Nonelectronic Attacks

Nonelectronic—or nontechnical attacks—are attacks that do not employ any technical knowledge. This kind of attack can include social engineering, shoulder surfing, keyboard sniffing, and dumpster diving.

Social engineering is the art of interacting with people either face to face or over the telephone and getting them to give out valuable information such as passwords. Social engineering relies on people's good nature and desire to help others. Many times, a help desk is the target of a social-engineering attack because their job is to help people—and recovering or resetting passwords is a common function of the help desk. The best defense against social-engineering attacks is security-awareness training for all employees and security procedures for resetting passwords.

Shoulder surfing involves looking over someone's shoulder as they type a password. This can be effective when the hacker is in close proximity to the user and the system. Special screens that make it difficult to see the computer screen from an angle can cut down on shoulder surfing. In addition, employee awareness and training can virtually eliminate this type of attack.

Real World Scenario: Shoulder Surfing

Sue is a receptionist at a busy doctor's office. She was working at her computer when a flower delivery man came into the office. He told Sue he had a flower delivery for Dr. Smith. This was the doctor's name he saw on the front door of the office as he entered the waiting room.

Sue was busy that day and Dr. Smith was in with a patient, so she told the flower delivery man that he could leave the flowers on the desk and she would make sure the doctor received them. He said he needed to wait and give them directly to the person who was listed on the delivery ticket. So, Sue asked him to stay in the waiting room until Dr. Smith was available to receive the flower delivery. As Sue turned back to her computer to finish writing an email she had started, she was distracted thinking about the work she had in front of her. She quickly typed the password to unlock her Windows workstation. The flower delivery man paused for just a moment before turning to take a seat in the waiting room. As he paused, he was able to see the five-character password Sue typed to unlock her screen. It was in this manner that he was able to discern her password and continue the hacking process. The password was gathered using shoulder surfing, a form of social engineering.

---

Dumpster diving hackers look through the trash for information such as passwords, which may be written down on a piece of paper. Again, security awareness training on shredding important documents can prevent a hacker from gathering passwords by dumpster diving.