social engineering / helpdesk

Posted on 2009-05-20
Last Modified: 2012-05-07
We are trying to get together a list of best practice controls and countermeasures to thwart any social engineering type attacks against our IT helpdesk. The main concerns we identified or ways a social engineer could try and attack us were users (impersonate an employee) trying to get new network or application accounts setup, password resets, requesting their passwords by passed over the phone, (impersonate a network admin) request configuration details of servers and applications over the phone.

Have we considered every way a social engineer would operate to attack a helpdesk or would there be other ways or types of information that would be tried to be lured out a helpdesk?

What controls and procedures do you train your IT helpdesk staff so they dont fall victim to social engineer, i.e. ask the person logging the call with the helpdesk some security questions to check they are who they say they are? Any other techniques outside of security questions that you use or could recommend? Or do you not divulge anything sensitive over the phone, do you use email to communicate sensitive data?
Question by:pma111
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 33

Expert Comment

by:Dave Howe
ID: 24431023
first pass for social engineering attacks usually targets names of internal staff (particularly senior management or senior technical), email addresses for them, direct dials (etc etc)

not only useful for "cover" when doing later social engineering, but valuable in their own right (to telemarketing and recruitment types)

Author Comment

ID: 24431318
Hi Dave, Do you mean they may ring up the helpdesk asking for employees contact names and details etc?
LVL 33

Expert Comment

by:Dave Howe
ID: 24432788
pretty much. A typical script would run something like "Hi, I am from <name of big company> and need to talk to <name you never heard of> in accounts - however, his email bounces with a message saying he has left the company. Can you tell me who has replaced him in Accounts Receivable?"

"Oh, ok. is he on <standard number with 123 added to the last three digits> like <guy mentioned> was?"


"so, would that be <guy's first name>.<guy's last name>@<company domain> ?"

the important thing is to get another line into the company bypassing the helpdesk; normally, people who aren't on the helpdesk will transfer you almost anywhere to get rid of you if you "accidentally" dial the wrong number (so it is worth trying random numbers a couple up from the helpdesk/general dial number, to see who answers). you can also usually convince people that you are an internal caller if you are transferred, but that depends on their telephony solution.

your helpdesk/reception/published number is like a perimeter firewall - you can get it to the point where it is impenetrable, but that's no use if someone can connect in by another method and bypass it entirely.  that is why, once you have a name, trying random numbers can help - you can often get them to transfer you or even tell you your target's extension (and direct dial usually maps directly to the extension number)

Author Comment

ID: 24438885
Thanks DaveHowe, Do you have any generic suggestions how to protect against SE, and to tighten the helpdesk to act as a tight permiter firewall
LVL 33

Accepted Solution

Dave Howe earned 250 total points
ID: 24441731
do regular testing would be my best recommendation - give them deliberately fuzzy-timescale warnings like "we will be performing Social Engineering testing next month - anyone who gives out internal information, particularly usernames, passwords, names of people in roles or internal phonebook numbers, will have their photo and details of the leak posted to a 'wall of shame' noticeboard near the employee entrance for one month" - actually doing the pentesting is optional.

Work up a few example scripts and distribute them, ideally on an internal website (saves costs, and you can even record some audio files for playback and host them there)

if your company structure is appropriate, try posting the audio files (and transcripts) to a site, and offer a small prize for the best summary of the issues revealed, recommendations for ways to politely refuse information and so forth. the answers themselves aren't important, but the benefit is in getting people thinking about the transcript, in context, and what they would do to avoid that attack.

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The related questions "How do I recover the passwords for my Q-See DVR" and "How can I reset my Q-See DVR to eliminate a password" are seen several times a week.  Here we discuss the grim reality of the situation.
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question