Social engineering is used to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity.
The following is a recent real life example which would seem very innocuous.
An associates phone rings. The person identified herself as working for the accounts receivable department. She indicated to the user that the phone extension he had was noted as sitting near an HP Color Printer. She asked if he could provided the model and serial number for her records. (Before we go any further, how many of you reading this sit “near” and HP printer?)
The user was keen enough to ask the caller’s name. She responded with only a first name “Kathy”. Fortunately this set off a red flag that something many not be completely legitimate with her request. He then indicated it wasn’t necessarily a good time for him and asked if he could get the information and send it to her in an email. Still suspicious but now afraid the caller may just hang up, the user stalled and answered “oh yes, there is an HP printer right here” and gave the model number, but nothing specific to the device or the company he works for (serial number or IP address).
After saying this, the caller seemed more interested again and continued to ask how they administer and maintain the printers. The end user indicated he wasn’t sure and would have to ask. He then asked for her last name to which she responded “White”. Being resourceful, the user quickly checked the companies Active Directory. No users matched that specific name.
He then offered to get the rest of the information and call her back. The caller indicated that the phone she was using was only able to make outbound calls and she wasn’t sure what number would call her area (does this sound like any phone in your company?). When he insisted he’d need to call her back, she quickly hung up on him.
By asking specific and probing questions, a caller may be able to piece together enough information to infiltrate an organization’s network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility. While each of those pieces of information may seem insignificant by themselves, in total, they may give a hacker just the information they need to footprint a company or network in order to run a targeted attack on the environment.
Related articles
- Security Alert: Fake Netflix App Aids Phishing (mylookout.com)
- How a Phone is Phished: New Infographic (mylookout.com)
- A Marketer’s Guide to Facebook Phishing Scams (hubspot.com)
- Phishing 101 (fortinet.com)
