Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
I was diagnosed of herpes in 2019 and I tried all possible means to get cure but all to no avail until i saw a post in a health forum about a herbal doctor from Africa who prepare herbal medicine to cure all kind of diseases including herpes virus, at first i doubted if it was real but decided to give it a try, when i contact this herbal doctor via his email i bought the herpes herbal medicine and received it through DHL within 7 days and used it as prescribed, i tested negative to herpes virus within 3 weeks of usage. Thanks to Dr Ughulu His email: drughulupowerfulspelltemple@gmail.com And Calling Number: +1(252) 409-1841 More Reviews on his site: https://drughulupowerfulsp.wixsite.com/my-site-ughulu Or WhatsApp: +1(720) 794-2516
I am amazed by Dr Aba herbal remedy. I Have had herpes for over 6 years with frequent outbreaks. Sometimes average 2-3 times per month. Before one breakout could end, the next would begin. Nothing has helped me. I came online in search for a possible way to see how I can fight this virus so I found Dr Aba here online after seeing a lot of testimonies of how he cured herpes and other diseases with natural herbs so I decided to give it a try, I only took his remedy for two weeks and I was completely cured. I recommend Dr Aba remedy to anyone suffering from herpes that wants to be completely cured too. email: dr.abaherbalhome@gamil.com and for quick response Message him on his whatsapp number +2348107155060
AN AMAZING REMEDY FOR HSV 1 & 2. It’s so unbelievable how wonderful herbs can be. when I first saw a post that said that a man have a perfect cure for HSV 1&2, i was like could this be real or some kind of scam but due to my eagerness to be cured I took the risk of contacting him, he gave me reasons to believe he is a real herbalist so I followed all his instructions on how to take the drugs for 14 days and now all my test results shows HSV 1&2 (-) negative , Dr Aba have the most safe cure for herpes and other stubborn virus which are HSV 1&2,STI,STD just name it he has the cure for them all. Contact him via his personal email address which is dr.abaherbalhome@gmail.com . Trust me you will like this method, it’s safe, cheap and easy. Do well to let others know about this..
Hello I’m so happy sharing this, I still can’t thank you enough powerful Priest Ade, My husband left for a younger lady because i was unable to give birth due to PCOS,I was so devastated i was lonely i cried a lot i even tried taking my life, Then my friend told me about this great man Priest Ade who helped her made her marriage perfect, I also went online and did more research about him i was not too sure but i decided to give him a try he told me not to worry everything was going to be alright, He told me all i needed to pay which was a convenient fee and i did and he did his work and sent me video proof and told me to wait 24hrs that he will be back, The next morning to my greatest surprise it was Shawn my husband on his knees begging I’m so happy, It didn’t stop there, I’m proud to say that I’m 3 weeks pregnant thank you so much Priest Ade I’m forever grateful contact him ancientspiritspellcast@gmail.com Website ancientspellcast.wordpress.com WhatsApp:+2348100170928
Hello everyone i want to use this medium to appreciate the greatest spell caster Priest Ade for restoring my broken marriage, My husband and i have been having problems for months now we use to be very sweet but all of a sudden everything changed he was now distant from me until one day he told me he wanted a divorce which left me devastated i cried my eyes out so i told my friend about all that has been going on, She introduced me to Priest Ade he told me not to worry he told me all i needed to do and he assured me that in 24 hours all that is wrong with our relationship will be fine the next day to my greatest surprise it was my husband back home apologizing I’m so happy we are closer and stronger than we have ever been, I promised to share your amazing work when i get results so this is me keeping my word, Thank you so much Priest Ade,I will leave his contact information for anyone who needs help: ancientspiritspellcast@gmail.com
Read more on his website:
https://ancientspellcast.wordpress.com
WhatsApp: +2348100170928
I am excited to share this testimony, I was 3 years ago diagnosed of Herpes virus . My medical condition was heart broken because it was causing me so many our brakes, I was subjected to different medications by my medical doctor just to control the ourbrakes. Despite my visit to several doctors my health wasn’t getting better, all they could say is for me to stay on the treatment. At the verge of giving up, I went to the internet to search for a treatment on my own at least. But I found a cure instead. In the internet, I read a testimony of a lady who had herpes. She shared an e-mail address of the Doctor. Luckily everything seemed to be okay after I took the Herbal Medicine. I wish I could say that’s the end of it because I haven’t had any symptoms since then. Do not expose yourself to more danger, use a herbal remedy that is safe and effective. If interested contact him via email address dr.abaherbalhome@gmail.com. or call +2348107155060
God bless Dr Ughulu for his marvelous work in my life, I was diagnosed of Herpes simplex virus (HSV) since 2014 and I was taking my medications, I wasn’t satisfied I needed to get the Herpes simplex virus (HSV) out of my system, I did a researched about some possible cure for Herpes simplex virus (HSV) I saw a comment about Dr Ughulu, how he cured Herpes simplex virus (HSV) with his herbal medicine, I contacted him and he guided me. I asked for solutions, he started the remedy for my health, he sent me the medicine through UPS SPEED POST. I took the medicine as prescribed by Dr Ughulu and 7 days later I was totally cured from Herpes simplex virus (HSV) . Thank you Dr Ughulu, get in touch with him too. WhatsApp: +1(720) 794-2516 Call Text Number: +1(252) 409-1841 Via:drughulupowerfulspelltemple@gmail.com Or website: https://drughulupowerfulsp.wixsite.com/my-site-ughulu
I will forever be grateful for the miraculous work you did for me Lord Vasikar, words are not enough to express my gratitude. I was diagnosed of herpes in 2021 and I tried all possible means to get cure but all to no avail until I saw a post in a health forum about a herbalist who prepares herbal medicine to cure all kind of diseases including herpes virus, at first i doubted if it was real but decided to give it a try, when i contacted this herbal doctor via his email i bought the herpes herbal medicine and received it through DHL within 7 working days and used it as prescribed, i tested negative to herpes virus within 27 days of use. Thanks to Lord Vasikar His email: homeofnaturalremedie@gmail.com And WhatsApp Number +44 7494 422098. More Reviews on his page https://www.facebook.com/profile.php?id=100088110402630.?.
I can’t express my gratitude to Dr Aba for making me a living testimony. i have battled with HERPES SIMPLEX VIRUS 2 for about 7years now, and i have done all i can to make sure i am cured but nothing worked out, but miraculously my friend invited me to see a video on his Blog and as i visited i decided to see few of the comment below, and i found some people talking about Dr Aba, and i decided to contact this great herbal healer to also help me,so i wrote to him, and he replied me back and assure me that i will get a cure for my HERPES SIMPLEX VIRUS 2. and after preparing my medicine he sent it to me and when i started using it for 2weeks i was completely cured, I am assuring you that you will be cured if you also contact this great man on his Email: dr.abaherbalhome@gmail.com or whatsapp is mobile number on +2348107155060
Am really grateful and thankful for what Dr Aba has done for me and my family. I Was having HERPES for good three years with no solution, the diseases almost took my life and because I was unable to work and I was also loosing lots of money .for medication, but one faithful day when I went online, I met lots of testimonies about this great man so I decided to give it a try and to God be the glory he did it. he cured me of my diseases and am so happy and so pleased to Write about him today. if you need his help or you also want to get cured just the way I got mine, just email him below Dr.abaherbalherbalhome@ gmail. com or Whatsapp :+2348107155060