Advertisement

A Structured Comparison of Social Engineering Intelligence Gathering Tools

  • Kristian BeckersEmail author
  • Daniel Schosser
  • Sebastian Pape
  • Peter Schaab
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10442)

Abstract

Social engineering is the clever manipulation of the human tendency to trust to acquire information assets. While technical security of most critical systems is high, the systems remain vulnerable to attacks from social engineers. Traditional penetration testing approaches often focus on vulnerabilities in network or software systems. Few approaches even consider the exploitation of humans via social engineering. While the amount of social engineering attacks and the damage they cause rise every year, the defences against social engineering do not evolve accordingly. However, tools exist for social engineering intelligence gathering, which means the gathering of information about possible victims that can be used in an attack. We survey these tools and present an overview of their capabilities. We concluded that attackers have a wide range of intelligence gathering tools at their disposal, which increases the likelihood of future attacks and allows even non-technical skilled users to apply these tools.

Keywords

Social engineering Threat analysis Security awareness Security tools 

Notes

Acknowledgements

This research has been partially supported by the Federal Ministry of Education and Research Germany (BMBF) with project grant number 16KIS0240.

References

  1. 1.
  2. 2.
  3. 3.
    Norwegian register. http://skattelister.no/
  4. 4.
    Tax information. http://www.veroporssi.com/
  5. 5.
  6. 6.
    Barrett, N.: Penetration testing and social engineering: hacking the weakest link. Inf. Secur. Tech. Rep. 8(4), 56–64 (2003)MathSciNetCrossRefGoogle Scholar
  7. 7.
    BBC News. How to hack people, October 2002. http://news.bbc.co.uk/2/hi/technology/2320121.stm
  8. 8.
    CareerBuilder. Job search engine. http://careerbuilder.com/
  9. 9.
    Dimensional Research. The risk of social engineering on information security, September 2011. http://docplayer.net/11092603-The-risk-of-social-engineering-on-information-security.html
  10. 10.
    Dimkov, T., van Cleeff, A., Pieters, W., Hartel, P.: Two methodologies for physical penetration testing using social engineering. In: Proceedings of ACSAC, ACSAC 2010, pp. 399–408. ACM (2010)Google Scholar
  11. 11.
    Dun & Bradstreet. Sales acceleration platform. http://www.hoovers.com/
  12. 12.
    Edge-Security. theHarvester. http://www.edge-security.com/theharvester.php
  13. 13.
    Glassdoor. Recruiting website. https://www.glassdoor.de/
  14. 14.
    Gragg, D.: A multi-level defense against social engineering. SANS Reading Room, 13 March 2003Google Scholar
  15. 15.
    Gulati, R.: The threat of social engineering and your defense against it. SANS Reading Room (2003)Google Scholar
  16. 16.
  17. 17.
    Hadnagy, C.: Social Engineering: The Art of Human Hacking. Wiley, Indianapolis (2010)Google Scholar
  18. 18.
    Hadnagy, C.: The Official Social Engineering Portal (2015)Google Scholar
  19. 19.
    Internetsafety 101. Social Media Statistics (2013). http://www.internetsafety101.org/Socialmediastats.htm
  20. 20.
    Kakavas. Geolocation OSINT Tool. http://www.geocreepy.com/
  21. 21.
    Kee, J.: Social Engineering: Manipulating the Source. GCIA Gold Certification (2008)Google Scholar
  22. 22.
    KnowEm LLC. Social media brand search engine. http://knowem.com/
  23. 23.
    Krombholz, K., Hobel, H., Huber, M., Weippl, E.: Social engineering attacks on the knowledge worker. In: Proceedings of Security of Information and Networks, SIN 2013, pp. 28–35. ACM (2013)Google Scholar
  24. 24.
    LinkedIn. Business social networking service. http://linkedin.com/
  25. 25.
    MarketVisual. Business search engine. http://www.marketvisual.com/
  26. 26.
    Milosevic, N.: Introduction to Social Engineering (2013)Google Scholar
  27. 27.
    Mitnick, K.D., Simon, W.L.: The Art of Deception: Controlling the Human Element in Security (2003)Google Scholar
  28. 28.
    Monster Wolrdwide Inc., Job search engine. http://monster.com/
  29. 29.
    Namechk. Username and domain search tool. https://namechk.com/
  30. 30.
    National Association of Counties. http://www.naco.org/
  31. 31.
    Pakistan Government. Federal board of revenue. http://www.fbr.gov.pk/
  32. 32.
    Paterva. Maltego clients and servers. https://www.paterva.com/web6/products/maltego.php
  33. 33.
    Public Accountability Initiative. http://littlesis.org/
  34. 34.
    Ratsit & Invativa. Credit business website. http://www.ratsit.se/
  35. 35.
    Regan, K.: 10 Amazing Social Media Growth Stats From 2015 (2015)Google Scholar
  36. 36.
    Shodan. Search engine for the internet of things. https://www.shodan.io/
  37. 37.
    Socialmention. Social media search platform. http://socialmention.com/
  38. 38.
    Spokeo. People search website. http://www.spokeo.com/
  39. 39.
    The Internet Archive. The wayback machine. https://archive.org/web/
  40. 40.
    Tomes, T.: Web reconnaissance framework. https://bitbucket.org/LaNMaSteR53/recon-ng
  41. 41.
  42. 42.
  43. 43.
    Warkentin, M., Willison, R.: Behavioral and policy issues in information systems security: the insider threat. Eur. J. Inf. Syst. 18(2), 101–105 (2009)CrossRefGoogle Scholar
  44. 44.
    Watson, G., Mason, A., Ackroyd, R.: Social Engineering Penetration Testing: Executing Social Engineering Pen Tests, Assessments and Defense. Syngress, Rockland (2011)Google Scholar
  45. 45.
    Xing. Business social networking service. http://xing.com/

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  • Kristian Beckers
    • 1
    Email author
  • Daniel Schosser
    • 1
  • Sebastian Pape
    • 2
  • Peter Schaab
    • 1
  1. 1.Institute of InformaticsTechnische Universität München (TUM)GarchingGermany
  2. 2.Faculty of Economics and Business AdministrationGoethe University FrankfurtFrankfurtGermany

Personalised recommendations