Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
I thought the physicians says there is no cure for HSV 2!!! I am telling you today that DR.UMA cure HSV 2 with his herbal medicine and once you get cured you are cured forever it is never reversible, I have been suffering for this deadly disease called HSV 2 for more than 2years and I lost all hope because my doctor says there is no cure for HSV 2. Brethren I saw a testimony on the internet on how DR.UMA cure HSV, Hapatitis etc with his herbal medication and an email and watsapp to contact him was also displayed, I thought this was a joke but I decided to contact him and he replied telling me not to worry that my problem is over . DR.UMA sent me a herbal medication to drink for one month but only 2weeks I feel strange and I went to my doctor and he confirmed me negative. He can help you too. Contact him via email…dr.umaherbalcenter@gmail.com WhatsApp +2347035619585. He is capable of curing AUTISM, HERPES, HPV, HSV1&2, HEPATITIS A B C, and DIABETES.
HOW I GOT CURED FROM HERPES: I already gave up on ever getting cured of herpes because I have tried many treatment and none has work, I have gone to different hospitals they always recommend me same drugs and it not working on me, until I came across a post about DR ABA on the net from a lady who is recommending people, then i contacted him that day, and he started giving me hope and then prepared some herbal medicine which I took according to his prescription on them, so I was still doubting if it was working on me so at a time my Husband just ask me to go for check up and I did, so I found out that I was cure and free from the herpes virus, thanks to DR ABA once again. his email address is dr.abaherbalhome@gmail.com or WhatsApp him on +2348107155060
I already gave up on ever getting cured of HSV2 because i have try many treatment none of them work out for me i have gone to different hospital they always tell me the same thing there is no cure for herpes, when i came across a post about Dr UMA in the net from a lady called Angela i contacted her and she reassured me with his herbal medicine which i took according to the way he instructed, that how i was cured. I doubted at first because i have been to a whole lot of reputable doctors, tried a lot of medicines but none was able to cure me. so i decided to listen to him and he commenced treatment, and under. two weeks i was totally free from Herpes. i want to say a very big thank you to DR UMA for what he has done in my life. feel free to leave him a message on email dr.umaherbalcenter@gmail.com or also Whats-app him +2347035619585.. he also cure all this 1.HIV 2.HIV HPV 3 .ALS 4. BED WETTING DIABETES.,
If you are reading this ,I hope it finds you well,My name is Denise Blesh. My relationship with my boyfriend was the best love I have ever experienced. It was a bit toxic though as I wasn’t in the best of places just coming out of my divorce. But our souls were so beautiful together. The good were amazing, we were friends but the challenging times were hard. We were together on and off for 7 years. We got married at the end we had problems and I freak out and thought I was locked in another toxic marriage and broke it off we separated ways i dedicated some time to myself doing therapy and soul cleansing when I began to stabilize and find my self and love life again and I realized what a gift he was,I still love him however now he will not have anything to do with me again. I missed him. I have tried to move on from him but my heart won’t let me so I reached out to PRIEST ADE who helped me fix our problems and brought us back together. I’m grateful I believe he can help you too contact him through these options. Email ancientspiritspellcast@gmail.com WhatsApp +2348100170928 Website https://ancientspellcast.wordpress.com
If you are reading this ,I hope it finds you well,My name is Denise Blesh. My relationship with my boyfriend was the best love I have ever experienced. It was a bit toxic though as I wasn’t in the best of places just coming out of my divorce. But our souls were so beautiful together. The good were amazing, we were friends but the challenging times were hard. We were together on and off for 7 years. We got married at the end we had problems and I freak out and thought I was locked in another toxic marriage and broke it off we separated ways i dedicated some time to myself doing therapy and soul cleansing when I began to stabilize and find my self and love life again and I realized what a gift he was,I still love him however now he will not have anything to do with me again. I missed him. I have tried to move on from him but my heart won’t let me so I reached out to PRIEST ADE who helped me fix our problems and brought us back together. I’m grateful I believe he can help you too contact him through these options. Email ancientspiritspellcast@gmail.com WhatsApp +2348100170928 Website https://ancientspellcast.wordpress.com
Honestly, this Love spell caster made me feel a lot better. My marriage was restored and my husband came back to me he apologized for all the wrongs he did and promise never to do it again. A big thanks to this wonderful psychic for bringing my husband back to me.. I never really believed in magic spells or anything spiritual but a trusted friend opened my eyes to the truth about life. My marriage was heading to divorce a few months ago. I was so confused and devastated with no clue or help on how to prevent it, till I was introduced to Dr. Excellent that did a love spell and broke every spiritual distraction from my marriage. A day later my husband started showing me love and care even better than it used to be, he’s ready to talk things through and find ways for us to stay happy. It’s such a miracle that my marriage can be saved so quickly without stress. You can also contact him for help. Here his contact. Call/WhatsApp him at: +2348084273514 "Or email him at: Excellentspellcaster@gmail.com , His website:https://drexcellentspellcaster.godaddysites.com
I am Sorrow Andrew from drama United States ( northern ireland), i want to share a testimony on how a powerful spell caster cured my HERPES disease, i was diagnosed of this disease, in the year 2009, last week i saw a testimony on Dr ahonsie how he cured my HERPES patient, so i contacted him through phone call and he asked me to email him, which idid, so he told me that all my problems is over and then he decided to do an healing spell spell for me so after he finished it, he told me to wait for just 24 hours and then i should go for a test, so i really did as he had said, so my greatest surprised when i went to the hospital to go for an HERPES test, the Medical doctor diagnosed that, i am now HERPES negetative at first i was amazed and now i have come to realise that this spell caster DR AHONSIE is a very powerful one and a real spell caster. So viewers of this should please join me in my celebration for i am the happiest man on earth today and if you want to contact him, you can do this via his email drahonsie002@gmail.com or whatsapp him +2348039482367 https://drahonsie002.wixsite.com/dr-ahonsie https://www.facebook.com/drstellaherbalhome?mibextid=ZbWKwL
Hello everyone,
I’d like to take this opportunity to express my heartfelt gratitude to Dr. Jakuta, a powerful spell caster who helped me reunite with my ex-lover after a painful breakup. For six long months, I thought our relationship was over, but Dr. Jakuta’s spell brought us back together. Within 48 hours of the spell being cast, my ex reached out, apologizing for the hurt and promising to make amends. I was overjoyed and welcomed her back into my life. If you’re facing similar relationship challenges or other difficulties, I highly recommend contacting Dr. Jakuta. His spell casting abilities are truly remarkable.
You can reach Dr. Jakuta via WhatsApp: +2349161779461
Email: doctorjakutaspellcaster24@gmail.com
My name is Amelia Jonathan from the United States, Using this opportunity to thank Dr. Ughulu is a grateful thing to me, for over years I have been sick with Hepatitis B disease, I have done a lot of things to get cured of my diseases and nothing has worked out. I have taken different types of medication for it , but it still doesn’t work for me. I still keep going for a check up so that the doctor will tell me my disease has be gone, because i’m taking my medicine with no result nothing has been cured, I have spent a lot of money just to get cure of Hepatitis B. until my old time friend came to my place and saw what am going through, and then direct me to contact Dr. Ughulu who is a very powerful man, which I did explain my problem to Dr. Ughulu and send me a herbal remedy bottle and explain to me how I should drink it. So I started to drink the herbal tea in one week that I drink the herbal tea. I went for a check up to check if I’m cured from Hepatitis B disease, then the nurse told me nothing is wrong with me anymore and said I’m fine. I am the happiest person right now. I promise Dr Ughulu I will testify about his good work on the internet. Reach out to Dr. Ughulu Via: drughulupowerfulspelltemple@gmail.com Thank you so much sir for what you did for me you’re the best of all. TEXT OR CALL: +1(252) 409-1841 or website: https://drughulupowerfulsp.wixsite.com/my-site-ughulu WHATSAPP NUMBER: +1(720) 794-2516
HOW I GOT CURED FROM HPV: Words are not enough to thank you Lord Vasikar for healing me of this HPV that has been disturbing me for 3 years now. I have promised to tell the whole world about your good works if the herbs are legit and work, now I’m here to do it and say thank you so much Lord Vasikar I’m so happy with my life now. At last I’m free from HPV. He can also cures HERPES, EPILEPSY, DIABETES,COLD SORE, Multiple Sclerosis, CANCER, Stroke, Alzheimer’s disease, FIBROIDS, LEUKEMIA , LIVER, KIDNEY PROBLEMS , INFERTILITY, ULCER, LUPUS, ARTHRITIS , THYROID, HIV, Hepatitis A,B,C ,DYSTONIA, Dementia, AIDS, ALS, C.O,P.D, Parkinson’s Disease Neuropathy and a lot more. CONTACT INFO Below With his WhatsApp +44 7494 422098?. Email: homeofnaturalremedie@gmail.com For More Reviews visit his page https://www.facebook.com/profile.php?id=100088110402630