Social engineering of Information Security [1]: Information Collection of attack techniques

The previous post popularized some basic concepts and common sense. Next, let's talk about some practical things: introduce common routines used by attackers. Attackers can perform the following steps: information collection, counterfeiting, influence, and final attack. Since each step is quite a long introduction, I will introduce the "Information Collection" step today.

★What is information collection?
Information collection is to obtain organizations, organizations, and companies through various means (hereinafter referred to as"Institution).InsensitiveInformation. Why do we emphasize "no sensitivity? If the information is not sensitive, there will be no strict access restrictions and attackers will be able to gain access. In addition, in the process of obtaining such information, it is not easy to attract the attention of others, reducing the risk of attackers themselves.

★What is the use of collected information?
Most social engineering attackers collect information. However, information is often collectedNoThe ultimate goal of an attacker is only the preparation of the attacker in the next stage. Most attackers obtain this information and most of them use it to package themselves for subsequent identity counterfeiting. I will introduce how to package and impersonate the package in the next post.

★What information is not sensitive?
TypicalInsensitiveThere are several types of information:
◇ Some key figures
Here"MaterialsThis includes the Department, position, email address, mobile phone number, and landline extension number of the person. Attention:Key figuresThey are not necessarily famous or highly weighted people, but the key points of these people on the attack route. Attackers must use these people for some purpose.
◇ Steps of some internal operation procedures of the Organization
Each organization has several operational processes (such as the reimbursement process and approval process), which are very useful to attackers. Once the details of these processes are identified, attackers can find out what objects are involved in each attack stage and what departments are these objects in? In what roles? What is the authorization?
◇ Organizational Structure
The organizational structure of an organization consists of the following aspects: the affiliation of each department, business exchanges between departments, division of authority, whether a department is strong or weak, and so on.
The use of organizational structure charts is similar to the operation process.
◇ Some frequently-used terms and slang within the organization
Most attackers collect some internal terminology and slang. When an attacker communicates with other personnel in the Organization, if he or she is proficient in using various specialized terms and statements, he or she can effectively dispel the doubts of others and gain trust.

The above information seems quite common, and it seems to everyone that there is no value. However, when the information reaches the attacker's hand, it can play a huge role.

★How to collect non-sensitive information?
There are several ways to collect such common information:
◇ Use websites and search engines
For example, the internal operation procedures of many organizations are directly stored on the official website and can be easily obtained. There is still a lot of unsensitive information, attackers can find the attacker through Google.
◇ Resign an employee
Sometimes, when an employee (even a small role) changes to a competitor, it can bring a lot of information. You can get at least the address book of the original company if you save the money. If you are a little better, you can also get the organizational structure and deeper information.
◇ Spam Analysis
Many organizations directly throw some common printing materials to the waste bin without the shredder processing. Therefore, attackers can find a lot of useful information from office spam.
A simple example: many companies print a list of new employees every time they hire new employees, personnel or administrative staff. List abovePossibleThere will be the following content:
　　IP addresses of common internal servers (such as printing servers and file servers)
New Employee external email name and default password
Username and default password of the company's internal systems (such as ERP and MIS)
Simple instructions for using some internal systems
If a new employee does notNowChange the default password (a considerable percentage of new employees do not change the password immediately on the day of employmentAllDefault password), and the list is directly thrown into the trash. That's a big bargain for spam analysts!
However, the spam analysis method is difficult. Every time you use this trick, you have to pinch your nose and turn it on the bin for several hours. But there are still a lot of commercial espionage.
◇ Ask by phone
Some attackers can call the front-end or customer service department directly and use some techniques (detailed post later) to generate a lot of valuable information.
Why do attackers prefer front-end and customer service staff? This is very elegant! Generally, the front-end and customer service personnel belong to the Service Support Department of the Organization. Employees in these departments are often trained to have the following characteristics: Don't complain, be hospitable, and be helpful. Therefore, such employees will be patient and able to meet some (even a little unreasonable) requirements of attackers.

The above is the basic knowledge of information collection in social engineering. Next post in this series, let's talk about the "fake identity" topic.