Which of these items retrieved through dumpster diving would not provide useful information?

Dumpster Diving

“Dumpster diving” means searching trash for useful information. The trash may be in a public dumpster or in a restricted area requiring unauthorized entry. Dumpster diving depends on a human weakness: the lack of security knowledge. Many things can be found dumpster diving (e.g., CDs, DVDs, hard drives, company directories, and so forth). Probably the most famous example of dumpster diving was performed by Jerry Schneider in southern California. While in high school in 1968, Jerry found documentation regarding Pacific Telephone’s automated equipment ordering and delivery system, which he used to order equipment and have delivered to dead drops. Jerry accumulated hundreds of thousands of dollars worth of telephone equipment and established Creative Systems Enterprises to sell it; some of it was sold back to Pacific Telephone. Jerry was arrested in 1972, and started a security company in 1973 that he left in 1977. Read more about Jerry Schneider at //en.wikipedia.org/wiki/Jerry_Schneider. Read more about dumpster diving at www.reference.com/browse/wiki/Dumpster_diving.

Tip

Dumpsters can contain hazards such as broken glass and nails. Wear work boots and other protective clothing. Dumpster diving is illegal in some municipalities and legal in others. Know your situation.

Attacking in person

In person social engineering attacks are the stuff of legends. Attackers dressed as service professionals have removed servers, stolen workstations, and even stolen backup tapes while pretending to be tech support. In person attacks take the most ability but can yield the greatest results.

Dumpster diving is listed by many as a social engineering attack, but to me it is more physical security, as a social engineering attack requires someone to engineer. This smelly method of attack yields interesting results. Old credit card forms, all the internal forms and memos and posted notes, all contain valuable information helping the social engineering attacks. Organizational structure, staff names, and departmental names are available to the dumpster diver.

While dumpster diving usually gives great results it does have its dangers. You'll need several items to keep this a polite process. Always take along extra clothes to wear just for this as sometimes dumpsters have real garbage in them. Take several pairs of latex gloves and leather work gloves. I usually wear the latex gloves as liners to the work gloves because icky stuff soaks through the work gloves but not the latex liner. A long stick with a hook of some type always helps and keeps you from having to reach so far in the dumpster. New dumpsters are tall so take some form of step stool to get in and out easily. I like to dive mid evening when it's quiet. Lastly, always call to see what the cafeteria has for lunch because it may end up in the dumpster you're diving in. Never dive when spaghetti is on the menu.

Shoulder surfing is the lowest tech attack but does supply login credentials and pin numbers. The attacker stands behind the victim and looks over their shoulder to see their pin number or password. This type of attack works great with administrators who log on to computers locally. The attacker is usually an insider as most employee screens are faced away from public view (We hope). Watch people at the ATM machine: some use their bodies to shield the keypad while they punch in their PINs, while other don't really care who is watching.

The human based attack has great advantages over computer based in that the attacker has the ability to adjust the attack based on real-time feedback. Monitoring the victim for physical signs of stress allows the attacker to have full control of the situation and the victim.

Dumpster Diving

Dumpster diving is an interesting attack that produces an immense amount of information on an organization, firm, individual, or entity. You can learn a lot about a person or company from the trash they throw away. It’s also extremely surprising how much personal and private information is thrown out for those to find. Generally, most dumpsters and trash receptacles do not come with locks, this would make it nearly impossible for regular trash collection services to dispose of it properly; however, other solutions are available to secure your trash.

For one, you should never throw anything out that has information contained on or within it without considering how it can be used against you. If you throw out bill statements and other paperwork that contain private information, you should consider burning it, shredding it, or any other way of destroying the information it contains.

In Figure 3.2, we can see an attacker digging through trash to locate useful information.

Cross cut shredders were created because it was proven that a bag of shredded paper that came from a normal straight cut shredder could be reassembled given enough time. Kevin Mitnick, president of Defensive Thinking, was originally a hacker who once caught, turned to good. He claims that social engineering is one of the biggest links and dumpster diving is a huge hole in security controls. A large amount of data can be assembled quickly by using paper shredders and enough time that can be used against you and/or an entity.

We tend to throw things away without considering the impact of them being recovered. We gleefully assume that because we put something in the trash, it is dutifully removed from the premise and destroyed adequately. If only that was the truth. Your trash can easily be recovered and used to gather information. Disk drives can be thrown out, and even if you attempted to destroy them, can be reassembled and/or fixed enough to get data off them. There are many secrets that can be uncovered in the trash; you should consider that next time before you throw something away.

No-Tech Hacking

No-tech hacking is hacking that does not require the use of high-tech tools. Dumpster diving is one example of no-tech hacking. People throw out amazing amounts of highly sensitive information, and the authorities are highly suspicious and will investigate when someone reports seeing a person lurking around a corporate dumpster.

For a great article on dumpster diving, see the Internet Security Systems Web page at www.iss.net/security_center/advice/Underground/Hacking/Methods/WetWare/Dumpster_Diving/default.htm.

Another form of no-tech hacking is the use of social engineering to gain access to government and business data. One notorious hacker in this regard is Kevin Mitnick. This guy had an unparalleled ability to talk his way into getting people to assist him, without ever meeting them face to face, thanks primarily to his skill in leveraging human psychology to his advantage. By applying needs-based persuasion in his conversations with an intended target, he could get them to disclose sensitive information or provide him with a login he was not entitled to by listening closely and adjusting his emotional response to their initial hesitancy or wariness. This is just one example of the methods that can be used to exploit human psychology to gain information or bypass controls.

Eventually Mitnick was caught and served time in prison for his misdeeds. Today he uses his keen skill in a more constructive way, by teaching social engineering awareness classes and delivering lectures to educate the public (and those in high technology) the finer points of the social engineering threat. He even wrote a fictional book on hacking. For now this story has a happy ending.

Thankfully, people understand today how important it is to guard their personal information, as exposures to this threat are increasingly in the news. Incidents of computer hacking and identity theft are fairly common these days. As a result, businesses and organizations are increasingly being pressured to exercise due diligence. Due diligence goes back to the early part of the twentieth century when liability concerns for securities fraud began to surface. Today, those in information security are highly encouraged to protect their network and ensure that sensitive information is protected. Due diligence is about sizing up all the known threats and risks to a computer network and related assets, and making a diligent effort to reduce or eliminate those risks of compromise, beyond the perceived basics, with the goal of protecting the organization's data.

With hackers, as with most things in life, where there's a will there's a way; if a hacker is intent on attacking your network, it's just a matter of time before he finds a way to do it. Unfortunately, hackers with a background in technology can get in more easily, as they already know the lay of the land, so to speak. At the following URL, you'll find an article from the Santa Clara County District Attorney's press archives describing how a former computer administrator used his talent and skill to break into organizations in the California Bay Area and implant software that was used to harvest usernames, passwords, and other sensitive information. Lucky for us, the perpetrator was convicted.

www.sccgov.org/portal/site/da/agencyarticle?path=%252Fv7%252FDistrict%2520Attorney%252C%2520Office%2520of%2520the%2520%2528DEP %2529&contentId=ae306383d969d110VgnVCM10000048dc4a92____&cpsextcurrchannel=1

Dumpster Diving

Another threat that can be overlooked in companies is dumpster diving. As with tailgating, it is about as low-tech a method of threatening security as anyone could think of. It literally involves getting into a dumpster and going through the trash, searching through garbage bags, looking in wastebaskets, and rummaging through other places where people may have disposed sensitive information.

This method of breaching security remains popular because it is so effective. In addition to the rotting refuse of people's lunches, one can find discarded printouts of data, papers with usernames and passwords, test printouts that have Internet Protocol (IP) address information, and even old hard drives, CDs, DVDs, and other media containing the information you'd normally have to hack the network to obtain. Even the most innocuous waste may provide a wealth of information. For example, printouts of e-mail will contain a person's name, e-mail address, contact information, and other data that could be used for social engineering purposes (discussed in the next section).

There are many solutions to resolving dumpster diving as a security issue. Dumpsters can be locked with a padlock to limit access, or they can be kept in locked garages or sheds until they're ready for pickup. Companies can also implement a shredding policy so that any sensitive information is shredded and rendered unusable by anyone who finds it. This is especially important if the company has a recycling program, in which paper products are kept separate. If documents aren't shredded, the recycling containers make it even easier to find information, as all of the printouts, memos, and other documentation are isolated in a single container. Because discarded data isn't always in paper form, companies also need to implement a strict hardware and storage media disposal policy so that hard disks are completely wiped and old CDs and DVDs containing information are destroyed. By obliterating the data before the media is disposed, and protecting the waste containers used afterward, dumpster diving becomes difficult or impossible to perform.

Shred Your Documents

Having the ability to shred mail and documents is a very effective countermeasure to dumpster diving. Paper shredders have become more affordable; so if possible, acquire a shredder so that you can dispose of credit card, bank statements, bills, and medical records with assurance. While you can go crazy with the features of all the capabilities with the various shredders, take a look at what's good enough for you and try and buy one that fits comfortably in your budget. If you don't have the resources to shred from home, borrow one from work or school. Most organizations have paper shredders and encourage the use of them, so wherever possible and convenient borrow those resources (if permitted). Be sure to get permission from the company or organization that you are a part of before taking such actions.

Shoulder surfing

Shoulder surfing is another information gathering technique that is often described as social engineering. However, in the similar way to dumpster diving, it is not the technique itself but the way the gathered information is used. In its most basic sense, shoulder surfing is looking over someone’s shoulder to see what they are doing; typing, writing, etc. For example, an employee may covertly look across at their colleague’s keyboard as they type their password or look at a monitor as an e-mail is being composed.

It could be argued that there would be little benefit in employing this technique, as access to the target building has already been achieved. Having breached the security, knowing an employee’s password may be of some use, but it would be far easier to plug in a device and attack the network remotely. This is true, but the employees are not “always” within the target building. For example, although very much a long game technique, an attacker could shoulder surf an employee using their laptop in a local cafe. If the password could be seen, it could then be used to access the corporate e-mail. This could then be used to launch phishing e-mail attacks.

Looking for passwords is obvious, but remember that a social engineer can potentially use any information to attack the business. Consider the cafe example again, what else could the attacker see? They would be able to see operating system version, the web browser, the software they’re using, and the make and model of the laptop. This is all very useful information that can aid an attacker when launching phishing attacks. Knowing the software used can narrow down the attacks that are likely to work.

Protected Data

When it comes to how best to steal valuable personal information, the days of purse snatching, breaking & entering, dumpster diving and shoulder surfing are long gone. Pod slurping or simply walking off with a laptop, backup tape, even an entire server is far more de rigueur, vulnerabilities of a digital age out shadowed only by the explosion of creative and malicious exploits once deployed by hackactivists, now wielded across the Internet for profit. While phishing, pharming, vishing,20 and spimming21 attacks depend in part on social engineering and user confusion, the transmission both indirectly through seemingly innocuous email attachments, text messages, and IMs, and directly across the firewalls and routers of insecure networks, of malicious code designed to harvest valuable sensitive information is where the real illicit money is at. And not simply transmission. Mass dissemination, in volumes and at rates historically unparalleled, true particularly given the recent ease with which botnet networks have come to consist of hundreds of thousands of compromised machines at any given time

Against this backdrop, it is not surprising then that across the globe legislation designed to better protect personal data has emerged. In the United States, federal industry-specific standards for the treatment of certain classes of sensitive information are the norm, while at the state level laws have been implemented requiring notification to users and consumers when information about them is digitally hijacked. For the digital investigator tasked with performing forensic analysis on malicious code designed to access, copy, or otherwise remove protected information, understanding the nature of those protections will help inform necessary investigative and evidentiary determinations along the way

10.1.1.1 Document and Information Handling

•

Be vigilant whenever dealing with sensitive personal or financial information.

Shred all unnecessary documents that contain personally identifiable or financial information before disposing them off as dumpster diving is a very big source of identity theft.

Do not carry your Social Security card in your wallet unless required for a specific purpose.

Be extremely cautious about providing your SSN to non-governmental agencies and do so only if it is absolutely necessary.

Do not leave checks in your car and avoid carrying your check book with you unless required for a specific reason. The Fed Chairman, Ben Bernanke became a victim of identity theft when his wife left her purse carrying personalized checks in a restaurant [38,39].

Do not carry all your credit cards and debit cards in your wallet—if your wallet is lost or stolen, you stand to lose all your cards.

Prefer using credit cards over debit cards as a fraudulent use of a stolen debit card number would result in immediate withdrawal of funds from your checking account as opposed to a financial transaction on the credit card that can be disputed more easily with the banks.

Dumpster diving

If you’ve ever thrown something in the garbage that maybe should have been put in a shredder, you should wonder who might have access to it. Dumpster diving is a low-tech way of getting information, which involves pulling documents containing information from the trash. A person may throw out a piece of paper with a password on it, a work document, pay stub, bill, or something else containing sensitive information. One in the trash, anyone with access to the waste basket, a trash bag the janitor throws it into, or the outside dumpster can pull it out and use it. Even if the information isn’t as direct as a piece of paper with a password written on it, the information on multiple documents can be compiled into something the attacker can use.

Organizations should implement a policy that any documents containing confidential information should be shredded and not thrown out with regular trash. However, even if your business follows such policies, this doesn’t protect you from employees taking information home and throwing it out there. In the second annual Infosecurity Europe survey mentioned earlier, it was found that 80% of employees took confidential information home with them when they changed jobs. Even if an attacker didn’t have access to information at your business, it doesn’t mean that they can’t get it through current and former employees.

Trying to restrict what information an employee can and can’t take home from work can be difficult if not impossible. Many people in a workplace use tablets, laptops, and other devices that store considerable amounts of data and walk in and out of a business on a regular basis. As such, education and policy are important, so that workers take this responsibility seriously.

For employees, there is a greater need to control what they leave the building with on their last day of work. If a former employee is angry enough to leave a business with confidential information, they are also probably more than willing to share it with anyone who asks. Some may even be angry enough to start posting confidential information on social networking sites, or as we discussed in Chapter 6, uploading documents to various sites like WikiLeaks (www.wikileaks.org).