Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
The marital crisis I was going through came to and end when spiritual uyi got involved. Just like every other couples out there, we had our differences and I ensure I did my best to lead her right, provide for her and my kids and also protected them. We both made sacrifices to ensure we survived the union until she started acting up and deliberately had so many fights with me. The home became unpleasant for everyone else including my children. She was being manipulated by a friend who had been divorced and wanted to also ruin my marriage. I had to contact spiritual uyi and he responded and did his best to end the issues. He restored the love and connection between us and I can tell now that whatever illusion my wife was under has been taking away and she is a better woman now. The result of what spiritual uyi did for me that manifested after two days was what amazed me. I and my household remain grateful. I appeal to anyone who needs help to fix their relationships and marital problems to contact spiritual uyi because the solution is sure. Review/contact him via spiritualuyi@gamil.com webpage : https://spiritualuyi.wordpress. or text him on WhatsApp +2348169844860 ,.,.,./././.
I have be dealing with herpes for the past years until i got review online about Dr Aziegbe people testifies how they got cured with his herbal medicine. And i order the treatment, after taking it for 14days i totally got cured with Dr Aziegbe herbal treatment. I’m recommending you diagnosis with herpes should get this treatment and be cured of it… contact him if you need his help too, feel free to leave him a message on WhatsApp +2349035465208 or email DRAZIEGBE1SPELLHOME@GMAIL.COM He also have herbs medicine to cured the following diseases;
Diabetes, Lupus, HPV, Gout, Hepatitis A,B, Infertility, HIV/AIDS, CANCER, WART
https://draziegbe1spellhome.simdif.com
Hello everyone out there Am Mrs Williams Morgan from usa. This is a true life story about how my husband was diagnosed with prostate cancer on July 18, 2016. and got cured by Ede via WhatsApp that we got the oil from +2347035623817
If not for the mis-understanding and skepticism my mom would not have died of her lung cancer today. We never knew that Vegetable oil can cure cancer, if not my lovely and adorable mom wouldn’t have die of her lung cancer, well all the same i still get to give God all the glory and a big thanks to Doctor Ede who provided me with Vegetable oil for my husband liver cancer cure, after i lost my mum to lung cancer 6 years later my husband was diagnosed with prostate cancer he under-go many chemo and radiation treatment in seeking solution to cure the prostate cancer we spent all we get but all to no avail until I meant a friend of mine who directed me to Ede holistic Wellness Vegetable oil via Email: medicalmediumherbal@gmail.com
I quickly emailed him and in less than an hour, I got feedback from him and he directed me on how to purchase the medication Vegetable oil and he told me the delivery logistics which I quickly responded to, after two days of procuring the oil, the oil was delivered to me as he promised me. immediately my husband commenced with treatment with the Vegetable oil as directed by the prescription manual. To God be the glory after using the oil for couple of Weeks (Three weeks) my husband is free from cancer and today me and my husband are living happily but it is a sad story that my mum didn’t have this opportunity to survive it, once again you have to be aware that there is cure for any kind of diseases today contact Ede Holistic Wellness , save a life today!!!!
Am very glad to share this testimony with everyone for the marvelous work Dr Aba has done for my life, 6months ago i was diagnosed with herpes virus and ever since then i have been very unhappy, i was so down broken everyday, until one day when i came across a shocking testimony about how Dr Aba cured someone of his herpes virus, without wasting much time i contacted him immediately on his email address: dr.abaherbalhome@gmail.com and after i explain myself to him about how terrible i have been, and he assure me that he will help me to cure my herpes virus,after he has prepared the herbal medicine he sent it to me and when i have received it and started using it i was totally cure within 2weeks, i am forever grateful to Dr Aba for helping me out with his herpes prescription that cured my virus. contact his email address: dr.abaherbalhome@gmail.com or you can call or whatsApp his Mobile number:+2348107155060
I am amazed by Dr Aba herbal remedy. I Have had herpes for over 6 years with frequent outbreaks. Sometimes average 2-3 times per month. Before one breakout could end, the next would begin. Nothing has helped me. I came online in search for a possible way to see how I can fight this virus so I found Dr Aba here online after seeing a lot of testimonies of how he cured herpes and other diseases with natural herbs so I decided to give it a try, I only took his remedy for two weeks and I was completely cured. I recommend Dr Aba remedy to anyone suffering from herpes that wants to be completely cured too. email: dr.abaherbalhome@gamil.com and for quick response Message him on his whatsapp number +2348107155060.
I’m thrilled to share my incredible experience with Dr. Progress’s herbal medicine! After being diagnosed with herpes, I felt hopeless and struggled with the symptoms. However, after using Dr. Progress’s herbal treatment, I’m delighted to report that I’ve been cured! The medicine was natural, effective, and had no side effects. Dr. Progress’s professionalism, compassion, and dedication to his patients are truly remarkable. If you’re struggling with herpes or any other health issue, I highly recommend Dr. Progress’s herbal medicine. It’s been a life-changer for me You can contact him on is email drprogress1@gmail.com Or mobile or WhatsApp number +2348022830500
I’m thrilled to share my incredible experience with Dr. Progress’s herbal medicine! After being diagnosed with herpes, I felt hopeless and struggled with the symptoms. However, after using Dr. Progress’s herbal treatment, I’m delighted to report that I’ve been cured! The medicine was natural, effective, and had no side effects. Dr. Progress’s professionalism, compassion, and dedication to his patients are truly remarkable. If you’re struggling with herpes or any other health issue, I highly recommend Dr. Progress’s herbal medicine. It’s been a life-changer for me
You can contact him on is email
drprogress1@gmail.com
Or mobile or WhatsApp number
+2348022830500
My husband Broke up with me, left me and my two kids, I apologized to him but he never wanted to see me at all, I also tried few other means to get him back but all efforts failed, instead, he started working on a divorce, then I was lost and hopeless, drowning in my mistakes. I decided to surf on the internet for help, then I saw lots of testimonies about a powerful love Spell caster called Priest AZ, I read so many testimony and stories of how Priest AZ restored people’s relationships and marriages and I decided to contact him, He responded immediately and give me some instructions which I followed and surprisingly within 24hrs My husband contacted me again after a year of silence, My husband started asking for forgiveness of course I can’t hesitate to forgive my husband. Priest AZ pulled me out of the darkness. He helped me returned my husband back to me within 24hrs with his powerful and effective love spell. Now, I live in the light with my Husband and family, forgiven and renewed. If you urgently need to get your ex back to you, Contact Priest AZ at Mightylovespell@gmail.com. WhatsApp: +43 680 5400 8232
I’m thrilled to share my incredible experience with Dr. Progress’s herbal medicine! After being diagnosed with herpes, I felt hopeless and struggled with the symptoms. However, after using Dr. Progress’s herbal treatment, I’m delighted to report that I’ve been cured! The medicine was natural, effective, and had no side effects. Dr. Progress’s professionalism, compassion, and dedication to his patients are truly remarkable. If you’re struggling with herpes or any other health issue, I highly recommend Dr. Progress’s herbal medicine. It’s been a life-changer for me
You can contact him on is email
drprogress1@gmail.com
Or mobile or WhatsApp number
+2348022830500
Herpes simplex virus is said to have no cure, just as i was told by my family doctor After i got Infected with the virus March 4th, 2019, that herpes can not be cured but can be controlled, Although i was a very stubborn person i never believed in what my doctor told me about herpes having no cure. Am a very honest person who believe in nature and i also believed that there could be cure somewhere in the world, I kept my faith so strong and kept on doing my research till i saw an article shared by a testifier on How a herbal Doctor Razor from west Africa, I Decided to use his herbal medicine, so i Reached out to him and explained my situation to him, he promised to guide me, after 4 days of reaching out to him i received my medication sent to me by Doctor Razor and he instructed me to use it for 18 days, After Completion of his herbal medicine dosage, i went for a medical checkup as i was told by Doctor Razor. I am so happy and extremely excited that I got cured of this Virus. Massive gratitude to doctor Razor. Reach out to him via his clinic email : drrazorherbalhome@gmail.com Telephone/call his cell phone +2349065420442. Together we stand a chance to fight herpes. Let’s continue to share this till The whole world Gets to know that there is a herbal cure for herpes.God bless you all. God Bless You Dr. His Email Adress : drrazorherbalhome@gmail.com..