3 ms·

This is like countless other social engineering attacks, getting people to unwittingly enter their passwords (e.g. phishing) has a high ROI and physical access

by timf 17y ago

This is like countless other social engineering attacks, getting people to unwittingly enter their passwords (e.g. phishing) has a high ROI and physical access just makes this very easy (e.g. ATM skimming).

idlewords 17y ago
How is this a social engineering attack in any way? The point of interest here is how rapidly an encrypted laptop can be compromised by an untrained person, in a way that evades easy detection.
- timf 17y ago
  You get/let someone to trust the physical situation of their machine. In this case of the "maid" getting to play the maid is the engineering part. Once you have physical access to a machine, cracking is usually guaranteed (this is not new or of much interest). This is no different than a complicated "Sneakers" movie style social engineering attack to get physical access to something... it's just easier in a hotel.
- blasdel 17y ago
  Because it's 'compromised' by surreptitiously convincing the user to give you the password.
  - pyre 17y ago
    That's no more social engineering than installing a hardware keylogger is. It's a technical solution. Social engineering would be convincing the user person-to-person to give up their password (as with a phone call). Phishing scams and virus emails are social engineering in that they are conning the user into taking an action. You're not 'conning' the user into entering their password, you are just making it look like the system is normal and the user is entering their password on their own (because they are looking for access to the system). It would no more be a social engineering hack if you were to make a duplicate laptop with only a keylogger on it, and then burst into the room guns-blazing once they tried to log in with the password. Maybe I'm off here but most social engineering has to do with convincing the user to trust 'you' where 'you' can be an unsolicited email telling them to send money to Nigeria, or a person on the phone claiming to need their password to 'reset their account.' In the case of this attack (or a keylogger), they are trusting something that they already trust, their laptop. You're not 'convincing' them to trust their laptop. You're just covering up the fact that it's been compromised.
    - timf 17y ago
      You seem to want to limit the definition of social engineering to actually coming into social contact with the password-giver. The victim trusts the hotel, the social engineering I saw here is getting into the position of being a maid (who is trusted to not mess with your stuff (well, not by me but apparently by some)). Just like you can social engineer yourself into any company in order to get at the machines and install a keylogger. In my original statement I did not do a very good job at how I am dismissing the interestingness of the original blog post, but a keylogger insertion (either software or hardware based) is a time tested technique,there is nothing new here with the attack "payload." So all I see is "how did the attacker get physical access" but did not flesh this viewpoint out at all, and I apologize. Think of it in terms of remote exploits and their payloads. Why discuss the subtle differences between rootkit #1 vs. rootkit #2 and how each will screw you: the problem is actually in the attack vector, not the payload. Once you're in, the details are somewhat boring (relatively speaking).

by timf 17y ago

idlewords 17y ago

How is this a social engineering attack in any way? The point of interest here is how rapidly an encrypted laptop can be compromised by an untrained person, in a way that evades easy detection.

timf 17y ago
You get/let someone to trust the physical situation of their machine. In this case of the "maid" getting to play the maid is the engineering part. Once you have physical access to a machine, cracking is usually guaranteed (this is not new or of much interest). This is no different than a complicated "Sneakers" movie style social engineering attack to get physical access to something... it's just easier in a hotel.
blasdel 17y ago
Because it's 'compromised' by surreptitiously convincing the user to give you the password.
- pyre 17y ago
  That's no more social engineering than installing a hardware keylogger is. It's a technical solution. Social engineering would be convincing the user person-to-person to give up their password (as with a phone call). Phishing scams and virus emails are social engineering in that they are conning the user into taking an action. You're not 'conning' the user into entering their password, you are just making it look like the system is normal and the user is entering their password on their own (because they are looking for access to the system). It would no more be a social engineering hack if you were to make a duplicate laptop with only a keylogger on it, and then burst into the room guns-blazing once they tried to log in with the password. Maybe I'm off here but most social engineering has to do with convincing the user to trust 'you' where 'you' can be an unsolicited email telling them to send money to Nigeria, or a person on the phone claiming to need their password to 'reset their account.' In the case of this attack (or a keylogger), they are trusting something that they already trust, their laptop. You're not 'convincing' them to trust their laptop. You're just covering up the fact that it's been compromised.
  - timf 17y ago
    You seem to want to limit the definition of social engineering to actually coming into social contact with the password-giver. The victim trusts the hotel, the social engineering I saw here is getting into the position of being a maid (who is trusted to not mess with your stuff (well, not by me but apparently by some)). Just like you can social engineer yourself into any company in order to get at the machines and install a keylogger. In my original statement I did not do a very good job at how I am dismissing the interestingness of the original blog post, but a keylogger insertion (either software or hardware based) is a time tested technique,there is nothing new here with the attack "payload." So all I see is "how did the attacker get physical access" but did not flesh this viewpoint out at all, and I apologize. Think of it in terms of remote exploits and their payloads. Why discuss the subtle differences between rootkit #1 vs. rootkit #2 and how each will screw you: the problem is actually in the attack vector, not the payload. Once you're in, the details are somewhat boring (relatively speaking).