The next exploit that we're going to be talking about
is one of my favorite ones to talk about, social engineering
and phishing because instead of exploiting technology,
it's exploiting the person.
And I've seen this in action many, many times
throughout my career.
So in this Nugget, what we're going to be talking about
is how an attacker may actually prey on the person instead
of the tech that they're using.
Let's get going.
The next one is one that I really like talking about a lot
because it's one that if you work in IT,
this is the one that's going to get you.
This is the one that's really going to get your end users.
And that's phishing and social engineering. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's phishing and social engineering.
Now these are two different attacks.
But they're categorized into the same section
because what they really do is they
play on the vulnerability of people,
the trustworthiness of people.
And that's where they really get your.
With phishing, this is commonly carried out through email.
And this is where you get an email that looks legitimate,
it looks like it's coming from maybe Microsoft, or maybe
Facebook, or something like that.
But the email address would be something more like--
I'm just picking on Facebook here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm just picking on Facebook here.
Facebook is really secure and everything--
but it might be FacebookSSupport.
And then it may be two T's, or something
like that, @msYb125.com.
But you don't see that.
You never look at the email address.
All you see is something like Facebook support.
And in close but not perfect English,
it says something like click this link right here
to reset your password, maybe because your account's been
compromised, or maybe because you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
compromised, or maybe because you
have 30 days to reset your password,
or something like that.
But the thing is, is this link doesn't take you to Facebook.
It takes you to msYb125.com.
And it looks like a Facebook page.
So when you type in your current user
name and your current password, guess what?
They've now got your Facebook account
because you were misdirected to something
that looked legitimate.
You had an email that looked legitimate,
and you had a website that it took you
to that it looked legitimate.
But it was just a little off. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But it was just a little off.
And to the unsuspecting eye, or the untrained eye,
they totally fell for it.
And this is called phishing.
Attackers send this email out to tens of thousands
or even hundreds of thousands of people at once.
And all they're hoping for is that one or two fall for it.
And chances are, they probably will.
Now there is a type of phishing where
they go after C-level executives and directors.
And that is called whaling.
That is a more targeted attack, trying
to get usernames and passwords to the sensitive information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to get usernames and passwords to the sensitive information
of the CEOs and C-level executives.
So that's phishing and whaling, where
they're just firing off emails and hoping something sticks.
Something that's a little more involved,
actually a lot more involved, is social engineering.
Now there are steps to social engineering.
And these are the things that you need to look for.
First thing that the attacker is going to do,
is they're going to be researching the business
and figuring out, OK, who do they partner with?
Who do they work with?
What do their receipts look like?
That way, they can set the stage.
They can identify themselves as somebody else or somebody WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They can identify themselves as somebody else or somebody
trustworthy based on who the company is already
working with.
They figure out who they're going to identify.
And even though it says, identify frustrated employees,
it's not necessarily frustrated employees.
They're just looking for someone that they can fool.
And as terrible as this is to say,
sometimes this is actually the nicest person in your company.
So over time, they'll find a way to build a relationship
with them, maybe pretending to be someone they're not.
For instance, maybe they've done dumpster diving
and found a receipt for AT&T. Maybe WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and found a receipt for AT&T. Maybe
then they identify someone within the company that
believes they work with AT&T.
So they dress up like an AT&T employee
and they have an AT&T bill of service.
And they show up to the front door and tell them, look,
I'm with AT&T. I'm here to do some work on your network.
And that's how they build the relationship.
The person being as friendly as they are,
doesn't check to see that they have
an appointment with AT&T. They just let them in
because they trust AT&T.
And lastly, they exploit the relationship. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And lastly, they exploit the relationship.
Now that the person has unfettered access
into the business because they look like an AT&T employee,
they're going to walk around and find a server room.
And all they have to do at this point
is plug in a USB stick with their attacking software in it.
And here's the thing.
Earlier we talked about white hat hackers and pen testers,
you better believe, what I just described
is exactly what they do.
When I was a consultant, we hired a pen tester
to tell one of the companies about their vulnerabilities.
They showed up dressed like an AT&T employee. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They showed up dressed like an AT&T employee.
They had unfettered access to everything
in the entire environment.
They plugged a USB stick into the server in the server room.
They went into every single office.
And you know what they found?
In one of the offices of the principal software developers
there, the principal software developer
had left their computer unlocked,
logged into the SQL server as the systems administrator.
And now the pen tester had full access
to the entire database of confidential data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the entire database of confidential data.
All it took was just looking trustworthy enough
to get past the front door.
And that's the power of phishing and social engineering.
And this is why it honestly may be your number one
vulnerability.
So that's phishing and social engineering.
I hope this has been informative for you.
And I'd like to thank you for viewing.