A Structured Comparison of Social Engineering Intelligence Gathering Tools Kristian Beckers, Daniel Schosser, Sebastian Pape and Peter Schaab
Aug 30th / 31th, 2017
TrustBus 2017
Lyon, France
Agenda
1
Social Engineering
2
Method & Criteria
3
Tools
4
Summary and Conclusion
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
2 / 20
Introduction: Social Engineering
Source: cybertec-security.com
Breach vectors leading to compromise:
Source: PWC Information Security Breaches Survey 2017
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
3 / 20
Social Engineering Process ●
Pre Engagement Interactions
●
Intelligence Gathering
●
Pretexting
●
Exploitation
●
Post-Exploitation
[26] Milosevic. Introduction to Social Engineering, 2013. Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
4 / 20
Social Engineering Information
Communication Channels
User Credentials
Locations
Job Positions Company Lingo Sebastian Pape
Personal Information
A Structured Comparison of Social Engineering Intelligence Gathering Tools
5 / 20
Information Needs
Phishing ●
●
Communication channels Company knowledge
Sebastian Pape
Baiting ●
●
Locations (walking routes) Company knowledge
Impersonation ●
●
Information about a single person Company knowledge
A Structured Comparison of Social Engineering Intelligence Gathering Tools
6 / 20
Agenda
1
Social Engineering
2
Method & Criteria
3
Tools
4
Summary and Conclusion
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
7 / 20
Method ●
●
Input –
Google Search ”social engineering and tool or application or script or webpage”
–
List by Hadnagy [17]
–
Consents of 3 researchers
Analysis –
●
General Overview of Tool
Mapping to Attack Types –
Output of tools’ information types
–
Mapped information types to Attack types (Phishing, Baiting, Impersonation)
–
Mapped Tools to Attack Types [17] C. Hadnagy. Social engineering: The art of human hacking. John Wiley & Sons, Indianapolis, 2010.
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
8 / 20
Tool Applicability
Purpose
Price
Input Parameters Sebastian Pape
Usability
Output Visualisation
Counter Measures
Sorting & Ranking
A Structured Comparison of Social Engineering Intelligence Gathering Tools
9 / 20
Mapping of SE Characteristics to Attack Types
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
10 / 20
Agenda
1
Social Engineering
2
Method & Criteria
3
Tools
4
Summary and Conclusion
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
11 / 20
Social Engineering Tools
Maltego
Spokeo Sebastian Pape
Recon-ng
SET A Structured Comparison of Social Engineering Intelligence Gathering Tools
Cree.py
theHarvester 12 / 20
Social Engineering Webpages + X
Wayback Machine ●
Tax Records (e.g. US, Sweden)
●
Company Related Information
Background Checks
Whitepages
Wireshark Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
13 / 20
Social Engineering Attack Potential
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
14 / 20
Tool Coverage of Communication Channels
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
15 / 20
Tool Coverage of Company Data
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
16 / 20
Tools Mapped to Attacks
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
17 / 20
Agenda
1
Social Engineering
2
Method & Criteria
3
Tools
4
Summary and Conclusion
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
18 / 20
Summary and Conclusion ●
●
●
Variety of tools exist –
Allow non-experts to gather information
–
Company Lingo not covered
None of the tools refers to countermeasures –
Risk Assessment of available information
–
Propose policies depending on outcome
Outlook –
More tools
–
More data
Sebastian Pape
A Structured Comparison of Social Engineering Intelligence Gathering Tools
19 / 20
Deutsche Telekom Chair of Mobile Business & Multilateral Security Dr. Sebastian Pape Goethe University Frankfurt Theodor-W.-Adorno-Platz 4 60629 Frankfurt, Germany Phone +49 (0)69 798 34668 Fax +49 (0)69 798 35004 E-Mail:
[email protected] WWW: www.m-chair.de 20
