Social Engineering Training

Training Goals

Increase Laboratory Awareness. Provide the tools required to identify, avoid

and report advanced Social Engineering attempts. Spot sophisticated e-mail phishing attempts. Avoid phone-based information elicitation. Detect “baiting” attacks via USB keys, CDs,

and other physical media.

Why Social Engineering Training?

DOE Red Team Tests The Red Team used Social Engineering tactics to attempt

to infiltrate the laboratories in Spring 2008. They were successful in gaining access and maneuvering

without detection at two DOE laboratories and one Site Office.

Increased use and sophistication of Social Engineering tactics.

Overview

Definition Attacker Motivation Techniques Tests Summary

Definition

What is social engineering?

Art of manipulating people into performing actions or divulging confidential information.

Using trickery to gather information or computer system access.

In most cases the attacker never comes face-to-face with the victim.

What motivates social engineers?

Obtaining personal information.

Gaining unauthorized access.

Circumventing established procedures.

Because they can.

Pretexting Invented scenario

Can use any communication medium. Phone Calls E-mail Physical media

General Prevention Think about motivation – how could this be used maliciously? Be polite (it could be legitimate). Record available contact information. Ask a question for which the answer is not publicly available.

Tools Used in Pretexting

Any publicly available information Postings on public web pages. Phone book information. Professional information.

Personal and professional relationships Association with ISU. Association with DOE. Conferences and collaborations in field of

expertise.

Specific Techniques

Phone Cold Calls / Scams

E-Mail Phishing1

Trojan Horse1

Physical Media Baiting1,2

1The DOE Red Team used these techniques in their latest successful attacks on two DOE laboratories and one site office.

2The DOE Red Team was successful using these methods to infiltrate DOE laboratories in the past.

Phone Scams Unexpected / Unsolicited Phone Calls

Attempt to elicit personal or organizational information.. Example Pretexts

Offer to perform a service. Ask for information about organization (i.e. reporters,

prospective students). Claim to be calling for a friend or family members that need

access to something.

Prevention Be polite. Ask for a number to call *them* back; may allow tracing later. Ask a question for which the answer is not publicly available.

E-Mail Unsolicited / Unexpected E-Mail - entice user to:

Click on a link to a fraudulent web page. View or execute an attachment. Reply to message.

Example Pretexts Standard Viagra, off-shore lottery, etc…spam. Notice from DOE, ISU or other requiring a quick

response and personal information. Unsolicited CVs, proposals, professional requests.

E-Mail – Trojan Horse

Malicious software delivered via e-mail Attachment Web link

Pretext Cool screen saver. Important anti-virus or

system upgrade. Latest gossip about a

celebrity.

E-Mail - Prevention

Verify Web Links Known Site. URL and text match. Copy and paste rather than click.

Verify sender prior to opening attachments or clicking on web links. Contact through different medium (i.e. call sender). Verify via an associate of sender, if known.

Examine e-mail headers Forward suspect e-mail to abuse@ameslab.gov

Email Example - Links

Email Example - Headers

Email Example - Headers

Email Example - Attachments

Email Example - Attachments

What you see: What you don’t see:

Attacker’s Server

Physical Media - Baiting Deliver malware via

infected CD ROM or USB flash drive.

Pretexts “Lost” in a location sure to be

found (bathroom, elevator, sidewalk, parking lot).

Delivered with a legitimate looking curiosity-piquing label and simply waits for the victim to use the device.

Physical Media - Prevention

Verify unexpected mailings with sender.

Never put anything into your computer if you don’t know where it’s been.

Bring found USB keys, CD-ROMs, or other digital media to IS for examination.

Quick TestsName 3 clues in this e-mail that should make you suspicious

Quick Tests – Solution

Quick TestsWhich of these emails is legitimate? Which is fake?

Quick TestsThe left email is a Red Team attack.The right email is from DOE.

Quick Tests

Can you think of ways the information on Ames Laboratory’s public web page could be exploited to execute a social engineering attack?

Can you think of an unsolicited e-mail, phone call, or physical mail attack which would be impossible to verify or handle safely?

When to report Social Engineering

What to report Spam emails with local information. Unusual DOE/Ames Laboratory emails. Unsolicited phone calls digging for

information/contacts. What not to report

General spam.

How to report Social Engineering

If Social Engineering techniques are attempted while at work…

If you believe you might have revealed sensitive information about the Ames Laboratory…

Report it to the IS office at: Phone: 4-8348 Email: abuse@ameslab.gov

This will alert us to any suspicious or unusual activity.

Summary

Be suspicious. Think about motivation when revealing

information. Verify identity. Be careful what you click on. No one will catch everything – Be willing to

ask for help.

Thanks for Attending