Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
I’m the happiest man on earth today. SPIRITUAL UYI has made me believe that it is good to keep trying. My marriage of nine years was almost over. I got married to my wife nine years ago and we both have two kids. We were living happily together until my wife was transferred to another city to work, That was how all the problems started coming up. When she was first transferred we always talk when she’s on break or closed hours, Sometimes she does come to the house and spend the weekend with us. After some months things started slowly going down and the communication started dying off, She didn’t come to the house again nor respond to calls. Now if I call my wife to check up on her she will start coming up with all kinds of excuses. All this worried my mind and kept me in deep pains. So one day I had to travel to the city where she works. I got to her home address she gave me when I got there, I rang the door, When the door was open I saw my wife with just a towel and what shocked me was seeing another man lying in bed fully naked. This broke my heart and I walked away. After some months have passed my wife never even cared to call me, That is when I now said to myself that this is not ordinary. I came to the internet to look for help. That is how I came across SPIRITUAL UYI who helped restore peace in my home today. The man I saw with my wife was a co-worker who used spiritual power to lock my wife for her to forget everything about us. But with the help of i was able to get back my wife, SPIRITUAL UYI did best magic spell that brought back my wife to me. You contact him Via WhatsApp/Viber: +234 8169844860 OR E-Mail: spiritualuyi@gmail.com
Having recently Been cured permanently of Herpes Simplex Virus type 1 and Hepatitis, I felt the urge to write this Little article for Others to read since it has become a Pin in the neck especially in The US and our Government are doing Absolutely nothing about the constant widespread of the virus but Only Producing Meds That will never cure the Virus but can Cause Severe life damaging Effects to An individual. Thanks to Doctor RAZOR herbal medicines , I found out Doctor RAZOR Herbal medicine is very much Effective and Helps in completely Obliterating Every Virus. Not everybody Alive has been Opportune to be cured of this Virus. I am very delighted to Write this appreciation Testimony Concerning HERBALIST RAZOR For coming to my aid, God guide and bless you sir, Please continue your Good work, The World will Get to Know about you Sir!!. Contact DOCTOR RAZOR on Email : drrazorherbalhome@gmail.com . Contact DOCTOR RAZOR Through WhatsApp/Tel DOCTOR RAZOR on +2349065420442. Visit his Website https://herbalistrazorherb.wixsite.com/drrazorherbalhome to Place your Order for his Herbal Products and watch your health Change for the Better…
Having recently Been cured permanently of Herpes Simplex Virus type 1 and Hepatitis, I felt the urge to write this Little article for Others to read since it has become a Pin in the neck especially in The US and our Government are doing Absolutely nothing about the constant widespread of the virus but Only Producing Meds That will never cure the Virus but can Cause Severe life damaging Effects to An individual. Thanks to Doctor RAZOR herbal medicines , I found out Doctor RAZOR Herbal medicine is very much Effective and Helps in completely Obliterating Every Virus. Not everybody Alive has been Opportune to be cured of this Virus. I am very delighted to Write this appreciation Testimony Concerning HERBALIST RAZOR For coming to my aid, God guide and bless you sir, Please continue your Good work, The World will Get to Know about you Sir!!. Contact DOCTOR RAZOR on Email : drrazorherbalhome@gmail.com . Contact DOCTOR RAZOR Through WhatsApp/Tel DOCTOR RAZOR on +2349065420442. Visit his Website https://herbalistrazorherb.wixsite.com/drrazorherbalhome to Place your Order for his Herbal Products and watch your health Change for the Better.
If you have been looking for ways to naturally get rid of the herpes simplex virus from your body totally, Then you are welcome to read further. Let’s face reality here, You have tried so many counter drugs and you are confused, weak and angry because nothing seems to work. Good News For you my friend…. Yes, I came with good news that will liberate you from the pains and stress of the herpes outbreak, You will get a total cure from this virus using Dr Ikpoko Herbal Medication. He researched and identified some herbs and established a unique methodology to healing the human body using Herbal medicine that was confidently entrenched in his over 26years of experience. According to him, He has the cure for so many diseases/virus like GENITAL HERPES, HIV, DIABETES, CANCER, HPV, HSV1&2, GENITAL WART, SHINGLES, VIRGINAL INFECTION and so many more. You can reach Dr Ikpoko on his email: drikpoko@gmail.com or web: https://drikpoko.wixsite.com/herbs. I am using this medium to inform everyone how to get treated of herpes using Dr Ikpoko on YouTube recommended Herbal medication.
I’m here to testify about the great work Dr Aba did for me. I have been suffering from (HERPES) disease for the past 5 years and had constant pain, especially in my knees. During the first year, I had faith in God that i would be healed someday.This disease started circulating all over my body and i have been taking treatment from my doctor, few weeks ago i came across a testimony of one lady on the internet testifying about a Man called Dr Aba on how he cured her from Herpes Simplex Virus. And she also gave the email address of this man and advise anybody to contact him for help for any kind of sickness that he would be of help, so I emailed him telling him about my (HERPES Virus) he told me not to worry that i was going to be cured!! Well i never believed it,, well after all the procedures and remedy given to me by this man few weeks later i started experiencing changes all over me as Dr Aba assured me that i will be cured,after some time i went to my doctor to confirmed if i have be finally healed behold it was TRUE, So friends my advise is if you have such sickness or any other at all you can contact Dr Aba via email dr.abaherbalhome@gmail.com You can also call or whatsApp his telephone number on +2348107155060. Thanks once again Dr Aba.
If you have been looking for ways to naturally get rid of the herpes simplex virus from your body totally, Then you are welcome to read further. Let’s face reality here, You have tried so many counter drugs and you are confused, weak and angry because nothing seems to work. Good News For you my friend…. Yes, I came with good news that will liberate you from the pains and stress of the herpes outbreak, You will get a total cure from this virus using Dr Ikpoko Herbal Medication. He researched and identified some herbs and established a unique methodology to healing the human body using Herbal medicine that was confidently entrenched in his over 26years of experience. According to him, He has the cure for so many diseases/virus like GENITAL HERPES, HIV, DIABETES, CANCER, HPV, HSV1&2, GENITAL WART, SHINGLES, VIRGINAL INFECTION and so many more. You can reach Dr Ikpoko on his email: drikpoko@gmail.com or web: https://drikpoko.wixsite.com/herbs. I am using this medium to inform everyone how to get treated of herpes using Dr Ikpoko on YouTube recommended Herbal medication.
My husband started acting strange these past few weeks. He glued himself to his phone day and night. Hid the screen when I walked by. Laughed at secret texts. Stayed up late scrolling. My gut screamed something was wrong. I could not shake the doubt. So I dug online for ways to check his phone. No passwords. No traces left behind. Searched for hours. Found real help fast. A cyber pro named 77cyberspy @ g mail . com stepped in. He cracked full access in no time. No alerts. No mess. I peeked at chats, pics, calls. Proof hit hard. The guy cheats like a dog. Lies piled up. Other women. Dates hidden. Heart broke, but truth freed me. 77cyberspy @ g mail . com, you saved my life. True hero.
AN AMAZING REMEDY FOR HSV 1 & 2. It’s so unbelievable how wonderful herbs can be. when I first saw a post that said that a man have a perfect cure for HSV 1&2, i was like could this be real or some kind of scam but due to my eagerness to be cured I took the risk of contacting him, he gave me reasons to believe he is a real herbalist so I followed all his instructions on how to take the drugs for 14 days and now all my test results shows HSV 1&2 (-) negative , Dr Aba have the most safe cure for herpes and other stubborn virus which are HSV 1&2,STI,STD just name it he has the cure for them all. Contact him via his personal email address which is dr.abaherbalhome@gmail.com . Trust me you will like this method, it’s safe, cheap and easy. Do well to let others know about this.
God bless Dr. Aba for his marvelous work in my life, I was diagnosed of HERPES since 2019 and I was taking my medications, I wasn’t satisfied i needed to get the HERPES out of my system, I searched about some possible cure for HERPES and i saw a comment about Dr. Aba how he cured HERPES, DIABETES, HEPATITIS B and CANCER with his herbal medicine, I contacted him and he guided me. I asked for solutions, he started the remedy for my health, he sent me the herbal medicine through DHL. I took the medicine as prescribed by him and 14days later i was cured from HERPES, Dr. Aba truly you are world greatest herbal doctor, do you need his help also? Why don’t you contact him today through his email address: dr.abaherbalhome@gmail.com and his WhatsApp phone number +2348107155060
It’s obvious some patients with herpes are being enslaved to the antiviral and other supplementary Orthodox medicine just to help suppress the virus and not a cure. I have been with the virus since 2020 until I was introduced by a blogger who also narrated her story online on how she was cured of Genital Herpes after using Dr Kano Herbal Medicine. This is a year and 2 weeks since I was delivered from genital Herpes. All thanks to God for using this Great herbalist to heal me. I have promised to keep telling good things about Dr Kano. Please feel free to share Your problems with him and don’t forget to tell him I did refer you to Him. Thanks. Write him on mail drkanopureherbalhome@gmail.com He deals with Alzheimer virus, Cancer, HIV, Herpes, Genital, warts, ALS, BV, UTI, Virginal infection, Genital, Wart, HPV, Hepatitis A/B, Good luck, HSV, Pregnancy, Ex back. here is his WhatsApp number: +2348164749895