Social engineering revolves around psychology. It tries to influence human behavior to reach a goal, and unfortunately it often works quite well. In my opinion the best way to educate people is by example. An interesting video is the Social Engineering LIVE demonstration from Defcon.
Most of the time a social engineer will be required to take the initiative, either by sending an email, making a phone call, or even transmitting a fax (as was first presumed in the Rapid 7 DNS hijack). Here are a few questions you should ask yourself:
- Who is contacting me here? (Remember, most contact details can be found on the Internet!)
- Why is he contacting me?
- Is the way he's contacting me normal for this company?
- Is the information he's requesting sensitive?
- Is there a way to verify that this is indeed this person?
A good approach is to use two seperate communication channels which have been established up front. For instance if you get a phone call from a certain person who's requesting that you perform some action, put down the phone and call that person back using credentials from a trusted source. For instance if someone is calling from the helpdesk, check their extension number and name. Then look it up in your companies internal phonebook and see whether it's the same. You might want to call them back yourself and see whether it's still the same person. NEVER EVER use phone numbers provided by the person itself (for this example anyway).
An example for this is the recent Microsoft support scam where attackers pretended to be Microsoft technicians. Victims were instructed to open cmd and execute a command, and then the attackers stated "hey, I'm Microsoft because I can do this". They followed this by requesting that victims shut down their anti-virus and any other security mechanisms. In cases where victims grew suspicious, the attackers would apply pressure in other ways.
In the case of a company, especially when there are procedures in place for authentication and verification, it must be ensured that there are no loop holes where protocol can be bypassed. I recently heard a story of a person trying to increase his credit card limit (often used by scammers to increase their spending ability after stealing a credit card). The person did not get his increase because he couldn't be authenticated. Which is good! But then he called customer support, got really angry and threatened to change banks. Customer support responded by increasing his credit limit without even attempting to authenticate him. This is just one example of pressuring people for nefarious purposes.
Non-IT minded people might get tricked by this so to educate them give them several examples of social engineering attacks. A good piece of advice by David Schwartzberg:
Whenever an unauthenticated person on the telephone suggests surfing to an unfamiliar website, the best thing to do is nothing. Whenever an unverified person on the telephone asks for personally identifiable information or financial information, the best thing to do is hang up. Don't even say goodbye.
If you need to know more, have a look here at social-engineering.org
US-CERT has some guidelines against social engineering as well:
- Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
- Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.
- Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
- Don't send sensitive information over the Internet before checking a website's security (see Protecting Your Privacy for more information).
- Pay attention to the URL of a website. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).
- If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group (http://www.antiphishing.org).
- Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic (see Understanding Firewalls, Understanding Anti-Virus Software, and Reducing Spam for more information).
- Take advantage of any anti-phishing features offered by your email client and web browser.
What should you do if you are a victim?
If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.
If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.
Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.
Watch for other signs of identity theft (see Preventing and Responding to Identity Theft for more information).
Consider reporting the attack to the police, and file a report with the Federal Trade Commission (http://www.ftc.gov/).
