Hacking News Úvod  Komunikace(28)  Databáze(39)  Hardwarové(4)  Infrastruktura(7)  Mobil(18)  LAN(26)  Software(3)  Virus(66)  Web(724)  VoIP (5)  All

Social site (6)

 

Název

Obrázky

Popis

PretextingSocial hacker pretexting technique The attacker will reach out to you under a pretext, which can be very believable depending on how much effort they put into researching you. This pretext can then be used as a hook to verify information they already have, or gain new information. The attackers might also leverage information they previously acquired to give the impression that since they are authorized to know what they already know, they are authorized to know more.For example, knowing about a recent Internet outage at your office, a clever attacker might call you for a follow-up or even show up in person to gain valuable insights into how your network is secured—and where it’s vulnerable.
DiversionSocial hacker diversion techniqueIn this tactic, the social hackers will try to intercept data or even money by routing it along routes that they control. These requests could come in the form of a call from the “suppliers,” which will inform you of a change in their bank or email accounts. But it could also be as simple as adding somebody in cc of an email chain. You could for example get an email from a private account with the name of your business partner. Your “business partner” claims they currently can’t access their work email, asking you to resend the budget forecasts or blueprints.
BaitingSocial hacker USB bait tacticThe most common version of this tactic can come in the form of a USB stick you find near your car, or a free music in your mailbox. These come pre-filled with malware that infect your computer as soon as you insert the drives. In a well targeted attack, they are custom made for your computer and likely evade common anti-virus software. But baiting can also be much less technical. It could take the form of a free tour during which you are befriended and tricked into revealing sensitive information, or you have your equipment bugged.
Asserting AuthorityHacker is asserting authorityEspecially in large organizations, it can be difficult for each employee to at all times know who they are accountable to. Hackers exploit this by asserting their authority over people and pressuring them into revealing information, making changes to data structures, or giving up access to systems. In security-relevant departments, it is important to develop a clear chain of command, including a limited set of authentication methods (PGP works great for that). The people in that command have to learn to deny requests when they do not come from the appropriate channels or lack proper authentication. Imagine getting a request from someone in an overseas department who claims to have superiority over your boss, asking you for their travel details. Would you give it to them?
Exploiting KindnessHacker exploiting kindness techniqueIt’s great when people are helpful, and we usually assume that those around us have good intentions. But from a security standpoint, giving strangers the benefit of the doubt can be devastating. An attacker might appeal to your kindness. Often enough, asking for compromising information is all that it takes. Some rare compliments from a contractor can brighten up anybody’s day. So is it too much when they ask for a heads-up on the budget planning? Most likely it is.
AssociationsSocial hacking associationsThe human mind quickly jumps to conclusions and sides with what is familiar to us. This is why we see the Virgin Mary on toast and that woman standing on Mars. Attackers can exploit that by playing with your associations, making it unclear who is calling you and being vague about what they are talking about. Often enough the attacker doesn’t know themselves who they supposed to impersonate, but the person being hacked fills the gaps for them. Who was that just now on the phone talking about some security audit? Must have been Adam. He always bugs people about that stuff. But if it wasn’t Adam, who did you just gave that password to?