Slide 1: Social Engineering
Social Engineering Techniques, Methods, Tools & Mitigation Panagiotis Gkatziroulis, Security Consultant
Slide 2: Agenda
Agenda • Social Engineering Methodology • Attacks & Techniques • Demos • Tools of the trade • Prevention Methods and Advice
Slide 3: What is Social Engineering?
SOCIAL. ENGINEERING _ The clever manipulation +) of the natural human tendency to trust.
Slide 4: Invest in Products...
Invest in Products... NCCQfOUP raarmet McAfee: SOURCE/irc’ Blue&Coat
Slide 5: Is Our Security Focus Wrong?
Is Our Security Focus Wrong? necgroUue
Slide 6: Why Security Fail???
Why Security Fail??? nccgroup” IN THIS CORNER We HAVE FIREWALLS, ENCRYPTION, ANTIVIRUS SOFTWARE , ETC. AND IN THIS CORNER, We Wave DAVE! / < q
Slide 7: Who Are The Threat Actors?
Who Are The Threat Actors? • Aggrieved ex-employees • Internal Employees • Activists • Corporate Espionage • Blackhat Hackers
Slide 8: Who Are The Targets?
nccgroup~ Who Are The Targets? Mik
Slide 9: It Only Needs One...
& It Only Needs One... necgfoup WHY PHISHING SCAMS | § KEEP WORKING i | Tyo ye j i é
Slide 10: Social Engineering Methodology
Social Engineering Methodology
Slide 11: Social Engineering - Recon
Social Engineering - Recon Digital • Search Engines • Email Harvesting • DNS Records • Social Medial • Metadata • Public Records Physical • Physical Walk • Dumpster Diving • Tailgate Employees to Lunch Breaks
Slide 12: Social Engineering - Breach
Social Engineering - Breach • Obtain Domain Credentials via Phishing Attacks • Obtain Network Level Access via Spear Phishing Attacks • Bypass Physical Security Defences and Obtain Corporate Documents
Slide 13: Attack Vectors
Attack Vectors • Physical • Phishing • Telephone • Shoulder Surfing • Tailgating
Slide 14: Social Engineering Tactics
Social Engineering Tactics • Impersonation (Spoofed Emails, Telephone Attacks, Scenario-based attacks) • Urgency • Obligation • Authority • Flattering • Fear
Slide 15: Do you recognize the signs?
. . 4 Do you recognize the signs? NccQroup freedom from doubt telephone: +44 (0) 20 8752 8040 Cc d Ss email: enquiries@cdsgroup.co.uk q @cdsgroup ant. iTS Dear client, Please find attached your invoice number 241-28195 If you have any queries with this invoice, please email us at accounts@cdsgroup.c
Slide 16: Do you recognize the signs?
freedom from doubt telephone: +44 (0) 20 8752 8040 Gc d S email: enquiries@cdsgroup.co.uk q @cdsgroup an . . 4 Do you recognize the signs? NccQroup er pe Please find attached your invoice number 241-28195 If you have any queries with this invoice, please email us at accounts@cdsgroup.co.uk or call u
Slide 17: Do you recognize the signs?
. . 4 Do you recognize the signs? nccgroup freedom from doubt cd Ss telephone: +44 (0) 20 8752 8040 cd Ss email: enquiries@cdsgroup.co.uk group group Dear client, Please find attached your invoice number 241-28195 If you have any queries with this invoice, please email us at accounts@cdsgroup.co.uk
Slide 18: NCC Test Case
NCC Test Case necgroup® freedom from doubt Outlook migration support aT Tue 22/04/2014 14:17 ye All, As part of Es migration to a new IT infrastructure we request that all users confirm that they are able to login to the email portal by 29/04/2014. Any accounts that have been dormant for over 2 mont
Slide 19: Why This Attack Was Successful?
Why This Attack Was Successful? 1. Trusted Source // IT Helpdesk 2. Promotes Fear // Accounts will be disabled Lesson Learned? Always Validate the Origin of the Information!!!
Slide 20: Tools of The Trade
Tools of The Trade • SET • TheHarvester • Recon-NG • Phishing Frenzy • PwnPlug Devices
Slide 21: Physical to Cyber is Just One Port Away....
Physical to Cyber is Just One Port Away….
Slide 22: Do You See These Stuff Often Internally?
Do You See These Stuff Often Internally?
Slide 23: Mitigations
Mitigations • Limit Online Exposure • Email and Web Gateway Solutions (URL Sandboxing etc.) • Anti-tailgating Barriers • Social Engineering Assessments • Increase User Awareness via Trainings • Policies (Escort visitors etc.)
Slide 24: Conclusion
Conclusion • False Sense of Security (PCI DSS, Products etc.) • Management People are Reactive NOT Proactive • Strong Physical && Weak Human == Pwned • Employees Must Feel Safe to Click Any Link Inside Their Company Environment!!!
Slide 25: Any Questions???
nccgroup~ Any Questions??? DONEWITH MY PRESENTATION NOW | HAVETOANSWER Ec
Slide 26: Website: trustforum.nccgroup.com
Website: trustforum.nccgroup.com Twitter: @NCCTrustForum Email: trustforum@nccgroup.com
Slide 27: UK Offices North American Offices Australian Offices
UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham Atlanta Edinburgh New York Leatherhead Seattle London Thame European Offices Amsterdam - Netherlands Munich – Germany Zurich - Switzerland