No Tech Hacking (eBook)

A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing

Johnny Long (Autor)

eBook Download: EPUB

2011 | 1. Auflage
384 Seiten
Elsevier Science (Verlag)
978-0-08-055875-2 (ISBN)

Infos

"As the clich? reminds us, information is power. In this age of computer systems and technology, an increasing majority of the world's information is stored electronically. It makes sense then that as an industry we rely on high-tech electronic protection systems to guard that information. As a professional hacker, I get paid to uncover weaknesses in those systems and exploit them. Whether breaking into buildings or slipping past industrial-grade firewalls, my goal has always been the same: extract the informational secrets using any means necessary. After hundreds of jobs, I discovered the secret to bypassing every conceivable high-tech security system. This book reveals those secrets, and as the title suggests, it has nothing to do with high technology. As it turns out, the secret isn't much of a secret at all. Hackers have known about these techniques for years. Presented in a light, accessible style, you'll get to ride shotgun with the authors on successful real-world break-ins as they share photos, videos and stories that prove how vulnerable the high-tech world is to no-tech attacks.

As you browse this book, you'll hear old familiar terms like dumpster diving, social engineering, and shoulder surfing. Some of these terms have drifted into obscurity to the point of becoming industry folklore, the tactics of the pre-dawn information age. But make no mistake, these and other old-school tactics work with amazing effectiveness today. In fact, there's a very good chance that someone in your organization will fall victim to one or more of these attacks this year. Will they be ready?

.Dumpster Diving
Be a good sport and don't read the two D words written in big bold letters above, and act surprised when I tell you hackers can accomplish this without relying on a single bit of technology (punny).
.Tailgating
Hackers and ninja both like wearing black, and they do share the ability to slip inside a building and blend with the shadows.
.Shoulder Surfing
If you like having a screen on your laptop so you can see what you're working on, don't read this chapter.
.Physical Security
Locks are serious business and lock technicians are true engineers, most backed with years of hands-on experience. But what happens when you take the age-old respected profession of the locksmith and sprinkle it with hacker ingenuity?
.Social Engineering with Jack Wiles
Jack has trained hundreds of federal agents, corporate attorneys, CEOs and internal auditors on computer crime and security-related topics. His unforgettable presentations are filled with three decades of personal war stories from the trenches of Information Security and Physical Security.
.Google Hacking
A hacker doesn't even need his own computer to do the necessary research. If he can make it to a public library, Kinko's or Internet cafe, he can use Google to process all that data into something useful.
.P2P Hacking
Let's assume a guy has no budget, no commercial hacking software, no support from organized crime and no fancy gear. With all those restrictions, is this guy still a threat to you? Have a look at this chapter and judge for yourself.
.People Watching
Skilled people watchers can learn a whole lot in just a few quick glances. In this chapter we'll take a look at a few examples of the types of things that draws a no-tech hacker's eye.
.Kiosks
What happens when a kiosk is more than a kiosk? What happens when the kiosk holds airline passenger information? What if the kiosk holds confidential patient information? What if the kiosk holds cash?
.Vehicle Surveillance
Most people don't realize that some of the most thrilling vehicular espionage happens when the cars aren't moving at all!"

---

Johnny Long's last book sold 12,000 units worldwide. Kevin Mitnick's last book sold 40,000 units in North America.As the cliche goes, information is power. In this age of technology, an increasing majority of the world's information is stored electronically. It makes sense then that we rely on high-tech electronic protection systems to guard that information. As professional hackers, Johnny Long and Kevin Mitnick get paid to uncover weaknesses in those systems and exploit them. Whether breaking into buildings or slipping past industrial-grade firewalls, their goal has always been the same: extract the information using any means necessary. After hundreds of jobs, they have discovered the secrets to bypassing every conceivable high-tech security system. This book reveals those secrets; as the title suggests, it has nothing to do with high technology.* Dumpster DivingBe a good sport and don't read the two "e;D words written in big bold letters above, and act surprised when I tell you hackers can accomplish this without relying on a single bit of technology (punny). * TailgatingHackers and ninja both like wearing black, and they do share the ability to slip inside a building and blend with the shadows.* Shoulder SurfingIf you like having a screen on your laptop so you can see what you're working on, don't read this chapter.* Physical SecurityLocks are serious business and lock technicians are true engineers, most backed with years of hands-on experience. But what happens when you take the age-old respected profession of the locksmith and sprinkle it with hacker ingenuity?* Social Engineering with Jack WilesJack has trained hundreds of federal agents, corporate attorneys, CEOs and internal auditors on computer crime and security-related topics. His unforgettable presentations are filled with three decades of personal "e;war stories"e; from the trenches of Information Security and Physical Security. * Google HackingA hacker doesn't even need his own computer to do the necessary research. If he can make it to a public library, Kinko's or Internet cafe, he can use Google to process all that data into something useful.* P2P HackingLet's assume a guy has no budget, no commercial hacking software, no support from organized crime and no fancy gear. With all those restrictions, is this guy still a threat to you? Have a look at this chapter and judge for yourself.* People WatchingSkilled people watchers can learn a whole lot in just a few quick glances. In this chapter we'll take a look at a few examples of the types of things that draws a no-tech hacker's eye.* KiosksWhat happens when a kiosk is more than a kiosk? What happens when the kiosk holds airline passenger information? What if the kiosk holds confidential patient information? What if the kiosk holds cash?* Vehicle SurveillanceMost people don't realize that some of the most thrilling vehicular espionage happens when the cars aren't moving at all!

Inhalt

Front Cover 1
No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing 2
Copyright Page 4
Johnny Long, Author 6
“I’m Johnny. I Hack Stuff.” 6
Technical Editor 8
Contributing Author 9
Foreword Contributor 10
Special Contributors 11
Contents 14
Foreword 18
Introduction 20
What Is “No-Tech Hacking?” 20
Chapter 1: Dumpster Diving 26
Introduction to Dumpster Diving 27
Chapter 2: Tailgating 38
Introduction to Tailgating 39
Dressing the Part 42
Real-World Tailgating Exercise 49
Chapter 3: Shoulder Surfing 52
What is Shoulder Surfing? 53
Outside of the box 55
Great Locations for Should Surfing 58
Electronic Deduction 64
Killer Real-Life Surfing Sessions 72
Military Intelligence 72
Airliner Espionage 75
Robbing a Bank 78
Robbing Banks in Uganda, Africa 83
Chapte 4: Physical Security 86
Introduction 87
Lock Bumping 87
Shimming Padlocks (With Deviant Ollam) 88
Master Lock Combo Lock Brute Forcing 92
Toilet Paper vs. Tubular Locks 97
Electric Flossers: A Low-Tech Classic 98
Laptop Locks Defeated by Beer (With Matt Fiddler and Marc Weber Tobias) 100
TSA Locks (With Marc Weber Tobias) 103
Gun Trigger Locks vs. Drinking Straw (With Marc Tobias and Matt Fiddler) 105
Entry Techniques: Loiding (aka the Old Credit Card Trick) 108
Entry Techniques: Motion Sensor Activation 112
Bypassing Passive Infrared (PIR) Motion Sensors 115
Camera Flaring 117
Real World: Airport Restricted Area Simplex Lock Bypass 121
Cahpter 5: Social Engineering: Here's How I Broke Into Their Buildings 126
Introduction 127
How Easy Is It? 127
Human Nature, Human Weakness 130
Hello? Is this thing on? 131
The Mind of a Victim 133
"Social engineering would never work against our company!" 133
What Was I Able to Social Engineer Out of Mary? 135
The Final Sting 135
Why did this scam work? 136
Countering Social Engineering Attacks 137
Be Willing To Ask Questions 137
Security Awareness Training 138
Posters 138
Videos 140
Certificates 142
Chapter 6: Google Hacking Showcase 146
Introduction to the Introduction 147
Introduction 147
Geek Stuff 148
Utilities 148
Open Network Devices 153
Open Applications 162
Cameras 168
Telco Gear 178
Power 185
Sensitive Info 191
Police Reports 200
Social Security Numbers 204
Credit Card Information 210
Beyond Google 215
Summary 220
Chapter 7: P2P Hacking 222
Understanding P2P Hacking 223
Real World P2P Hacking: The Case of the Naughty Chiropractor 237
Chapter 8: People Watching 242
How to "People Watch" 243
Chapter 9: Kiosks 252
Understanding Kiosk Hacking 253
Real World: ATM Hacking 264
Chapter 10: Vehicle Surveillance 270
How Easy Is Vehicle Surveillance? 271
Chapter 11: Badge Surveillance 284
Where Are Your Badges? 285
Electronic Badge Authentication 289
Real World Badge Surveillance 291
Epiloque: Top Ten Ways to Shut Down No-Tech Hackers 298
Go Undercover 299
Shred Everything 299
Get Decent Locks 300
Put that Badge Away 301
Check Your Surveillance Gear 301
Shut Down Shoulder Surfers 302
Block Tailgaters 302
Clean your Car 303
Watch your Back Online 304
Beware of Social Engineers 304
Index 306

Textauszug

Introduction

What Is “No-Tech Hacking?”

When I got into this field, I knew I would have to stay ahead of the tech curve. I spent many sleepless nights worming through my home network trying to learn the ropes. My practice paid off. After years of hard work and dedicated study, I founded a small but elite pen testing team. I was good, my foo strong. Networks fell prostrate before me. My co-workers looked up to me, and I thought I was The Man. Then I met Vince.

In his mid-40s, hawk-eyed, and vaguely European looking, Vince blended in with the corporate crowd; he was most often seen in a black leather trench coat, a nice dress shirt, dark slacks, black wing tips and the occasional black fedora. He had a definite aura. Tales of his exploits were legendary. Some said he had been a fed, working deep-black projects for the government. Other insisted he was some kind of mercenary genius, selling his dark secrets to the highest bidder.

He was brilliant. He could do interesting and seemingly impossible things. He could pick locks, short-circuit electronic systems, and pluck information out of the air with fancy electronic gear. He once showed me a system he built called a “van Eck” something-or-other.1 It could sniff the electromagnetic radiation coming from a CRT and reassemble it, allowing him to eavesdrop on someone’s computer monitor from a quarter mile away. He taught me that a black-and-white TV could be used to monitor 900MHz cellular phone conversations. I still remember hunching over a table in my basement going at the UHF tuner post of an old black-and-white TV with a pair of needle-nosed pliers. When I heard a cellular phone conversation coming through that old TV’s speaker, I decided then and there I would learn everything I could from Vince.

I was incredibly intimidated before our first gig. Fortunately, we had different roles. I was to perform an internal assessment, which emulated an insider threat. If an employee went rogue, he could do unspeakable damage to a network. In order to properly emulate this, our clients provided us a workspace, a network jack, and the username and password of a legitimate, non-administrative user. I was tasked with leveraging those credentials to gain administrative control of critical network systems. If I gained access to confidential records stored within a corporate database, for example, my efforts were considered successful. I had a near-perfect record with internal assessments and was confident in my abilities.

Vince was to perform a physical assessment that emulated an external physical threat. The facility had top-notch physical security. They had poured a ton of money into expensive locks, sensors, and surveillance gear. I knew Vince would obliterate them all with his high-tech superpowers. The gig looked to be a real slam-dunk with him working the physical and me working the internal. We were the “dream team” of security geeks.

When Vince insisted I help him with the physical part of the assessment, I just about fell over. I imagined a James Bond movie, with Vince as “Q” and myself (of course) as James Bond in ninja assault gear. Vince would supply the gadgets, like the van Eck thingamabob and I would infiltrate the perimeter and spy on their surveillance monitors or something. I giggled to myself about the unnatural things we would do to the electronic keypad systems or the proximity locks. I imagined the looks on the guard’s faces when we duct-taped them to their chairs after silently rappelling down from the ceiling of the surveillance room.

I couldn’t wait to get started. I told Vince to hand over the alien gadgets we would use to pop the security. When he told me he hadn’t brought any gadgets, I laughed and poked him. I never knew Vince was a kidder. When he told me he really didn’t bring any gear, I briefly considered pushing him over, but I had heard he was a black belt in like six different martial arts, so I just politely asked him what the heck he was thinking. He said we were going to be creative. The mercenary genius, the storm center of all the swirling rumors, hadn’t brought any gear. I asked him how creative a person could be when attacking a highly secured building without any gear. He just looked at me and gave me this goofy grin. I’ll never forget that grin.

We spent the morning checking out the site. It consisted of several multistory buildings and a few employee parking lots, all enclosed by protective fencing. Everyone came and went through a front gate. Fortunately, the gate was open and unguarded. With Vince driving, we rounded one building and parked behind it, in view of the loading docks.

“There,” he said.

“Where?” I asked.

“There,” he repeated.

Vince’s sense of humor sucked sometimes. I could never quite tell when he was giving me crap. I followed the finger and saw a loading dock. Just past the bay doors, several workers carried packages around. “The loading dock?” I asked.

“That’s your way in.”

I made a “Pffft” sound.

“Exactly. Easy.” he said.

“I didn’t mean ‘Pffft’ as in easy. I meant ‘Pffft’ as in there’s people there and you said I was going in.”

“There are, and you are,” he said. Vince was helpful that way. “Just look like you belong. Say hello to the employees. Be friendly. Comment on the weather.”

I did, and I did. Then I did, and I did and I found myself inside. I walked around, picked up some blueprints of tanks and military-looking stuff, photocopied them and left. Just like that. I’m skipping the description of my heart pounding at 400 beats per minute and the thoughts of what military prison would be like and whether or not the rumors about Bubba were true, but I did it. And it was an incredible rush. It was social engineering at its simplest, and it worked wonders. No one questioned me. I suppose it was just too awkward for them. I couldn’t hide my grin as I walked to the car. Vince was nowhere to be found. He emerged from the building a few minutes later, carrying a small stack of letter-sized paper.

“How did you get in?” I asked.

“Same way you did.”

“So why didn’t you just do it yourself?” I asked. “I had to make sure it would work first.”

I was Vince’s guinea pig but it didn’t really matter. I was thrilled and ready for more. The next building we targeted looked like an absolute fortress. There were no loading docks and the only visible entrance was the front door. It was wood and steel—too much like a castle door for my taste—and approximately six inches thick, sporting a proximity card-reader device. We watched as employees swiped a badge, pulled open the doors and walked in. I suggested we tailgate. I was on a roll. Vince shook his head. He obviously had other plans. He walked towards the building and slowed as we approached the front door. Six feet from the door, he stopped. I walked a step past him and turned around, my back to the door.

“Nice weather,” he said, looking past me at the door.

“Ehrmm, yeah,” I managed.

“Good day for rock climbing.”

I began to turn around to look at the building. I hadn’t considered climbing it.

“No,” he said. “Don’t turn around. Let’s chat.”

“Chat?” I asked. “About what?”

“You see that Bears game last night?” he asked. I had no clue what he was talking about or even who the Bears were but he continued. “Man, that was something else. The way that team works together, it’s almost as if …” Vince stopped in mid-sentence as the front door opened. An employee pushed the door open, and headed towards the parking lot. “They move as a single unit,” he continued. I couldn’t help myself. I turned around. The door had already closed.

“Crap,” I said. “We could have made it inside.”

“Yes, a coat hanger.”

Vince said strange stuff sometimes. That was just part of the package. It wasn’t crazy-person stuff, it was just stuff that most people were too dense to understand. I had a pretty good idea I had just witnessed his first crazy-person moment. “Let’s go,” he said. “I need a washcloth. I need to go back to the hotel.” I had no idea why he needed a washcloth, but I was relieved to hear he was still a safe crazy person. I had heard of axe murderers, but never washcloth murderers.

We passed the ride back to the hotel in silence; Vince seemed lost in his thoughts. He pulled up in front of the hotel, parked, and told me to wait for him. He emerged a few minutes later with a wire coat hanger and a damp washcloth. He tossed them into the back seat. “This should work,” he said, sliding into his seat and closing the doors. I was afraid to ask. Pulling away from the hotel, he continued. “I should be able to get in with these.”

I gave him a look. I can’t exactly say what the look was, but I imagine it was somewhere between “I’ve had an unpleasant olfactory encounter” and “There’s a tarantula on your head.” Either way, I was pretty convinced he’d lost his mind or had it stolen by aliens. I pretended not to hear...

Produkt-Details

• Erscheint lt. Verlag: 18.4.2011
• Mitarbeit: Herausgeber (Serie): Kevin D. Mitnick
• Sprache: englisch
• Themenwelt: Literatur ► Biografien / Erfahrungsberichte
• Themenwelt: Literatur ► Romane / Erzählungen
• Themenwelt: Sachbuch/Ratgeber
• Themenwelt: Informatik ► Netzwerke ► Sicherheit / Firewall
• Themenwelt: Mathematik / Informatik ► Informatik ► Theorie / Studium
• Themenwelt: Wirtschaft ► Betriebswirtschaft / Management ► Finanzierung
• Themenwelt: Wirtschaft ► Betriebswirtschaft / Management ► Personalwesen
• ISBN-10: 0-08-055875-5 / 0080558755
• ISBN-13: 978-0-08-055875-2 / 9780080558752