Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
God bless Capital Crypto Recover Services for the marvelous work you did in my life, I have learned the hard way that even the most sensible investors can fall victim to scams. When my USD was stolen, for anyone who has fallen victim to one of the bitcoin binary investment scams that are currently ongoing, I felt betrayal and upset. But then I was reading a post on site when I saw a testimony of Wendy Taylor online who recommended that Capital Crypto Recovery has helped her recover scammed funds within 24 hours. after reaching out to this cyber security firm that was able to help me recover my stolen digital assets and bitcoin. I’m genuinely blown away by their amazing service and professionalism. I never imagined I’d be able to get my money back until I complained to Capital Crypto Recovery Services about my difficulties and gave all of the necessary paperwork. I was astounded that it took them 12 hours to reclaim my stolen money back. Without a doubt, my USDT assets were successfully recovered from the scam platform, Thank you so much Sir, I strongly recommend Capital Crypto Recover for any of your bitcoin recovery, digital funds recovery, hacking, and cybersecurity concerns.
You reach them Call/Text Number +1 (336)390-6684
His Email: Capitalcryptorecover@zohomail.com
Contact Telegram: Capitalcryptorecover Via Contact: Recoverycapitalfastservice.com
His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
I’m truly grateful for the services of an ethical hacker who helped me. I never would have imagined that I could recover my stolen bitcoins and gain back access to my wallet after losing over $160,208 to a fake investment platform. It’s truly amazing the kind of services Mathias Roon and his team provides, I was able to recover all that was stolen from me within 3 days, Mathias Roon provides top-notch services and he is very professional indeed. If you ever doubt the recovery of cryptocurrency once it is lost. I suggest you contact them and provide the accurate information of how it happened,they will surely do a good job. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. Mathias roon is here to provide that service for you. I highly recommend their services to everyone who wishes to recover any cryptocurrency. Kindly reach them via their E-mail address: webmasterforyou247@gmail.com
I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery’s commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact Recoverycapital@fastservice.com and on Telegram OR Call Number +1 (336)390-6684 via email: Capitalcryptorecover@zohomail.com you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Hello Am From The UK , I want to write a little testimony about the good work of doctor Oyagu who cured me from Hsv 1 and 2 for just 2 weeks with his herbal medicine, I never believe I can be normal again and have a good life like others I always regretted the day I got diagnose with the virus, I was lost of hope when my doctor told me there is no cure for it but I keep thinking and thinking about my future, if I can have kids of my own well I am so grateful for my helper who get me cured with his herbal medicine, I go online in search of anything that can help me because I can’t deal with it forever so I found this doc Oyagu email on a blog of someone who was cured by him I quickly contact him for help and explain all my pain to him, he told me not to worry about it there is cure for real, I never believe until he send me the herbal medicine when I order for it and I have it within 4 days that is how I took the medicine for 2 week and the following week I go for test just to confirm I was 100% cured from this sickness what a miracle in my life I am so happy right now, you can also get in contact with him if you have such sickness through email address oyaguherbalhome@gmail.com or text him on WhatsApp, phone number +2348101755322 Dr Oyagu also has remedy to others disease like COLD SORES,HIV/AIDS,DIABETES.CANCER,HIGH BLOOD PRESSURE AND MANY MORE. I oblige everyone to contact this powerful herbalist Dr Oyagu and be free from suffering.
ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH
In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team’s primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance
Phone (Call/Text): +1 (336) 390-6684
Email: Capitalcryptorecover@zohomail.com
Alternate Email: Recoverycapital@fastservice.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Hello everyone , good day , I just want to share a review on what happened to me and my uncle last month . when i thought i have seen it all but Dr Amos let me know that there is more to life . i had Herpes Simplest Virus HSV2 and my uncle was tested HIV positive . we spent a lot trying to get cured ,until i contacted Dr Amos for a help . just within 21 days his herbal medicine cured me and my uncle , its still unbelievable to me and other member of my family .but I’m cured and my uncle is now tested HIV negative just after 21day . this is a miracle. i do not know how else i can appreciate Dr Amos for his works , other than to share my review for others to see WhatsApp
+2349064159687 or Email Herbalistdoctoramos@gmail.com
Thanks for reading. and God bless you🙏
I want to use this medium to share my incredible manifesting with Dr. Kachi, who truly changed my life. For a long time, I struggled with homelessness after losing my job as a nurse. Life felt like an endless battle, and I spent many years trying to win the lottery, hoping for a better future. But despite my efforts, I had no success and was growing increasingly frustrated. That was until I came across an amazing testimony from a woman named Natasha, who shared how Dr. Kachi helped her win the National EuroMillions jackpot. I had always loved playing EuroMillions, but winning seemed impossible for me. However, after seeing Natasha’s story, I decided to reach out to Dr. Kachi prepared a special spell to help me with guaranteed lucky numbers. Within 24 hours, he provided me with the winning numbers and instructed me to play. To my amazement, I won £184.656 million in the EuroMillions! Thanks to Dr. Kachi, my life has been transformed, and my financial situation has changed for the better. I will never forget this joyful moment, as it has been the best thing to ever happen to me. If you’re struggling and seeking a way out, never give up. Dr. Kachi can help you, just as he helped me. Keep your faith and take a chance – your life could change too! contact website https://drkachispellcaster.wixsite.com/my-site his email drkachispellcast@gmail.com or his phone text or call number: +1 (209) 675-7342
HELLO EVERYONE.. FEW MUNINETS TO REDY THIS INFOR ON HERPES CURE 2018..
2017 MY MOTHER WAS DIAGNOSED OF HERPES/ KNOWN AS GENITAL WARTS ,I SPENT A LOT OF MONEY ON HER MEDICATION TILL A POINT I EVEN LOST HOPE,BECAUSE MY MOTHER WAS GRADUALLY DYING AND LOST HER MEMORY TOO, I WAS SO DESPERATE TO GET MY MOTHER BACK TO NORMAL, ONE DAY MY UNCLE WHO LIVES IN LONDON UNITED KINGDOM TOLD ME ABOUT DR OLIHA ,WHO HELPED HIM GET RID OF HERPES /GENITAL WART WITH HERBAL MEDICINE AND HIS HERBAL SOAP ,I WAS SO SHOCKED WHEN HE TOLD ME ABOUT THIS ,ALTHOUGH I NEVER BELIEVE IN HERB BUT, I KEEP TO BELIEVE BECAUSE MY UNCLE CAN’T TELL ME LIES WHEN IT COMES TO HEALTH CONDITION I CONTACTED DR OLIHA VIA HIS EMAIL; OLIHA.MIRACLEMEDICINE@GMAIL.COM , YOU CAN TALK TO HIM VIA CALL OR WHATSAPP MESSENGER ON +2349038382931 , HE REPLIED AND ASK ME TO SEND MY HOME ADDRESS AND MY MOTHER’S DETAIL AND THEN I PURCHASED THE HERBAL MEDICINE,SENT ME THE HERBAL MEDICINE THROUGH COURIER SERVICE, WHEN I RECEIVED THIS HERBAL MEDICINE USED IT FOR 2 WEEKS, AND 4 DAYS OF USAGE THE WARTS FELL OFF, MY MOTHER I NOW TOTALLY CURED AND MY MOTHER IS LIVING FREE AND HAPPY AGAIN. YOU CAN TALK TO DR VIA HIS MOBILE NUMBER OR WHATS APP HIM ON +2349038382931 OR https://olihamiraclemedici.wixsite.com/drolihamiraclemedici/ ALL THANKS TO DOCTOR DR OLIHA
Can’t still believe that I got cured from Genital Herpes through herbal treatment from Dr Oliha who I met through the internet, I actually couldn’t believe it at first because it sounded impossible to me knowing how far I have gone just to get rid of it. Dr Oliha send me his medicine which I took as instructed and here I am living a happy life once again, a big thanks to Dr Oliha, I am sure there are many herbal doctors out there but Dr Oliha did it for me, contact him oliha.miraclemedicine@gmail.com visit his website is: https://olihamiraclemedici.wixsite.com/drolihamiraclemedici
or Cell Whatsapp Number +2349038382931 thank you
ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH
In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team’s primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance
Phone (Call/Text): +1 (336) 390-6684
Email: Capitalcryptorecover@zohomail.com
Alternate Email: Recoverycapital@fastservice.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1