Freaks Macintosh Archive/Freaks Macintosh Archive.bin/Freaks Macintosh Archives/Textfiles/zines/hir/hir3 Folder.sit/hir3 Folder/HIR3-2.TXT

Text File | 1997-12-29 | 10KB | 337 lines

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

        The Official HiR Guide To The Art Of Social Engineering

                                By: Axon

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-



        First and foremost, I want to thank the Social Engineering Panel at

2600's Beyond HOPE In August 1997.  I was not able to attend the meeting,

but, thanx's to Izaac who RealAudio'd Most of the BH stuph, I was able to

add quite a bit to my SE (Social Engineering) knowledge.  Shoutouts to them

all!



        As I was mentioning, I gathered most of my information from personal

experience, THE Social Engineering Panel at BH, and the Social Engineering

FAQ.



Part 1: What exactly IS social engineering anyway?



Straight from the New Hacker's Dictionary, this is da definition:



social engineering: /n./  Term used among crackers and

        samurai for cracking techniques that rely on weaknesses in

        wetware rather than software; the aim is to trick people into

        revealing passwords or other information that compromises a target

        system's security.  Classic scams include phoning up a mark who has

        the required information and posing as a field service tech or a

        fellow employee with an urgent access problem.  See also the

        tiger team story in the patch entry.



okay, lingo check.  Some may not be able to understand some of the words in

there.  (If the above definition seems at all hazy or vague to you, you really

ought to pick up the Hacker's Jargon File or New Hacker's Dictionary).  I'll

go over a few less-commonly used words.  Wetware is referring to the human

brain.  This will be discussed later.  Samurai are hackers who hire themselves

out for legal hacking jobs.  The above definition does not include phreaks and

hackers in the scheme.  Matter of fact, social engineering doesn't have to be

about technology at all (We'll talk about that later, too).



        When you get right down to it, Social engineering is basically the

same as "Bullshitting", except it is used differently, in a more subtle manner

than flat-out lying.





Part 2: What is SE used for?  What good is learning how to bullshit people?



        Social Engineering is not typically done just for fun.  Usually, it

is an art reserved for finding out some info about a company, certain computer

network or server, person, or product.  One might try to use SE to get a

password out of a person with a standard user-level account on a specific

server (once a hacker has a user-level account, it's only a matter of time

before he can get root on the system).  Maybe you want free stuff.  Who knows.

Knowsing how to SE is a good thing to know, however.  No metter how secure a

system is, there is always the loser who isn't quite all there in-between the

ears, and will divulge a password over the phone believing you're a tech.  I

am sure that you'll find that the computers may not have security holes, but

the people who run them are the weakest link in the chain.





Part 3: How is SE done?



        The first thing you do is gather info.  Research.  Do they have a web

site?  Go for it.  Look for employee names, extension numbers, product or

service lists.  Do NOT jump into the situation blind.  Jump into their trash

bins, without getting caught trespassing, and look for anything and everything

useful.  You can even go up to them face-to-face, although this is a method I

would not recommend to anyone.  A more detailed way of getting information on

your mark is to dial them up on the phone.



        Sometimes you need to make multiple phone calls to your mark to get

through.  An SE panel member gave a good example that I will outline with my

own paraphrasing cuz i don't know exact words.  Call up your mark, and ask for

a certain department, maybe information Services if it's a college, or some

kind of thing like that.  Ask for the manager/leader/head/etc of that

department, and see if you can get a name.  If you can't, hang up and call

later, stating you need to mail something to the head of x department, and

need the name and mailing address.  Bingo, you have a name.  Later, you can

call and say "I need to fax John Smith this quote, could i get his Fax number"

and you have even more info.



        You can call somewhere, pretending to be a different branch (the BH

people picked on k-mart) that's having some sort of problem, in this case,

getting the PA system in the store to work.  So the hacker calls up a random

k-mart, asks for the menswear department, then, once menswear is on the phone,

requests a manager.  He tells the manager he's from a random k-mart in the

phone book, and asked if he was having trouble using the PA system.  The

hacker said that he normally dials 50 to get on the PA but that isn't working,

then the manager corrected him "50?  I've never heard of that.  Try 613." and

hung up.  Later he called back and asked for Shoes, then bullshitted about

sandals for a while, then asked to be transferred to 613.  After a couple of

seconds, he blared into the phone, deepening his voice, saying "Attention

K-mart shoppers: Everything in aisle 4 is FREE!" then hung up...



        Another very good technique was utilized in that last scenario.  Note

that the hacker did not ASK for the extension to the PA system.  He told the

manager what he thought it was, then proceeded to let himself be corrected.

this is a tactic that can be used to get passwords easily.  Use research to

find a mark that is potentially kind of slow, technologically.  Don't pick a

nerd to SE, pick the technophobe in he bunch, because a good scare will help

them give you the info.  Tell them that his system had a virus and you just

cleaned it, and now you're checking everyone's accounts for traces, so it

won't happen again.  Tell them "according to our records, your password is

xxxxxxxx (insert some stupid password there)."  Sure as hell if he's really

as dumb as you thought he was, you'll be corrected by him telling you what his

password REALLY is.



        SE is not limited to phone conversation, though.  You can use the same

technique with e-mail (spoofing, too), And in person, as i was dicussing

toward the beginning.  I'll leave the e-mail up to you, as I have never seen

it work without using phone SE too (Such as sending an e-mail from <some made

up company>, and then calling and saying "yah, this is <some name> from <that

made-up company>, i sent you an email the other day...") you get the picture.



        I've only seen live social engineering work once, when some guy went

into a company's doors with a huge array of A/V equipment, and fake press

cards, saying they were putting together a documentary of technology in the

kansas City area for journalism class as a final project, and wondered if they

could include this place, talked to the big guy in charge there, who was more

than happy to have some extra advertisement, and gave them a tour of the whole

placee (or most of it).  He taped everything.  Things he got on tape were

codes to unlock doors (they only had 3 different codes that he saw on about 8

doors), locations of certain rooms containing things of interest, he even got

a tour of a big room that people were working in, and was fortunate enough to

tape a guy logging on to a computer (although the last 2 letters of the

password weren't seen, he knew what side of the keyboard they were on.)  =]



        You can call tech-support lines and SE with techs.  In most companies,

the technicians are GODS.  They are omniscient, and can get you what you want.

Be careful, though.  They are usually fairly intelligent, too.  You can try to

get them to divulge specs on products, or maybe they can fax you a few white

papers or whatever else they have access to.



Part 4: Extra Tips and helpful SE Hints.



If your mark is a large company (more than 500 people) than find out enough

about that company to sound like you are with them.  Most company members will

tell co-workers anything they want to know.



Remember that humans are creatures of habit.  People's habits can be monitored

and exploited.  Just remember that you, too are human.  Hackers should strive

to be an exception to the rule.  Do not be a creature of habit, because that

is how hackers are caught.



Using an accent is helpful.  Make sure you stay on accent.  Try Japanese,

scottish, etc.  (Note: The most accepted accents in the U.S. are British male

and Southern Female)



To really throw your mark for a loop, combine SE tactics and SE them more than

one way at the same time.  Be careful though.



Remember that SE focuses on People as the weak link.  This is because, unlike

a computer, they respond to other humans and emotions (I.e. anger, kindness,

rushed, etc).  While you can exploit a seceratary's emotions, you can't make

a computer sympathize with you.





Part 5: Few final ideas



If you want to find someone's unlisted phone number, find out if they have

cable T.V. or some other service (in a pinch maybe electricity would work).

Call the cable, electrical, etc company, and SE them into giving you their

#.  (maybe you are ready to check out their cable and you're 1 and a half

hours ahead of schedule, and wanted to call them to see if earlier service

would be okay, whatever floats your boat)  This may also work for addresses

if you are a serviceman who "lost/forgot" the address...MAYBE.



Part 6: Conclusion



That pretty much sums it up for the HiR Guide to SE.  I hope this information

helps everyone out.  Most of this is just common sense.