- [Instructor] The first type of attack category
that we will cover here, are reconnaissance attacks.
So reconnaissance attacks include the discovery process
used to basically find information about the network,
their users, and the victims.
So if you're an attacker
and you want to gather information about the victim,
you can launch what we call a passive reconnaissance attack
or an active reconnaissance attack.
In a passive reconnaissance attack,
the threat actor investigates the victim
without actually launching an active scan to their network.
And they do this by searching key users, executives
or any other victims within the organization
that they want to attack, in social media,
things like using tools like Spokeo,
to search online public records
and also using more automated tools like Maltego.
Now that I mentioned Maltego,
Maltego is a great tool that analyzes
real world relationships
between information that is actually publicly accessible
in the internet.
So this includes footprinting the internet infrastructure,
as well as gathering information about the people
and the organization who owns it, right?
So Maltego can be used to determine these relationships
between many different entries or entities,
including people;
So gathering information about specific person,
like their names, their email addresses,
any type of alias that they have used,
personal identifiable information if they can,
you know, things like physical addresses,
the date of birth, what are the users likes and hobbies,
who do they work before for,
and what are their specialties;
so let's say they actually find information
about a user that is a sales manager in an organization.
And then, you know, was able to correlate information
from things like LinkedIn and see that the person
actually had a job at a different company
about two years ago,
they can actually personalize their attack later on,
by actually gathering this information.
So again, tools like Maltego actually makes this really easy
to determine these type of relationships
and also correlate those with other users
or groups of people, right?
So, using social networks,
looking at what are your Facebook friends,
what other connections you have on LinkedIn,
Who do you interact with in Twitter,
You know, the companies, again,
that you actually have worked for,
any organizations that you belong to,
any websites that actually have information about you,
any personal websites as well,
internet infrastructure information like domains,
DNS names, net blocks and IP addresses of that organization;
And then associate that with the specific users
any type of affiliations that are there.
And of course, anything that you can find on the internet
as far as documents and files related to that victim.
So connection between these pieces of information
are actually found using open source intelligence techniques
by querying sources, such as DNS records, WHOIS records,
search engines, social networks, and various online APIs
and extracting metadata about the victims.
Another great tool that is actually used
for passive attacks, is the Social Engineering Toolkit.
People call it SET, right? SET.
This is a tool that was created by Dave Kennedy.
He's actually a personal friend of mine,
and is used by many pentesters and real-world attackers
to perform social engineering attacks.
So, Social Engineering Toolkit is a menu driven
attack based system, which is fairly unique,
because it supports multiple scenarios,
options and different consumerization
that you can actually do.
So for example, you can launch
a spear-phishing attack even, right?
Or send target email attacks against a victim.
You can send multiple emails based on what you learn
about that victim or individual through your searches,
or by using Maltego, like I mentioned before,
or you can even send malicious attachments to the victim
to actually try to compromise their system as well, right?
So, since the Social Engineering Toolkit
is integrated with Metasploit,
it actually makes it easy to carry this type of attacks.
Now that I mentioned Metasploit,
Metasploit is an exploitation framework.
You will learn a little bit more about it
later in several other lessons.
But again, it's actually a tool or a framework
that includes many tools that are used by many pentesters
and of course also attackers nowadays.
Now that I mentioned social engineering,
let's go over what exactly is social engineering, right?
So, and what are these type of attacks, right?
So this attacks leverage what we call the weakest link
which is a human, right?
So there's a saying out there
that there's actually no patch to human stupidity.
It's actually kind of true.
If the attacker can get the user to reveal information,
it's way easier for the attacker to actually cause some harm
rather than using some other method or reconnaissance
or some tools, right?
Some sophisticated tools.
So, this could be done through just an email
or a misdirection of a webpage;
So the result is in the user actually clicking
something that leads the to the attacker
getting information about that user
or to a malicious link or so.
Social engineering can also be done in person by an insider
or an outside entity or over the phone.
You know, primary example of that,
is if you get a phone call of somebody impersonating a bank
asking you or telling you that your bank account
has been compromised
or there has been some fraudulent charges;
And then of course they want you to verify
your account information and provide personal information
over the phone.
And another primary example
is the attacker leveraging normal user behavior.
So let's think for a second
that you're a security professional,
you're in charge of network firewalls,
or other infrastructure equipment in your company,
an attacker actually can post a job offer
for a fairly lucrative and attractive position, right?
So, and it makes it very attractive to the victim,
in this case you, the security professional.
And they can put in the job description,
you know, list of pretty good benefits and compensation,
far beyond what you're probably already making
at your company,
then whenever you apply for that position,
the criminal or the attacker,
even schedules an interview with you, right?
And then some of these criminal organizations
actually have local folks,
you know, that doesn't look like,
actually they are calling from a different country;
If not that they actually will persuade you
to actually tell you to tell information
about yourself and about the company, right?
So since you're likely to, quote-on-quote,
show off your skills and your work, right?
To get a job, he may ask you,
how do you configure those firewalls?
What other networking infrastructure devices
your company actually has?
What other security products they actually have deployed
and how they have deployed?
So you may even disclose information
about the firewalls using your network,
how you configure them, how you design them.
And this definitely gives the attacker
a lot of knowledge and information about the organization
even without performing any type of scanning
or active reconnaissance in the network, right?
So, other social engineering techniques
include phishing;
You know, whenever the attacker
actually presents a link
that looks like a valid trusted resource to a user, right?
Through an email.
And then whenever that user clicks on the link,
he's is prompted to disclose confidential information
such as user names or passwords.
Another one is pharming;
And that's whenever the attacker uses this technique
to direct the customers URL from a valid resource
to a malicious one that could be made to be appear
as its the valid site for the user, right?
So from there, an attempt is actually made
to extract confidential information from the user
and from the organization, right?
So, and another one, another example is malvertising;
Malvertising is the act of incorporating
malicious acts on trusted website.
So, you know, that's a key.
And trusted websites which definitely will fool the user
and results in the user's browsing or the browser
being redirected to sites hosting malware, right?
So, that's what it...
Is very important.
So it is extremely important that a security aware culture
must include ongoing training that consistently
informs all employees about the latest security threats,
as well as policies and procedures
that you can reflect the overall vision
and mission of the corporate information security
in your organization.
This emphasis on security, helps employees
understand the potential risk of social engineering threats,
how they can prevent again such attacks
and why their role within the security culture
is critical for the overall corporate health, right?
So, security aware employees
are definitely better prepared to recognize
and avoid rapidly changing
and increase in the sophisticated
social engineering attacks,
are more willing to take ownership
of security responsibilities, right?
So, one of the things that actually we do at Cisco,
is that from time to time, we actually send
what it looks like a regular email,
perhaps through a survey
or to benefits for different employees;
And we send these emails throughout the corporation,
and not only to see how many users
of course are actually clicking on those links that we send
and/or probably attachments,
but also to train the users
that not all emails are equal, of course,
and that you should not be clicking on things
that you should not trust, right?
Or it may be good to be good,
too good to be truth, in some cases, right?
So, now official security policies and procedures,
take guesswork out of operations.
So, helps employees make direct security decisions.
And this type of policies actually includes,
you know, things like password management,
you know, of course, more authentication capabilities
for VPN users and local users;
Like two factor authentication,
that also includes of course, the anti-phishing defenses
and antiviruses, change management:
a documented change-management process
is actually more secure than an ad hoc process, right?
Which is more easily to be exploited by an attacker
who claims to be in a crisis,
information classification, you know, policies,
document handling and destruction policies,
and of course, physical security policies as well.