Đang tải... (xem toàn văn)
Sách về dùng social engineering để hack.Con người luôn là lớp bảo mật yếu nhất trong mọi bảo mật. The first book to reveal and dissect the technical aspect of many social engineering maneuversFrom elicitation, pretexting, influence and manipulation all aspects of social engineering are picked apart, discussed and explained by using real world examples, personal experience and the science behind them to unraveled the mystery in social engineering.Kevin Mitnick—one of the most famous social engineers in the world—popularized the term “social engineering.” He explained that it is much easier to trick someone into revealing a password for a system than to exert the effort of hacking into the system. Mitnick claims that this social engineering tactic was the singlemost effective method in his arsenal. This indispensable book examines a variety of maneuvers that are aimed at deceiving unsuspecting victims, while it also addresses ways to prevent social engineering threats.Examines social engineering, the science of influencing a target to perform a desired task or divulge informationArms you with invaluable information about the many methods of trickery that hackers use in order to gather information with the intent of executing identity theft, fraud, or gaining computer system accessReveals vital steps for preventing social engineering threatsSocial Engineering: The Art of Human Hacking does its part to prepare you against nefarious hackers—now you can do your part by putting to good use the critical information within its pages. From the Author: Defining NeuroLinguistic Hacking (NLH) Author Chris HadnagyNLH is a combination of the use of key parts of neurolingusitic programming, the functionality of microexpressions, body language, gestures and blend it all together to understand how to “hack” the human infrastructure. Let’s take a closer at each to see how it applies. NeuroLingusitic Programming (NLP): NLP is a controversial approach to psychotherapy and organizational change based on a model of interpersonal communication chiefly concerned with the relationship between successful patterns of behavior and the subjective experiences underlying them and a system of alternative therapy based on this which seeks to educate people in selfawareness and effective communication, and to change their patterns of mental and emotional behaviorNeuro: This points to our nervous system which we process our five senses: • Visual• Auditory• Kinesthetic• Smell• TasteLinguistic: This points to how we use language and other nonverbal communication systems through which our neural representations are coded, ordered and given meaning. This can include things like: • Pictures• Sounds• Feelings• Tastes• Smells• WordsProgramming: This is our ability to discover and utilize the programs that we run in our neurological systems to achieve our specific and desired outcomes. In short, NLP is how to use the language of the mind to consistently achieve, modify and alter our specific and desired outcomes (or that of a target). Microexpressions are the involuntary muscular reactions to emotions we feel. As the brain processes emotions it causes nerves to constrict certain muscle groups in the face. Those reactions can last from 125th of a second to 1 second and reveal a person’s true emotions. Much study has been done on microexpressions as well as what is being labeled as subtle microexpressions. A subtle microexpression is an important part of NLH training as a social engineer as many people will display subtle hints of these expressions and give you clues as to their feelings.
Table of Contents Cover Title Page Copyright Dedication About the Author About the Technical Editor Credits Foreword Preface and Acknowledgments Chapter 1: A Look into the World of Social Engineering Why This Book Is So Valuable Overview of Social Engineering Summary Chapter 2: Information Gathering Gathering Information Sources for Information Gathering Communication Modeling The Power of Communication Models Chapter 3: Elicitation What Is Elicitation? The Goals of Elicitation Mastering Elicitation Summary Chapter 4: Pretexting: How to Become Anyone What Is Pretexting? The Principles and Planning Stages of Pretexting Successful Pretexting Summary Chapter 5: Mind Tricks: Psychological Principles Used in Social Engineering Modes of Thinking Microexpressions Neurolinguistic Programming (NLP) Interview and Interrogation Building Instant Rapport The Human Buffer Overflow Summary Chapter 6: Influence: The Power of Persuasion The Five Fundamentals of Influence and Persuasion Influence Tactics Altering Reality: Framing Manipulation: Controlling Your Target Manipulation in Social Engineering Summary Chapter 7: The Tools of the Social Engineer Physical Tools Online Information-Gathering Tools Summary Chapter 8: Case Studies: Dissecting the Social Engineer Mitnick Case Study 1: Hacking the DMV Mitnick Case Study 2: Hacking the Social Security Administration Hadnagy Case Study 1: The Overconfident CEO Hadnagy Case Study 2: The Theme Park Scandal Top-Secret Case Study 1: Mission Not Impossible Top-Secret Case Study 2: Social Engineering a Hacker Why Case Studies Are Important Summary Chapter 9: Prevention and Mitigation Learning to Identify Social Engineering Attacks Creating a Personal Security Awareness Culture Being Aware of the Value of the Information You Are Being Asked For Keeping Software Updated Developing Scripts Learning from Social Engineering Audits Concluding Remarks Summary Index Social Engineering: The Art of Human Hacking Published by Wiley Publishing, Inc 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2011 by Christopher Hadnagy Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-63953-5 ISBN: 978-1-118-02801-8 (ebk) ISBN: 978-1-118-02971-8 (ebk) ISBN: 978-1-118-02974-9 (ebk) Manufactured in the United States of America 10 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 6468600 Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose No warranty may be created or extended by sales or promotional materials The advice and strategies contained herein may not be suitable for every situation This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services If professional assistance is required, the services of a competent professional person should be sought Neither the publisher nor the author shall be liable for damages arising herefrom The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read For general information on our other products and services please contact our Customer Care Department within the United States at (877) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002 Wiley also publishes its books in a variety of electronic formats Some content that appears in print may not be available in electronic books Library of Congress Control Number: 2010937817 Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc and/or its affiliates, in the United States and other countries, and may not be used without written permission All other trademarks are the property of their respective owners Wiley Publishing, Inc is not associated with any product or vendor mentioned in this book To my beautiful wife and my wonderful family; without you this would not have been possible Mati, there are no words to describe the gratitude I feel for what you have done dialects expressions preloading movies and steak dinner presupposition pretexting celebrity death conclusion definition description dialects examples Hewlett-Packard Rifkin, Stanley Mark expressions follow-through FTC and information gathering and Internet and legal issues life uses personal interests phone use Pitt, Brad post-disaster scams principles of radio hosts and research and simplicity spontenaity targets, attachments tech support guy tools prevention audits and auditor selection goal setting included items personal security awareness culture scripts software update maintenance steps product placement profiling software password profilers CUPP (Common User Passwords Profiler) WYD (Who’s Your Daddy) Progressive Environmentalist Movement pronoun use proof of listening props, pretexting psychological needs psychologists public reports public servers Matelgo purple color association Q questions assumptive closed-ended leading open-ended pyramid approach quotes, embedded commands and R rakes for lock picking raking locks rapport active listening, reflective responding bank tellers building affect on people appearance and body language matching breathing rate key phrases kindness and liking people listening speech pattern matching vocal tone matching curiosity and definition empathy and general knowledge importance influence and meeting people’s needs talking about self testing Rasul, Imran reality TV shows, framing and reciprocation ask for what you want concessions and cultural differences and giving away something Gouldner, Alvin indebted feelings influence and recording devices cellular card reasons for red color association reflective responding reinforcement relationships, framing and rental car reports, public reports research, pretexting and response time, interrogation and Rifkin, Stanley Mark ripped up check in car ROI (return on investment), hackers and routers, searching for rules for communication Rusch, Jonathan J S sadness sales, social proof and salespeople social engineers mirroring salting the tip jar Sargant, William, Battle for the Mind satiation of reinforcement scam artists scarcity principle economics intentional short supply meat salesman restaurants social events urgency scripts prevention and mitigation SE (Social Engineering) definition overview scarcity and uses search engines Google Shodan security hackers versus co-workers patches for software personal security awareness culture seriousness security through education self-confidence, situational senses modes of thinking sub-modalities sensory acuity sentence structure, NLP and servers hosting public searching for SET (Social Engineer Toolkit) Shannon, Claude Shannon-Weaver model basis problems for Shodan search engine shoppers, manipulation music loops short supply of product shove knives for lock picking shredded documents similarity, social proof and simplicity in pretexting skills, ingraining skin color, interrogation and Skitka, Linda Slaney, Malcolm Smart, Jamie “The map is not the territory.” smart phones, pictures, GPS location SMCR (Sender-Message-Channel-Receiver) model smiles de Boulogne, Duchenne true versus fake Snow, David frame amplification social, definition social anxiety disorder campaign social authority social engineering framework social engineers communication and disgruntled employees doctors executive recruiters governments hackers identity thieves lawyers microexpressions and NLP use penetration testers psychologists salespeople scam artists spies thinking like types social incentives social networks tail-gaiting social interaction rules social media Blippy information gathering social media outlets, job information social proof Candid Camera celebrity endorsement of product Cialdini, Robert laugh tracks pain tolerance sales and similarity and tip jar salting uncertainty and Social Security Administration hack (Mitnick) Social Security Number background checkers and illegal use software profiling software Maltego password profilers searching Internet for security patches update maintenance speech pattern matching spies SpoofApp SpoofCard spoofing Caller ID caller ID SpyHawk SuperTrak GPS Worldwide Super Trackstick USB Data Logger reading data stamp collection steepled fingers Stevens, Tom G., self-confidence stoic eyes stories as direct instructions subliminal framing suggestibility of target increasing pen clicks surprise fear and symbols of authority sympathetic approach to interrogation T tail-gating tapping/drumming fingers targets attention, holding baseline behavior and your emotion emotional attachments environment, controlling intimidation personal attachments powerlessness suggestibility, increasing undermining beliefs tech support, pretexting Teensy HID attack vector telelphone use telephone-based tools Asterisk Caller ID spoofing scripts SpoofApp SpoofCard Telephone Records and Privacy Protection Act of 2006 tense switches tension wrenches for lock picking The Art of Deception (Mitnick) The Expression of the Emotions in Man and Animals (Darwin) The Real Hustle theft, employee theft theme development Theme Park Scandal Thriving Office tip jar salting Tomkins, Silvan tools GPS Tracker online Maltego SET (Social Engineer Toolkit) password profilers physical cameras lock picks recording devices practice pretexting telephone-based Asterisk Caller ID spoofing scripts SpoofApp SpoofCard Top Secret case study Top Secret case study torture, framing and Tostitos logo touching objects by kinesthetic thinkers touching self transactional model of communications, Balmund, D.C trash dumpster diving pointers shredded documents valuable things Tupperware parties Turtles All the Way Down (DeLozier and Grinder) TV reality shows, framing and U Ultimate Voice, NLP and uncertainty, social proof and undermining beliefs Unmasking the Face (Ekman) updating software USB drive acceptance, communication and user sites V valuable things thrown away value of information verb tense verbal communication visual framing visual thinkers sub-modalities vocal tone matching voice interrogation and NLP and Vontu, confidential data in email W warm leads Weaver, Warren See also Shannon-Weaver model web attack vector, SET (Social Engineer Toolkit) websites background checkers ICanStalkU.com information collection lock picking microsoft.com, PDF files personal websites public reports public servers search engines social-engineer.org social media user sites wedging the alibi approach to interrogation Westbury, Chris white color association Whois Winston, Joel Withgott, Margaret Wizards Project Wong, Kelvie words, interrogation and workplace friends WYD (Who’s Your Daddy) profiling software Y yellow color association Z Zinbarg, Richard E zygomaticus major muscle in smiling ... day While software companies are learning how to strengthen their programs, hackers and malicious social engineers are turning to the weakest part of the infrastructure? ?the people Their motivation... Chris Hadnagy offers those inside the fence an opportunity to take a look from the other side, the dark side, as he exposes the thinking and methods of the world’s most malicious hackers, men,... than other types of attacks The old hacker adage, “knowledge is power” does apply here The more knowledge and understanding one has of the dangers and threats of social engineering each consumer