I need your help in my research - no questionnaires

[Pekka]

OK so I'm doing a reserach proposal. This could very well turn out to be my thesis so this is of great importance to me. This might be something I set out to do with my life.

It's Social Engineering (IS related) and gaining access. A good example is if you know Kevin Mitnick and read his books (Art of Deception, Art of Intrusion). Now, please I ask, don't spam. If you have no idea about this subject, and no input, check the subject from wikipedia or something and come back with input or don't bother

So my area is gaining access (to IS) using Social Engineering. But I need research question, so I have to focus more. The research question is the culmination point of this all because it determines what I actually research if the proposal is good enough, meaning that the exact question will be my thesis and maybe later on, work, or further studies.

So I need to focus more so the framework is realistic. I picked up one technique of it, which is used a lot, and that is identity theft. Identity theft, assuming an identity, or possibly just discarding identity altogether. But most likely stealing an identity (for example within a company, prentending to be someone who is there in real life) or assuming an identity (person that doesn't exist). Using this technique to gain access is the thing I'm after.

But I need to focus even further. This still is A WIDE subject, so I'm looking for things I could focus with this.

Social Engineering:Gaining Access:Identity theft/Assuming identity:?

Remember, this is a research proposal, I'm proposing a research topic. If it works out, I might do this atual research (as my thesis).

So I'd like to have your input and ideas, throw them around, if you have good links and stuff, what ever.

I would truly appreciate your input.

ALSO ASHER, I NEED YOUR HELP. You have been talking about identification methods, and some kind of data-mining related to that, I can't remember exactly but you were after some particular technique. So everyone, please thow some identification methods around. For example voice detection, eye (iris?) detection, photo (picture) detection, all kinds of methods that are used for indentificating people. So these can be exploited when assuming an identity, so I'm going to get into that but I need all kinds of methods to identificate people, especially in business world, government official world, everything that is importnat and has information systems of importance that they restrict from public eye for what ever reasons.

Thank you.

[Pekka]

Ok so another word for identity theft in THIS framework is impersonation using someones real identity, or a made up one.

Hope this cleared up if you got confused.

[Cort Haus]

Who are you and what have you done with Pekka?

[Pekka]

Come on man, don't spam... at least not this early This proposal is something I need to do in timely order, so I don't have a lot of time with this. I already need to go through some books and research and studies, but I'd like to get your help as well because collective minds > one mind (But only if collective minds include mine). Wow. This is actually Russel's Paradox

So.. throw around your ideas adn thoughts, and if you have some knowledge on identification methods, let's here. Links to good websites (there are not a lot of those), studies etc..

Yeah.. help me focus this subject further.

But I got to say, this is what got me into computers when I was a kid.. Gaining Access. That should be like the most explosive hollywood film, in extremely geeky way

[SpencerH]

How's about defining succesful vs unsuccesful techniques for gaining access i.e. you could compare success rates using authoritative vs friendly (or other)approachs to getting the info you want. I would think that the data could be stratefied based upon many different variables and it might even have a value (compared the the vast majority of useless thesis out there).

[Spiffor]

I could help you for the sociological aspect of this (I have written my poli-sci dissertation in a uni that is very strict on the use of scientific method), if there is any.

I must admit the aims of your research sound fairly mysterious to me.

[Pekka]

Spencer, too wide. I need focus. I would need to get a single technique for that. Getting identity is a technique but there are many subsets to that also.

Another thing, if I would take that, I'd have to do field work, maybe lab experiments in order to find that out. Nothing wrong with that, but it would already settle my future work and define it kind of much. THAT'S not wrong however, it will naturally.

I've actually thought of that, but it's too wide for this work as a subject, I need to narrow it down.

[Pekka]

Spiff, hmm, most likely I don't need that kind of help but thanks for the offer.

I mean, YES, I COULD do that as well, but this work takes an aspect and does not do a comprehensive study on this all, I mean there are psychological things (most of it is) when exploiting trust, gaining trust in order to gain access... for the intrusion.

I'm not very sure about it though so I'll hold that in my head and give you a question if I get one though.

[Spiffor]

Disclaimer: I'm drunk right now.

I'd advise you not to venture into psychological stuff too much (ie not make psychological stuff anything more than a veyr marginal and expandable aspect of your thesis) if you don't study it.

I have used a few elements of psychology in my dissertation (because behavioral poli-sci is somewhat interested in the inner workings of the human psyche), and the psychologists use a method that has many specificities, and use a specialist vocabulary that is difficult to grasp without good knowledge of the field. Even though my major at uni was related to psychology (loosely, but still), it really felt like an alien field when I ventured there, and I bet it showed in my dissertation. I guess that psychology would feel like a completely alien domain when a comp-sci like you venture there.

[Japher]

did I miss the summary?

[Pekka]

"I'd advise you not to venture into psychological stuff too much (ie not make psychological stuff anything more than a veyr marginal and expandable aspect of your thesis) if you don't study it."

Of course not, because it's not my field

[Pekka]

So when you really need help for something important, you get like 5 replies

Come on folks, if you have thoughts (valid input), share share share..

[Pekka]

Ok so I have focused my topic a little bit...

It is:

Social Engineering:Identity Theft/Assuming Identity AND going directly into the target (usually this is the case) versus reverse social engineering (making the target come to you, for example sabotage network, advertise yourself and make sure they'll call you, then go and do 'assistance').

I'd be comparing these two techniques (direct approach vs reverse). I still need to focus it a little bit. I need to measure the effectiveness of both to make comparison and come up with more variables. Basically I'm studying both these techniques and comparing them to each other.

Any input, suggestions, brainstorming, what ever?

[Japher]

There was a segment on the news last night about a 2 year old that apparently owes over 200k because someone stole his identity. Apparently anyone can get your birth certificate at the county here. Why? I have no idea, since to actually go into debt you need a social security number or a tax payer ID which usually is accompanied and cross-referenced with a date of birth.

[Pekka]

Right. I need to note at this point, that this is about social engineering in with information system's, there is a difference between normal industrial spying, miltiary/gov intelligence (regular spies) and social engineering done by hackers. The techniques are similar and most of the times exactly the same, yet it's not the same phenomenon.

Anyway, I've been studying stealing identities etc (weird course, don't ask), and basically with a birth certificate in the States, you can also get a passport. You can say no no you can't, yes you can, period. With a bit of manipulation you can, and people do that all the time.

However, that's not my MAIN issue, because that alone is outside the framework. Yet, it is the focus, when it's in my framework

But yeah, it's crazy what people can do.. and when you can do, people WILL do. It's not a question of morals or ethics. People do stuff when it's possible. Exploitation has many motivations.. money, power or even just for the sake of exploitation.. you do because you can, for action, self satisfaction... for playing a game.. what ever.