Slashdot Mirror
The Art of Deception
The Art of Deception is extremely easy to understand and actually fun to read.
The first part of the book, Behind the Scenes contains the first chapter, Security's Weakest Link, which describes through many examples how and why the social engineer is able to so easily manipulate people to get what he wants.
Part 2, The Art of the Attacker, contains chapters 2-9, which describe various ways a social engineer can manipulate people over the phone. Each chapter tells of a different method that could be used to gain information. Each chapter also contains at least one example.
Part 3, Intruder Alert, contains chapters 10-14, which tell about different ways a social engineer can get inside a company, whether physically or through an internal contact. Each chapter contains at least one example.
Part 4, Raising the Bar, contains chapters 15 and 16, which explain how a company should create their security policies and training to prevent the social engineer from gaining access to sensitive information. These chapters are definitely more geared toward the executive, security analyst, or other specialist, as they contain specifics on what new policies should be implemented and why.
The last section in the book, Security at a Glance, contains some charts and information which should be read over by a more general audience, such as employees and other people that may be contacted by a social engineer.
And one sidenote: there's a nice little foreword by Woz (Steve Wozniak).
The Summary Although this book is geared toward the company security expert, this book also has appeal to anyone with an interest in social engineering. I found it to be a quick and fun read. As a social engineer, this book taught me new tactics to try as well as ways that my targets might be prevented from giving me information I seek.Table of Contents
Foreword
Preface
Introduction
Part 1 Behind the Scenes
* Chapter 1 Security's Weakest Link
Part 2 The Art of the Attacker
* Chapter 2 When Innocuous Information Isn't
* Chapter 3 The Direct Attack: Just Asking for It
* Chapter 4 Building Trust
* Chapter 5 "Let Me Help You"
* Chapter 6 "Can You Help Me?"
* Chapter 7 Phony Sites and Dangerous Attachments
* Chapter 8 Using Sympathy, Guilt and Intimidation
* Chapter 9 The Reverse Sting
Part 3 Intruder Alert
* Chapter 10 Entering the Premises
* Chapter 11 Combining Technology and Social Engineering
* Chapter 12 Attacks on the Entry-Level Employee
* Chapter 13 Clever Cons
* Chapter 14 Industrial Espionage
Part 4 Raising the Bar
* Chapter 15 Information Security Awareness and Training
* Chapter 16 Recommended Corporate Information Security Policies
Security at a Glance
Sources
Acknowledgments
Index
You can purchase The Art of Deception from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Doesn't the US DCMA NOT allow for tools that bypass security? I wonder how soon it will be before someone tries to use the DCMA against someone who used social engineering.
"If you are on fire you can just stop, drop, and roll. If you fall into Lava you are just dead." - my 5yr old daughter
there are always people that will have contact with them from the inside
Can't you get cryptographic keys that are sealed inside a black box device so that no-one can access them? Couldn't this sort of thing be done for at least some hardware?
Oh dear, I think I've just justified security through obfuscation.
Is generally the users. Excluding those who run open mail relays, most servers/sysadmins have enough brains not to run the file in their email coming with a message:
.exe/.vbs/etc entirely.
This iz a very fun game
I hope you anjoy it
I made this just for u
How users manage to continually fall for this idiocy is beyond me, but they do. My family is a prime example of this (they refer to me when something dies, but never listen to my "do not open attachments" rant): thus, they now get Mozilla and I'll probably block emails with
Just based on the chapter titles, I think tricks such as the "Let me help you", etc are probably some of the nastiest. Considering the many people who seem to know shiat about progamming and come for help, it wouldn't be hard to slip something cruel into your "sample code."
It's amazing how, after helping somebody directly with something for 30 minutes or so, they're suddenly willing to let me
a) Have root access to their machine ('nix)
b) Control their PC (netmeeting/etc windows)
Luckily I'm a nice person, but not everybody is so helpful as they appear. Social engineering is definately an increasing trend, which is leading to user pananoia. I still don't think that the statement "One of the weakest links to the most secured computer systems are the humans that operate them."
A good sysadmin will block a lot of things that lead to exploitation (unused ports, etc), and perhaps notice odd happenings/traffic. It's the operators of the less-secure systems (clients) that are at risk most often.
SmartCard security, ATM cards, and a host of other security solutions (not just along the card theme) already employ the "Something you have, something you know" security scheme in which sensitive things can only be accessed if you have both a device (usually containing some sort of identifier) as well as a password.
Another interesting version of this system involves a keychain or some similar device that contains a computer whose only job is to take some encryption key and scramble it every n time interval. The central sever is doing the same thing. The end result is that the user has to know two passwords - his normal password, plus a key that changes every minute or what have you.
One of the anecdotes in this book exploits a SecurID, using a well-meaning 3rd party. Basically a caller poses as an employee when talking to an operator during a snowstorm. He says he needs to get some work done, but he left his SecurID on his desk. The operator doesn't want to go to the desk to get it, so instead he gives his own SecurID number and PIN to the caller. This was probably one of the most clever manipulations in the book.
Fundamentally, any time you have a human involved in a process, you have a potential security hole.
-Alison
Not really, there are plenty of people are not willing to take bribes.
The easiest way to manipulate people is to pretend to be their friend. We tend to let our friends do things that don't jive with bueracratic and annoying rules, because they are friends.
Nazi-like policies and a lack of user education from arrogant and obnoxious IT people results in social engineering exploits.
Conformity is the jailer of freedom and enemy of growth. -JFK
You wrote: "However, I'm not so sure his tactics will work as well as they did a few years ago"
That's because we're so much smarter about security now, right?
Well, we are smarter now. We are the people who have been around computers for a few years now (enough to be intersted in /. reviews of security books). However, every single day there's a new sucker using a computer for the very first time.
I'm absolutely certain that I could sucessfully use all of those tricks against the company I currently work for.
But I've cut off his thumb, let me in...
The reader would probably check if there is blood circulating through the thumb. I don't know about the commmercial fingerprint readers, but the retinal scanners definitely do that. You could maybe fool them with some kind of specialized pump, but it's not something the average thief could concoct.
-a
"The majority of the successful attacks on operating systems come from only a few software vulnerabilities ..."
That's basically why the Counterpane guys are now leaning towards "distributed security." The idea is not to let any one password (or person) have enough access to anything to cause problems. I read an article somewhere in which Schneier pointed out, among other stuff, that far too many people use the same password everywhere. Thus if you get hacked on amazon.com, the thief will get into your fidelity.com account and your employer's network as well.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
A HUGE part of my job is preventing social engineering type stuff (or if you want to be specific - evaluating the degree to which a client has successfully implemented good risk management and security management). I interview people all the time, and I assure you that waving $100 is the most sure fire way to not get what you want.
People are more afraid of getting caught, of loosing their job or of getting in trouble than I think you realize. That said, it is amazing the things people do, if they think they're supposed to do them.
I'll routinely call people at a client and just start asking questions to total strangers. I've been in server rooms interviewing people and I'll ask questions like, "How does a visitor get access to this room?" When they answer, I'll ALWAYS follow up with, "Why was I not subjected to that procedure?" I'm legitimately supposed to get access to the information I get, and I sign NDAs and get approval for everything I do. Not once have I ever been challenged to provide that information. (For some reason, if you call the manager of a department and tell him that you'll be talking to his employees and why - they assume you're legitimate.)
Show up, talk the talk and look like you belong there and people will tell you anything. Wave around $100 and people call security.
I hope I'm not the only one out there who gets disgusted everytime I here the term "social engineering" used to describe what is essentially taking advantage of individuals who are only guilty of being naive and trusting. I've spent my entire adult life around engineers, and almost without exception, the one thing they all had in common was that they work hard to create something new and useful for the benefit of others. The coining of the term "social engieering" to describe the under-handed techniques used to get people to betray the security of their system is, to me, an afront to engineers everywhere. I have no idea what thought process lead Mr. Mitnick to describe what is essentially a con artist as some sort of engineer. In my mind, an engineer is someone you can trust and can rely on to get a job done. The key words being trust and rely upon.
Mr. Mitnick, if you are reading this, I would ask that you please reconsider popularlizing the term "social engineering" to describe what you did. I'd much rather the term engineer continue to be synonomous with helpful and useful rather than deceitful and untrustworthy.
(For a better example of what I would consider social engineering, please refer to _Childhood's End_ by Arthur C. Clarke.)