Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6yrs now. We were happily married with two kids, 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. I became very worried and I needed help. I did all I could to save my marriage but it fail until a friend of mine told me about the wonderful work of Dr Jakuta I contacted him and he assured me that after 24hrs everything will return back to normal, to my greatest surprise my husband came back home and went on his knees was crying begging me for forgiveness I’m so happy right now. Thank you so much Dr Jakuta because ever since then everything has returned back to normal. One message to him today can change your life too for the better. You can contact him via WhatsApp +2349161779461 or Email : doctorjakutaspellcaster24@gmail. com
Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6yrs now. We were happily married with two kids, 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. I became very worried and I needed help. I did all I could to save my marriage but it fail until a friend of mine told me about the wonderful work of Dr Jakuta I contacted him and he assured me that after 24hrs everything will return back to normal, to my greatest surprise my husband came back home and went on his knees was crying begging me for forgiveness I’m so happy right now. Thank you so much Dr Jakuta because ever since then everything has returned back to normal. One message to him today can change your life too for the better. You can contact him via WhatsApp +2349161779461 or Email : doctorjakutaspellcaster24@gmail. com
Greetings to everyone here online🤗. In 2020 during the time of coronavirus I had HSV1 which I have been looking for a way to cure. I didn’t see any herbal remedy to cure me. I worried both day and night that this disease shouldn’t take away my life at an early age. I did so much research online to cure my HSV1, I couldn’t find anyone who will help me. Exactly the day I went to the hospital to take my covid-19 injection my doctor told me what to write to get a good search online so I can find a herbal spell caster to get me cured. So I really did what the doctor says, so I went home to search for a cure online and I found a spell caster called Dr ughulu who prepared me herbal remedy to cure my HSV1 and covid-19 disease. He did everything within 24 hours. Now if you’re going through all kind of disease contact Dr ughulu phone number here: CALL NUMBER: +1(252) 409-1841 whatsApp: +1(720) 794-2516 You can visit his website: https://drughulupowerfulsp.wixsite.com/my-site-ughulu EMAIL: drughulupowerfulspelltemple@gmail.com
I’m thrilled to share my incredible experience with Dr Jakuta, a powerful spell caster who helped me reunite with my wife. We were facing numerous issues, and our relationship deteriorated, leading to a heartbreaking breakup. However, with the guidance of Dr Jakuta, whom my friend introduced me to, I followed his advice and, amazingly, my wife returned to me within 24 hours! I’m forever grateful. For those seeking help, you can reach Dr Jakuta at doctorjakutaspellcaster24@gmail.com or WhatsApp him on +2349161779461
I have been suffering from Herpes for the past 1 years and 8 months, and ever since then i have been taking series of treatment but there was no improvement until i came across testimonies of Dr. UMA on how he has been curing different people from different diseases all over the world, then i contacted him as well. After our conversation he sent me the medicine which i took according .to his instructions. When i was done taking the herbal medicine i went for a medical checkup and to my greatest surprise i was cured from Herpes. My heart is so filled with joy. If you are suffering from Herpes or any other disease you can contact Dr. UMA today on this Email address: dr.umaherbalcenter@gmail.com or whatsapp +2347035619585.
TESTIMONY OF HOW I GOT CURED FROM (HERPES SIMPLEX VIRUS) BY THE GREAT HEALER DOCTOR AKHIGBEHello everyone my name is Cuquimorejoon I am here to testify of the great work Dr AKHIGBE did in my life with the help of his herbal traditional medicine. I have been suffering from Herpes since 2015 and ever since then I have been looking for solutions on how to cure it. I have being to different hospitals but I discovered none of them was working out for me that I was just wasting money. So I decided to live everything to God, then I was taking my medications to sustain my life and reduce the pains. So on this particular Sunday morning after coming back from service I sat down and begin to ask myself questions, then my phone rang behold it was my sister calling which I answered the call and she started telling me that a friend of hers who has been suffering from same herpes has just been cured by Dr akhigbe the herbal medicine man. Then I was over whelmed, even though I was a little bit confused so she encourage me to also give Dr akhigbe a trial and see for myself then I told her to help me get his contact and forward them to me, So immediately she got the contact of Dr Akhigbe and send them to me, immediately I contacted Dr Akhigbe and he told me everything I needed to do to enable me get the herbs for my medications and immediately i did that which he instructed me to do without wasting anytime. And here I am today sound and healthy without any symptoms of herpes or any sickness in my body system. And he also told me that there is no sickness on this planet earth that doesn’t have a cure that with the help of herbs he can cure any sickness or disease you can ever think off. So if you are suffering from HERPES or any other sickness or disease and you need a cure you can also contact Dr Akhigbe with this Email Address at (drakhigbe2@gmail.com) whatsApp: +2347083551316 website: https://doctorakhigberemed.wixsite.com/doctorakhigberemedie so you can also receive your healing and share your testimony
I’m thrilled to share my incredible experience with Dr Jakuta, a powerful spell caster who helped me reunite with my wife. We were facing numerous issues, and our relationship deteriorated, leading to a heartbreaking breakup. However, with the guidance of Dr Jakuta, whom my friend introduced me to, I followed his advice and, amazingly, my wife returned to me within 24 hours! I’m forever grateful. For those seeking help, you can reach Dr Jakuta at doctorjakutaspellcaster24@gmail. com or WhatsApp him on +2349161779461
I’m thrilled to share my incredible experience with Dr Jakuta, a powerful spell caster who helped me reunite with my wife. We were facing numerous issues, and our relationship deteriorated, leading to a heartbreaking breakup. However, with the guidance of Dr Jakuta, whom my friend introduced me to, I followed his advice and, amazingly, my wife returned to me within 24 hours! I’m forever grateful. For those seeking help, you can reach Dr Jakuta at doctorjakutaspellcaster24@gmail. com or WhatsApp him on +2349161779461
I just want to share this great testimony to appreciate Lord Vasikar. Few months back l found out I have HERPES. I had used different kinds of medication which didn’t help. Then I have to do a research and found so many interesting testimonies on the internet how Lord Vasikar helped people to cure herpes, I took his contact I found in the internet and I contacted him and he sent me herbal medication via courier service. Then i start taking the medicine according to his instruction and within 6 weeks I was free from HERPES. And for that I will always be grateful to Lord Vasikar. If you need his help, kindly contact him on WhatsApp +44 7494 422098. Email:homeofnaturalremedie@gmail.com Or visit his page https://www.facebook.com/profile.php?id=100088110402630 He also cures , HEPATITIS B, ALS, C.O.P.D, HIV/AIDS, EPILEPSY, LEUKEMIA, ASTHMA, CANCER, GONORRHEA, EMPHYSEMA, GENITAL WARTS, ES, ULCER, DIABETES, HERPES, HSV-1, HSV-2,AUTISM, NEUROPATHY, INFERTILITY, Parkinson’s disease and lots more. There’s no side infects when you take this herbal medicine.
I am so happy sharing my amazing experience with the powerful spell caster Priest Ade who helped me bring my boyfriend back me and my partner was having a lot of issues things got so worst we broke up I was devastated I love him more than anything,I cried my eyes out until my friend who had a perfect relationship told me how she did it and introduced me to the wonderful man Priest Ade he told me everything was going to be Ok that there is no perfect relationship so he will help me fix mine,He told me what to do which I did and exactly 24 hours later my boyfriend came back I’m so happy thank you so much I’m going to leave his info ancientspiritspellcast@gmail.com Read more on his website ancientspellcast.wordpress.com WhatsApp: +2348100170928