Password Cracking

The easiest password attack mechanism is called dumpster diving, a euphemism for "rummaging through trash." As its name suggests, this method involves searching for sensitive information that may be thrown away into the trash, which can be accessed by an intruder who can physically retrieve the trash. Some users allow easy access to their passwords by leaving their passwords on notes around their computer area—some passwords are even taped to the computer monitor.

One way to obtain a password is the brute force method, trying all different alphanumeric combinations until the password is cracked. A similar method is thedictionary attack, matching every word in the dictionary against the password to decrease the search space. There are many software programs designed to crack passwords using these methods.

Prevention:

• Do not throw away legible password information in the trash or leave your passwords at obvious places

• Destroy or lock up sensitive information

• Use difficult to guess passwords that are resistant to brute force or dictionary attacks

• Change passwords frequently

• Limit physical access to computer areas, especially central servers

Packet sniffing

A packet sniffer is a software program or a hardware device that captures data packets as they are transmitted through the network. Some data packets captured may contain sensitive information. Installing a packet sniffer does not require administrator rights. It can be installed on a laptop and access the network through an open port.

Cable modem and wireless users have a higher risk of exposure to packet sniffers compared to DSL and traditional dial-up users because entire neighborhoods of cable modem and wireless users are part of the same LAN. A packet sniffer installed on any cable modem or wireless user's computer may be able to capture data packets transmitted by other computers in the same LAN.

Prevention:

• Employ data encryption to use encrypted protocols (more about encryption will be discussed later in 6.2.1 Encryption)

• Limit physical access to network connections

• Monitor network usage and investigate abnormal or suspicious activities

Social Engineering/Fraud

Social engineering refers to the action of tricking people into providing information needed to gain access to systems. Unlike the other attack methods discussed, this attack does not involve a software tool. An attack via social engineering can be accomplished by manipulating the network administrator or other authorized user to give you account name and password information. This can be achieved over the phone, via email or even in person pretending to be someone important in an organization.

The following is an example of a social engineering attack: Joe is an employee at a company. He wants to access the CEO's computer. He calls the system administrator pretending to be the CEO. He claims to have forgotten his password and asks the system administrator to reset it. Because resetting passwords is a common task that network administrators perform frequently, the network administrator reset the password without asking Joe further questions. While the CEO is out of the office, Joe sneaks into the CEO's office and uses the password obtained from the system administrator to access the CEO's computer. He can now act as the CEO and go through his files, alter his data, or send out emails.

Prevention:

• Verify identities of people requesting sensitive information

• Become aware of social engineering schemes and educate others of security policies and their importance