Social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures.
Social engineering is a component of many, if not most, types of exploits. Virus writers use social engineering tactics to persuade people to run malware-laden email attachments, phishers use social engineering to convince people to divulge sensitive information, and scareware vendors use social engineering to frighten people into running software that is useless at best and dangerous at worst.
I will tell you what stands out to me from all these attacks," says Rik Ferguson, a consultant at the security company Trend Micro, who has with long experience of countermanding hacking and malware. "They may use the most sophisticated malware which attacks computers in ways that haven't been seen before, but they always start with social engineering."
That, he explains, is the computer hacker's equivalent of a con trick: making people think someone or something is safe or familiar when it is not.
Thus, many of the attacks against the 72 targets identified by McAfee, another security company, began with "spear phishing" – an email sent to a particular person inside an organisation and tailored to appear as though it had come from a contractor or government source, and so trustworthy.
Instead, such emails would contain a link which, when clicked on, would lead to malware that would in turn be downloaded on to the user's machine. From there the remote access tool – or RAT – would be employed to hunt through the computer network or even infect other people's computers.
While social engineering was always the successful spy's stock-in-trade (in the old days they were always the gregarious ones at ambassadors' parties, charming indiscretion out of their opposite numbers), the internet has transformed espionage into something that can be done from the comfort of one's home, and home country.
As long as you can be sure that your target will be sitting in front of a computer somewhere, you have a good chance of getting some useful information out of them, ideally without their knowledge. The modern internet is in fact a blizzard of operation and counter-operation at every level: governments attack others (so the US and Israel almost certainly cooperated to build the Stuxnet worm which put Iran's nuclear ambitions two years behind schedule – much cleaner than a bombing raid), commercial hacker groups wage war with each other to control giant botnets of malware-infected PCs, while at the ground floor factions inside collectives, such as Anonymous, bait and taunt each other while defacing sites. If you think the internet is peaceful or safe, you are looking in the wrong direction.
But are we generally at risk from these attacks by the biggest players? Yes, says Dmitri Alperovitch, McAfee's vice-president of threat research, who collated the data about Shady RAT: "Having investigated intrusions such as Operation Aurora and Night Dragon (systemic long-term compromise of western oil and gas industries), as well as numerous others that have not been disclosed publicly, I am convinced that every company in every conceivable industry with significant size and valuable intellectual property and trade secrets has been compromised (or will be shortly), with the great majority of the victims rarely discovering the intrusion or its impact. In fact, I divide the entire set of Fortune Global 2000 firms into two categories: those that know they've been compromised and those that don't yet know."
Security experts propose that as our culture becomes more dependent on information, social engineering will remain the greatest threat to any security system. Prevention includes educating people about the value of information, training them to protect it, and increasing people's awareness of how social engineers operate.
Security experts propose that as our culture becomes more dependent on information, social engineering will remain the greatest threat to any security system. Prevention includes educating people about the value of information, training them to protect it, and increasing people's awareness of how social engineers operate.
No comments:
Post a Comment