First-Person Account of a Social Engineering Attack 347
darkreadingman writes, "A penetration tester tells how he broke into a bank's network dressed as a copier repairman. Some good lessons here — many companies spend millions on network security, but don't teach their employees how to challenge a stranger in the building. Social engineering at the company site can be one of the most difficult attacks to defend against." From the article: "Before departing scenes like these, we try to document the effort and provide proof of our success. I usually leave something behind and then contact the person who hired me and direct them to the mark. In this case I wrote his password on a ream of paper and tucked it under the machine."
Hmm... (Score:5, Funny)
Re: (Score:2, Informative)
This is funny mods.. funny. Not insightful
Re:Hmm... (Score:5, Funny)
Because you don't get karma for Funny moderations any more, so some moderators like to throw in an Insightful moderation for funny comments.
Re:Hmm... (Score:5, Informative)
Re:Hmm... (Score:5, Funny)
Re:Hmm... (Score:4, Funny)
Re: (Score:3, Interesting)
The
Not quite news (Score:2, Insightful)
Re: (Score:2)
Plus, this is a bank that was the victim of the attack. That's pretty worrying, I think. News like this (that illustrate how trivial social engineering can be) should hopefully make more people in important places (like banks) get over their false sense of security.
Re: (Score:3, Interesting)
I had a job on wall street many years ago. And I consistently caught people whom were trying to get info about our main frames or dumpster diving. I ended up putting a strict policy, and I was able to buy one heck of a schreader ( this THING was as big as a wide screen TV and could eat your hand if you were not careful).
I still do my transaction thier because the guy I left in charge was
Not news... but still useful (Score:5, Insightful)
While this is not technically "news", it serves as a good reminder and notice of warning. As mentioned in the article...
Hearing stories like this raises awareness for all of us, and reminds us of different ways that we can be exploited so that we can avoid them. Just like learning from history, it is always better to learn from someone else's mistake instead of learning it the hard way.
Yikes! So much effort! (Score:5, Insightful)
I think it goes without saying that anyone getting into your office claiming to be someone they aren't is a threat. Hacker or otherwise, they can easily get information they want with a "hall pass" for the whole building.
Re: (Score:2)
That said, these people do seem to have access to some special equipment:
"Our office at Secure Network Technologies utilizes a proximity card access system, which also serves as an employee identification badge. Conveniently, we have the machine that prints these things.
and
"Using our past experience with copier folks, we
Re: (Score:2)
When someone bluffs his way into the vault, I'll be shocked. If he tried to monkey with the IT systems, he would probably have been snagged faster than a spawning salmon. Bank, Casinos, etc have people watching the people who watch the people.
Re: (Score:2)
(To find out more, I sent a colleague into the bank to inquire about a checking account. While in the bank she took notice of the various pieces of office equipment, specifically the printers, faxes, and copiers. )
Re:Yikes! So much effort! (Score:4, Insightful)
Re:Yikes! So much effort! (Score:5, Funny)
"Are you sure you want to replace 'Teh Money.xls', size $13.28, modified 11/21/2006, with 'Teh Money.xls', size $1,000,000.00, modified 11/30/2006? [OK] [Cancel]"
Re:Yikes! So much effort! (Score:4, Funny)
Or, transfer it into your own, separate account on the same bank, then use Log Modifier to change the destination account in the transaction record to someone you hate (or someone you're being paid to discredit), and Log Deleter to delete the record on your end. Disconnect before they trace you, and BOOM! Watch your Uplink rating smash through the roof...
You'll probably need a level 5 Firewall Disable (or Firewall Bypass) and version 3 of Decypher. And don't try to hack into the Uplink Corporation's bank; yours is the only account.
Wait, we are talking about Uplink, right?
-:sigma.SB
Re: (Score:3, Informative)
You need to get into the vault alone. Everytime I've ever gone to add/remove stuff from my SDB I've been escorted into the vault where I was put into a small room while then unlocked the safety door to the vault, not the big solid door, but a smaller internal door. On this door was a lock. Also the whole are
Re: (Score:3, Insightful)
Why would you want to get into the vault? The amount of money a bank keeps on-hand is very small, and the penalty for getting caught is huge.
If you can get into the bank's internal network, you can get all sorts of information. Identity theft can net more money without the risk.
Re: (Score:3, Insightful)
Re:Yikes! So much effort! (Score:5, Informative)
That's an understatement. My wife's bank doesn't even have wastebaskets at teller stations, for fear that an account number could end up in the dumpster out back. All paper is either quickly shredded or couriered daily to a processing center. Loose sheets - even a sticky note - are verboten.
Each teller has a binder on hand that contains security procedures specific to the teller. When one teller accidentally grabbed another's binder a few month ago, the whole branch had to do a security update, which included a two-hour procedure to change the vault codes.
Re: (Score:3, Interesting)
I am a private IT consultant and I was recently contracted by a Fortune 500 insurance company subsidiary on a very minor issue (2 days). I was hired through an ad on an online bulletin board. The president of the company hired me over the telephone without requesting any references or inquiring about background, education, or even aptitude with the systems they had in place.
Upon arriving for the appointment, I was led into the server room and immediately left alone, laptop in hand. I left the first day
Re:Yikes! So much effort! (Score:5, Informative)
However, also being the guy who ran the prox card access system, I can tell you this: Prox cards are not easy to reprogram. They are usually hard coded with technology that resembles a primitive form of a RFID chip and small battery that only energizes when in the prescence of a mildly strong magnetic field (more than kitchen refrigerator magnets, but not as strong as the rare earth magnets you can buy for cheap), has a transmit range of 6 inches, and is attached to a antenna/induction coil loop that circles the length of the card about 5-10 loops.
Theres a reason you don't leave a prox card on top of a unchielded stereo speaker... Not only does the stripe become scrambled over time, but the battery, which is constantly in the range of the magnetic field, will stay energized and keep broadcasting the signal untill.... well, until its dead. Typical prox cards are specced for about 10-20 access per day, with a usable lifespan of 5 years.
Prox cards from HID (one of the biggest manufacturers of prox security equipment) are sold with a two-fold identifier: 4-digit site ID, and 6-digit card number. Yes, these are both printed on the card. Yes, HID keeps track of which company owns which site ID, so they can sell further stock in the future with the same site number...and also so they don't sell the same site number to someone else in the same region.
Prox reader controllers (a closet component that is what the readers are wired to, each controller capable of holding a token-style chain of 127 modules that can each control up to 8 doors on each module) are programmed to accept only a certain set of site ID's. They keep a local database, updated at regular intervals from the master controller, a server (anywhere from 15 mins to an hour) of what card numbers within each site are allowed to access a specific reader/door combo.
If the communications to the server is down, the controller tries to contact the nearest controllers it knows about (up to 255), which also keep the same database. If no redundundant communication to other controllers or to server is available either, the controller maintains its current memory and security settings for 72 hours from last communication. After that, no access is allowed at readers until communications are enabled again and a database synch is performed.
Of course, this info is all dated to 2002, for Andover Controls security systems... but is pretty much standard to all prox systems.
Re: (Score:2)
It's much easier to just plug into the LAN & sniff for l/p's (which shouldn't be sent as cleartext in the firstplace, but frequently are)
And why is it that way? (Score:5, Insightful)
Hello, McFly? Which is better: my having an easily-remembered but difficult-to-guess password that I never write down, or you forcing me to change my password frequently and then write it down because your policy makes me choose something obscure? My original password was fairly strong (a combination of upper and lowercase letters and numbers that are meaningful only to me) but when I'm forced to change to something new, it will be written down somewhere until it's committed to memory. Can you say "counterproductive"? How about "unintended consequences"?
Of course, I understand that a lot of these policies are based on out-dated recommendations and come down from on high. However, it would be nice if those making these "rules" to realize that most users have other things to do besides remembering a constantly changing set of passwords. Oh, BTW -- my new password is "theCIOsucks!"
Re:And why is it that way? (Score:5, Interesting)
I went from very secure passwords to insecure passwords written down on paper slips as a direct result of our security policy.
1) Change every 90 days (up from 60 at least. that was really bad).
2) no repeating letters or numbers
3) no letter or number in the same position as last password.
4) must have a number
5) not be a word in a dictionary
Starting password something like
YuL1P3729 (the last 4 digits were what changed- they were an old phone number- I slid through it horizontally)
Current password something like
secre1t
I have about 8 passwords.
And they are all on a yellow sticky on my desktop.
Re: (Score:2)
Of course most password policies still have there roots into the mainframe world.
Re: (Score:3, Interesting)
This is veering dangerously OT, but here's what has worked (so far!) for me: I had a nice, secure password that I never wrote down. When they made me "change" it regularly, I started using the same password but with my right hand shifted one letter down on the keyboard. 6 months later, shift the other hand down. 6 months later, shift the right hand outward. I intend to move around in this fashion until I can return both hands back to home position.
The only part that requires brainpower is "what to do when
Re: (Score:3, Funny)
Re: (Score:2)
A secure login token system would be, after the intial purchase has been amortized, cheaper, more secure, and more convenient than some draconian password policy. It's certainly cheaper than absorbing the risks of allowing weak passwords.
Re:And why is it that way? (Score:5, Interesting)
All of which is really a distraction. Sticky notes on the monitors? If someone's that close they can install a hardware keylogger in a matter of seconds or RAT and rootkit the machine with a live CD in a few minutes. The only security improvement you get from taking down the sticky notes is against casual or opportunistic attacks, which is not nothing, but face the fact that physical access means Game Over.
Re: (Score:3, Funny)
Re: (Score:2, Interesting)
How about this: I _HAD_ a user who made the MS Flying banner hold his password. I would have never believed it had I not seen it myself.
negative vs positive (Score:5, Insightful)
Instead, for those bosses with less scruples, you'd probably get more bang for your buck by faking the penetration test. Hire some dude to try to get in, and arrange some employee to "catch" him. Then you get to circulate the news that you were successful because an employee did the right thing. I think the information would be just as instructive (always ask for outside confirmation of vendor reps), but instead of being depressing (you guys all failed to do the right thing) it could be empowering (it's easy to do the right thing, and one of you managed to do it).
Is penetration testing even worth the money for a system as obviously insecure as this one? If, as the article claims, these attempts succeed 9 times out of 10, then you don't need to pay for the penetration test to know your company will fail. Does a bank manager really need to pay someone to tell them the obvious? They should take some proactive steps towards security-enhancements first, and save the penetration testing for when they actually think they have a somewhat hardened system (social and technical) to penetrate.
-stormin
He didn't say they succeed 9 times out of 10 (Score:3, Insightful)
He's saying that, when they do get caught, nine times out of ten i
penetration tester (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
No - In Porn They're Called "Troubleshooters" (Score:2)
Re: (Score:2)
Man that'd make a badass business card.
Re: (Score:2)
Re: (Score:2, Funny)
Hmm (Score:2, Interesting)
Re: (Score:2, Insightful)
Re: (Score:2, Insightful)
I'm not super knowledgable in the area
In the words of the Paranoia RPG (Score:4, Funny)
Just Check! (Score:3, Insightful)
Simple enough. I don't know if I am parnoid or what, but if I recieved an unsolicited "service" for one of our machines I would double check with my contact for that company.
If some one is poking around who I do not know I will check it with my boss.
Re: (Score:3, Insightful)
Would Biometric Security Devices Mitigate Sniffing (Score:3, Interesting)
Re: (Score:2)
You could make the argument that they weaken security since the password has to be stored twice. And in many cases if you know what you are doing, a good print (good enough to fool the reader
good grief... (Score:2)
Re: (Score:2)
Please RTFA before commenting in this vein.
Immediately after that sentence comes:
The password
perhaps I wasn't clear enough (Score:3, Insightful)
Doubt me? Ask Randal Schwartz. Unless I missed something, Randal has admitted his naivety, but not malice, concerning the matter of cracking passwords to demonstrate security problems to one of his clients. The client was not amused. Here is an example, from the first click in a trivial google search.
Intel v. Randal Schwartz: Why Care? [mabuse.de]
Clearly, Randal was someone who should have kno
Re: (Score:2)
Yes indeedy. Sorry for the misunderstanding.
There are better ways to prove that an attack worked than just leaving a password somewhere, that's for sure.
Look under your keyboard... (Score:2)
If you see your password there, that proves I was in your place.
"In this case I wrote his password on a ream of paper and tucked it under the machine."
If it says "12345" it proves you watched Spaceballs.
Re:Look under your keyboard... (Score:5, Funny)
Amazing! (Score:2, Informative)
Re: (Score:3, Insightful)
No 802.1x? (Score:2)
It required some effort, since we had to "quarantine" non-802.1x devices to separate networks, but i think the security advantages outweigh the work needed.
We're just a small IT service company, not a bank. I really wonder why a bank wasn't using 802.1x since several years.
Re: (Score:2)
We don't secure our wireless because it is a pain, and futile. Anyone who wanted to seriously crack into the system would use a hard line, an idle terminal, MAC spoofing, etc.
We secure the servers, and monitor for odd behavior. Mostly because most or our problems aren't foriegn invasion, they are inside jobs, mistakes, etc.
Re: (Score:2)
Mac Addresses are easily faked (Score:2)
What you need to do is assume that your wireless network has already been penetrated by Joe sitting at Starbucks, and then develop a defense from there. For example, one solution is having all wireless clients go through a VPN client with strong authentication mechanisms just to get back into the corporate network.
Re: (Score:2)
Re: (Score:3, Insightful)
1 ream = 500 sheets (Score:5, Funny)
That seems like an awful lot of effort, when you could just write it on one sheet.
Dont really need that. (Score:5, Insightful)
Install a few key loggers, come back in a week and harvest them. No problem and easily undetected at any corporation. They probably will never suspect you even after they get massive hacks later because security typically is also underpaid and way under trained.
Re:Dont really need that. (Score:4, Insightful)
The copyer hole (Score:3, Interesting)
1st: Some one calls an office and says that copier supply cost will go up next month so stock up now. Then they charge you an arm and a leg for your order. (Most of the time toner and developer is covered under the service contract)
2nd: Some times, some one would call up and say that they don't like the new tech that we sent out. I would say "what tech, you don't have a call up on your machine?" then after a few minuets of back and forth they would realize that it was (a) for the other copy machine and not one from my company, or (b) some one was looking around the office without authorization. The scary thing is that this often happened at schools.
Later, at my next job, I nabbed some one pretending to be a copy 'service agent' at the front desk and fed them a line until they went away.
The moral of the story is be paranoid, ask for ID, make people sign in, never ever trust some one who just shows up and make sure all visitors are escorted at all times.
Some do (Score:2, Interesting)
Where I once worked we had students trying social engineering on us all the time. I was a student worker at the time and knew most of the tricks, but when anything new came along it had to go through the filter of common sense. If only 3 people have open access to certain systems, one of them must know of someone claiming they need access, but if you can't contact the other two, you simply stand your ground, bar access and say to the attempted intruder, "Sorry, can't let you in, but don't worry, not your
Re: (Score:2)
haha.. asdly most common sense goes out the window in the corp. world.
If that repairman was to fix a critical issue, you would get inot trouble in most places. Even if you where following policy.
It's that kind of crap that makes an employee not want to question anything.
Man I Wish... (Score:3, Funny)
Re: (Score:2)
And your need for that good is pretty high after this latest dry spell, eh?
Re: (Score:2)
Re:Man I Wish... (Score:5, Funny)
- Get permission first or you'll end up in a world of trouble. Given the likely circumstances of this particular test, I strongly recommend that you cover your ass.
- File a report afterwards, or your mark may never know you were in there - with this target, and especially with your particular toolset, such an outcome is especially likely.
:P
Yes, I have mod points, but this seemed like more funEmployees are not conditioned to be security aware (Score:5, Interesting)
I normally hire from one particular branch and drop it back off there and as a regular customer known each of the staff by name, however on this occasion I was dropping the car back at the airport.
After parking up a guy came from a car in another bay (for the same car company) and asked if was dropping off one of their cars which I confirmed and told him it had come from my usual branch and not the airport. He asked to see the paperwork and did a check over the car - not a problem. After he gave me the paperwork back he asked for the keys. Since I didn't know him and he wasn't even wearing a uniform I asked to see ID, he couldn't provide it and all he did have was a stack of paperwork with the company letterhead in a file.
Well I'm afraid that isn't really good enoguh proof of ID - I told him I'd drop the key off at their desk (which is opposite my check in desk) since I had no way to know if he was an employee or not.
After dropping the key off at the office of the car company in the airport it turns out he was a legitimate employee but the question of ID has never come up.
I saw some of the otehr cars there - they are always brand new and while I usually take something like an astra or a vectra this being the airport car park had several jags and a merc or two. Its seems it would be a VERY easy way to obtain a few cars... park up, inspect the car, ask for the key.
Even if you get pulled over by the police you would just have to say its a hire car - a check of the registration would confirm that - these companies really should be a little more careful of their security!!
Re:Employees are not conditioned to be security aw (Score:2)
Re:Employees are not conditioned to be security aw (Score:3, Insightful)
In a perfect world everyone would be competent and always available on the other end of the phone, but in the real world it can be a
No DHCP! (Score:3, Interesting)
At my previous job, DHCP was not used for printers. In fact, you could not plug into any port and get a connection. Everything was locked down by MAC address and every printer was given a specific IP address. Even the pc ports were locked by MAC address.
Sadly, my current place of employment does not follow this rule. Anyone could do what the article talks about except that our security guard is pretty good about calling someone if a technician shows up and says they have to do something. If that happens, I am usually the one who goes down and finds out what's going on. Since I work in IT, I would know if what the person is saying is true or not.
ObSneakers (Score:5, Funny)
True story. (Score:5, Interesting)
1) He broke into a top nuclear facility by holding a box and asking the person ahead of him to hold the door.
2) He set off the "man trap" and found he could easily climb out of it.
3) He found out the heavily secure facility had secure areas protected by sheetrock walls in some areas.
He finally embarrassed so many people that they posted a picture of his face to all employees with a warning to be careful. That destroyed his effectiveness. Some solution.
But that's the real world for you.
Re: (Score:3, Interesting)
Shit, I'd fire then sue them.
Re: (Score:3, Informative)
And they were reasonably clever about it.
They didn't say "WARNING! THIS MAN IS DANGEROUS!" they said something like "This man is our new security officer. Make sure you help him out and ensure we follow all security requirements!"
Re: (Score:3, Interesting)
So they hire your friend to pen test their security and, rather than implement his findings, they made up a "wanted poster" and did nothing else? What was the point of hiring him in the first place?
Re:True story. (Score:5, Interesting)
Most nuclear power facilities are run by private companies, but a separate government organization is responsible for safety inspections. When a government inspector finds something wrong, the company involved can face massives fines.
I know a guy who was an inspector at our local nuclear power plant. He said that once he found a guard sleeping so he went and got the supervisor so it could be documented. On the way back, he said the supervisor was talking loudly and stomping his feet. Not surprisingly, the guy was awake when they reached him, and consequently, that supervisor saved the power company a couple hundred thousand dollars.He did learn his lesson, and in later similar situations would only tell supervisors to come with him and not the reason. :)
Re: (Score:3, Funny)
Re:True story. (Score:5, Informative)
Re:True story. (Score:4, Insightful)
He apparently reached up, grabbed the wall, pushed up the ceiling panel, and climbed up easily using the door handle to step on. It held him about 30 seconds.
More than just social security problems here... (Score:2, Interesting)
> I then disconnected the network cable from the copier/printer and attached my laptop. As soon
> as my laptop booted up, DHCP provided a network address and I was on the internal network.
This should never be. In the first place, DHCP should not hand out an internal-network address to any old network card that comes calling, and in the second place, the copier should probably be isolated from any important or sensitive s
Re: (Score:3, Informative)
The switches, they do *nothing*! (See the various attack methods for turning a switch into a hub on the fly, then sniffing all traffic.)
The better question is why the company is sending passwords in the clear in the first place? Just about every protocol under the sun can be encrypted now. And in an
teach employees? (Score:5, Insightful)
If I'm walking out the door, and someone coming in catches the door after I walk out, am I going to stop, turn around, go back in the building, stop the person on the way to the stairs, force him to follow me back to the badge reader, and wait to make sure his badge is accepted by the reader? No.
It will never happen.
Even if your security awareness training is so successful that 50% of your employees do this, an intruder only has to try twice to get in. You gain nothing.
Employee-enforced physical security is a farce. You will ONLY have real physical security if you have a dedicated security guard who checks every badge and photo-ID for every person entering the building.
Why not a male model? (Score:2, Funny)
One of the classics (Score:2)
Or... He could have hacked the copier (Score:2)
If you call them on it, people get upset. (Score:5, Interesting)
Some months back, I saw some people working on the phone lines outside my house. They knocked off my DSL connection, so I went out to see what they were doing. They didn't have an SBC truck, so I asked to see their ID. Classically, telcos were very careful about issuing picture IDs to all employees authorized to meet the public or work on plant. There's even a notice in most telephone directories about it, telling customers that all telephone employees are required to carry a telco photo ID.
They didn't have SBC IDs. So I called SBC repair service via a cell phone. They didn't have a clue. So I called 911 and had the local cops come out. They ask the guys for phone company ID, and the techs don't have it. Twenty minutes of confusion as the techs and the cops are calling various parties.
Turned out that SBC had quietly been "outsourcing" some routine outside plant work, and had been sloppy about issuing credentials to the outsourcing contractor. Tied up four techs and two cops for half an hour to straighten that out.
That's what happens when you do it right. Annoys everybody.
for the sake of clarity (Score:5, Insightful)
Backwords (Score:2)
Yes deception is lying.
If you say "I'm going to the movies" then drive to the movie wait 5 minutes, and then go to a motel to bang your mistress, you have still lied. I would argue the worst kind of lie.
Re:Backwords (Score:5, Funny)
neither Backword nor Forward (Score:3, Informative)
(1) Not all lying is social engineering.
Lying, by definition, is making a statement believed to be untrue with the intent to deceive another (see: lie [wikipedia.org]) therefore all lying might be considered a form of social engineering, using the most inclusive possible definition for "social engineering". However, one might consider that there are types of lying which do not really have a useful purpose (e.g. pathalogical lying) and which are not employed to seek a gain, and these types
Re: (Score:3, Insightful)
Its a con. Plain and simple. Since you generally know the conversation and physical scenario that is going to take place, all that is needed is some improv. Thats why I state its a bit more than lying. You're feeding off of the targets lack of awareness, willfullness to give information, and general good nature, as 'everything seems to be in order' with your physical presence.
As far as distinction in vocabulary and vernacular of language, that wou