November 28th, 2016
Social engineering is the use of psychological tools such as deceit, misdirection, manipulation and flattery to elicit unauthorised information or access to systems. Social engineering is an increasingly common way for criminals to attack organisations as it does not always rely on cyber vulnerabilities but rather takes advantage of the weakest element in an organisation, human beings. People are susceptible to social engineering because these attacks exploit social norms and human nature, including reciprocity, curiosity, and pride. As we become increasingly connected – at work, at home and intertwining the two – the opportunities and impacts of social engineering are increasing.
- December 14th, 2012
A recent whitepaper published by Microsoft describes an attack known as Pass-the-Hash (PtH), which has become a common attack vector for credential theft. A PtH attack is where an attacker captures account logon credentials, but instead of capturing the clear text password, the attacker captures the password hash, which can then be re-used to logon to network services, because the password hash is an unsalted MD4 hash.
I’m not going to go into too much depth in this post, as the whitepaper provides comprehensive information on these attacks, which I highly recommend you read – Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques