Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
Welcome to Good Life Bitcoin Trading
I am a bitcoin professional trader, and I always win my trade with my best
trading platform, so are you looking for a professional trader or looking for
someone that can help you invest and trade your Bitcoin for more profit to be
made? With and 8 hours of investment profit plans.
Do you know you can grow your money by investing in Bitcoin and get profit by
helping you to trade, Email us for more info melodygoodlife617@gmail.com
My investment plans;
Invest $250 X 8=$2,000
Invest $500 X 8=$4,000
Invest $1,000 X 8=$8,000
Invest $1,500 X 8=$12,000
Invest $,2,000 X 8=$16,000
Invest $3,000 X 8=$24,000
Contact us today let’s teach you how you can get that done with proof on my
trading platform by investing and make your profit in 8-Hours..
E-mail Address: melodygoodlife617@gmail.com
Melody Good Life.
A Try We Convince You With Good Life Investment.
It is a very hard situation when playing the lottery and never won, or keep winning low fund not up to 100 bucks, i have been a victim of such a tough life, the biggest fund i have ever won was 100 bucks, and i have been playing lottery for almost 11 years now, things suddenly change the moment i came across a secret online, a testimony of a spell caster called Dr.Isa who help people win in any type of lottery numbers, i was not easily convinced, but i decided to give a try, now i am a proud to be a lottery winner with the help of Dr.Isa spell, i won 2,000,000 Million dollars and i am making this known to everyone out there who have been trying all day to win the lottery, believe me this is the only way to win the lottery, this is the real secret we all have been searching for.
His WhatsApp: +2347046030096
Email: drisaspellcaster@gmail.com
Website: https://drisaspellcaster.wixsite.com/dr-isa
Hello everyone i want to use this medium to appreciate the greatest spell caster Priest Ade for restoring my broken marriage, My husband and i have been having problems for months now we use to be very sweet but all of a sudden everything changed he was now distant from me until one day he told me he wanted a divorce which left me devastated i cried my eyes out so i told my friend about all that has been going on, She introduced me to Priest Ade he told me not to worry he told me all i needed to do and he assured me that in 24 hours all that is wrong with our relationship will be fine the next day to my greatest surprise it was my husband back home apologizing I’m so happy we are closer and stronger than we have ever been, I promised to share your amazing work when i get results so this is me keeping my word, Thank you so much Priest Ade,I will leave his contact information for anyone who needs help: ancientspiritspellcast@gmail.com
Read more on his website:
https://ancientspellcast.wordpress.com
WhatsApp: +2347070518515
I want to give thanks to Priest AZ for bringing back my ex husband. No one could have ever made me believe that the letter I’m about to write would actually one day be written. I was the world’s biggest skeptic. I never believed in Love spells or anything like this, but I was told by a reliable source (a very close co-worker) that contact priest Az a Trusted, dedicated, gifted, reliable and talented Love Spell caster, It was one of the best things I have ever done. My love life was in shambles; I had been through two divorces and was on the brink of a third. I just couldn’t face another divorce, and I wanted to try harder to make our marriage work, but my husband didn’t seem to care. and he left me again. I was confuse and do not know what to do again, rather than to get in contact with Priest AZ. He did a love spell that made my husband come back to me. we are now very much happy with our self. Priest AZ make him to realize how much we love and need each other. This man is for REAL and for good. he can also help you to fix your broken relationship. I had my husband back! It was like a miracle! He suddenly wanted to go to marriage counseling, and we’re doing very, very well in our love life. contact Email: Mightylovespell@gmail.com OR Mightylovespell@yahoo.com or WhatsApp: +43 680 5400 8232
Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6yrs now. We were happily married with two kids, 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. I became very worried and I needed help. I did all I could to save my marriage but it fail until a friend of mine told me about the wonderful work of Dr Jakuta I contacted him and he assured me that after 24hrs everything will return back to normal, to my greatest surprise my husband came back home and went on his knees was crying begging me for forgiveness I’m so happy right now. Thank you so much Dr Jakuta because ever since then everything has returned back to normal. One message to him today can change your life too for the better. You can contact him via WhatsApp +2349161779461 or Email : doctorjakutaspellcaster24@gmail. com
Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6yrs now. We were happily married with two kids, 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. I became very worried and I needed help. I did all I could to save my marriage but it fail until a friend of mine told me about the wonderful work of Dr Jakuta I contacted him and he assured me that after 24hrs everything will return back to normal, to my greatest surprise my husband came back home and went on his knees was crying begging me for forgiveness I’m so happy right now. Thank you so much Dr Jakuta because ever since then everything has returned back to normal. One message to him today can change your life too for the better. You can contact him via WhatsApp +2349161779461 or Email : doctorjakutaspellcaster24@gmail. com
I’m thrilled to share my incredible experience with Dr. Progress’s herbal medicine! After being diagnosed with herpes, I felt hopeless and struggled with the symptoms. However, after using Dr. Progress’s herbal treatment, I’m delighted to report that I’ve been cured! The medicine was natural, effective, and had no side effects. Dr. Progress’s professionalism, compassion, and dedication to his patients are truly remarkable. If you’re struggling with herpes or any other health issue, I highly recommend Dr. Progress’s herbal medicine. It’s been a life-changer for me
You can contact him on is email
drprogress1@gmail.com
Or mobile or WhatsApp number
+2348022830500
I started a healing journey with Dr EHIMARE for 4weeks because I had a chronic infection . He is absolutely the best! He recognizes every ability and modifies for all his patients . I love his page on Instagram and is so informative about health issues. I was at the 3rd week of my healing journey when I decided to go for a test with out him knowing. I was shocked, my dr was also shocked , and tears of joy rolled down from eyes. Because am free from the deadly infection.
CONTACT HE TODAY 👇🏿
Whatsapp number +2349016865471Gmail info doctorehimare80@gmail.com
https://linktr.ee/doctorehimare
Here is my testimony.. I thought it was over for me when my ex left. I gave all I had for the relationship to work but it was all failure. 4month after my partner left me for another person, I was introduced to Dr Masako and he helped me bring back my ex in 24hours. Now we are fully married and I am 2months pregnant. I promised Dr Masako that I will tell everybody about him if it works. I am very glad to be living a happy life with my love. He did it for me and I am 100% sure that he will do yours. I am a living example. Contact him directly: Doctormasako@gmail.com
Whatsapp: +2349047144277
Wow what a good God I am so excited to tell you all how I become a millionaire I’m a woman of faith I was reading a comment on google where I meet a man sharing how Dr UYI cast a spell for him and he get his wife back after the spell I was interested I have to do research when I was doing the research I got so many testimony about this same man call Dr UYI how he help people to win lottery how he help people to get there ex back how he help people to do so many things I was happy and I contact him to help me win the lottery when I contact him and he told me what to do and after I did what he ask me to do he den gave me a lottery number to play and told me to go and buy ticket after playing the game I was so surprise the game come out good and I won the sum of 90, 000,000 dollars i was amazed and promise to share it to the people around me if anyone is willing to play the mage lottery it should contact Dr UYI so he can give you the right number to play thanks to you Dr UYI I’m so so grateful contact Dr UYI via drzukalottospelltemple@gmail.com OR WhatsApp on +17174154115