Introduction to Social Engineering
Social engineering is a term that is frequently encountered on newscasts and articles in magazines and other places. But even though it is used a lot, it is typically not very clearly defined. Social engineering is a technique used to interact with human beings for the purpose of gaining information that can be used to reach a specific objective.
In practice, social engineering can be a potent tool in the hands of an individual who knows how to put the techniques to the best use. Social engineering sharing, by targeting human beings, is going after the weakest part of any system.
Technology, policies and procedures, and other measures can be effective, but the reality is that a human being can be tricked or coerced or otherwise made to reveal information.
Social engineering is an effective tool that, once mastered, can be employed during several points of the pentesting process. That’s because social engineering targets human beings and humans are deeply involved in all aspects of business and technology. Remember that after reviewing this blog, you can incorporate the methods anywhere and anytime during your process of gaining information.
So what types of information do social engineers typically keep an eye out for? Well, there are a lot of different types of information that can be of use to a social engineer.
Anything from personal information, organization information, project information, financial information, technical data, employee names, passwords, operational information, and anything else that may catch the attention of the engineer. A simple email address, for example, can reveal a user’s login name.
Social engineering is effective for a number of different reasons, each of which can be addressed depending on whether you are the defender or the attacker. Let’s take a look at each:
Lack of a Technological Fix Technology can do a lot of things and do it quite well, but one of the things it is not so good at is stopping the impact of social engineering.
While technology is more than capable of assisting in slowing or nullifying some of the impacts of social engineering attacks, it is not 100 percent effective in every case and thus needs to be supplemented with proper training and awareness.
Difficult Detection Social engineering is very difficult to detect in many cases. Although someone may appear to be asking questions or having a casual conversation, they could, in fact, be collecting information either directly or indirectly for later use.
Lack of Training Many companies fail to provide regular security awareness training, which could easily go a long way toward addressing many of the issues that threaten security such as social engineering.
How does a social engineer gain access to information through a human being? As a social engineer, you won't get the victim to reveal information, and commonly this is done by getting the person to drop their guard and trust you.
Whatever information that the victim reveals may be useful at that time or may be valuable in fine-tuning a later attack. Let’s look at how to exploit human traits in the next section.
Exploiting Human Traits
When thinking of social engineers, it usually helps to consider them in the same context as you would a con artist. As you may be aware, a con artist is a type of person who can make use of a scam or situation to build a relationship with the victim and then later exploit that relationship to achieve a specific result.
Generally, anyone who engages in activity that would be considered social engineering is good at interacting with people, thinks very quickly on their feet, can understand body language, is able to read the verbal cues in a conversation, and just overall understands how human beings work and communicate.
Social engineers are then able to pull all that information together to do their manipulation. While there are a number of things a social engineer can do to be successful, let’s break these approaches down to a small number of commonly used techniques:
Moral Obligation An attacker using moral obligation is able to make use of the tendency of people to want to help other people. For example, a social engineer might craft a story that states a certain charity or cause is looking for volunteers, making the target provide information to register to help the cause.
Trust One of the key behaviors in human beings that can be exploited to great success by social engineers is that of trust. Trust is a behavior that is built into people from the time they’re born.
By understanding that human beings have a fundamental tendency to trust, social engineers find a way to gain that trust, which might mean sharing information with the victim or possibly even dressing in a certain manner that encourages trust.
Threats A social engineer may threaten a victim if they do not comply with a request. Now, this can be a tricky one for social engineers to achieve without setting off any alarms. A social engineer using threats may be subtle, or they may be bold in suggesting that the victim may get in trouble for not providing assistance.
For example, a social engineer might suggest that a noncompliant victim may be reported to their manager for failing to provide assistance when asked.
However, if threats are used carelessly, the result could be the opposite, with a victim deciding that they don’t want to help. Or the threat could raise enough suspicion that the attack loses its ability to be kept secret.
Something for Nothing The attacker may promise a victim that for little or no work, they will benefit from assisting the attacker. The attacker may convince a victim that they’ll get a good word put in for them or gain some recognition as a result of their help.
Urgency Social engineers may force the victim into taking an action by planting the belief that they have limited time to act before the opportunity is gone. Making a victim act by telling them they have a limited time to respond can be a big motivator.
Essentially, what urgency, sometimes called scarcity, is attempting to do is increase the stress on a victim—perhaps making them take certain actions or do certain things that they wouldn’t do if they had time to think about the situation.
For example, say you are in a restaurant and can’t decide what to order off the menu. You finally narrow your choices down to three. If you are given unlimited time to think about it, you will eventually choose which one of the three items you want and be done with it.
However, if the situation is changed to one where a decision between those three items has to be made within the next 60 seconds, then it becomes harder to make a decision. In some cases, the decision that you make will leave you wondering whether you made the right one.
Blackmail or Extortion Blackmail or extortion can prove effective at gaining information from a victim. For example, knowing that a victim has a gambling problem or engages in some other form of embarrassing or addictive behavior can be used against the victim.
Acting Like a Social Engineer
Signs of a potential social engineering–based attack can be many. Here are some common signs of such an attack being attempted:
Use of Authority An attacker may make overt references to who they are or who they know, or even make threats based on their claimed power or authority. Typically a victim can tell when someone is trying to abuse them with authority.
An attacker will frequently go overboard with tactics such as name-dropping, and it becomes quite obvious that they are trying to intimidate or scare the victim into doing what they want. A victim who is aware of the use of authority as a way to compel compliance may not only stop an attack but also inform company security.
Inability to Give Valid Contact Information A victim may ask the attacker to provide information so they can be contacted as a follow-up or in response to a question. If the attacker has not prepared properly, they will try to avoid the issue, provide bogus details, or possibly cause a lot when responding to questions.
Using the Buddy System This involves making informal or “off-the-books” requests designed to encourage the victim to give out information that they may not otherwise. While it’s not uncommon for people to be asked to do favors or little off-the-blog things here and there for one another in a work-place, sometimes it is a signal that there might be something else going on.
Individuals asking for too many off-the-book requests in a relatively short time may be trying to get around security controls and possibly even exploit trust with the victim.
VIP or Name Dropping Excessive name dropping is an uncommon thing to see in today’s world, but it can be used to gain trust and confidence from an organization. However, most people recognize that excessive name dropping not only is on the annoying side of things but can also be an indication that there’s more to the situation.
Stroking the Ego Excessive use of praise or compliments designed to flatter a victim is a sure sign that something is going on. While it’s not always a bad thing to hear a lot of praise coming from an individual, a victim needs to be on guard because too much praise can lead to the intended victim dropping their guard and letting their ego take over, thus making them more likely to reveal best-kept secrets.
Discomfort or uneasiness when questioned doesn’t always mean that the individual being questioned is a bad person or up to mischief; it may just mean that person is not comfortable with being asked questions.
However, some people when questioned will struggle for an answer and may avoid answering or even try to change the subject in an effort to keep from having to answer a query that the victim is posing.
Targeting Specific Victims
An attacker will look for targets of opportunity that have the most to offer. Some common targets include receptionists, help desk personnel, users, executives, system administrators, outside vendors, and even maintenance personnel.
Remember that anyone inside an organization can be a victim of social engineering, but some people are much more likely to be targets based on the information they may have in their head or how accessible they are. The following list shows some likely candidates for targeting by social engineers but definitely not the only ones.
Receptionists—the first people visitors encounter in many companies—represent prime targets. They see many people go in and out of an office, and they hear a lot of things.
In addition, receptionists are meant to be helpful and therefore are not security focused. Establishing a rapport with these individuals can easily yield information that’s useful on its own or for future attacks.
Remember that receptionists don’t always just act as receptionists; they may have other responsibilities. They may also do such tasks as writing reports and working on projects. Thus the information they handle may be well above and beyond just a sign-in sheet and company directory.
Helpdesk personnel offers another tempting and valuable target because of the information they may have about infrastructure, among other things. Filing fake support requests or asking these personnel leading questions can yield valuable information.
Keep in mind that while help desk people are a viable target for a social engineering attack they may not always have good or detailed information about a network and its infrastructure.
Help desk people are usually easy to contact, but they typically are not the ones who are responsible for maintaining the network and systems on it, so the information they have will be limited.
System administrators can also be valuable targets of opportunity, again because of the information they possess. The typical administrator can be counted on to have high-level knowledge of infrastructure and applications and future plans. Given the right enticements and some effort, these targets can sometimes yield tremendous amounts of information.
Executives are a valuable source of information and a prime target for attackers because individuals in these types of positions are not focused on security.
In fact, many of the people in these positions focus on business processes, sales, finance, and other areas. Don’t let the fact that an executive may not have technical data dissuade you from targeting them because they can have other viable information about their organization that is just as helpful and may have that piece of information that helps you hit a home run as far as your testing goes.
Users are probably one of the biggest sources of leaks because they are the ones who handle, process and manage information from day to day. Also, many of these individuals may be less than prepared for dealing with this information safely.
New employees who are not trained to recognize social engineering attacks are a prime target. Cleaning crews that may work off-hours such as at night can prove to be effective targets. Keep in mind that they have detailed information about a facility and its people, and present a great opportunity to ask questions.
Leveraging Social Networking
One of the biggest developments in technology on the web over the past decade or more has been that of social networking and social media. The technologies and services that fit within this area allow individuals to share information either to everyone or to their friends with a few button clicks.
The users of these services do everything from share postings on a wall on what they’re thinking or what they’re doing at work to sharing photos and other details that may not be the best to post on a public forum.
It is because of this practice that these services present a valuable target in your quest to gain information from human beings. How many other places are you aware of that the users of the service freely share information without giving it a second thought?
The rapid growth of social networking technologies lets millions of users each day post on Facebook, Twitter, Instagram, and many other networks. A huge amount of information exists on these social networks, and this makes them a good source data.
The danger of making this wealth of information available is that a curious attacker can easily piece together clues from these sources and create a much clearer picture of a target. With this information in hand, the attacker can make a convincing impersonation of that individual or gain entry into a business by using insider information.
When employees post information on social networks or other sites, it should always be with a mind toward how valuable the information may be in the wrong hands and whether it is worth posting. It is easy to search social networks and find information that an individual may have unwittingly shared.
Social networking gives employees the ability to quickly and easily spread information without giving it much thought initially. Corporations have become aware that their employees can post literally anything they want and just about anyone may be able to access and view that company’s dirty laundry.
Social media can be made safer if simple steps are taken to strengthen accounts. In fact, it has been found in many cases that with a little care and effort, steps can be taken to lessen or avoid many common security issues and risks.
Conducting Safer Social Networking
Because social networking increased in popularity so quickly, there has been little time to deal with the evolving problems the technology brought to bear. The public has become aware of the dangers and has learned how serious the danger is and that they need to take steps to protect themselves.
Company policies should address the appropriate use of social media, such as the kind of conduct and language an employee is allowed to use on these sites.
Social networking can be used relatively safely and securely as long as it is used carefully. Exercising some basic safety measures can substantially reduce the risk of using these services. As a pentester, you can train users on the following practices if a client opts to include this in the contract:
Discourage the practice of mixing personal and professional information in social networking situations. Although you may not be able to eliminate the company information that is shared, it should be kept to a bare minimum.
Avoid reusing passwords across multiple social networking sites or locations to avoid mass compromise. Don’t post just anything online; remember that anything posted can be found, sometimes years later.
Avoid posting personal information that can be used to determine more about you, impersonate you, or coax someone to reveal additional information about you.
Avoid publishing any identifying personal information online, including phone numbers; pictures of home, work, or family members; or anything that may be used to determine identity.
Be aware that with such systems anything published online will stay online, even if it is removed by the publisher. In essence, once something is put online, it never goes away.
Stay up-to-date on the use of privacy features on sites such as Facebook. Instruct employees in the presence of phishing scams on social networks and how to avoid and report them.
Understanding Social Engineering
Not all vulnerabilities are found within a computer. If you are managing a network of computers and you have made it a point that there is no hole in the security framework and you are repeatedly testing for vulnerabilities, then malicious hackers can go beyond the computer in order to find their way in and launch an attack.
More often than not, the way that they find themselves in your network is not by remotely probing your computer for weaknesses. They can simply ask you what your password is to let themselves in.
Social Engineering Explained
Social engineering is the process of getting valuable information about a computer system and its network through the user. You can think of this practice as hacking the people who use the device that they are hacking.
Social engineering hackers typically pose as another person to obtain the information that they need. Once they get the information that they need, they can simply log in to their target computer and then steal or delete the files that they need. Normally, they will pretend to be the following:
1. Fake support technicians
They may pretend to be technicians who would tell you that you need to install or download a program to update any existing software in order to remotely control your computer.
2. Fake vendors
They may claim to represent the manufacturer of your computer or an application that you are using and then ask for your administrator password or the answer to your security question in order to grant themselves access.
3. Phishing emails
These may be sent in order to get passwords, user IDs, and other sensitive data. They may look like an authorized email sent by a company that you are subscribed to or a web form that may dupe you into putting personal information.
4. False employees
These people may ask to obtain access to a security room or request for access to a computer in order to have physical access to files that they need.
Social engineering attacks can be slow and simple, but they are very effective. They are often designed to avoid suspicion. They only gather small bits of information and then piece them together in order to generate a map of how the networking system works and then launch massive infiltration.
However, if a social engineer realizes that his targets can be easily lured into providing information, gaining a password can be as quick as asking for information over a quick phone call or through a short email.
Why Social Engineering should be Prepared
Any malicious hacker who watched corporate espionage films can deduce that any organization or person who uses technological devices to communicate and send data prepares for this kind of attack the least. Most people are not ready for this kind of manipulation, which makes it very effective.
Social engineers know that most organizations do not have any formal and secure data organization or any incident response plan. A lot of computer users are also not knowledgeable about authentication processes of social media accounts and all the possible ways to possibly retrieve a lost password.
Malicious hackers always take these factors into consideration, especially when they are aware that it is a lot easier to retrieve information this way.
Once a social engineering attack becomes successful, a hacker can get the following information:
1.Any user or administrator password
2.Security badges to a computer server room
4.Unreleased intellectual property files such as designs and research
5.Customer lists or sales prospects
Also, take into consideration that unknowingly granting access to social engineers may also be in the form of unknowing or naïve computer users who forget their responsibility in maintaining the security in a shared network.
Always remember that having a secure firewall and networking system may be useless against hackers if the user himself is vulnerable to a social engineering attack.
A social engineering attack is done through the following steps:
1.Conduct research and find the easiest way to infiltrate
2.Build confidence and trust
3.Create a relationship with a target computer user
Means to getting Information
If it is not possible to create rapport with a target computer user, then it would be easy to phish for information instead before launching a large-scale social engineering attack.
Gathering information can prove to be easy, given the nature of computer users today – it is rather easy to get phone numbers, employee list, or some personal information about the targeted user through social networking sites. It is also easy to find information through public SEC filings, which could display a lot of organizational details.
Once a malicious hacker gets a hand on this information, they can spend a few dollars on doing a background check on the individuals that they are targeting in order to get deeper information.
If it is difficult to get useful information using the Internet, a malicious hacker may choose to do a riskier method called dumpster diving. Dumpster diving is literally rummaging through the trash of their target in order to get the information that they need.
While this method can be messy, there are a lot of gems that a hacker can discover through discarded paper files. One can find credit card information, subscriptions, phone numbers, addresses, important notes, or even password lists. They can even make use of discarded CDs or hard drives that may contain backup data.
What Makes a Social Engineering Attack Powerful?
You may think that criminal hackers are going low on technology and resources when they use social engineering hacks to gain access to your protected files. However, social engineering hacks are very powerful because they are the means to hack the most important component of a computer’s security – you.
These attacks are, in fact, psychological attacks – instead of attempting to use numerous hacking tools to manually decrypt any password in a world of advanced security protocols, hackers are more inclined to let their own targets do the job for them instead.
The only goal that they have when it comes to social engineering is this: create a scenario that is convenient for their targets, to the point that they would be willing to loosen their security in exchange for something that they desire.
An example of a good social engineering scheme is a type of the evil twin hack, which makes targets believe that they are connecting to a legitimate free wireless internet, in exchange for their passwords.
Why do these tricks work on most people? The reason is that people are not really that careful when it comes to giving away their information.
For most cases, there’s not even any need for fake company personnel to contact a hacker’s target in order to get privileged information – you would be surprised that there are just too many people that would immediately create accounts on an unverified landing page using the password to their private emails.
How does that happen so easily? The reason is this: when you are prompted to create an account using your email address as the username, it is very likely for you to use your email’s password as your new password for this particular account that you are trying to make.
For criminal and ethical hackers alike, there is something embedded in Kali Linux that proves to be very useful – Social Engineering Tools (SET). These tools are developed in order to create the following social engineering hacks:
2.Mass mailer attack
3.Infectious media generator
4.Arduino-based vector attack
5.SMS spoofing attack
6.Wireless Access Point
7. Spear-Phishing Attacks
All these attacks are designed to make you do what social engineering wants you to do: give out information or create an action because of a legitimate-looking request.
If it is hard to obtain information, one can simply use sleight of hand or gleaning techniques to retrieve passwords. One can make effective password guesses by looking at hand movements when someone enters a password.
If one gets physical access to the computer, it is also possible to insert a keylogging device by replacing the keyboard or placing a device between the keyboard and the computer.
Hacking Someone with a Phishing Email
How easy is it really to scam a person using a phishing email? A phishing email normally contains the following components:
1. A reliable-looking source of the email, such as a co-worker, that will serve as bait.
2.A legitimate-looking attachment, which would serve as the hacking tool to obtain the information that a criminal hacker needs.
3. Great timing, meaning that the email should be sent during a reasonable time of the day in order for the target to be convinced to click on the attachment.
Given the right tools, any criminal hacker can send a legitimate-looking email, complete with an attachment that looks trustworthy. To create a phishing email, you only need to follow the following steps:
1. Get Kali Linux and pull up SET (Social Engineering Toolkit)
This Toolkit would show you different services that are used for social engineering hacks. To do a phishing attack, choose on Spear-Phishing attack.
Note: Why Spear-Phishing?
When you think of phishing as a hacker attack, its method is to cast a large net over your targets, and then being able to get random people to give you the result that you need. With spear-phishing, you get to target a specific range of people and obtain an exact result that you desire.
When you click on spear-phishing from the menu, you can choose to do the following:
1. Send a social engineering template
2.Create a mass email attack
3.Create a FileFormat payload
For this example, choose FileFormat payload. This would allow you to install a malware in the target’s system that would serve as a listening device for you to get the information that you want remotely.
2. Now, choose the type of payload that you want to attach in your target’s computer.
The SET offers a good range of file formats that your target would see once they receive the email. You would even see in the list that you can choose to send a PDF-looking file (that actually has an embedded EXE) with your phishing email!
For this example, select the Microsoft Word RTF Fragments type of attack. Also known as MS10_087, this type of attack would send a Word file to your target. Once clicked, it would automatically install a rootkit or a listener on your target’s machine.
3. Now, select the type of rootkit you want to install. If you want to have full control of your target’s system, you can choose to install a Metasploit meterpreter. This would allow you to make a variety of commands remotely that your target computer would follow.
4. Since you are already set on the type of results that you want to get from this attack, you can now start creating the file. Now, you need to create a port listener and proceed to create the malicious file that you want to send. By default, the SET would be creating a file called filetemplare.rtf.
Since it is probably not convincing enough for a target to click on it, you can choose to rename it as, say for an example, SummaryReport2015. By renaming your file as something that your victim should be expecting in his email, you elevate the rate of success of your attack.
5. You are now ready to send the malicious file masked as a Word document. In order to do this, you would need to create the first layer of your attack, which is the email body.
SET would offer you a generic email template to use. However, if you want to be sure that your target would find nothing suspicious in your email and proceed with downloading the malware that you have just created, select “one-time-use email” option.
Now, make your email more inviting. Choose to create the email body in HTML to make it look more legitimate and original. Once you are done typing the email body, hit Ctrl + C to save what you just wrote.
Here is an example of a good phishing email body: Dear Mr. _____________
Kindly find attached the summary report of our last meeting. Should there be any questions, please feel free to ask.
Of course, great phishing emails would depend on the targets that you are sending to. It would be great to check the background of the person that you are trying to hijack to ensure that you are spoofing the right credentials.
For this example, good use of Facebook and LinkedIn would provide you with the information that you need.
6. Once you are done creating your email, it is time to send it to your target. You have two options on how you are going to send it: (1) From a Gmail account, or (2) Straight from the SMTP server.
You would most likely want to send it from a legitimate-looking Gmail account, based on the names that you know should be important to your target. Of course, do not forget to create an anonymous account on Gmail for this to work. Once you are all set, SET would be sending the phishing email, complete with the malicious file, to your target.
Ways to Prevent Social Engineering
You may realize that it is quite easy for any hacker to obtain classified information or even take control of your entire device once they have an idea of what is going on in your daily life.
While the times make it necessary for you to disclose a portion of your life online, there are plenty of ways on how you can prevent hackers from taking over and stealing your data.
Based on the example that was just given, a good firewall and an antivirus program would be able to detect if there is any installed payload in the attachments that you are receiving every day. Of course, a hacker would be able to simply recode the file attachment to make it undetectable by current virus scanners.
For that reason, computer security should not be left solely to programs that you have, because they can also be breached. In order to create a security fortress, you would also want the users of your computer network are not hackable themselves.
Information security personnel always advise that computer security should feel like a candy – hard on the outside and soft on the inside before one reaches the core.
It is the responsibility of all computer users to secure their firewalls and make sure that there is no vulnerability in their computers. It is also important for computer users to make it a point to follow safety protocols when it comes to using a computer and giving out information.
Every computer user should learn how to:
1. Make sure that there is no one around when entering passwords
2.Learn all authentication policies when it comes to changing passwords
3.Destroy all paper copies of sensitive information to prevent dumpster diving
4. Choose passwords that cannot be easily guessed through all information provided in social media
5. Make sure that only authorized users have access to computers
6.Refrain from providing password or authentication information over emails or phone calls
7. Refrain from sharing password information to anyone, including families and friends Now that you know how to protect yourself from social engineering, you have better information about physically protecting your computer from any unauthorized user.
Protecting your Passwords
Password hacking is considered the easiest way to hack into a computer system online. If you know how to hack a password, then you can easily infiltrate another computer’s Wi-Fi access and take control of another person’s internet connection, or even take control of a person’s online accounts and retrieve sensitive information.
Passwords are easy to break once you know how they are encrypted, or you have a good guess on what they are.
The weakness of passwords lies in its very nature, which is secrecy. Passwords are normally shared among computer users especially when one person allows other users to use a personal computer, especially when the purpose is to share files among different people and skip sharing files over a network.
Always remember that knowing a password makes one an authorized user of a computer. The tough side of making passwords the sole basis of network security is that passwords can be easily passed from one person to another, and it is hard to track who has that information. Sometimes, password sharing is intentional, but there are many times that it is not.
What Makes a Password Weak?
There are two factors that may cause a password to be easily hacked by any malicious user:
1. The user or organizational vulnerabilities
This means that there are no password policies that are employed to make it harder to guess, or that users do not care for the password’s use for security.
2. Technical vulnerabilities This means that passwords that are being used have weak encryption policies, or that the database that stores them is unsecured. A weak password has the following qualities:
1.Easy to guess
2.Reused over and over again for different security points
3.Stored in unsecured locations
It is the nature of many computer users to make passwords convenient, and they often rely on their minds in order to remember them. Because of that, people often choose passwords that are not only easy to remember but also contain a lot of clues that they can see in their immediate environment.
For added assurance that they will definitely remember passwords for easy access, they would also want to write it down where they can easily see it.
If a computer user would choose a more difficult passphrase to guess, it can still be easily hacked by targeting the weakness in its encryption scheme. Computer users and vendors often think that a password that is long and difficult to guess because of the string of characters used is not prone to attacks.
However, note that when the encryption is weak, it can be easily targeted by a simple cracking attack.
There are over 6000 password vulnerabilities known today, according to the National Vulnerability Database. That number is still growing as hackers discover more sophisticated methods to get past encryption methods.
The most popular and easiest ways to uncover a password is through social engineering, cleaning, and using a keylogger, but there are different other methods to remotely obtain a password. Here are some of the tools that are used to get passwords without having to be near a target computer or having physical access to it:
1. Elcomsoft Distributed Password Recovery – This tool cracks Microsoft Office encryption, PKCS, and PGP passwords. This allows you to use GPU acceleration that speeds up the hacking process up to 50 times.
2.John the Ripper – This tool cracks hashed Windows, Unix, and Linux passwords.
3.Proactive System Password Recovery – This tool recovers any locally stored Windows, WPA or WEP, SYSKEY, and VPN passwords
4. Cain and Abel – This tool cracks LanManager, Windows RDP, Cisco IOS, and other types of similar passwords.
5.Proactive Password Auditor – This runs using brute-force, dictionary, and rainbow attacks and can extract NTLM and LM password hashes.
Countermeasures Against Password Cracking
In order to prevent unauthorized users from uncovering passwords, here are some tips that you can use to thwart any attack designed to crack authentication:
1. Use switches on networks
Hackers typically make use of network analyzers to detect network cards that have activities. To prevent that from happening, you can use programs like sniffdet in order to uncover if someone is trying to sniff out information from your ports.
2. Make sure that unsupervised areas do not have network connections
3. Do not let anyone have physical access to your network connection or your switches.
4. Make sure that you use updated authentication policies on your network in order to make sure that you are using better encryption that hackers will find hard to attack.