I've recently finished book The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick 

The book was released on 4th December 2002. Not talking only about techniques described in this book, but are the ways used by social-engineers still a threat today?

I think that now, as we moved at least 10 years from the book and issues described in it, we should be immune to such attacks, as we can quickly verify any information presented to us and with possibilities to use cyphering, high-speed mobile network connections, privileges control systems, biometric identification, etc...

Do I live in false sense of safety, or is it fear speaking from me?



And now you can think about, whether it was an social engineering to ask such question and get all your valuable knowledge, or not. :-)

You most definitely live in a sense of false security! Social engineering is very prevalent still today, and I doubt that is about to change in decades if ever. 

Here are some brief explanations on why social engineering works. It's tough to cover everything because social engineering is a really broad field.

Some reasons why social engineering works (From the book quoted in the bottom):


Most people have the desire to be polite, especially to strangers
Professionals want to appear well-informed and intelligent
If you are praised, you will often talk more and divulge more
Most people would not lie for the sake of lying
Most people respond kindly to people who appear concerned about them


Being helpful

Usually humans want to be helpful to each other. We like doing nice things!


I run into the reception at a big corporate office with my papers soaked in coffee. I talk to the receptionist and explain that I have a job interview meeting in 5 minutes, but I just spilled coffee over all my papers. I then ask if the receptionist could be so sweet and print them out again for me with this USB memory stick that I have. 

This might lead to an actual infection of the receptionist's PC and may gain me a foothold within the network.


Using fear 

The fear of failing or not doing as ordered:


The company's director's (John Smith) facebook page (or whatever other source of information) reveals that he has just left on a cruise for 3 weeks. I call the secretary and with a commanding voice I say "Hi, it's Chris calling. I just got off the phone with John Smith, he's having a very good time on his cruise with his wife Carla and kids. However, we are in the midst of integrating a very important business system and he told me to give you a call so you can help us. He couldn't call himself because they are going on a safari, but this is really urgent. All you need to do is take the USB stick that is addressed to him in the mail and plug it in, start the computer and we are all done. The project survives! 

Thank you very much! You have been a great help! I am sure John Smith will recognize you for this act of helpfulness. "


Playing on reciprocation


The tailgate. I hold the entry door for you, and I quickly walk behind you. When you open the next door, which is security enabled, I head in the same direction and most people will try and repay the helpful action by holding the door for you again, thus allowing you into a place where you should not be. Worried about getting caught? Nah.. You just say you're sorry and that you went the wrong way.

The target would almost feel obliged to hold the door for you!


Exploiting the curiosity


Try dropping 10 USB sticks in various locations in your organization. You don't have to place them in too obvious places. The USB should have an auto-run phone home program so you can see when someone connects the USB stick and should theoretically be exploited.

Another version of this is to drop USB sticks with a single PDF document that is called e.g. "John Smith - Norway.pdf". The PDf document contains a Adobe Acrobat Reader exploit (there is tons of them) and once the user clicks the document he will be owned. Of course, you have made sure that the exploit is tailored to the target organization's specific version of Adobe. It will feel natural for most people to open the document so that they can try return the USB stick to its owner. 


Another example of curiosity (maybe another term explains this better) is all these SPAM mails or bad Internet ads that you have won something or a Nigerian prince is offering you a whole lot of money if you can help him. I am sure you are familiar with these already, but these are also social engineering attacks, and the reason they haven't stopped is that they still work!



That's just a few examples. Of course there are tons more!

We can also take a look at historic social engineering events:

HBGary

Full story can be read here (Page 3 contains the social engineering part)


Last year HBGary was hacked. This attack involved many different steps but also a social engineering aspect as well. Long story short, the hacker compromised the email account of a VIP in the company and sent an email to an administrator of the target system saying something like this: "Hi John, I am currently in Europe and I'm bouncing between airports. Can you open up SSH on a high numbered port for me coming from any IP? I need to get some work done". When the administrator gets this email he feels it is natural to comply with this, seeing as the email is coming from a trusted source. 

But that is not it! The attacker had the password for the account, but the login was not working! So he emails back to the administrator "Hey again, it does not seem to be working. The password is still  right? What was the user-name again?". Now he has also provided the actual password for the system (the attacker had it from the earlier compromise of another system in the same hack), giving the attacker a whole lot more trust from the administrator. So of course the administrator complies and tells the attacker his user-name. 


The list at the top comes from the book "Social Engineering: The Art of Human Hacking" and I can very highly recommend it!
