Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
DR Oyagu you are the best herbalist online no doubts. After using your herbal medication and getting cured I believed you for life and immediately my trust grew up more for you. I sincerely believe lots of people gonna despise you and blaspheme you for no reasons but they don’t know what they’re missing. You’re a powerful healer of herpes. You be my doctor forevermore for life. I rest my case .contact Dr Oyagu on his Email: oyaguherbalhome@gmail.com or via WhatsApp +2348101755322
ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH
In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team’s primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance
Phone (Call/Text): +1 (336) 390-6684
Email: Capitalcryptorecover@zohomail.com
Alternate Email: Recoverycapital@fastservice.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Being herpes positive is not the end of life and Never believe Our government who had labelled herpes as an incurable disease, Thereby generating the mindset to keep patronizing themselves and the medical pills which never cure the HSV virus.. I am delighted to be finally cured of herpes virus completely after completing the Dosage of Dr Kham Herbal Remedies for Two Weeks, I reached out to him by Email and helped me get rid of this horrible virus out of my system with the help of his herbal medicine. I recently got permanently cured of my Herpes type 2 after applying Dr Kham herbal formula for Just two weeks, I have battled this infection for 5 years and am glad that I finally defeated the virus permanently, Herbalist Dr Kham herbs is also available and placing your order now will help you out just like me and you will be the next to testify about his good work next as you contact him. You can reach him out on his Email address dr.khamcaregiver@gmail.com and his WhatsApp contact is +2348159922297, If you want more proof, Visit his Website is https://herbalistdrkhamcaregiver.simdif.com
God bless Capital Crypto Recover Services for the marvelous work you did in my life, I have learned the hard way that even the most sensible investors can fall victim to scams. When my USD was stolen, for anyone who has fallen victim to one of the bitcoin binary investment scams that are currently ongoing, I felt betrayal and upset. But then I was reading a post on site when I saw a testimony of Wendy Taylor online who recommended that Capital Crypto Recovery has helped her recover scammed funds within 24 hours. after reaching out to this cyber security firm that was able to help me recover my stolen digital assets and bitcoin. I’m genuinely blown away by their amazing service and professionalism. I never imagined I’d be able to get my money back until I complained to Capital Crypto Recovery Services about my difficulties and gave all of the necessary paperwork. I was astounded that it took them 12 hours to reclaim my stolen money back. Without a doubt, my USDT assets were successfully recovered from the scam platform, Thank you so much Sir, I strongly recommend Capital Crypto Recover for any of your bitcoin recovery, digital funds recovery, hacking, and cybersecurity concerns.
You reach them Call/Text Number +1 (336)390-6684
His Email: Capitalcryptorecover@zohomail.com
Contact Telegram: Capitalcryptorecover Via Contact: Recoverycapitalfastservice.com
His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
God bless Capital Crypto Recover Services for the marvelous work you did in my life, I have learned the hard way that even the most sensible investors can fall victim to scams. When my USD was stolen, for anyone who has fallen victim to one of the bitcoin binary investment scams that are currently ongoing, I felt betrayal and upset. But then I was reading a post on site when I saw a testimony of Wendy Taylor online who recommended that Capital Crypto Recovery has helped her recover scammed funds within 24 hours. after reaching out to this cyber security firm that was able to help me recover my stolen digital assets and bitcoin. I’m genuinely blown away by their amazing service and professionalism. I never imagined I’d be able to get my money back until I complained to Capital Crypto Recovery Services about my difficulties and gave all of the necessary paperwork. I was astounded that it took them 12 hours to reclaim my stolen money back. Without a doubt, my USDT assets were successfully recovered from the scam platform, Thank you so much Sir, I strongly recommend Capital Crypto Recover for any of your bitcoin recovery, digital funds recovery, hacking, and cybersecurity concerns.
You reach them Call/Text Number +1 (336)390-6684
His Email: Capitalcryptorecover@zohomail.com
Contact Telegram: Capitalcryptorecover Via Contact: Recoverycapitalfastservice.com
His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
DR OYAGU herbal medicine is a good remedy for herpes simplex virus cure. My name is MIGNON WRIGHT , am from USA,I am here to give my testimony about DR OYAGU who helped me in my life, i want to inform the public how i was cured from (HERPES SIMPLEX VIRUS) by DR OYAGU, i visited different hospital but they gave me list of drugs like Familiar, Zovirax, and Valtrex which is very expensive to treat the symptoms and never cured me. I was browsing through the Internet searching for remedy on HERPES and i saw comment of people talking about how DR OYAGU cured them, when i contacted him he gave me hope and send a Herbal medicine to me that i took and it seriously worked for me, am a free person now without any problem, my HERPES result came out negative, I pray to God to never let me and my family forget you in our life, am now cured permanently, you can also get your self cured my friends if you really need this doctor help, you can reach him on his website ;https://oyaguspellcaster.wixsite.com/oyaguherbalhome Email: oyaguherbalhome@gmail.com or via WhatsApp +2348101755322
“In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: Recoverycapital@fastservice.com
Phone CALL/Text Number: +1 (336) 390-6684 Contact: Capitalcryptorecover@zohomail.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
AN AMAZING REMEDY FOR HSV 1 & 2. It’s so unbelievable how wonderful herbs can be. when I first saw a post that said that a man have a perfect cure for HSV 1&2, i was like could this be real or some kind of scam but due to my eagerness to be cured I took the risk of contacting him, he gave me reasons to believe he is a real herbalist so I followed all his instructions on how to take the drugs for 14 days and now all my test results shows HSV 1&2 (-) negative , Dr Aba have the most safe cure for herpes and other stubborn virus which are HSV 1&2,STI,STD just name it he has the cure for them all. Contact him via his personal email address which is dr.abaherbalhome@gmail.com . Trust me you will like this method, it’s safe, cheap and easy. Do well to let others know about this.
“In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: Recoverycapital@fastservice.com
Phone CALL/Text Number: +1 (336) 390-6684 Contact: Capitalcryptorecover@zohomail.com
Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
Hello everyone, Words cannot describe how happy I am today after being cured from the diabetes disease that I have been suffering from for over 4 years now. I was diagnosed with diabetes and I have been living in shame and hiding it, but it became worse that I was searching for a cure from different means until I met with a lady online who was testifying about this herbal doctor called Dr oriane. Who said she got her cancer disease cured with the use of Dr oriane herbal medicine. I never believed it but I have to give it a try because I was desperately in need of a cure to the deadly disease that I have been living with. So I contacted him and we discussed how to get the cure and Dr Oriane told me that he had cured with herbal medicine which I will order for and it will be delivered to me. While I did what he wanted and to my greatest surprise the herbal medicine was delivered to me at my address which I gave to him, with instructions on how to apply it was also given to me by Dr oriane. Then i started to use herbal medicine, so after four weeks of using the herbal medicine, i saw physical changes and went for a test at two separate hospitals and i was totally cured, i am here to say thanks to you again Dr oriane for saving me from the deadly cancer disease. Anyone with such disease can also contact Dr oriane through his EMAIL: droriane6@gmail.com. or via whats app +2349031652461