Social Engineering - Revision history

Manionc: /* References */

2007-04-19T18:58:59Z

‎References

Manionc: /* References */

2007-04-19T18:58:12Z

‎References

Manionc at 18:56, 19 April 2007

2007-04-19T18:56:46Z

Manionc: /* Examples */

2007-04-19T18:54:12Z

‎Examples

Manionc: /* Definition */

2007-04-19T18:53:36Z

‎Definition

Manionc at 18:51, 19 April 2007

2007-04-19T18:51:46Z

Manionc: /* Countermeasures */

2007-04-19T18:50:53Z

‎Countermeasures

Manionc at 18:49, 19 April 2007

2007-04-19T18:49:56Z

Manionc: New page: '''Social Engineering''' '''Definition''' An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning user...

2007-04-19T18:48:19Z

New page: '''Social Engineering''' '''Definition''' An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning user...

New page

'''Social Engineering'''

'''Definition'''
An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning users or operators and pretending to be an authorized user, to attempt to gain illicit access to systems.

'''Examples'''
Example #1: (Believe it or not, this has worked for some attackers!)
1. An attacker, posing an a system administrator, sends an email to several users on a large network (like a college campus network) and asks them to, “Please change your password to ‘xyz123’ and then notify me when you've completed this.”
3. The attacker then logs in as one of the users from over the network.
4. System bugs are then exploited to gain complete control of the system.

'''Countermeasures'''
– Educate staff
– Establish mechanisms for problem reporting and handling and make sure users know what those mechanisms are
– Identify security-related transactions that must be done in person

← Older revision		Revision as of 18:58, 19 April 2007
Line 19:		Line 19:

	== References ==		== References ==
−	[http://en.wikipedia.org/wiki/Social_engineering_(computer_security)#Quid_pro_quo]	+	Social Engineering [http://en.wikipedia.org/wiki/Social_engineering_(computer_security)#Quid_pro_quo]

← Older revision		Revision as of 18:58, 19 April 2007
Line 19:		Line 19:

	== References ==		== References ==
		+	[http://en.wikipedia.org/wiki/Social_engineering_(computer_security)#Quid_pro_quo]

← Older revision		Revision as of 18:56, 19 April 2007
Line 12:		Line 12:
	* Establish mechanisms for problem reporting and handling and make sure users know what those mechanisms are		* Establish mechanisms for problem reporting and handling and make sure users know what those mechanisms are
	* Identify security-related transactions that must be done in person		* Identify security-related transactions that must be done in person
		+
		+
		+	== Related Attacks ==
		+
		+
		+
		+	== References ==

@@ Line 3: / Line 3: @@
 == Examples ==
-Example #1: (Believe it or not, this has worked for some attackers!)
+'''Example #1:'''
 *An attacker, posing an a system administrator, sends an email to several users on a large network (like a college campus network) and asks them to, “Please change your password to ‘xyz123’ and then notify me when you've completed this.”
 *The attacker then logs in as one of the users from over the network.

@@ Line 1: / Line 1: @@
 ==Definition ==
-An attack based on deceiving users or administrators at the target site. Social engineering attacks are typically carried out by telephoning users or operators and pretending to be an authorized user, to attempt to gain illicit access to systems.
+An attack based on deceiving end users or administrators at a target site. Social engineering attacks are are typically carried out by email or by contacting users by phone and impersonating an authorized user, in an attempt to gain unauthorized access to a system or application.
 == Examples ==

@@ Line 12: / Line 12: @@
 == Countermeasures ==
-– Educate staff
+* Educate staff
-– Establish mechanisms for problem reporting and handling and make sure users know what those mechanisms are
+* Establish mechanisms for problem reporting and handling and make sure users know what those mechanisms are
-– Identify security-related transactions that must be done in person
+* Identify security-related transactions that must be done in person