Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
My husband filed for a divorce after 8 years of marriage it was difficult on me and the kids I did all I could to save my marriage and my family but all fail until a friend of mine told me about the wonderful work of Priest Ade I contacted him and he assured me 24hours all will be well the next day to my greatest surprise my husband came back home and he went on his knees and was crying begging me for forgiveness I’m so happy right now thank you so much Priest Ade, One message to him today can change your life too for the better.Email: ancientspiritspellcast@gmail.com Read more on his website: ancientspellcast.wordpress.com WhatsApp +2347070518515
I need a genuine love spell caster that will be able to help me secure my relationship and stop a divorce bringing back someone’s ex-lover to reunite with happily CONTACT DR DAVID AWESOMESPELLTEMPLE@GMAIL.COM OR WHATSAPP/CALL +2347051149457
I am so happy sharing my amazing experience with the powerful spell caster Dr David who helped me bring my WIFE back me and my partner was having a lot of issues things got so worst we got separated I was devastated I love her more than anything, I cried my eyes out until my friend who had a perfect relationship told me how she did it and introduced me to the wonderful man Dr David he told me everything was going to be Ok that there is no perfect relationship so he will help me fix mine, He told me what to do which I did and exactly 24 hours later my WIFE came back I’m so happy thank you so much I’m going to leave his details here so you too can benefit from him and his work you can also WhatsApp +2347051149457 or Email him at : awesomenesspelltemple@gmail.com or view his website for more review: 63e1caad0959a.site123.me/
How To Get Your Ex Lover/Partner/Boyfriend/Girlfriend/Wife Or Husband Back Contact Dr David awesomenesspelltemple@gmail.com or WhatsApp/Call Him +2347051149457
My husband changed dramatically towards me, doesn’t communicate anymore. He disrespects me and accuses me falsely of infidelity because of wicked gossip …but I’m simply AMAZED at the results of PRIEST AWESOME (AWESOME SPELL TEMPLE) who did a reunion love spell for me. Everything is going so well and EXACTLY how he said it would be. Even though it took 3 days to fully progress, it was so worth it because things are just about at perfection! How he took my situation and completely turned it around to give me exactly what I wanted is beyond me, but something I will never question and just be completely grateful for. God Bless Dr. DAVID for turning sorrow into happiness. You can also contact PRIEST AWESOME : give you 100% guarantee that he will help you..Email him: awesomenesspelltemple@gmail.com or WhatsApp him on +2347051149457
Website: https://63e1caad0959a.site123.me/
The United Nations spends $158 billion dollars a year towards research in finding a cure for infection & diseases like tremor, anxiety & depression, psoriasis, shingles, eczema, urethra wart, chronic problems. Herpes, Cancer, ALS, Hepatitis, Diabetes, HPV, Psoriasis, ulcer, respiratory obstruction. They don’t want a cure because there’s no profit in it for them and the pharmaceutical industry let truth be told please, that’s more reason why I venture into herbal treatment, and I was able to cure myself from diseases that they said were incurable medically .Sometimes you don’t always have to give up on everything you do and let someone else decide your fate .Doctor Ede herbs are very essential and it has the potential to cure the so-called incurable. His contacts are always active. Check out his email to order your medicine via medicalmediumherbal@gmail.com or WhatsApp: +2347035623817
I’m thrilled to share my incredible experience with Dr. Progress’s herbal medicine! After being diagnosed with herpes, I felt hopeless and struggled with the symptoms. However, after using Dr. Progress’s herbal treatment, I’m delighted to report that I’ve been cured! The medicine was natural, effective, and had no side effects. Dr. Progress’s professionalism, compassion, and dedication to his patients are truly remarkable. If you’re struggling with herpes or any other health issue, I highly recommend Dr. Progress’s herbal medicine. It’s been a life-changer for me
You can contact him on is email
drprogress1@gmail.com
Or mobile or WhatsApp number
+2348022830500
I am john danilla from UK, i want to share a
testimony on how a powerful spell caster cured my HIV disease, i was
diagnosed of this disease, in the year 2009, last week i saw a testimony on
Dr. on how he cured an HIV patient, so i contacted him through phone
call and he asked me to email him, which idid, so he told me that all my
problems is over and then he decided to do an healing spell spell for me so
after he finished it, he told me to wait for just 24 hours and then i
should go for a test, so i really did as he had said, so my greatest
surprised when i went to the hospital to go for an HIV test, the Medical
doctor diagnosed that, i am now HIV negetative at first i was amazed and
now i have come to realise that this spell caster Dr. believe is a very
powerful one and a real spell caster. So viewers of this should please join
me in my celebration for i am the happiest man on earth today and if you
want to contact him, you can do this via his email
(drbelieve921@gmail.com) or whatsapp him +2348105257464 Some other solution you need Dr believe help you get cured.
{1}Diabetes
{2}HPV
{3}ALS
penis oil
{4}Herpes
Contact
Dr via Email drbelieve921@gmail.com
Hey everyone, I hope you’re all doing great! I wanted to share a truly incredible journey that I’ve been on recently. You see, few months ago, my marriage hit a really rough patch. It was a time filled with confusion, heartbreak, and a lot of searching for answers. I looked into so many different places for help, hoping to find someone who could guide me through this difficult time. I reached out to friends, family, and even sought advice from professionals, but unfortunately, nothing seemed to be working. It felt like I was hitting dead ends at every turn. But then, one day, while I was surfing the internet, feeling a bit lost and unsure of what to do next, I stumbled upon something truly remarkable. It was the good work of a spell caster called Priest AZ. His effective love spell stories and positive impact he had made in the lives of others with his powerful love spell caught my attention. Intrigued and hopeful, I decided to reach out to Priest AZ for help. And let me tell you, that decision changed everything. From the very first conversation, I could sense his genuine care and understanding. He listened to me without judgment and provided a safe space for me to express my feelings and concerns. Priest AZ’s Love-Spell were like a beacon of light during my darkest days. He helped me navigate the complexities of my situation. He helped me solved the underlying issues in my marriage with his effective and powerful love spell. In just a short time the results were surprising, my husband called me in less than 24hrs after the love-spell and he was apologizing for me to accept him back and definitely I accepted him back. . It wasn’t an easy journey, I’ll admit. There were moments of doubt and uncertainty along the way. But with the unwavering help of Priest AZ, Through the love spell, my husband and I were able to reignite the love that brought us together, and ultimately restore our marriage. I can’t express enough how grateful I am for the intervention of Priest AZ in my life. He truly made a difference, not just in my marriage, but in my overall well-being. His kindness, compassion, and dedication to helping others are truly inspiring. If any of you out there is going through a similar situation, If you need to get your husband back to you, you need to fix a broken marriage, you need to stop a divorce or you want to restore a broken marriage/relationship. I want to encourage you to seek help from priest AZ, Contact him at Mightylovespell@gmail.com. WhatsApp: +43 680 5400 8232
Bitcoin Recovery Testimonial
After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets.
Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto.
Contact: Capitalcryptorecover@zohomail.com
Phone CALL/Text Number: +1 (336) 390-6684
Email: Recoverycapital@fastservice.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
My husband Broke up with me, left me and my two kids, I apologized to him but he never wanted to see me at all, I also tried few other means to get him back but all efforts failed, instead, he started working on a divorce, then I was lost and hopeless, drowning in my mistakes. I decided to surf on the internet for help, then I saw lots of testimonies about a powerful love Spell caster called Priest AZ, I read so many testimony and stories of how Priest AZ restored people’s relationships and marriages and I decided to contact him, He responded immediately and give me some instructions which I followed and surprisingly within 24hrs My husband contacted me again after a year of silence, My husband started asking for forgiveness of course I can’t hesitate to forgive my husband. Priest AZ pulled me out of the darkness. He helped me returned my husband back to me within 24hrs with his powerful and effective love spell. Now, I live in the light with my Husband and family, forgiven and renewed. If you urgently need to get your ex back to you, Contact Priest AZ at Mightylovespell@gmail.com. WhatsApp: +43 680 5400 8232
My Profound and Utmost Gratitude to Doctor Razor, I am here to Share my testimony about a doctor who helped me remove a burden from my life. I was diagnosed with HPV 1 on March 4th, 2013, i didn’t bother seeking for medical aide because i know that the Government And medical Scientists Have been lying to us about herpes not Having a complete Cure, so I was thinking of how to get a solution, To make sure i get this Infection out of my body. I went to visit a friend of mine who happens to be A family friend as well and she asked why i was looking so sad, i explained to her my problem, she told me that she can help me out, she introduced me to a doctor who used herbal medication to cure HUMAN PAPILLOMAVIRUS and gave me his email drrazorherbalhome@gmail.com. So I emailed him. He told me all the things I needed to do and also gave me instructions on How i was to take the medicine For 18 days, which I followed properly. After completion of the Dosage the herbalist Requested that i go for a medical Test And i was amazed after my Test Result came out HPV Negative. If you are also heart broken and also need help, you can also email him at: drrazorherbalhome@gmail.com . Whatsapp/Call Doctor Razor via +2349065420442