Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
HOW I GOT MY HERBAL REMEDY FOR MY HERPES DISEASE
Hello, I think it is the right time for you all to know about this traditional herbal spell caster who helped me find a remedy to cure my Herpes disease. I have been a victim of herpes disease for the past 2 years. I have done everything I could to get rid of it, but it has all failed me. All thanks to Dr Isa, who came to my rescue and sent me herbal tea that I drank for 7 days, which cured me totally from suffering from my herpes disease. For those of you who need help to cure your disease should contact this traditional herbal man for help. I assure you that he will help you. WHATSAPP: +2347046030096 Contact email: drisaspellcaster@gmail.com Website: https://drisaspellcaster.wixsite.com/dr-isa
I’m still trying to put into words the incredible journey I’ve been on with Priest AZ’s guidance. A few months ago, my marriage was on the brink of collapse. The love and connection that once burned bright had flickered out, leaving only ashes and heartache. I felt lost, alone, and desperate for a solution. I tried everything to save my marriage – counseling, therapy, even pleading with my husband to stay. But no matter what I did, things only seemed to get worse. It was like we were two strangers living in the same house, unable to find our way back to each other.
That’s when I stumbled upon Priest AZ’s website, filled with stories of his powerful love spells and the countless lives he’s changed. I was skeptical at first, but something about his words resonated deep within me. Maybe it was the kindness in his tone or the sincerity in his promises, but I knew I had to reach out. From the very first conversation, Priest AZ was a beacon of hope.
He listened to me with compassion and understanding, offering words of encouragement and guidance. He helped me see that my marriage wasn’t beyond repair, that with the right tools and mindset, we could reignite the flame that once burned so bright. With Priest AZ’s love spell, I began to notice subtle changes in my husband’s behavior. He started showing interest in me again, asking about my day, and even surprising me with small gestures of affection. It was like the spell had awakened something deep within him, reminding him of the love we once shared. But the spell didn’t just stop at my husband – it also worked on me.
I began to let go of my anger, my resentment, and my fear. I started to see my husband in a new light, to appreciate the good in him, and to forgive him for his past mistakes. It wasn’t easy, and there were still moments of doubt and uncertainty. But with Priest AZ’s guidance, we were able to navigate the complexities of our situation, to confront the underlying issues that had driven us apart, and to find our way back to each other. Today, my marriage is stronger than ever. My husband and I have fallen deeply in love again, and I can honestly say that I’ve never been happier. Priest AZ’s love spell was the catalyst for our transformation, the spark that ignited the flame of our love once more.
If you’re going through a similar situation, I urge you to seek help from Priest AZ. His love spells are powerful, his guidance is invaluable, and his kindness is unwavering. Don’t give up on your marriage – don’t give up on love. Let Priest AZ help you find your way back to each other.
Contact him at Mightylovespell@gmail.com. WhatsApp: +43 680 5400 8232
I’m the happiest man on earth today. SPIRITUAL UYI has made me believe that it is good to keep trying. My marriage of nine years was almost over. I got married to my wife nine years ago and we both have two kids. We were living happily together until my wife was transferred to another city to work, That was how all the problems started coming up. When she was first transferred we always talk when she’s on break or closed hours, Sometimes she does come to the house and spend the weekend with us. After some months things started slowly going down and the communication started dying off, She didn’t come to the house again nor respond to calls. Now if I call my wife to check up on her she will start coming up with all kinds of excuses. All this worried my mind and kept me in deep pains. So one day I had to travel to the city where she works. I got to her home address she gave me when I got there, I rang the door, When the door was open I saw my wife with just a towel and what shocked me was seeing another man lying in bed fully naked. This broke my heart and I walked away. After some months have passed my wife never even cared to call me, That is when I now said to myself that this is not ordinary. I came to the internet to look for help. That is how I came across SPIRITUAL UYI who helped restore peace in my home today. The man I saw with my wife was a co-worker who used spiritual power to lock my wife for her to forget everything about us. But with the help of i was able to get back my wife, SPIRITUAL UYI did best magic spell that brought back my wife to me. You contact him Via WhatsApp/Viber: +234 8169844860 OR E-Mail: spiritualuyi@gmail.com
Hello my name is Sally my fiancé broke up with me last week i was so sad I changed completely, I wasn’t eating and i wasn’t talking to anybody, I cried a lot, I was so depressed and stressed out that I was scared I’m going to end up in the hospital because of all the stress and depression until one day i search online on getting love tips because I Love & care about him deeply and I just want us to be together as a couple again and I want us to last forever then i found a powerful spell caster Called Priest Ade that he solved so many relationship problem then Priest Ade told me he will come back to me between 24hrs after he cast spell on him never believe it until my fiancé called me on the phone and told me he want us to come back and live happily together forever , Am so happy now that Priest Ade help me bring my finance back to me. Thanks so much Priest Ade he can also help you Email him at ancientspiritspellcast@gmail.com
Website ancientspellcast.wordpress.com WhatsApp: +2348100170928
Hello my name is Sally my fiancé broke up with me last week i was so sad I changed completely, I wasn’t eating and i wasn’t talking to anybody, I cried a lot, I was so depressed and stressed out that I was scared I’m going to end up in the hospital because of all the stress and depression until one day i search online on getting love tips because I Love & care about him deeply and I just want us to be together as a couple again and I want us to last forever then i found a powerful spell caster Called Priest Ade that he solved so many relationship problem then Priest Ade told me he will come back to me between 24hrs after he cast spell on him never believe it until my fiancé called me on the phone and told me he want us to come back and live happily together forever , Am so happy now that Priest Ade help me bring my finance back to me. Thanks so much Priest Ade he can also help you Email him at ancientspiritspellcast@gmail.com
Website ancientspellcast.wordpress.com WhatsApp: +2348100170928
Appreciation to the Admins of this page, Thank you. Both HSV-1 and HSV-2 can be painful and cause discomfort to the individual suffering from it. Once you suffer from herpes, there are a lot of medications and dietary supplements sold to help relieve you from the pain God bless Dr Razor . A herbal Practitioner From West Africa who used his wisdom on Herbs to get me cured from Herpes Simplex Virus II . Yeah! I thought it was a scam as well when I first saw the recommendation post. After visiting https://herbalistrazorherb.wixsite.com/drrazorherbalhome I decided to contact him for help and he assured me he was going to help me . After a few days he sent me my herbal medicine. and gave me instructions on how to take it , I am totally glad to be completely cured of HSV 2 and having my happiness back.. Contact Dr Razor on His Tel/Whatsapp +2349065420442 Email Address : drrazorherbalhome@gmail.com
Appreciation to the Admins of this page, Thank you. Both HSV-1 and HSV-2 can be painful and cause discomfort to the individual suffering from it. Once you suffer from herpes, there are a lot of medications and dietary supplements sold to help relieve you from the pain God bless Dr Razor . A herbal Practitioner From West Africa who used his wisdom on Herbs to get me cured from Herpes Simplex Virus II . Yeah! I thought it was a scam as well when I first saw the recommendation post. After visiting https://herbalistrazorherb.wixsite.com/drrazorherbalhome I decided to contact him for help and he assured me he was going to help me . After a few days he sent me my herbal medicine. and gave me instructions on how to take it , I am totally glad to be completely cured of HSV 2 and having my happiness back.. Contact Dr Razor on His Tel/Whatsapp +2349065420442 Email Address : drrazorherbalhome@gmail.com
I was told there is No Herpes Cure except treatment to control it. I totally lost hope all i could think was loosing my life because it was so embarrassing to have this virus. A few weeks ago I read about a possible natural cure which was 100 percent guaranteed. And I ordered the treatment from Dr Uma. And I also told him about my sister’s cancer, After some weeks we got 100% cured. Now I’m so excited to share this testimony to every article for others living with HERPES, CANCER, PENIS ENLARGEMENT, HPV,HIV, etc. there is possible natural treatment to eliminate this virus. Email him for more info! Dr.umaherbalcenter@gmail.com or message him on WhatsApp +2347035619585.
My husband changed dramatically towards me, doesn’t communicate anymore. He disrespects me and accuses me falsely of infidelity because of wicked gossip …but I’m simpHow To Get Your Ex Lover/Partner/Boyfriend/Girlfriend/Wife Or Husband Back Contact Dr David awesomenesspelltemple@gmail.com or WhatsApp/Call Him +2347051149457
l AMAZED at the results of PRIEST AWESOME (AWESOME SPELL TEMPLE) who did a reunioI truly believe in the effectiveness of spells, and I want to share how Psychic Doctor David helped me during a very challenging time in my marriage. My husband and I were facing serious misunderstandings that nearly led to divorce. In my moments of despair, I found myself crying and searching for love quotes online when I stumbled upon glowing reviews of Doctor David work. Feeling hopeful, I contacted him and shared my situation. He confidently told me that my husband would return within 24 hours. I followed his advice, and to my absolute surprise, my husband came back the very next day, sincerely asking for my forgiveness and wanting to rebuild our relationship. If you’re going through similar struggles in your marriage, I encourage you to reach out to him. He truly can make a difference!
awesomenesspelltemple@gmail.com love spell for me. Everything is going so well and EXACTLY how he said it would be. Even though it took 3 days to fully progress, it was so worth it because things are just about at perfection! How he took my situation and completely turned it around to give me exactly what I wanted is beyond me, but something I will never question and just be completely grateful for. God Bless Dr. DAVID for turning sorrow into happiness. You can also contact PRIEST AWESOME : give you 100% guarantee that he will help you.. https://web.facebook.com/Awesomelovepelltemple Email him: awesomenesspelltemple@gmail.com or WhatsApp him on +2347051149457
Website: https://63e1caad0959a.site123.me/
My name is Max Kai, and I’m from the USA. I was deeply in love with a woman, and even after I found out she was cheating on me, I still wanted to make things work. Unfortunately, she chose to stay with the person she cheated with, and that broke me. About six weeks later, I came across a post on a relationship forum about a spell caster named Dr. Masako who helps people reconnect with lost love through love spells. With nothing left to lose, I decided to reach out to him via WhatsApp and shared my story. To my surprise, within just 24 hours, Dr. Masako helped bring my ex back into my life and now, we’re engaged and planning our wedding. I honestly didn’t expect this to work, but it did. If you’re going through something similar and need help getting your ex back, I highly recommend contacting Dr. Masako. You can reach him on WhatsApp at +2349047144277, email him at doctormasako@gmail.com, or visit his website: doctormasako2.wixsite.com/drmasakospelltemple