Hello and welcome to the second lecture.
And out of hikin humans intro to social engineering presented by our city and this lecture we look at
why social engineering is adopted by a malicious updos in 2017 some major cyber attacks or could.
There was one of cry pecial not Pitsea Equifax breach and it was also revealed that all yahoo accounts
were compromised in a previous breach.
Why not cry on paternal Petchey I walk around somewhere with one of and computer systems in over 100
countries.
Ted Turner Petya resulted in cost in international shipping company mask's three hundred million dollars.
There has been a rise in cyber attacks whether targeted individuals businesses or nation states.
However there is something that most of these attacks seem to have in common.
They are mentally initiated and spread by taking advantage of human weaknesses.
Which makes these attacks easier and cheaper to propagate.
So what motivates social engineers.
Social engineering could be used by a malicious individuals for various reasons.
These include pranks gaining on authorized access to confidential information and data extortion and
blackmail or initiating attacks some social engineers carry out social engineering solely for the purpose
of practical jokes to make fun of their targets where the individuals organizations or even nation states
these type of attacks usually low risk in terms of impact on their targets but may also be a way of
expressing an ideological or political views to the target and can affect their target in terms of reputation
which could have adverse effects on the target's business customers for example or those who patronize
their target victim might end up shot into a victim resulting in adverse effects on the victims or on
an investment.
Malicious attackers also use social engineering to gain access to information and data that they are
not supposed to have access to which they can Freude use to get access to more authorized data on information
of victims like online banking credentials.
Got details and so on the other to rise.
Access can be used to steal identity funds confidential information like trade secrets and the like.
Malicious or once they have compromised a target using social engineering can have unbridled access
to confidential information and data and take control of such as a result of the aforementioned they
can hold such data or information hostage in exchange for funds or threaten to reveal secrets content
in the data out to the public if certain demands are not met.
The secrets could range from trade secrets to embarrass and personal habits.
This can be seen in ransomware social engineers can leverage the data they compromise to fall victims
to give them what they want.
Life funds or assets or whatever.
A malicious attacker cannot only get access to an authorized data via social engineering get an access
to confidential logical access or system controls is possible.
These can be used to launch attacks on a system or network using things like malware.
An example could be seen in the case of stock that which was e-mail model where it wanted to be precise.
That target that suspected uranium enrichment systems in Iran it was initiated using social engineering
techniques.
So why is social engineering adopted.
Well the easiest way to break into a system is to target the weakest point malicious attack us adopt
social engineering as a means of attaining the militias goals because it is cheaper less complicated
readily available and safer.
Instead of employing very expensive I.T. infrastructure to carry out a malicious attack or breach on
the system compromising the operators of the system would be a wise choice.
It is far less expensive.
Compromise and the human element saves the cost and trouble of cracking codes decryption having to make
a prison break in or physically capturing on important relevant systems operator going back to the case
of Stuxnet on the Iranian nuclear systems getting the systems infected by means of social engineering
was cheaper than trying to get someone in to infect the systems with malware or trying to hack into
the network to get infected or trying to physically destroy the infrastructure.
The cost effectiveness of social engineering can also be seen in e-mail scams where the scammers could
be from very poor backgrounds and yet could hit a jackpot with little or no financial investments.
Social engineering attacks do not require a lot of sophistication to be carried out.
Requirement of complicated tools and techniques for initiating attacks can be significantly reduced
or even eliminated with the adoption of social engineering techniques.
Social engineering is also more readily available and easier to deploy done more sophisticated attack
techniques like direct hacking which could be stalled due to cost of the beauty of tools or the target
having very good physical and electronic defenses like foules anti-malware software or anti-hacking
devices.
Crimes like armed robbery or kidnapping can be very risky to life and limb of criminals.
Moreover they might end up not getting the desired returns despite the risk taking.
So for example scummers would be more at ease engaging in the crime of scamming.
Patiently waiting until they strike gold.
There is less stress on even if caught.
This sentence is not likely to be as bad as that of engaging in more dangerous crimes like Groby kidnapping
or human trafficking.
This is likely to be later on if we pare back to this.
In that case again we can see that it was easier to use social engineering to get the Iranian systems
infected sending agents in to do the job could have exposed the agents to capture or death.
And in the event the agents of course they might be broken down or made to reveal more precious information
about their employers which could make the operation counter productive.
Using a mall would also be risky as it might not be easy to design or where the malls Latty really lies.
So has just a brief synopsis of what could end up next case on how it can be used to emphasize Weisel
social Anyway I doubt adopted stocks net thought to have been developed in a joint operation between
the U.S. and Israel targeted suspected Iranian uranium enrichment facilities specifically in Natanz
in 2010.
It was a new type of malware in that it was destruction of physical infrastructure as opposed to the
tradition obligations of such malware or they are affecting information systems the Iranian uranium
enrichment infrastructure all were kept off the internet for security reasons fear of being hacked.
But this will all managed to get through the computer systems running into a uranium enrichment facility.
How is that who USV thumb drives.
B that the facility was off the net.
The originators of stocks net infected the computer systems of some companies that were contractors
to the facility in Athens probably to the Internet.
Employees in these companies use the U.S. drives on their systems getting them infected and then for
the fact that they're not on systems they use deadrise on their warm then clothing from rated over the
network in the facility.
The result was that the uranium enrichment centrifuges failed on an unprecedented scale.
From default when we see that the initiators of stocks that saw the challenges of getting into the facility
and not does it get infected it would have been difficult to get someone to the opposite Guddi it could
not have been infiltrated remotely.
It was not connected to the Internet and a physical assault on the facility would probably be too costly
both in terms of finance and lives.
So they decided to make employees of the contract of companies on within Korea as of the malware we
will disclose baiting of which aversion involves the winner and Tyson malware infected external storage
media about in order to get an unsuspecting curious victim to inside to the storage media on his computer
system and get it infected.
This question was what was initially suspected to have been adopted to initiate the attack.
However debating that was applied in this case was to get unsuspecting inquiries infected to get the
job done.
The case of Stuxnet was initiation of attack by taking advantage of the human weaknesses inherent in
their own witta inquiries of the malware this saved the perpetrators the hassle and cost of getting
access to the systems and Natans physically or emotionally.
Granting the malware infection easy access it also saved from the risk of losing agents going to the
facility to carry out the act which would have led to capture or death or even betrayal.
Cost of crowding out a physical assault was also avoided which would have also resulted in death or
capture or compromise of those who carry out the attack.
Have been or went.
Collateral damage.