Social Engineering Penetration Testing. Executing Social Engineering Pen Tests, Assessments and Defense

386 Pages·2014·1.18 MB·English

by  Gavin Watson

Social Engineering
Penetration Testing
Social Engineering
Penetration Testing
Executing Social Engineering
Pen Tests, Assessments
and Defense
Gavin Watson
Andrew Mason
Richard Ackroyd
AMSTERDAM(cid:129)BOSTON(cid:129)HEIDELBERG(cid:129)LONDON
NEWYORK(cid:129)OXFORD(cid:129)PARIS(cid:129)SANDIEGO
SANFRANCISCO(cid:129)SINGAPORE(cid:129)SYDNEY(cid:129)TOKYO
SyngressisanimprintofElsevier
AcquiringEditor:ChrisKatsaropoulos
EditorialProjectManager:BenjaminRearick
ProjectManager:MalathiSamayan
Designer:MarkRogers
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
TheBoulevard,LangfordLane,Kidlington,Oxford,OX51GB,UK
Copyright©2014ElsevierInc.Allrightsreserved
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,electronicormechanical,
includingphotocopying,recording,oranyinformationstorageandretrievalsystem,withoutpermissioninwriting
fromthepublisher.Detailsonhowtoseekpermission,furtherinformationaboutthePublisher’spermissionspolicies
andourarrangementwithorganizationssuchastheCopyrightClearanceCenterandtheCopyrightLicensing
Agency,canbefoundatourwebsite:www.elsevier.com/permissions
ThisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightbythePublisher(otherthan
asmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchandexperiencebroadenour
understanding,changesinresearchmethods,professionalpractices,ormedicaltreatmentmaybecomenecessary.
Practitionersandresearchersmustalwaysrelyontheirownexperienceandknowledgeinevaluatingandusingany
information,methods,compounds,orexperimentsdescribedherein.Inusingsuchinformationormethodsthey
shouldbemindfuloftheirownsafetyandthesafetyofothers,includingpartiesforwhomtheyhaveaprofessional
responsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,assume
anyliabilityforanyinjuryand/ordamagetopersonsorpropertyasamatterofproductsliability,
negligenceorotherwise,orfromanyuseoroperationofanymethods,products,instructions,orideas
containedinthematerialherein.
LibraryofCongressCataloging-in-PublicationData
Watson,Gavin,1982-
Socialengineeringpenetrationtesting:executingsocialengineeringpentests,assessmentsanddefense/Gavin
Watson,AndrewMason,RichardAckroyd.
pagescm.
Includesbibliographicalreferencesandindex.
ISBN978-0-12-420124-8(alk.paper)
1.Socialengineering.I.Title.
HM668.W382014
303.3072--dc23
2014003510
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary
ISBN:978-0-12-420124-8
ForinformationonallSyngresspublications
visitourwebsiteathttp://store.elsevier.com/Syngress
PrintedandboundinUSA
14 15 16 17 10 9 8 7 6 5 4 3 2 1
Foreword
I can still remember clearly when I sat down and started writing the framework at
social-engineer.org. I searched the Internet for helpful hints on topics I wanted to
cover.Nevertheless, Social Engineering was nota hottopic at that time.
I could find videos on getting free food from drive thru’s or picking up
girls... but nothing to do with security. Around the same time I was writing the
framework, I worked hard to try and include social engineering in any security
work I was doing. Most of the time companies would say things like, “Why try?
We know we will fail.” or “There is no way anything like that would work on
me!”
I even resorted to giving away the services at times, just to prove how danger-
ous social engineering was. Fast forward now years into the future, people are
emailing and calling for quotes on social engineering work every day. With the
increasein interest comesthe increase in“providers” of these services.
Unfortunately, for you, the readers of this book, there are so many providers it
must be mind numbing to try and chose the right one. You may have asked your-
self questions like “How do I know I am working with a good provider of SE
Services?” “What is a social engineering pentest really?” and many more
questions.
When I was approached about writing the foreword for this book, I was pretty
strict about slapping a foreword inside these pages, until I read the book and
understoodwhatmessage theseguyswere trying tosend. Ihadafewphonemeet-
ings to discuss their thoughts on topics and then I received the early editions of
their writing.
As I read through each chapter, I felt like I found a group of guys who “got
it.” They made it clear what a social engineering pentest is, what questions you
should ask, and how you can make the best of the budget you have to include this
very important aspect into youryearly checkups.
Years later, here I am still offering social engineering services. I used to be
one of the few, now one of the many but a book like this will help you find those
of usthat really know,understand, and ARE social engineering professionals.
I know you will enjoy this book. For your business folks out there, you will
especially enjoy Chapter 5. It will help you understand then relate why it is
important toengage a social engineer for your security needs.
The section in Chapter 7 about pretext development is an excellent coverage
of a very difficult topic that I know any ardent student of social engineering will
wanttostudy.
Chapters 14 and 15 will surely help you if you are seeking information on
how to set upan effective awareness program.
These are justa sampling of the chapters.Each one has benefitfor you.
xv
SocialEngineeringPenetrationTesting.DOI:http://dx.doi.org/10.1016/B978-0-12-420124-8.00024-7
©2014ElsevierInc.Allrightsreserved.
xvi Foreword
I truly appreciate the chance I have had to read the work of Gavin, Andrew,
and Richard. They have been open to my advice, more than patient with my busy
schedule but mostimportantly they care about security. They don’t preach “stupid
users” but they preach “uneducated users,” that is a message I hold close to my
heart. My motto from day 1 has been “Security through education.” It is nice to
finda group, likethe authors of thisbook, that think the same way.
Sincerely,
ChristopherJ. Hadnagy
Chief Human Hacker
Social-Engineer, Inc.
www.social-engineer.com
Author,Security Advocate, and Professional Social Engineer
Acknowledgements
The authors would like to thank the team at RandomStorm for their ongoing
support, ensuring that we all stay busy with a wide range of exciting social
engineering and other professional service engagements. Special mention to
Jim Seaman, Katie Bruce and Charlotte Howarth for providing invaluable help
throughoutthe entire process.
xvii
About the Authors
Gavin Watson—Senior Security Engineer
CISSP, CHECK Team Leader, CCNA
A frontline IT security expert with over 8 years hands-on ethical hacking and
penetration testing experience, Gavin is a specialistin the field ofsocial engineer-
ing, IT network security testing and regulatory compliance assessments. As
ProfessionalServiceManageratRandomStorm,heheadsupateamofpenetration
testers and is responsible for delivering multilayered security assessment projects
for a range ofenterprise and public sector clients.
With a growing reputation as an expert in the subject of social engineering,
GavinisaregularspeakerandworkshopleaderatWhiteHatindustryconferences
as well as providing expert comment for specialist publications on a range of
security testingtopics.
AndrewMason—CTO
CCIE#7144,CISSP, PCI DSS QSA
Cofounder and Technical Director at security testing and monitoring specia-
lists, RandomStorm, Andrew has been at the forefront of the network security
industry for over 20 years. A serial entrepreneur and security thought leader
Andrew has established a growing reputation for his innovative and practical
approach to solving many oftoday’s complexsecuritychallenges.
A network security specialist Andrew has authored several leading reference
booksonarange oftechnical subjects includingthedefinitivemanualsforseveral
Cisco networking products. He is also a regular contributor of expert articles for
leading security publications,onlineportals,and mainstream media.
Richard Ackroyd—SeniorSecurityEngineer
CCSP,CCSE, CHECK Team Leader
Richard is a Senior Security Engineer for RandomStorm and is responsible for
the delivery of penetration testing and social engineering assessments for clients
across all verticals. With over 10 years experience in the networking and IT secu-
rity sectors including working for a leading system integrator, Richard has played
a major role in the design of network architecture and security systems for top
tier enterprises and public sector bodies including Premiership Football Clubs and
the NHS.
In addition to his penetration testing knowledge Richard is also an expert in
the deployment of SIEM technology as well as Firewall, IPS, and Content
Filtering implementations.
xix
About the Technical Editor
Jim Seaman—Senior SecurityConsultant
MSc (Security Management), CCP, CISM, CRISC, PCI DSS QSA, A. Inst.
ISSP
A leading Information Security and Risk professional with over 20 years mili-
tary and commercial experience Jim has acquired an unrivalled depth of knowl-
edge of the practical application of layered security controls in complex network
environments, including physical security on active service for the MoD and the
Royal Air Force.
A regular, sought-after, speaker at specialist security events and conferences,
Jim is a widely respected and influential industry thought leader on the subject of
Security Risk Management, which he applies to his frequent consultancy engage-
ments and compliance audit projects with leading financial institutions,
Government departments, and major enterprises.
xx
CHAPTER
1
An Introduction to Social
Engineering
Gavin Watson
SeniorSecurityEngineer,RandomStormLimited
INFORMATION IN THIS CHAPTER
(cid:129) Definingsocialengineering
(cid:129) Examplesfromthemovies
(cid:129) Sneakers
(cid:129) Hackers
(cid:129) MatchstickMen
(cid:129) DirtyRottenScoundrels
(cid:129) TheImposter
(cid:129) Famoussocialengineers
(cid:129) KevinMitnik
(cid:129) FrankAbagnale
(cid:129) BadirBrothers
(cid:129) ChrisHadnagy
(cid:129) ChrisNickerson
(cid:129) Real-worldattacks
(cid:129) TheRSAbreach
(cid:129) TheBuckinghamPalacebreach
(cid:129) TheFinancialTimesbreach
(cid:129) TheMicrosoftXBoxbreach
(cid:129) OperationCamion
INTRODUCTION
This chapter has the sole aim of introducing the reader to the concept of social
engineering. There are various definitions, some vague and others precise, and
these will be discussed in order to explain what the concept of social engineering
1
SocialEngineeringPenetrationTesting.DOI:http://dx.doi.org/10.1016/B978-0-12-420124-8.00001-6
©2014ElsevierInc.Allrightsreserved.
2 CHAPTER 1 An Introduction to Social Engineering
is really about. Everyday examples will be used to show the reader the various
forms of social engineering used, highlighting how such techniques are not neces-
sarily confined to the realm ofcriminal activity.
To further understand the social engineering concept, this chapter will then
discuss some of the excellent examples from various movies. With the assistance
of poetic license, writers have been able to create wonderful examples of how
social engineering could potentially be used. Although these examples are of
coursefictitious,theyareinfactbasedonveryrealtechniques,providingcriminal
mindswith inspiration aswell as providing entertainment.
Certain individuals have pioneered social engineering techniques, resulting
in some being made famous and others fairly notorious. The exploits of both
historical and modern day social engineers, such as Kevin Mitnick and Frank
Abagnale, will be covered. This will demonstrate how single individuals have
used these techniques to achieve extraordinary breaches of seemingly robust
security.
Thischapter willconclude byfocusingon thenegativesideofsocialengineer-
ing and how it has been used to commit crime. The various attacks discussed
demonstrate the true reality of the situation: Social engineering attacks are rou-
tinely being used by organized criminal groups and they are a highly effective
meansof assault.
Defining social engineering
Social engineering has many definitions depending on which book you read or to
whom you speak. TheOxforddictionary defines itas:
Theapplicationofsociologicalprinciplestospecificsocialproblems...
Despite being partially relevant, in truth it falls far short of accurately describ-
ing what “realworld” social engineeringtruly is.
Another possibledefinition ofsocial engineeringmight be:
Theartofintentionallymanipulatingbehaviourusingspeciallycraftedcommu-
nicationtechniques.
This definition reduces social engineering down to the absolute basics of
leveraging communication in all its possible manifestations with the objective of
exploiting the human factor. Therefore, where there is interaction there is always
the capacity and potential for social engineering. The most fundamental example
of this would be the act of lying. Although the historical roots of individuals
committing immoral acts is beyond the scope of this book, it is important to note
that social engineering is asold ascommunication itself.