Security Vision from McAfee® Avert® Labs Fall 2008 SOCIAL ENGINEERING The World’s Leading Security Threat TROJANS, click fraud, and money appeals are just a few of the vectors that help malware writers take advantage of Internet users McAfee Security Journal Fall 2008 Editor Contents Dan Sommer Contributors Anthony Bettini Hiep Dang Benjamin Edelman Elodie Grandjean 4 The Origins of Social Engineering From Odysseus’ Trojan horse to Jeff Green phishing on the Internet: Deception just won’t go away. By Hiep Dang Aditya Kapoor Rahul Kashyap Markus Jacobsson 9 Ask and You Will Receive The psychology of social engineering: Karthik Raman Why does it work? By Karthik Raman Craig Schmugar 13 Social Engineering 2.0: What’s Next Click fraud appears one of the Statistics most likely threats that we’ll face in the near future. By Markus Jakobsson Toralv Dirro Shane Keats 16 The Beijing Olympics: Prime Target for Social Engineering Malware David Marcus The five rings, and other major events, are an irresistible attraction for François Paget malware authors. By Elodie Grandjean Craig Schmugar 22 Vulnerabilities in the Equities Markets Can hackers make money Illustrator from Patch Tuesday and other company news? By Anthony Bettini Doug Ross 28 The Future of Social Networking Sites Lots of money and users make Design social sites another magnet for malware. By Craig Schmugar PAIR Design, LLC 31 The Changing Face of Vulnerabilities Social engineering tricks can Acknowledgements lead users into holes in software. By Rahul Kashyap Many people helped create this issue of the McAfee Security Journal. We would like to cite a number of the key 34 Typosquatting: Unintended Adventures in Browsing Incautious web contributors: the senior executives at browsing can lead to the unexpected. By Benjamin Edelman McAfee, Inc. and McAfee Avert Labs who have supported this creation; our 38 Whatever Happened to Adware and Spyware? Tougher laws may review board—Carl Banzhof, Hiep Dang, have tamed adware, but PUPs and Trojans remain. By Aditya Kapoor David Marcus, Craig Schmugar, Anna Stepanov, and Joe Telafici; our 44 Statistics How risky are top-level domains? By David Marcus authors and their managers and teammates who have supported them with ideas and comments; marketing mavens Cari Jaquet, Mary Karlton, Beth Martinez, and Jennifer Natwick; public relations pros Joris Evers, his world- wide team, and Red Consultancy Ltd.; our design agency, Pair Design; our printer, RR Donnelley; and Derrick Healy and his mates in our Cork, Ireland, localization office, which has translated this publication into many languages. Thanks to all; we couldn’t have achieved this without you! Dan Sommer Editor Like it? Hate it? Send your comments to [email protected]. ‘McAfee Security Journal’ Debuts By Jeff Green Welcome to the first issue of the McAfee Security Journal. We kick off with a look back at the history of deception. Then We call this a first issue, but we’re not really producing this pub- we peer into the psychology of why these attacks work. Next lication for the first time. We have renamed the journal that we we look ahead to how social engineering might evolve during have, until recently, called (depending on the country you read the next few years. The 2008 Olympics in Beijing have ended, it in) McAfee Sage or the McAfee Global Threat Report. In the but malware authors once again attempted to fool sports fans McAfee Security Journal, you’ll find the same outspoken attitude into visiting bogus web sites. Is it possible to make money in the as well as all the dynamic content you have come to expect stock market by timing events such as Microsoft’s Patch Tuesday from the best researchers and authors in computer security or spoofing company news? Our extensive research will offer an research: the experts at McAfee® Avert® Labs. In this issue, answer. What’s next with social networking sites? Will security we take aim at the most insidious and pervasive of all threat tighten up, or are they doomed to be easy targets because of vectors—social engineering. overly trusting users? We’ll also look at how malware writers attack software vulnerabilities and take advantage of typosquat- Free Tibet! New images of World War 3! IRS Tax Break Secrets! ting—the exploitation of incorrectly typed web requests. Our New Gas Saving Technologies! Cheap Medication Online! final article will answer the question “Whatever happened to adware and spyware?” We’ll finish off with some statistics that The list could easily go on, but we hope the point is clear. Effec- show the varying degree of threats to top-level domains around tive and seductive messaging is critical to the success of malware the world. writers and identity thieves today, and more so now than ever before. Social engineering, however, as a method of bilking We hope you find this issue as challenging and thought provok- someone is certainly not new. It has existed since humans have ing as we do. Thanks for joining us once again as we journey into been communicating with one another. You have something I the depths of computer security. want. I want to talk you into giving it to me or into doing some- thing I want you to do. Social engineering is possibly the most difficult of all threats to combat due to the human element. The easiest way to steal someone’s identity might just be to ask for it. Jeff Green is senior vice-president of McAfee Avert Social engineering techniques—Ponzi schemes, confidence tricks, Labs and Product Development. He has worldwide pyramid schemes, simple fraud, phishing, or spam—all follow responsibility for McAfee’s entire research organiza- similar paths. Some of these attacks are physical, while others are tion, located throughout the Americas, Europe, and digital, but all have elements in common. They have the same Asia. Green oversees research teams focused on viruses, hacker/targeted attacks, spyware, spam, aim and in many cases may even use the same techniques. The phishing, vulnerabilities and patches, and host and goal of them all is to manipulate victims through a “bug” in the network intrusion technologies. He also leads human hardware. They all create scenarios that are designed to long-term security research to ensure that McAfee persuade victims to release information or perform an action. stays ahead of emerging threats. We have assembled another outstanding collection of researchers and authors to analyze and illustrate this topic for you. We’ve even broken new ground for our journal: this issue marks the first time we have guest contributors. We start with two of the finest: Dr. Markus Jacobsson of the Palo Alto Research Center and Professor Benjamin Edelman of the Harvard Business School. FALL 2008 3 The Origins of Social Engineering By Hiep Dang One would be hard pressed today to read a news article or book about computer security without coming across the term social engineering more than once. Popularized by Kevin Mitnick (arguably the most infamous social punished mortals by withholding fire. However, in yet another engineer in the modern computing era), social engineering is in act of social engineering against Zeus, Prometheus stole “the essence the art of persuasion—convincing individuals to disclose far-seen gleam of unwearying fire in a hollow fennel stalk” from confidential data or perform some action. Although social engi- Mount Olympus and bequeathed it to man. As punishment for neering is a contemporary term, the techniques and philosophies his acts, Prometheus was chained to a rock, where every day behind it have been around as long as humanity itself. We find an eagle would come and eat his liver, which would grow back stories of deception and manipulation in the pages of history, again at night. As a punishment for man, Zeus created the first folklore, mythology, religion, and literature. woman, Pandora, who brought with her a jar that she opened out of curiosity, releasing countless plagues. Prometheus: The God of Social Engineering? Jacob and Rebekah’s Phishing Attack From the Old Testament comes the story of Jacob and his mother, According to Greek mythology, humanity’s proficiency in social Rebekah, who used a social engineering technique that is the engineering today is probably a direct result of its greatest foundation of today’s phishing attacks—making the victim mentor: Prometheus, who was so skilled in this craft that he believe that the phisher is someone else. Jacob’s father and could trick Zeus, the king of gods. In Theogony and Works and Rebekah’s husband, Isaac, had gone blind in the last years of his Days, the epic poet Hesiod tells the story of Prometheus, a Titan life. As he prepared for death, he instructed his oldest son, Esau, known for his wily ways and cunning tricks. He is credited for to “hunt game for me, and prepare for me savory food, such the creation of man by molding him out of clay. In what became as I love, and bring it to me that I may eat; that I may bless you known as the “Trick at Mecone,” Prometheus offered Zeus two before I die.” (Genesis 27:2– 4.) Wanting Jacob instead of Esau choices to settle a dispute between the gods and mortals. One to receive Isaac’s blessings, Rebekah devised a plan. Jacob was offering was ox meat stuffed inside an ox’s stomach, the other reluctant at first, saying “Behold, my brother Esau is a hairy man, was an ox bone covered with shining fat. One was nourishment and I am a smooth man. Perhaps my father will feel me, and I wrapped in a vile covering while the other was an inedible shall seem to be mocking him, and bring a curse upon myself choice, though visually tantalizing.