Hacking: The Next Generation

Tracking Employees

Attackers do not necessarily limit their attacks to organizations. Often, the attacks are aimed at specific employees and business units of the target organization. The human factor is still the weakest part of the organization.

First things first: attackers need to gather employee lists and then correlate attack vectors to them. In doing so, attackers have a better chance of successfully entering the target organization.

A critical step for attackers is to gather a target list of employees. This list will often contain employee names, personal and work email addresses, home addresses, work and home phone numbers, and some interesting notes about the employees.

The information contained in such an employee list can have multiple uses. For example, certain information about an employee may suggest that the best attack method is social engineering through intimidation. Another employee’s profile may suggest she is particularly vulnerable to clicking links from emails received from social applications.

Email Harvesting with theHarvester

One of the first steps an attacker needs to take is to gather the corporate email addresses of employees. Attackers do this by using search engines or by crawling the corporate website. In addition, they can search forums, looking for email addresses ending in the target domain.

Obtaining email addresses provides a starting point for an attacker; once he has the email addresses, he can research the employees in more depth.

theHarvester, ...