Hacking human gullibility with social penetration
We don't need no stinking exploits
Customer Success Testimonial: Recovery is Everything
Security penetration testers Mike Bailey and Mike Murray rely plenty on attacks that exploit weaknesses in websites and servers, but their approach is better summed up by the famous phrase "There's a sucker born every minute".
That's because so-called social penetration techniques are more reliable and easier to use in identifying chinks in client fortresses, the principals of Mad Security said Wednesday. That's true even for organizations that place a high premium on security and train their employees to resist the most common attempts to trick them into letting down their guard.
"I like finding those elite little exploits where they'll bounce things off eight different websites through cross-site request forgery and cross-site scripting attacks," Bailey said Wednesday at the BSides security conference in San Francisco. "I've never actually needed it in a pentest, because all you have to do is send them a malicious link" or crafty email.
Bailey said he regularly sends client employees emails informing them the strength of their login passwords is being tested through a new website. They are then instructed to follow a link and enter their credentials. The success rate: as high as 50 per cent.
The vulnerability stems from humans' inherent tendency to trust one another. Survival over the millennia largely depended on their ability to work in groups. When one person saw that a group of his peers ate a particular berry and didn't die, he ate the same fruit - and survived as a result. Hackers who understand this trait can exploit it to access companies' most precious assets.
"The social part of our industry, we are never going to patch," Murray said. "We need to have our whole industry understand this. This is what all social attacks are about."
During their hour-long talk, the pair described the most common social penetration methods, which can be found in everything from 419 email scams to trojan attacks that succeed only when a victim clicks on a malicious link.
The come-ons often invoke a sense of urgency, such as an opportunity to make money only if the mark moves quickly. Scammers often try to form perceived bonds with their victims by thanking them for their attention or apologizing for an interruption. The ruses amount to hacks that suspend the marks' critical faculties just long enough to get them to make a critical mistake.
Bailey employed a similar trick last year, when he and two other ethical hackers claimed a $10,000 prize for breaking into the email account of StrongWebMail CEO Darren Berkovitz.
The XSS, or cross-site scripting, vulnerability they identified could only be exploited if the victim clicked on a link while logged in to his account. The solution: They sent him an email with the subject line "we think we've already won this contest," with the attack link in the body. Berkovitz took the bait, and they won the prize.
The technique works even on firms and individuals that regard themselves as especially security savvy, although the tricks often must be tailored to them, Murray warned.
"They spend all this time talking about security," he explained. "If I send them an email saying 'Do the right thing for security,' they say OK, and we own them. The things that normally work in most organizations don't work on them, but if you figure out what works on them, they're as easy to own as anybody else, no matter how intense their preparation is." ®
COMMENTS
Nothing to it...
On our highly decentralized company with about 40 different office locations, I started my job there assisting with a large project to replace CRT screens for LCD ones, inkjets for laser-printers and replacing ~100 XP machines with thin clients. Ok, so I was new.
The first thing you do of course when you enter an unfamiliar building looking for a department where you don't know anyone is applying basic courtesy and introduce yourself. But after having met the so-many'th uninterested office worker, and such a long line of offices still on the todo list, I started to play a little with it.
I went into an unfamiliar office building. Tried some doors, until I found one that was unoccupied and the door open, and walked out with computer equipment. Crazy! But with this success, I went further. I asked random people if they could unlock locked offices. And they did, without me even introducing myself, and I mostly wasn't questioned. The few times that I was questioned, I just said I was there to take away computer equipment.
Note that none of the things I did was announced. Roughly 95% of the people didn't know me. We have no company clothing (in fact, I'm a shorts and sandals type). And just for sport I made sure I went in empty handed and walked out with equipment.
Of course, with this job being legitimate and all, I made sure I'd bring in replacement equipment, and made an effort to get introduced to the office workers. But not before I had my fun with pretending to 'steal' equipment.
In all this time, only one user made an effort to verify my actions with her manager, and one who denied me access until I was able to convince her I was legit. This as opposed to me borrowing some six or seven master keys, and having bin in dozens of offices unsupervised, and walking out with loads of equipment unquestioned.
.
All this trust in a fellow human is of course beautiful. But I don't think it's an inherent trust that allowed for this. Rather, disinterest and/or fear to confront someone. But it also has to do with attitude. If you walk in with a determination to do something, people recognize that and will comply with you quite easily.
One last example, as it stands out above the others. We have a couple of small (often part time) support offices in the office buildings of other companies for some joint ventures we have. Really nobody knows me there. I walk in, and I have not a clue who to turn to or where to go.
But the human hierarchy works a bit like DNS. Nobody knows everything, but everyone knows someone who might know more. The first person I met was a cleaner, and I ask who could know where I should go. Somebody else gets called, and she knows the office I need to be, but it's locked. Long story short, the president of that company is the only one with access to the key I need.
So he gets called from the meeting he's in, and I borrow his personal keys (home, car, a dozen others) and I have the master key of his company. Now I've only given him my first name, made a vague reference to that I 'work in IT' and that I 'have to be in that office'.
The moral of the story, kids, is that you hardly have to shave, don't need a suit (sandals and shorts suffice) and you can leave buildings much richer than entering them. But remember that stealing is illegal in many countries, so be sure to consult your local authorities if you are in doubt about applicable laws.
/This on the subject of (in)security, please excuse the long post.
Grunts
"The grunts" perhaps a little less of this attitude from IT would help people feel they can tell someone to sod of when they phoen up and say "I'm from IT and".
Drill your own staff to prevent social penetration by outsiders.
I've often found the direct approach works even better. Find a telephone number in the IT department, play dumb by pretending to have called the wrong number, ask for a named person elsewhere in the organisation and to be transferred to them. Once connected, tell named person you're new and from IT (external CID often doesn't pass around phone systems, instead it will show the CID of the person transferring you) and ask for their username/password because there's a problem with mailboxes or shared drives or similar.
There is no easy cure, you have to drill it into your staff that under no circumstances do they *ever* give their passwords, to anyone, *ever*. Even then, it will still work a week or so after the dire warnings.
Simples.
Paris, Well drilled and plenty of social penetration experience.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
