Advice Dog, from the handy Meme Generator.

Social Engineering, and
Fighting Internet Hoaxes

Modified 12 January 2010

Social Engineering

"Social engineering" is just a fancy term for running scams and cons. Unfortunately, the only defense is educating your users and getting them to be careful, and that just doesn't work reliably.

Frank Stajano and Paul Wilson have written a very good paper about common street scams — how they work, the general principles of human behavior that they exploit, and what that means for designing secure systems. Get the PDF version of the paper: "Understanding scan victims: seven principles for systems security", University of Cambridge Computer Laboratory Technical Report Number 754, UCAM-CL-TR-754, ISSN 1476-2986, 2009.

Fighting Internet Hoaxes

Are you beseiged by messages claiming you can MAKE MONEY FAST if you send a get-well card to a Scottish kid dying of cancer, because Bill Gates will give you a free copy of Windows Vista plus cash if you forward the mail to 1000 people, and you'll get a free trip to Disneyland, and the American Cancer Society will give $0.03 per message to some other kid dying of cancer, so you'd better forward the message "just in case", but you'd better not read any replies with subject "Good Times" as they'll infect your hard drive with Dutch Elm disease?

Or maybe they're claiming that Life Cereal's Mikey died from eating Pop Rocks and Pepsi at the suggestion of Alice Cooper (when he was playing Eddie Haskell on "Leave it to Beaver"). Actually, Mikey crashed his JATO-powered pickup truck into an Arizona cliff, killing his passenger, Paul McCartney, who had recently had a kidney stolen. Really! I heard it from someone whose sister was dating a guy whose neighbor knew someone who used to work at the emergency room!

Keep these sites handy:

• http://www.urbanlegend.com/ and http://www.snopes.com/ are the best for debunking the stupid stories and implausible Photoshopped pictures that dumb people keep forwarded across the Internet. A lot of people using the Internet should not be allowed to do so without adult supervision.
• http://ciac.llnl.gov/ciac/bulletins/h-05.html — Debunk Internet Hoaxes
• http://www.f-secure.com/news/hoax/ — Debunk More Hoaxes
• http://www.nonprofit.net/hoax/hoax.html — Debunk Even More Hoaxes
• http://www.hoaxkill.com/ — Debunk Even More Hoaxes
• http://www.usps.gov/websites/depart/inspect/chainlet.htm — Proof that the amazing chain letter is really illegal.
• If you have somehow avoided the "419 scam" run by Nigerians, learn about it:
  • http://www.fbi.gov/majcases/fraud/fraudschemes.htm
  • http://home.rica.net/alphae/419coal/
  • http://home.rica.net/alphae/419coal/fighters.htm
• The National Consumers League has warnings on known Internet scams: http://www.natlconsumersleague.org/
• RCMP (Royal Canadian Mounted Police) has a division dedicated to economic crimes and scams: http://www.rcmp-grc.gc.ca/scams/index_e.htm
• As for serious looks at evaluating information gleaned from the net:
  • Evaluating Internet Research Sources: http://www.virtualsalt.com/evalu8it.htm
  • Evaluation of Information Sources: http://www.vuw.ac.nz/~agsmith/evaln/evaln.htm
  • Bibliography on Evaluating Internet Resources: http://www.lib.vt.edu/help/instruct/evaluate/evalbiblio.html
• Also see the section on fighting junk e-mail.

Security Page

Home Unix/Linux Networking Infosec Travel Technical Radio Site Map Contact