
The corporate security policy should address how and when accounts are set up and
terminated, how often passwords are changed, who can access what information, and how
policy violations are to be handled. Also, the policy should spell out help desk procedures
for the previous tasks as well as a process for identifying employees—for example, using
an employee number or other information to validate a password change. The destruction
of paper documents and physical access restrictions are additional areas the security policy
should address. Lastly, the policy should address technical areas, such as use of modems
and virus control.
One of the advantages of a strong security policy is that it removes the responsibility of
employees to make judgment calls regarding a hacker’s request. If the requested action is
prohibited by the policy, the employee has guidelines for denying it.
The most important countermeasure for social engineering is employee education. All
employees should be trained on how to keep confidential data safe. Management teams are
involved in the creation and implementation of the security policy so that they fully understand
it and support it throughout the organization. The company security awareness policy
should require all new employees to go through a security orientation. Annual classes
should be required to provide refreshers and updated information for employees.
Another way to increase involvement is through a monthly newsletter with security
awareness articles.
