Invasion of social engineering

You must know Kevin Mitnick, the super hacker. He is very impressed by his social engineering. The US Department of Defense, the Pentagon, the Central Intelligence Agency and the North American Air Defense System ... are all places where he walks. No one doubts his true identity and feels comfortable with the information he wants. This is the charm of social engineering. Of course, social engineering is not so difficult to grasp. This paper is divided into three parts: social engineering-information probing, social engineering-application of psychology, and social engineering-query technology, so that everyone can enter the mysterious world of social engineering. What do social engineers usually do? I'm afraid small investors must want to know, yes, their goal may be your bank account, private information, or taking a business secret from the enterprise. In any case, they will always try to find a breakthrough. Even if they only need your name, they can pass the best firewall or antivirus software you installed. It sounds a little scary, but the truth is, if they start designing a trap carefully, anything is possible. So social engineering also casts a mysterious veil on people.

order

Some social engineering skills have been introduced in previous issues of >, but they are social engineering in a narrow sense, and some have nothing to do with social engineering. For example, use dirshell to scan a large number of databases. Once there is a mailbox and QQ in it, you can successfully obtain the real password by using their passwords. In fact, this has something to do with psychology. Generally speaking, the password for people under 18 is 1~2. Why is this happening? Most people pay attention to their own convenience and are confident that their information is always in a safe state. We must see that social engineering in a narrow sense is not credible. What is social engineering in a broad sense? To put it bluntly, it is an empty glove and a white wolf. It requires you not only to know the computer information of the target, but also to know the weakness of the target through information collection, that is, the regular weakness and man-made weakness, and then start to construct a well-designed trap to let the target hand over the information that the attacker wants.

The following are some misunderstandings about social engineering, some can't be called social engineering, and some side dishes are misled. For example, in order to use findpass to find the password of an online administrator, the server was shut down and the administrator was forced to log in. Remember, this is not called social engineering, but a stupid method. Although the server is off, can you know that the administrator is online? Do you have the energy to wait tomorrow or the day after tomorrow? Beginners need to know that the premise of social engineering is inseparable from information spying, and our better method is to guide the target into our control step by step from the screened information.

There is no denying that social engineering and life-related things have something in common. Social engineering, for example, can be seen in social communication, business and transaction, but people can't feel it. Even if the computer is disconnected from the internet, equipped with advanced intrusion detection system and maintained by experts, we can't ignore that everyone has weaknesses! Social engineers can not only make good use of this weakness to serve them, but more dangerously, this fleeting invasion is difficult to be detected. In short, this part makes the dishes understand the difference between narrow social engineering and broad social engineering. The first part I will walk into below is information espionage ... information spying, making good use of the information around you and making good use of the information you already know, will be able to handle emergencies well. This kind of information refers to rules, systems, methods and practices. Rules and regulations refer to the rules and regulations of an industry, which we can think of as industry rules or internal agreements. For example, in order to grab the business of booth B, it is wrong for booth A to deliberately depress the price to monopolize, which violates the anti-unfair competition law. So try to understand this kind of information between all walks of life, such as campus. Only people in the leadership will have a contact list of teachers and students in the whole school. The service industry usually has internal agreements of one kind or another, and it is very beneficial for us to know this kind of information.

In addition to those methods that we must know, what is needed is industry terminology. Seeing this, the side dishes will definitely ask what this noun is and what is its main purpose? Well, the jargon in the industry is "slang" between different industries. For example, the fishing term in our hacker community is generally considered as online fishing. Of course, the terminology in the industry is of great use, and the identity of social engineering is constantly changing. If you want to pretend to be a bank salesman, you should know some terms such as compressed loan, counter-guarantee and affiliated enterprise. Otherwise, when we try to call a branch manager, they will call the police, that is, the manager will find your attack, which shows the importance of the clause.

So at the beginning of the attack, we must make some preparations. Suppose our goal is a data recovery enterprise, we can buy a book about data recovery and get familiar with some terms and concepts. By the way, pretend to be a visitor and look at some rules and regulations on the walls or desks of employees' offices. If you go to their garbage disposal site, there will always be a pile of waste paper, but it contains important information, which we can call the value of garbage, such as the account books of some customers and the ID numbers of employees. Small dishes must understand that any information is useful. Learn the disguise of detective. Suppose we have got some information about the target, but we must get more sensitive information through dialogue. We can't let the other party find out directly, so we have to complete the disguise of identity first. Suppose the object of a side dish is the sales department of an electrical appliance branch, then we'd better pretend to be the sales staff of another branch, and we know the internal sales terms of their company, or we bring a branch sales report, so I don't think the other party will suspect that you are not an insider.

Any social engineer will make people feel that he is trustworthy, friendly and polite. However, this is all an illusion they pretend. If we want to be gentle, we need to pretend in behavior and tone. One thing that social engineers are better than detectives is that they don't need to put beards on their mouths, haha. So, if Cai Xiao wants MM to like it, she might as well imitate the boy in her mind.

Let's talk about the main points of camouflage. Under no circumstances should you reveal your true information. Maybe we will encounter some unexpected events, so when we start to prepare, we should bring a mobile phone with a small balance, and don't use it after use to avoid being suspected. There is also a communication account QQ. Never use your own QQ. You'd better prepare yourself an envelope. After you get the target information, drag the other person into the blacklist. The weakness of human nature Everyone has psychological weakness, and no one has psychological weakness forever. It can be said that this part is an important part of social engineering. They can take advantage of people's trust, helpfulness and sympathy to make you fall for it. So, how should we find such a weakness? It's simple. We just need to construct a well-designed problem, pretend to be their colleagues, and design one to help them solve the problem. Then, we will trust us because of convenience, and it will be easier to get the information we want without being discovered. Beginners must often have a lot of questions, but they are always looking for help or trying to recognize a master. I have this experience. I took 50 apprentices in one night, just joking. My method is simple. Search directly on Google: I'm looking for a master, or search on Qihoo: looking for a master. Then help them solve a problem, two or three sentences won their trust, and some of them planned to pay me, but I told him it was just a joke. This example takes advantage of their trust in those who help them. This part is the most harmful, so I will talk about it separately. Please refer to the application of social engineering-psychology. The trap of organizing information construction assumes that we have mastered the information through the target colleagues, such as the real name, contact information and vacation time of the target. That's not enough. Smart social engineers organize, classify and filter information. Construct an elaborate trap so that the target can walk in by himself. Let me make an analogy. Oh, this is a case of my friend.

A: You can't open the forum now, can you?

B: Yes, it was blank when it was opened.

A: That's because of the authentication error. I am the administrator of XX forum. You should send the user name and password of the forum to XX to prevent the system from resuming your access in the future.

Now?

A: Yes, I must restore it to you immediately, otherwise I will cancel my account.

In a short time, my friend successfully got one of his VIP accounts. Why can't the forum be opened? Is it DDOS? From this example, we can see the importance of organizing information. If B can answer the first question correctly, A may consider another way. This case is very simple, that is, B doesn't know computers and is afraid of losing his account. He has no doubt that A gave him a password, which is almost universal. Most netizens' passwords are almost universal, which will cause great losses. For example, a hacker dragged away the library (database) of this forum. Maybe his goal is to crack the encrypted password of his forum, then your password has been leaked, which is not important! The most important thing is how your password is found to be universal (usually social workers will test whether your email password is the same after getting it) and how it is confirmed to be universal, then "a bloody case caused by a password" will happen, and the loss will be the biggest! So Cai Xiao understands that seniors always tell you not to use the same password, and never tell the password to a third party. The application of psychology

To sum up, we know that human weakness is an important part of social engineering. Actually, it is an application of psychology and a branch of social engineering. This paper analyzes three typical attack cases in The Art of Deception written by Kevin Mitnick, a social engineer, from the perspective of psychology, so as to reveal the application of psychology in social engineering. In order to save space, I don't intend to copy the case, so please refer to the document "The Art of Deception" attached to the CD.

Credit check

The attacker needs to query a user's transaction record from the national bank. However, the bank could not agree to such a request, so the attacker started his action. In the first call, the attacker dialed the telephone number of the National Bank and successfully learned the internal technical terms from Jim Andrews through personal questions. In the second call, the attacker called the bank account opening office as a customer service representative of credit check, and obtained the information he wanted through investigation. In the third call, the attacker dialed the credit check office as an employee of the National Bank, and finally learned the account transaction record of the target user. The following words marked with double quotation marks are all quoted from Kevin Mitnick's analysis and summary.

When I called the bank, the first young lady, Jim, hesitated when I asked them how to prove her credit. She hesitated, not knowing whether to tell me. Hesitation gives us an effective signal. It can be said that the psychological thought at this time lies entirely in the judgment of her left brain. The left brain is in charge of speech activities (listening, speaking, reading and writing), mathematical operation, logical reasoning and other functions, and it is the center of abstract thinking. At this time, we need to give each other a credible reason. I think you must have the experience of borrowing money from abroad. When you try to ask a strange young lady, she will be a little hesitant. But if you tell her that you are a director and get lost outside and give her a director's business card, I don't think any strange young lady will refuse, because the young lady is sure that he is a director, and the business card makes her have no doubt.

You must rely on your own feelings and listen carefully to what Mark [the deceived] said and how he spoke. Each of our lives is based on two forms of information transmission. The first is the inner transmission, which is the inner description, whispering and feeling; Second, external transmission, including words, tone, expressions, manners and behaviors in contact with the outside world, determines the success of social engineering. Social engineers must filter out the most useful information through external transmission to judge each other's personality, emotional type and psychological characteristics. The reaction process of various emotions is very similar to the director's works. Yes, in order to achieve dramatic effect, they must master the audience's vision and hearing. If he wants to scare you, he will raise his voice and unexpectedly jump out of an unexpected picture on the screen; If he wants to excite you, he will use music, lights and pictures to achieve this effect. Even if it is a material, the director can make it into a comedy or a tragedy, depending on how he intends to present it on the screen. If you want to control a person's mental activities and produce physiological movements, you can completely imitate Spielberg's dexterity.

Getting information that employees think is irrelevant (actually useful) Everyone has a psychology that their unimportant information is lying around. Perhaps, they think it is convenient. When I lived on campus, people always asked me to help them withdraw money. However, they always write the password on the deposit and withdrawal card. They seem to think that others can't withdraw money without a card, so what should I do with his ID card to report the loss? You must often see someone's personal information on QQ, usually a website, a number, mobile phone, email address, personalized signature, QQ-Zone, which gives attackers great convenience and they will quickly judge your professional and psychological weaknesses. One day, a stranger said, I am from your school (company), and I know your name. Please don't doubt. Hurry to change the information, it is best not to expose the real contact information. Social engineers are good at this.

Yinfen mobile phone

The wireless communication company launched a large-scale promotion campaign. As long as you sign up for the fee, you can get a brand-new mobile phone for only a dime. However, smart people know that there are many questions to ask. However, the attacker hated the way of bundling fees, and he began to act ... The first call was to Ted of West Girard Electric Chain Store, and he lied that the customer had successfully obtained the name of another employee, William Hadley. The second call was made to Katie of Guangbei Street Chain Store, pretending that William Hadley convinced Katie that he was an insider of the chain store, and he agreed to his request and sold a one-cent mobile phone to Ted Yan Xi (the attacker).

People will naturally trust people who are familiar with the company's internal business processes and technical terms and claim to be company colleagues. In this part, I try to explain it with NLP neurolinguistics in psychology. Simply put, NLP is to study the influence of language, whether voiced or unvoiced, on nerves. Our ability is based on our ability to control the nervous system. Kevin Mitnick sends special messages through the nervous system. You know the technique often used in social engineering is to pretend to be an insider. However, as far as NLP is concerned, this technology is called imitation. NLP has three forms: belief system, psychological sequence and physiological state, and it doesn't take you much time to understand. In fact, NLP emphasizes the imitation of behavior, internal memory and physiological state, while social engineers disguise their identities and use professional terms, which is behavioral imitation. If the imitation is correct, others will not have the slightest doubt about you. Because the company emphasizes teamwork spirit, it has become the memory of every employee. You will not doubt the credibility of your colleagues' requests and help, otherwise it will run counter to the team spirit of the company unless the other party seriously confirms it.

It is necessary to introduce the internal memory function of NLP separately, which is measured by five sensory organs. In other words, our understanding of the surrounding environment is information transmitted through sight, hearing, touch, smell and taste. The information transmitted to the brain is called sensory elements, mainly visual, auditory and tactile elements. Different people have different feelings. Some people think that pictures will be more attractive to them, while others have a tendency to feel. Internal memory is rarely used in social engineering, because such attacks come and go in a hurry to ensure that they are not discovered. If you want people to trust you for a week, you haven't lost a good method. Many people must have had the experience of chasing girls. You will definitely ask her: Do you like watching movies or listening to songs? Or do you like trinkets? Suppose she says she likes watching movies (visual type), you can set off fireworks at night, or write I love you on a string of balloons, then the other person will begin to feel trust in you. Now you must understand that some families are incompatible. Suppose that men are auditory and women are visual. If a woman asks, do you love me? If a man says I love you and a woman says I can't feel you love me, obviously, they have a crisis of trust. If a man drives to her company to send a bunch of flowers, the result is obvious.

Power network fault

Bobby's task is to implant a Trojan horse into Captain Starbird's office computer. On the first call, Bobby pretended to be Eddie Martin, the service center, lied that there was a network problem and got the computer port number. On the second call, Bobby pretended that Bob asked the factory technical support to seal the port number. In the third call, Tom Delay's help fell into Eddie's trap. On the fourth call, Tom trusted Eddie completely and ran Bobby's Trojan horse program.

This time, because he helped him solve the problem, the other party was grateful, so Tom agreed to download a software to his computer. This kind of psychology exists in many people, because we can't question each other's sincere help and relax our trust in the attacker, if we can't identify this false help. As Kevin mitnick said, it's amazing that social engineers can easily get people to do things for them according to well-structured requests. The premise is to cause an automatic response based on psychological effects, relying on people's psychological shortcuts when they feel that the caller is an ally. There are many ways for people to build trust, however, they all build trust through intentional or unintentional conversation and help. But social engineers don't think so. He can investigate what problems you have encountered temporarily. If you inadvertently ask for help in forums or Google discussion groups, it will be easy for him to help you solve it, otherwise he can create problems for you in order to establish a trust relationship. We in China or most people have such a weakness for the puppet gang attacks. People are kind, and it is impossible to be alert to attackers at all times unless individuals carefully verify them. Reverse query technology

What is backtracking technology? That is, anti-detection technology. In hacker attacks, the most important part is not to successfully invade the host, but to remove traces and prevent managers from discovering that data has been invaded and forged. Similarly, social engineering also has such a concept. So, what traces should we remove to avoid the discovery of network monitoring (hereinafter referred to as network police)? This part looks at the problem from the perspective of network police, to see how they came and whether they can find clues of social engineers. Or a joke: they are not so easy to find traces. Here we use a case to illustrate. Please note that this is a virtual case. Please correct me.

location

& gt Xiao Zhang, Data Storage Service Department

Xiao Zhang was busy registering the customer who took out the information when the internal telephone rang.

Xiao Zhang: Hello, Data Storage Service Department.

Xiao Wang: I'm Xiao Wang from the data storage post-service department. Our front desk computer is out of order. Uh, I need your help.

Xiao Zhang: May I know your work permit?

Xiao Wang: Well, the ID is 97845.

Xiao Zhang: What can I do for you?

Xiao Wang: There is something wrong with our network. I need you to make a copy of the information of XX enterprise and put it in the customer reception desk on the second floor. Our people will accept it.

Xiao Zhang: OK, there are many things around me. I'll send them to you right away.

As the attacker thought, he got the internal data of an enterprise and published it online. This caused serious economic losses to enterprises, and they began to report the case to the network police. But in the absence of all the clues, the telephone is an enterprise insider, the so-called Xiao Wang does not exist at all, and the data storage server is intact. As a last resort, they began to try to trace the source of IP from the enterprise data circulating on the Internet. However, the data was multiplexed and encrypted, and the case was in a desperate situation. I believe there must be three doubts in the DVD: 1. How did the attacker know the inside number? 2. Why does the attacker have an employee ID? 3. What methods did the attacker use to hide the IP? This is very simple. If you go to the hospital, you will notice the list of attending doctors on the wall, which is marked with ID, contact information and room number on the floor. The purpose of the hospital is to provide better services for patients. Similarly, data storage companies have set up such a list. However, in this case, Xiao Wang did not enter the data storage service company, but paid some fees to the garbage disposal company so that he could find something from it, and the attacker was looking for a contact list of an old employee with an internal number attached to it.

How is IP hidden? Let's look at four ways to transfer logs: 1. Direct IP, 2. ADSL dialing, 3. Agent, 4. Random routing transmission. Here's an explanation for the small dish. Direct IP means having an open IP, and the published log also shows the real IP. I don't recommend this practice. When ADSL goes online, ISP will record when this IP address goes online and through which phone number. Do you think it's safe? Is it safe for agents to surf the Internet? If the car owner or agent service provider who provides the agent compromises with the network police, the key is that the network police have the patience to negotiate with the agent service provider. Random routing transmission, every time information is requested to be transmitted, it will be transmitted through random routing, and every series of steps are encrypted. In addition, every computer on this series of transmission lines will only know the address of the nearest computer. In other words, router B only knows that router A transmits web pages through it, and this transmission request may be forwarded by router C. So, do you think the network police can find clues from it?

Next, what are we doing to understand the cyber police? Can their technology compete with social engineers? If readers are looking for some research on computer forensics technology and tools, I think you will find the most important information, that is, their focus is on intrusion detection system, data recovery, encryption and decryption, reverse engineering technology and the use of computer forensics software tools. However, they ignore the human factor. The wonder of social engineers lies in finding fatal loopholes in people and laws. The attack protection against social engineers is still a blank in the network security course. When this kind of attack tends to be serious, it becomes the primary consideration of network security experts. What is even more surprising, however, is that cyber police occasionally find that the source of attacks comes from within them. Some media deify cyber police. For example, a mobile network policeman caught an attacker in an Internet cafe on the spot, which is nothing special, except that the attacker did not hide the IP and used a public computer, so it is easier for the network policeman to determine the source of the IP.

behaviour

Do you believe in polygraph? No, I refuse to believe it! There are only two kinds of people who say this, one is a psychologist and the other is a social engineer.

Here is a typical case, which is the well-known story of the police catching thieves. What we are more concerned about is, what conditions do the police rely on to analyze who is the most like a thief? How do thieves in the crowd turn themselves into a wisp of air? It's simple. Once the people in the surveillance encounter two obvious characteristics: the thief's eyebrows and the thief's eyes, they will judge by this. Xiao Cai must have met a so-called fortune teller. They have an extraordinary ability to judge what kind of work you are engaged in and what kind of trouble you are in from your clothes, behavior and words. Yes, Xiao Cai can definitely guess what I want to say: behavior can reflect people's state.

Ok, let's talk about the behavior of people in reality and the internet. From the above, we know that behavior can reflect people. What if we change our behavior? Do you think it's possible for northerners to behave like southerners, not only dressed like them, but also living southerners? Of course, the side dishes will also list some N actors such as Andy Lau and Jacky Cheung. In social engineering, "disguise" is "acting" in the eyes of stars. Everyone can perform. Once trained simply, their behavior can escape people's eyes. The side dishes must be incredible. Here is an assignment for you, which is very simple and a joke for your family. Call your mother by imitating your father's way of speaking and find out what the purpose is. Yes, it will be a bit difficult, that is, the accent is disguised. Social engineers don't care. They just download a voice-changing software on the Internet and convert what they say through the voice-changing software. Hmm? What software or props do social engineers often use? Dishes must ask this question. It's simple. As long as social engineers have something, they will try their best to use it.

The last requirement is psychological quality. A polygraph is based on your tone of voice and your physiological state. When we take advantage of the loopholes in the polygraph program to test, there will be wrong results. Why do murderers occasionally fail the polygraph? They are extremely nervous, and every answer will definitely upset their mood. Social engineers have a strong psychological quality in this respect. If the network police can't find a trace of evidence, the initiative is still in his hands.