Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
Hello viewers, I’m here to share my testimony on how Lord Vasikar cured my herpes virus/hpv with his herbal medicine, i do not have much to say but with all my life i will forever be grateful to him and God Almighty for using Lord Vasikar to reach me when i thought it was all over, today i am happy with my life again after the medical doctor have confirmed my HERPES SIMPLEX VIRUS / HPV of 3 years is gone, I have never in my life believed that HERPES SIMPLEX VIRUS could be cured by herbal medicine. So I want to use this means to reach other persons who have this disease by testifying the power of Lord Vasikar that all hope is not lost yet, try to contact him by any means for any kind of disease. Thanks once again Lord Vasikar for your marvelous work may God continue to bless you. You can also reach him today via email: homeofnaturalremedie@gmail.com And WhatsApp Number +44 7494 422098.
I have been suffering from Herpes for the past 1 years and 8 months, and ever since then I have been taking series of treatment but there was no improvement until I came across testimonies of Dr. Silver on how he has been curing different people from different diseases all over the world, then I contacted him as well. After our conversation he sent me the medicine which I took according to his instructions. When I was done taking the herbal medicine I went for a medical checkup and to my greatest surprise I was cured from Herpes. My heart is so filled with joy. If you are suffering from Herpes or any other disease you can contact Dr. Silver today on this Email address: drsilverhealingtemple@gmail.com
HOW I GOT CURED FROM HPV: Words are not enough to thank you Lord Vasikar for healing me of this HPV that has been disturbing me for 3 years now. I have promised to tell the whole world about your good works if the herbs are legit and work, now I’m here to do it and say thank you so much Lord Vasikar I’m so happy with my life now. At last I’m free from HPV. He can also cures HERPES, EPILEPSY, DIABETES,COLD SORE, Multiple Sclerosis, CANCER, Stroke, Alzheimer’s disease, FIBROIDS, LEUKEMIA , LIVER, KIDNEY PROBLEMS , INFERTILITY, ULCER, LUPUS, ARTHRITIS ,AUTISM, THYROID, HIV, Hepatitis A,B,C ,DYSTONIA, Dementia, AIDS, ALS, C.O,P.D, Parkinson’s Disease and a lot more. CONTACT INFO Below With his WhatsApp +44 7494 422098?. Email: homeofnaturalremedie@gmail.com
Hello everyone my names are ALEX JACKSON from the UK, I want to use this golden medium to appreciate Doctor Abdul a great spell caster for helping me retrieving back my relationship with my ex lover when he ended and turned back on me for quite a long time now (6 months ago). He performed a spell for me and within 48 hours after the spell had been cast I received a text from my ex saying that he is sorry for the pains and tears that he had caused me and that he will not do such a thing to me again in his life. I was surprised but later accepted him back again. Anyone that is in the same line of problem or different one that wants to contact a spell caster should happily contact Doctor Abdul now on this email doctorabdulspellcaster@gmail. com or message him through his Whatsapp +2348108728256
With joy in my heart and gratitude to God almighty i have come to tell the general public that Lord Vasikar herbal medicine is the best remedy for Herpes and HIV/AIDS, I was a carrier of Herpes virus and I saw a testimony on how Lord Vasikar cure Herpes, I decided to have a contact with him and asked him for help and he started the remedies for my health and prepare the herbal medicine for me which i use to cure myself. Thank God, now everything is fine, I’m cured by Lord Vasikar herbal medicine, I’m very thankful to Lord Vasikar and i will not stop publishing his name on the internet because of the good work he did for me, You can reach him on his email: homeofnaturalremedie@gmail.com And WhatsApp Number +44 7494 422098.
LORD VASIKAR CAN AS WELL CURE THE FOLLOWING DISEASE:-
HIV/AIDS
HERPES
CANCER OF ALL KINDS
HSV
Hepatitis A,B,C
Diabetes
Parkinson’s disease
C.O.P.D
ALS
PCOS
Turner Syndrome (TS)
Heart Disease
Coronary Artery Disease (Ischemic Heart Disease)
Alopecia
Bipolar disorder
Bedwetting
Carpal tunnel syndrome
Celiac disease
Ear Infections
Endometriosis
Epilepsy
Chlamydia
Syphilis
Neuropathy
Natural remedy for curing HERPES and HIV. WhatsApp Lord Vasikar on +44 7494 422098.
Get rid of all kinds of Herpes and virus infections, Diabetes, Hepatitis A B C, Menopause and HIV with Natural Roots and Herbs, i was once infected with HERPES and after using Dr UMA Herbal Medicine for couple of weeks i couldn’t trace it anymore, i even went for checkup and my test came out Negative. Get your cure today from this wonderful herbalist, Dr. UMA.
You can also reach doctor UMA on WhatsApp
+2347035619585 or Email dr.umaherbalcenter@gmail.com.
i want to share to the whole world how Dr masako the Great of all the Spell Caster, that helped me reunite my marriage back, my Ex Husband broke up with me 3months ago, I have been trying to get him back ever since then, i was worried and so confused because i love him so much. I was really going too depressed, he left me with my kids and just ignored me constantly. I have begged him for forgiveness through text messages for him to come back home and the kids crying and miss their dad but he wont reply, I wanted him back desperately. we were in a very good couple and yet he just ignores me and get on with his life just like that, so i was looking for help after reading a post of Dr masako on the internet when i saw a lady name SHARRON testified that Dr masako cast a Pure love spell to stop divorce. and i also met with other, it was about how he brought back her Ex lover in less than 24 hours at the end of her testimony she dropped his email, I contacted Dr masako via email and explained my problem to Dr masako and he told me what went wrong with my husband and how it happen, that he will restored my marriage back, and to my greatest surprise my Ex husband came back to me, and he apologized for his mistake, and for the pain he caused me and my children. Then from that day our marriage is now stronger than how it was before, Dr masako you’re a real spell caster, you can also get your Ex back and live with him happily: Contact Email doctormasako@gmail.com or Call/whatsapp +2349047144277 Visit his Website: https://doctormasako2.wixsite.com/drmasakospelltemple
My name is Jonathan Helm, I’m from Michigan USA i contacted HIV 2023 after i was tested positive i tried all means but was not working on till i saw the wonderful work of DOCTOR ZACK BALO and i contacted him. that was how i was cured after taking his herbal medicine for two weeks, contact him today through his email address wiseindividualspell@gmail.com or visit his website https://wiseindividualspell.webnode.com
LORD MEDUZA IS THE BEST SPELL CASTER ONLINE
It’s an honor to share my testimony with the world. You merit all the accolades that mention you. Lord Meduza has been a gift to me since our meeting online. He is the only one that knows everything about creating spells. I adore him immensely for his kindness, compassion, integrity, and the support he offers to everyone who interacts with him. Without Lord Meduza, I wouldn’t have survived this difficult situation. His magic turned me into a Lottery winner of £177 Million Pounds, transforming my entire life into something beautiful and extraordinary. The numbers he provided for the lottery were transformative, elevating me from grass to grace, and I want to express my eternal gratitude to him. Thank you, sir, for being a source of help to those in need. Anyone who reads this article and requires assistance can reach him through his Email: lordmeduzatemple@hotmail.com or WhatsApp +18079072687 as he is unmatched in crafting spells.
HOW I GOT CURED OF HERPES VIRUS
I am writing this testimonial with immense gratitude and a renewed sense of hope in my heart. For years, I battled with the physical and emotional torment caused by the herpes virus. It felt like an unending struggle, until I discovered a remarkable solution that changed my life forever. Like many others, I had tried countless remedies, medications in search of a cure. I had lost hope, resigned to the belief that herpes was something I would have to live with indefinitely. However, fate intervened and led me to a breakthrough that altered the course of my life. Upon stumbling on a revolutionary treatment option, my skepticism slowly transformed into a flicker of hope. The treatment was a natural remedy from Lord Vasikar [ HERBS ] Over time, as I followed the treatment diligently, I started noticing positive changes and I experienced a boost in my overall well-being. I am ecstatic to share that I am now herpes-free confirmed by my Doctor after a test was done. The treatment I received was nothing short of miraculous and I couldn’t be more grateful. I have regained my self-confidence and the burden that once weighed heavily upon me has been lifted. I was cured of my herpes virus through natural medication.
If you, like me, have been struggling with herpes and searching for a way out, please know that hope exists. May my story inspire hope in the hearts of those who need it. He also specializes in getting rid of HPV, OVARIAN CYST,PENIS ENLARGEMENT, PCOS, ALS, HEPATITIS and a lot more.
Email:- homeofnaturalremedie@gmail.com
WhatsApp Number + (44) 7494 422098