Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
HOW I GOT CURED FROM HERPES: I already gave up on ever getting cured of herpes because I have tried many treatment and none has work, I have gone to different hospitals they always recommend me same drugs and it not working on me, until I came across a post about DR ABA on the net from a lady who is recommending people, then i contacted him that day, and he started giving me hope and then prepared some herbal medicine which I took according to his prescription on them, so I was still doubting if it was working on me so at a time my Husband just ask me to go for check up and I did, so I found out that I was cure and free from the herpes virus, thanks to DR ABA once again. his email address is dr.abaherbalhome@gmail.com or WhatsApp him on +2348107155060
I’m the happiest man on earth today. SPIRITUAL UYI has made me believe that it is good to keep trying. My marriage of nine years was almost over. I got married to my wife nine years ago and we both have two kids. We were living happily together until my wife was transferred to another city to work, That was how all the problems started coming up. When she was first transferred we always talk when she’s on break or closed hours, Sometimes she does come to the house and spend the weekend with us. After some months things started slowly going down and the communication started dying off, She didn’t come to the house again nor respond to calls. Now if I call my wife to check up on her she will start coming up with all kinds of excuses. All this worried my mind and kept me in deep pains. So one day I had to travel to the city where she works. I got to her home address she gave me when I got there, I rang the door, When the door was open I saw my wife with just a towel and what shocked me was seeing another man lying in bed fully naked. This broke my heart and I walked away. After some months have passed my wife never even cared to call me, That is when I now said to myself that this is not ordinary. I came to the internet to look for help. That is how I came across SPIRITUAL UYI who helped restore peace in my home today. The man I saw with my wife was a co-worker who used spiritual power to lock my wife for her to forget everything about us. But with the help of i was able to get back my wife, SPIRITUAL UYI did best magic spell that brought back my wife to me. You contact him Via WhatsApp/Viber: +234 8169844860 OR E-Mail: spiritualuyi@gmail.com
Hello everyone, I was infected with the HSV 2 virus and I got cured from the HSV 2 virus a few months ago after I contacted Dr Zack Balo, I saw a post on the internet after I have seek healing for several years from different doctors in California. I sent Dr Zack Balo a request for help, just a few emails. I followed his instructions and he sent me the herbal medication after I paid him. Now I am negative and I referred him to my friend who had this same sickness and she is cured too. You can contact him via email: wiseindividualspell@gmail.com or call/text him on WhatsApp +2348129592997.
I don’t like to meddle into people’s relationship but at the same time its not appropriate the way men cheat this days and even maltreated their wives whenever confronted, it really baffle me. l was in this situation some month ago l have to search some forum then l came across this hacker via his mail: [zattechhacker @ G ma/il com] this guy really unveil somethings l can’t imagine happening in my relationship’s think it’s high time we ladies have to hire someone like Zatt pro in other to get the truth about your spouse it really help. contact him via Email: [zattechhacker @ G ma/il com ]
Knowing that the love of my life, with whom I have been in a relationship for more than ten years, may harm me so severely makes me feel very depressed right now. It all began when I became aware of his erratic behavior at home, his tardiness at work, and his online conversations with certain ladies. Despite my years of faithfulness, I never anticipated him to cheat on me, so I wasn’t sure if what I was thinking was correct. I was able to discover the reality and dispel my self-doubt when I came across numerous excellent reviews regarding Wizard James Recovery via Google Mail, a specialist who is really quick, truthful, and reliable. The Wizard James Recovery was able to remotely access his laptop and cell phones, confirming my suspicions by providing evidence of his dishonest behavior. He was able to obtain all of his text messages, call records, WhatsApp, GPS tracker, and concealed messaging on Signal and Proton mail after I reached out to him a few hours later. When I received all of this information, I was astounded since what appeared to be false was obviously real. I decided to promote and endorse Wizard James Recovery for his outstanding achievements. I want to let people know that there are genuine, trustworthy professionals who can hack mobile phones without having to go through a difficult process or pay additional fees because I’ve read a lot of unfavorable reviews about some phony IT specialists who couldn’t accomplish what they claimed to be able to. Email:: Wizardjamesrecovery@usa.com
I am so happy, I was working as a air-holstess ( cabin crew ) for Over 4 years but in 2014, i lost my job due to the fact that i tested Positive to Herpes virus (HSV), I never felt sick or have any symptom, till all workers were ask to bring their doctors report, that was how i got tested and i found out that am HSV positive that make me loose my job, because it was considered as an STD and incurable disease, i was so depressed thinking of committing suicide, Till i explain to a friend of mine, who always said to me a problem share is a problem solved, that was how she directed me to Dr Razor, that was how i contacted him and get the medication from this doctor and i got cured for real, I just went back to my work and they also carry out the test to be real sure and i was negative. Please contact this doctor if you are herpes positive or any STD diseases his email is: drrazorherbalhome@gmail.com or you can call or whatsApp his mobile number on +2349065420442. Place your order through his website : https://herbalistrazorherb.wixsite.com/drrazorherbalhome.
Hello everyone i want to use this medium to appreciate the greatest spell caster Priest Ade for restoring my broken marriage, My husband and i have been having problems for months now we use to be very sweet but all of a sudden everything changed he was now distant from me until one day he told me he wanted a divorce which left me devastated i cried my eyes out so i told my friend about all that has been going on, She introduced me to Priest Ade he told me not to worry he told me all i needed to do and he assured me that in 24 hours all that is wrong with our relationship will be fine the next day to my greatest surprise it was my husband back home apologizing I’m so happy we are closer and stronger than we have ever been, I promised to share your amazing work when i get results so this is me keeping my word, Thank you so much Priest Ade,I will leave his contact information for anyone who needs help: ancientspiritspellcast@gmail.com
Read more on his website:
https://ancientspellcast.wordpress.com
WhatsApp: +2348100170928
Even when I dated my wife for years, cohabited with her and vetted her thoroughly and ensured her family accepted me to part of them, the fact that ferminity is mallaeble came to play out in my marriage. She had some close friends who were single and most are still single till date. They had a huge influence on my wife and that alone always made us had issues. Eventually she left me and i had to seek help from SPIRITUAL UYI knowing he is capable of restoring the love and happiness we shared and to also get her back to me. I complied with everything SPIRITUAL UYI told me and my wife came back home with regrets of paying attention to fake friends and we are happy together again now. You can read about his works on his page ( https://spiritualuyi.wordpress. ) or might EMAIL>> spiritualuyi@gmail.com or via my WhatsApp on: +2348169844860
My husband filed for a divorce after 8 years of marriage it was difficult on me and the kids I did all I could to save my marriage and my family but all fail until a friend of mine told me about the wonderful work of SPIRITUAL UYI I contacted him and he assured me 24hours all will be well the next day to my greatest surprise my husband came back home and he went on his knees and was crying begging me for forgiveness I’m so happy right now thank you so much SPIRITUAL UYI, One message to him today can change your life too for the better.Email: spiritualuyi@gmail.com Read more on his website: https://spiritualuyi.wordpress. WhatsApp ? +2348169844860.
I’m so happy to testify of the good work of Dr Maggi. I have been Suffering from Herpes virus since 2018 and I had frequent symptoms in my private area, after some time it will go away after using acyclovir drugs, then come back after some months. it was disheartening since i have been diagnosed, but after finding Dr Maggi and his reviews i was convinced that he will definitely cure me and so i contacted him and he told me how to get his medicine and using it for just 14 days and i will go for check up and first i said how can that be possible but i used his herbal medicine after making purchase and truly i used it and went for the test again, and my result came back negative. So I made it a task to share this good testimony in the internet so that those sick can benefit and get cured. WhatsApp or call: +19179796387 Or Email: drmaggiherbalhome@gmail.com