Timeline for Is social-engineering an actual threat
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 21, 2012 at 22:09 | comment | added | João Portela | @BillK if we go down that route everything is a human problem since software is written by humans, servers are configured by humans, etc.. That's why I said "where is the social engineering in that?", trying to avoid going down that same route. | |
| Feb 21, 2012 at 22:05 | comment | added | João Portela | @zephyr if he meant that he should have written it. Appart from that I agree that it cannot be easily hardened against. | |
| Feb 20, 2012 at 23:10 | comment | added | Bill K | Also, honestly I'd say that an FTP server open to an insecure network WAS a human problem--as is finding passwords in email. It's like buying a bathroom door lock that you can unlock with your fingernail and using it to secure your front door--The systems are fine, you are implementing them wrong! | |
| Feb 20, 2012 at 19:23 | comment | added | so12311 | @JoãoPortela obviously what he means by "humans will always be the weakest element" is that the human element is the one which cannot be easily or completely hardened against attack - and this is unlikely to ever change. | |
| Feb 20, 2012 at 17:18 | comment | added | João Portela | @ordag The point I was trying to make with my example, was that the weakest element was not the human element but rather the technical element (I was in no way implying that social engineering attacks where impossible). | |
| Feb 20, 2012 at 16:31 | comment | added | ordag | @JoãoPortela You can sniff such ftp packets and gain the same access rights as the observed user. Or you can trick the server admin to create a root account for you. Of course not everything else is secure because human behavior is not. Humans tend to look over the edge, they are not strict machines which just verify: "Username. Ok. Password. Ok." but instead (unconsciously) analyze the context: "Can I trust that person even if there are some inconsistencies?". And I hope we will always be the weakest element, because that weakness is trust, and I wouldn't want to give that up. | |
| Feb 20, 2012 at 14:08 | comment | added | João Portela | totally disagree, human beings are not always the weakest member. If some server only accepts ftp connections for file transfers, all you have to do to gain access is sniff some packets to read the username and password, where is the social engineering in that? Was the human being the weakest element? As for the "will always be" part, I don't know where you're getting your information from. | |
| Feb 20, 2012 at 9:50 | comment | added | Joachim Sauer | @MarekSebera: that only really helps if the boss himself is not susceptible to social engineering attacks. And that would be a very optimistic assumption. | |
| Feb 20, 2012 at 2:00 | comment | added | Marek Sebera | yes, but in most particular cases similar to this one, we should be able to eliminate possibility of breaching system like this, simply by applying security conventions. Which means, we don't allow the secretary to do anything on her bosses computer, because it would be security violation... | |
| Feb 19, 2012 at 21:31 | history | answered | ordag | CC BY-SA 3.0 |