Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
Greatest thanks to Dr Oyagu for his herbal drugs that he prepared for me and when I start using it in just 2weeks I was completely cured and that ended my HERPES SIMPLEX 1&2 DISEASE I am so happy and grateful to Dr Oyagu . after reading about him on a testimony of Jason Cash on a blogger. I knew suddenly Dr Oyagu was the right Doctor to cure my HERPES SIMPLEX 1&2 DISEASE. I discuss with Dr Oyagu and he prepared a herbal medicine for me and when it got sent to me in South Korean. I used the herbal medicine and 2weeks and I went to check up again. after 15years of suffering from HERPES SIMPLEX 1&2 at last I am smiling once again. Dr Oyagu also has remedy to others disease like COLD SORES, HIV/AIDS, DIABETES, CANCER, HIGH BLOOD PRESSURE AND MANY MORE. I oblige everyone to contact this powerful herbalist Dr Oyagu and be free from your suffering. contact his WhatsApp line: +2348101755322 or his Email: Oyaguherbalhome@gmail.com
God bless Capital Crypto Recover Services for the marvelous work you did in my life, I have learned the hard way that even the most sensible investors can fall victim to scams. When my USD was stolen, for anyone who has fallen victim to one of the bitcoin binary investment scams that are currently ongoing, I felt betrayal and upset. But then I was reading a post on site when I saw a testimony of Wendy Taylor online who recommended that Capital Crypto Recovery has helped her recover scammed funds within 24 hours. after reaching out to this cyber security firm that was able to help me recover my stolen digital assets and bitcoin. I’m genuinely blown away by their amazing service and professionalism. I never imagined I’d be able to get my money back until I complained to Capital Crypto Recovery Services about my difficulties and gave all of the necessary paperwork. I was astounded that it took them 12 hours to reclaim my stolen money back. Without a doubt, my USDT assets were successfully recovered from the scam platform, Thank you so much Sir, I strongly recommend Capital Crypto Recover for any of your bitcoin recovery, digital funds recovery, hacking, and cybersecurity concerns.
You reach them Call/Text Number +1 (336)390-6684
His Email: Capitalcryptorecover@zohomail.com
Contact Telegram: Capitalcryptorecover Via Contact: Recoverycapitalfastservice.com
His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Hello my name is Kallya from USA i want to tell the world about the great and mighty spell caster called Priest Ade my husband was cheating on me and no longer committed to me and our kids when i asked him what the problem was he told me he has fell out of love for me and wanted a divorce i was so heart broken i cried all day and night but he left home i was looking for something online when i saw an article how the great and powerful Priest Ade have helped so many in similar situation like mine he email address was there so i sent him an email telling him about my problem he told me he shall return back to me within 24hrs i did everything he asked me to do the nest day to my greatest surprise my husband came back home and was crying and begging for me to forgive and accept him back he can also help you contact ancientspiritspellcast@gmail.com
Website ancientspellcast.wordpress.com WhatsApp: +2347070518515
I’m truly grateful for my healing journey. After struggling with herpes for a long time, I can confidently say I’ve experienced a major turnaround in my health by. Dr Ahonsie The symptoms that once caused me discomfort and worry are now gone, and I feel stronger and healthier than ever. This experience has restored my hope and given me a new sense of peace by. Dr Ahonsie I’m thankful for the support, care, and steps I took that led me to this point. Healing is possible, and I’m living proof of that. Doctor’s contact: .Email: drahonsie00@gmail.com or whatsapp +2348039482367
“In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: Recoverycapital@fastservice.com
Phone CALL/Text Number: +1 (336) 390-6684 Contact: Capitalcryptorecover@zohomail.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Hello my name is Sally my fiancé broke up with me last week i was so sad I changed completely, I wasn’t eating and i wasn’t talking to anybody, I cried a lot, I was so depressed and stressed out that I was scared I’m going to end up in the hospital because of all the stress and depression until one day i search online on getting love tips because I Love & care about him deeply and I just want us to be together as a couple again and I want us to last forever then i found a powerful spell caster Called Priest Ade that he solved so many relationship problem then Priest Ade told me he will come back to me between 24hrs after he cast spell on him never believe it until my fiancé called me on the phone and told me he want us to come back and live happily together forever , Am so happy now that Priest Ade help me bring my finance back to me. Thanks so much Priest Ade he can also help you Email him at ancientspiritspellcast@gmail.com
Website ancientspellcast.wordpress.com WhatsApp: +2347070518515
God bless Capital Crypto Recover Services for the marvelous work you did in my life, I have learned the hard way that even the most sensible investors can fall victim to scams. When my USD was stolen, for anyone who has fallen victim to one of the bitcoin binary investment scams that are currently ongoing, I felt betrayal and upset. But then I was reading a post on site when I saw a testimony of Wendy Taylor online who recommended that Capital Crypto Recovery has helped her recover scammed funds within 24 hours. after reaching out to this cyber security firm that was able to help me recover my stolen digital assets and bitcoin. I’m genuinely blown away by their amazing service and professionalism. I never imagined I’d be able to get my money back until I complained to Capital Crypto Recovery Services about my difficulties and gave all of the necessary paperwork. I was astounded that it took them 12 hours to reclaim my stolen money back. Without a doubt, my USDT assets were successfully recovered from the scam platform, Thank you so much Sir, I strongly recommend Capital Crypto Recover for any of your bitcoin recovery, digital funds recovery, hacking, and cybersecurity concerns.
You reach them Call/Text Number +1 (336)390-6684
His Email: Capitalcryptorecover@zohomail.com
Contact Telegram: Capitalcryptorecover Via Contact: Recoverycapitalfastservice.com
His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Exactly after 2weeks I met Dr. Oyagu , he got me cured from my 3 years of silent pains, i just needed to get the items and he got the medicines prepared and sent to me through UPS, I followed his prescriptions and daily routine prayers and the end seems like a miracle that I was totally cured of my HSV2 herpes disease, I was totally cured from my Genital Herpes within a short period of time which was just 2weeks . Doctor Oyagu is so powerful and genuine man, his herbal medicine works for real, I used his herbal medicine and I confirmed it…. very effective herbal medicine for eliminating herpes virus forever is what Doctor Oyagu do make. I’m so glad to have contacted doctor Oyagu for help and here I’m today totally cured from HSV2. Thank you so much Dr. Oyagu and God bless you for all you’ve done for me, I’ll keep testifying about your good work and how powerful and effective your herbal medicine is in eradicating the Herpes Simplex Virus. Doctor Oyagu can be reached on WhatsApp with his contact number: +2348101755322. He is also available on EMAIL: oyaguherbalhome@gmail.com or website oyaguspellcaster.wixsite.com/oyaguherbalhome
I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery’s commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact Recoverycapital@fastservice.com and on Telegram OR Call Number +1 (336)390-6684 via email: Capitalcryptorecover@zohomail.com you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery’s commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact Recoverycapital@fastservice.com and on Telegram OR Call Number +1 (336)390-6684 via email: Capitalcryptorecover@zohomail.com you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1