Initial idea 2

I have read a book "Cybersecurity: What You Need to Know About Computer and Cyber Security, Social Engineering, The Internet of Things + An Essential Guide to Ethical Hacking for Beginners" by Lester Evans previous week and got interested in the using of social engineering for doing attacks such as brute force attack and dictionary attack. This post describes this area and is based on the book I read.

                                                                        (Evans, 2018)
                                                                       

Firstly, this is the list of attacks those are discussed in this post:

1. Brute force attack - in this type of attack, attacker does trial-and-error to guess the login info. "These attacks are done by ‘brute force’ meaning they use excessive forceful attempts to try and ‘force’ their way into your private account(s)" (Kaspersky, 2021).
2. Dictionary attack - a type of brute force attack that tries the passwords generated using the library of terms and other values. Dictionaries for such attacks can be seen on the internet (HYPR, 2021).

Social Engineering is a way of getting the private information through pretending to be another person during phone and/or text conversations, for instance pretending to be a client while speaking with bank accountant. In other words social engineering is exploiting inherent human trust in order to get access to private data (Evans, 2018)

Brute force attack is an attack focused on cracking passwords. It may be done by special software that tries loads of passwords one by one. It mixes letters, numbers in any order trying to guess the password. Dictionary attack is a special type of brute-force attack which is based on human common behaviour - people mostly create passwords using words, not the random order of characters and numbers. Hacker uploads a dictionary with lots of common used words in Dictionary attack software, which tries them one by one usually mixing upper-case and lower-case characters, adding numbers and/or tries the opposite order of the characters in the word. Dictionary attack demands less effort and can be done much faster than a regular brute force attack. 

Usually cracking the password can become an eternal task because good passwords (what password can be described as a good one will be discussed later in the post) demand really long time to crack. On the opposite, weak passwords are usually cracked in milliseconds. Nevertheless, if password is neither weak nor strong it still demands some time to crack it. The time is really essential because a hacker needs to complete an attack before the data leak is detected and the victim is trying to prevent the attack. Therefore, social engineering can make the task of cracking the password easier.

As it was said before, the most essential obstacle for cracking passwords using brute-force attack and dictionary attack is time. It takes significant amount of time to crack a well-done password, for instance I was trying to crack my own password, which consists of upper-case, lower-case characters and numbers, using the Hashcat program. This program will be discussed in the Major project theme post. It showed me the approximate duration of the attack as 7 hours even with the fact that I used the right preset and put the length and positions of every upper-case character and number. 

And at this very task social engineering can help an attacker a lot. An attacker can get a lot of information about the password and the victim using social engineering attacks. Sometimes it is possible even to get the password itself without the need to crack it. That is the reason why social engineering and brute-force attacks are interconnected.

To execute a brute force attack the hacker must know at least the login of the account he tries to log in. Using social engineering the hacker is able to find out the login of a particular victim, for instance an email address. Also, people have a tendency to use the information connected with their relatives, family and themselves in a password, for instance date of birth, names of children, date of marriage and so on. Such data gathered from the victim can be used to form a special dictionary for an attack on particular victim. Furthermore, if the attacker gains trust of the victim, he can ask to use some unimportant account of the victim, for instance an account on an online cinema or Netflix. If the attacker gains one of the actual passwords of any other victim's account, it is always a chance that the person uses same password on lots of the resources. Even if victim has different passwords on every resource, now the attacker knows the example of the password victim uses, therefore, attacker can approximately estimate the length, structure and complexity of the password he needs to crack, hence, the attacker can setup the attacking software the right way and decrease the time of an attack.

Social engineering attacks become even more dangerous if they are aimed at high-ranked people since every piece of information collected can become a turning point and the consequences may be really unpredictable. For example in 2012 the NATO supreme allied commander Admiral James Stavridis had been regularly targeted in a Facebook scam (Hopkins, 2012). Attackers created a number of accounts bearing his name to try to get any pieces of private information connected with the admiral. They contacted his colleagues, friends and relatives hoping that they would reveal private data (Hopkins, 2012).

Another interesting example of social engineering attack I found on the Tessian. "Perhaps the most successful social engineering attack of all time was conducted against Belgian bank Crelan. While Crelan discovered its CEO had been “whaled” after conducting a routine internal audit, the perpetrators got away with $75 million and have never been brought to justice" (Tessian, 2021).

In conclusion it is necessary to explain the way passwords are stored in a system and why it is so important to have a password with randomly mixed upper-case and lower-case characters and numbers. Passwords are usually stored in a system as a hash. Hash is a cryptographic sum of the given data. Meant to produce a scrambled data which can be used for comparison without exposing the actual text (Evans, 2018). That means that even if hacker gets excess to the file with logins and passwords he still needs to execute a brute force attack in order to get the actual password from the hash. The idea is that the longer and more complicated password is - the more effort attacker must do in order to crack the password. This topic will be discussed in more details in future posts. 

In summary, social engineering can be used in order to: identify the login of a particular victim, gather the information to create a specific dictionary for an attack on a particular victim, get the approximate parameters of the password, get the password itself and so on. The list of areas where social engineering may be used is really eternal.

Reference:

Kaspersky, 2021. Brute Force Attack: Definition and Examples. [online] www.kaspersky.com. Available at: <https://www.kaspersky.com/resource-center/definitions/brute-force-attack> [Accessed 12 October 2021].

HYPR, 2021. What is a Dictionary Attack? | Security Encyclopedia. [online] HYPR. Available at: <https://www.hypr.com/dictionary-attack/> [Accessed 12 October 2021].

Evans, L., 2018. Cybersecurity: What You Need to Know About Computer and Cyber Security, Social Engineering, The Internet of Things + An Essential Guide to Ethical Hacking for Beginners. pp.106, 102.

Hopkins, N., 2012. China suspected of Facebook attack on Nato's supreme allied commander. [online] the Guardian. Available at: <https://www.theguardian.com/world/2012/mar/11/china-spies-facebook-attack-nato> [Accessed 14 October 2021].

Tessian, 2021. 11 Social Engineering Examples - Real Attacks - Updated 2021 - Tessian. [online] Tessian. Available at: <https://www.tessian.com/blog/examples-of-social-engineering-attacks/> [Accessed 14 October 2021].