How cybercriminals steal data through social engineering

[Демитрий]

Man is the weakest link in security. Thanks to social engineering, cybercriminals gain access to sensitive data and upload malicious objects to corporate systems. But how exactly does this happen and what tools are used?

1. Introduction
2. Introducing the Social-Engineer Toolkit
3. A little practice, or How do they do it?
4. conclusions

Introduction
Please note that the article is written for informational purposes only and does not urge readers to illegal actions!

To begin with, it is worth explaining what social engineering is. This is a method of obtaining the necessary access to information, based on the characteristics of human psychology. The main goal of social engineering is to gain access to confidential information, passwords, banking data and other secure systems. First of all, I want to introduce readers to perhaps one of the most powerful and versatile tools, you can even call it the “Swiss knife” of social engineering. It is called the Social-Engineer Toolkit (SET), the figure shows its general view.

Figure 1. General view of the Social-Engineer Toolkit

General view of the Social-Engineer Toolkit
Introducing the Social-Engineer Toolkit
Social and technical attacks

The section includes a list of vectors for attacks:

• Website attack vectors
• Infectious Media Generator
• Creating payload and listener
• Mass attack
• Arduino-based attack vector
• Wireless access point attack vector
• QRCode generator attack vector
• Powershell attack vectors
• 3rd party modules

The section itself can work in several directions, from the creation and implementation of malicious loads, mass attacks, attacks on various Wi-Fi points, generating a QR code, and more.

Figure 2. Sections of the social-technical attack in the Social-Engineer Toolkit

Social-technical attack sections in the Social-Engineer Toolkit
The website vectors section is divided into methods:

• Java Deployment Method
• Metasploit Browser Method
• Harvester Attack Method Tabbat Attack Method
• Web Hiding Attack Method
• Multi-user web method
• Fullscreen attack method
• HTA attack method

Here, attack methods are divided into sections, starting from implementation and creation inside java, using ready-made metasplits for phishing, data collection, and multi-user attack methods to choose from; it is possible to use everything together - it all depends on the imagination of the attacker.

Figure 3. Attack methods of the socio-technical section

Attack methods of the socio-technical section
A little practice, or How do they do it?
Suppose an attacker needs to collect data about a specific victim, find out usernames, passwords and have access to all correspondence. So, for this, he uses the attack method on the harvester (that is, on collecting information). A cybercriminal proceeds as follows: selects the Social-Engineering Attacks item, then selects the Website Attack Vectors, then the Credential Harvester Attack Method. Three menu items will appear: 1) Web site templates; 2) Cloning sites; 3) Custom import.

Figure 4. Harvester type attack vector selection

Harvester type attack vector selection
Further, the attacker learns the type of his network address, since the Social-Engineer Toolkit will know where to redirect all the collected information. To do this, enter the ifconfig command. In this case, it is the address 192.168.0.20 (the IP address assigned to your interface) - its attacker will clone and attack in the future. An example of a social network VKontakte is shown below in the figure.

Figure 5. Entering a network address and cloning a site for an attack

Entering a network address and cloning a site for an attack
After completing the configuration, the attacker uses the standard service to convert the link and sends it to the victim. Usually a link to a photo or interesting content is sent on behalf of a friend or colleague. After clicking on the link, the user sees a familiar interface. However, looking at the address bar, you can pay attention that instead of the usual address the same 192.168.0.20 is indicated there. Due to inattention, many simply do not pay attention to this and enter their username and password.

Figure 6. Fake page view

Fake Page View
How cybercriminals steal data through social engineering

After entering their confidential melons, the system offers the victim to come back later, supposedly some kind of malfunction occurred or the username / password pair is not recognized. What, meanwhile, does an attacker see? Username and password entered by the victim. Thus, he got full access and can now enter the login and password of an unsuspecting user on the service, log in to his account under his profile and do whatever he wants in it.

Figure 7. The final result - the attacker receives the username and password of the victim

The end result - the attacker receives the username and password of the victim
It is possible that recent events related to leak of personal data of Sberbank employees , took place thanks to this tool. It is great for this type of attack, and with it you can also conduct mass mailing to Sberbank clients on behalf of employees whose base is already in the hands of attackers. In general, the Social-Engineer Toolkit is a powerful tool that has no equal so far. In earlier versions there was a function of sending SMS on behalf of any subscriber and any organization, but later the developers disabled the module. And if he acted at present, penetration into the system would be much easier, since SMS confirmation as an additional protection is now widespread. Whether the option is disabled for a long time and what modifications will be in the future to the instrument is still unknown.

conclusions
The method of social engineering is a subtle art. Having mastered it, you can be sure that the desired result will be obtained in 90-95% - it all depends on the ingenuity of the attacker and on the approach to a particular victim. As a rule, inattentive people fall into this bait, who are not so demanding on their own safety and rarely pay attention to details that seem insignificant at first glance (link in the browser line, text, etc.). True, we must admit that experienced users also come across this, albeit less often.

How to avoid such troubles? If you use social networks for communication, be sure to use two-factor authentication in addition to entering your login and password, thereby creating the complexity of an attacker to penetrate your profile.

Look carefully at the link in the browser line - as a rule, it is very similar to the original, the difference is in a pair of letters or numbers. So an inattentive user may not notice the hype. It is always better to double-check if possible: as a rule, the official websites of genuine organizations are on the very first line of search engines. If you received a suspicious link or a request from a friend, girlfriend, colleague, then do not be too lazy to contact the addressee in another way and clarify whether he sent it. Take care of yourself and your data!

Source: www.anti-malware.ru