Social engineering – hacking humans if you will – it’s one of those sexy topics that comes up from time to time, usually from a warning.. “Beware of the social engineers!”. But what is it?
Logan and I did two podcast episodes on social engineering. Part one goes into the different tactics used by social engineers. The more we talk about what they are, the more we can protect ourselves from using social engineering against us in a malicious way. And who knows, maybe we can get an upgrade using it ourselves?
Let’s start by breaking it down a bit.
Social engineering focuses on the targeting of people, versus computers, and it primarily relies on individuals or groups of people breaking security procedures, policies, and rules. Really, a social engineer’s job is to find and exploit human weaknesses and behaviors to accomplish their goals. This can be done in person, over the phone, text message, email, or really any method where you can engage with the target. It requires a good understanding of human behavior and human weaknesses – you want to persuade your target to provide information or access that will allow you to succeed in your goals, such a during a penetration or “Red Team” test.
Now let’s take a look at some tactics used by social engineers. Let’s also note that these are primarily focused on those in the sense of performing a penetration test.
- Trust: trust is at the foundation of most social engineering attacks. The easiest way to get someone to do what you want is to build trust. And remember, most individuals unconsciously want to trust others – we really do tend to think the best of others.
- Reciprocation: this is going to rely on the target feeling indebted to you, or that they need to return a favor.
- Authority: focuses on making the target believe you have the power or right to ask them to perform actions or provide information. Think about how official someone looks when they’re walking around with a clipboard (and some confidence!).
- Urgency: this is the sense that an action needs to be performed – now (or else).
- Fear: fear that something will go wrong, or that the target would be punished if they do not respond or help in some way.
- Likeness or similarity: people want to belong, they want to feel liked; finding a common denominator with your target is a simple means of building trust. Does your target love the Chicago Blackhawks? Wear a Blackhawks shirt (and make sure you know at least some of their history or some unique facts).
- Social proof: this relies on persuading your target that they should do something because other people have behaved similarly. Think of it like guilt-ing someone into doing something “because everyone else does it”.
- Scarcity: this is related to a fear-based approach, but focuses on there being fewer rewards or opportunities, requiring someone to act fast. Anyone remember the Great Toilet Paper Scare of 2020?
- Helpful nature: my personal favorite, this is people’s inherent nature to be good people and to help others.
Now that we’ve addressed some of the tactics of performing social engineering – let’s break it down into in-person vs. computer based social engineering. Each method is going to require a different skill set, but both are going to require a good understanding of the target.
In-person social engineering provides us with the ability to read our target’s body language and use that to our advantage (or disadvantage). Some of the more well-known methods of it include:
- Elicitation: by definition, elicitation is getting information without directly asking for it. Magic. Right? Well, not exactly. Typically, asking for information directly can cause suspicious. If someone asked you what your password was you’d probably tell them off, wouldn’t you? Well, what if they ask you about your pets, or ask when your birthday is, or where you’re from? Those are somewhat innocuous questions that could arise throughout a normal conversation, but they provide quite a bit of personal information. Elicitation is all about asking questions or talking about seemingly unrelated topics that are used to lead a person to reveal the information you are looking for. One of the best ways to do this is through open-ended questions or leading questions.
- Interrogation and Interviews: interrogation questions typically involve you (the social engineer), asking most, if not all, of the questions which is also likely to make the target less comfortable. Interview question, on the other hand, typically put a person at more ease. Think about the difference between a cop show and an interview on an Anthony Bourdain episode.
- Impersonation: essentially, disguising yourself as another person to gain access to facilities or resources. This could involve claiming to be a staff member or wearing a uniform and presenting a false or cloned badge or ID.
- Shoulder surfing: this is truly just watching over someone’s shoulder to get information like passwords or access codes. I see this at coffee shops when I set up behind another table and can watch everything that person is doing, watching people enter their cell phone passwords, or even in an office building when someone swipes their badge and enters a pin. Sometimes you don’t need to be a cyber nerd that cracks passwords when you can just watch someone enter it themselves.
Social engineering over a computer allows us a little more flexibility (in methods, timing, targets, etc.). Instead of spending hours looking for a potential software vulnerability to exploit, like in the case of a “hacker”, a social engineer is more likely to pose as a support technician and trick an employee into giving them their login credentials.
- Bating: this involves leaving something for someone to find, relying on an individuals curiosity. For example, leaving a USB thumb drive (or two or three), that is loaded with malware of course, in a commercial parking lot, waiting for someone to see it and plug into their computer to see what’s on it, thus injecting malware into the computer/network. Bonus points for labeling the USB thumb drive with “Confidential” or “Bonuses”.
- Phishing: probably one of the most prevalent methods of obtaining information from an unwitting victim. All it requires is ending an email to a target, sometimes with a link to clink or an attachment to download, or simply questions to answer.
- Email hacking or contact spamming: how much more likely are you to read an email that is coming from someone you know? A lot, I’d assume. This is something we see coming from criminals who have gained access into an email account and then proceed to send out mass emails to the entire contacts list, hoping to then compromise additional accounts.
- Watering-Hole: compromising a website by modifying its code to include malware. This can be done on the code of the site itself, or code from ads or plug-ins. Now, when a target accesses that site, the site will be laced with malware unbeknownst to the target.
- Cloned website: Just as it sounds, creating a replica, aka clone, of a website. It will appear to be a real website, but it will instead capture any data that is entered and either pass it along to the real website (while keeping a cope of it for the attacker), or by redirecting the user elsewhere. This is a great way for obtaining login credentials, and as easy as copying and saving the code and then using a tool such as Social Engineering Toolkit.
Social engineering is always malicious. Penetration Testers and Red Teamers use it all the time in their attempts to compromise a site or network. I’ve seen it used at bars, at the airport, or anywhere someone is just trying to get something for a discounted price. Negotiation is social engineering to an extent. Want to get someone’s number at a bar, use some of the tactics I mentioned above. But remember, it’s going to take practice to get it “right”, you want it to feel natural. And yes, the “bad guys” use it all the time, and we should be able to recognize when someone is trying to social engineer us.
Originally posted on www.allymarie.net
1284 comments
My name is Max Kai, and I’m from the USA. I was deeply in love with a woman, and even after I found out she was cheating on me, I still wanted to make things work. Unfortunately, she chose to stay with the person she cheated with, and that broke me. About six weeks later, I came across a post on a relationship forum about a spell caster named Dr. Masako who helps people reconnect with lost love through love spells. With nothing left to lose, I decided to reach out to him via WhatsApp and shared my story. To my surprise, within just 24 hours, Dr. Masako helped bring my ex back into my life and now, we’re engaged and planning our wedding. I honestly didn’t expect this to work, but it did. If you’re going through something similar and need help getting your ex back, I highly recommend contacting Dr. Masako. You can reach him on WhatsApp at +2349047144277, email him at doctormasako@gmail.com, or visit his website: doctormasako2.wixsite.com/drmasakospelltemple
I tested positive for HSV-2 a few months ago. At first, yes, I was devastated thinking I have an incurable STD for life. After doing hours of research I quickly realized genital herpes is a filthy parasite that just likes to hide in your body. Yes, there’s no “medical cure” but that doesn’t mean your body can’t get rid of it. I literally flush it out of my system with the help of Dr.Ehi natural herbal medicine which I ordered after doing some research. And now I’m HSV-2 Negative, I never believed it until my doctor finally gave me the test results and behold I was HSV free. I’m so glad that I found you Dr. Ehi. Thanks so much for your goodness I’m grateful. You can also get your help from him via email: herbalistehichoya@yahoo.com or WhatsApp +2347045844599 . Make order on website :https://herbalistehichoya.wixsite.com/herbs-is-devine thank you
Hello I`m very happy today with my family. My name is Violet Barnes, and I live in the United Kingdom. My husband left me for a good 3 years now, and I love him so much, I have been looking for a way to get him back since then. I have tried many options but he did not come back, until I met a friend that darted me to Dr Peter, a spell caster, who helped me to bring back my husband after 24 hours. My husband and I are living happily together today, That man is great, Now I will advise any serious persons that found themselves in this kind of problem to contact him now for a fast solution without stress.. contact him now on his email (drpeterspellcaster21@gmail.com) or WhatsApp: +2348162247974
drpeterspellcaster.wixsite.com/my-site-1
https://64a92941614d1.site123.me/
https://drpeterspellcaster.godaddysites.com/
REAL AND BEST 2025 SPELL CASTER TO BRING BACK MY EX LOVER
Hello everyone my names are ALEX JACKSON from the UK, I want to use this golden medium to appreciate Doctor Abdul a great spell caster for helping me retrieving back my relationship with my ex lover when he ended and turned back on me for quite a long time now (6 months ago). He performed a spell for me and within 48 hours after the spell had been cast I received a text from my ex saying that he is sorry for the pains and tears that he had caused me and that he will not do such a thing to me again in his life. I was surprised but later accepted him back again. Anyone that is in the same line of problem or different one that wants to contact a spell caster should happily contact Doctor Abdul now on this email doctorabdulspellcaster@gmail. com or message him through his Whatsapp +2348108728256
I started a healing journey with Dr EHIMARE for 4weeks because I had a chronic infection . He is absolutely the best! He recognizes every ability and modifies for all his patients . I love his page on Instagram and is so informative about health issues. I was at the 3rd week of my healing journey when I decided to go for a test with out him knowing. I was shocked, my dr was also shocked , and tears of joy rolled down from eyes. Because am free from the deadly infection.
CONTACT HE TODAY 👇🏿
https://linktr.ee/doctorehimare
Hello everyone, I was infected with the HSV 2 virus and I got cured from the HSV 2 virus a few months ago after I contacted Dr Zack Balo, I saw a post on the internet after I have seek healing for several years from different doctors in California. I sent Dr Zack Balo a request for help, just a few emails. I followed his instructions and he sent me the herbal medication after I paid him. Now I am negative and I referred him to my friend who had this same sickness and she is cured too. You can contact him via email: wiseindividualspell@yahoo.com or call/text him on WhatsApp +2348129592997.
I URGENTLY NEED A LOVE SPELL CASTER TO HELP ME GET MY EX BACK CONTACT (DR DAVID) AWESOMESPELLTEMPLE@YAHOO.COM OR +2347051149457 I want to share my wonderful testimony how I got back my husband back, who I sworn ever to be with until when he left me to another woman for no reason and I try to make things work for both of us yet things were getting worse and I love him so much and there is nothing I could do to get my husband back until I saw a testimony share by a woman called Rachel from Florida on the internet talking about a powerful spell caster who brought her husband back within 24 hours and I decide to give it a try and to my greatest surprise he also did it for me just as he did for Rachel and I have a lot of people complaining of fake spell caster but this one I met was a real spell caster who help me to solve my problem I have no solution to, I introduce many of my best friends that have a similar problems, and their problem were solve with the great help of DR David, who help them to get back their lovers within 24 hours. I am so happy that my husband is back to me again, and the most surprising thing is that our love is very strong, every day is happiness and joy. and There is nothing like being with the man you love. I am so happy my love is back to me with the help of DR David . if you have similar problem I will advise you to contact him ,he is there to help you and put a smile on your face as he did to me and others you can also WhatsApp him +2347051149457 or Email him at :awesomenesspelltemple@gmail.com or view his website for more review: https://63e1caad0959a.site123.me/
Hello everyone i am here to share this wonderful experience with you all of how i got a permanent cure to my herpes virus 1/2 with help of this great man dr udebhulu who uses his natural born talent to eradicate this terrible virus with his natural herbal cure medicine at first i didn’t believe this until i got tested free of my long suffering herpes virus and now i’m here sharing this great and amazing testimony to the world and if you are out there with this same health issue i urge you to contact dr udebhulu here drudebhuluherbalhome@gmail.com or call +2349032276724 And also he specializes in curing ENDOMETRIOSIS, PCOS, OVARIAN CYST, INFERTILITY, DIABETES 1/2, HEPATITIS A,B,C, COLD SORE, FIBROID, MULTIPLE SCLEROSIS, URTICARIA HIVES & ANGIOEDEMA, HANTAVIRUS, CANCER of all kinds, and so many other infections and diseases
Herpes was more than just a condition for me, it was something that affected every part of my life. I avoided relationships, I felt ashamed, and I was constantly anxious about the next outbreak. Doctors told me I could only manage it, but never fully heal. With Dr. Agbaka’s herbal medicine, my story changed. The process was natural and kind to my body. Over time, the outbreaks completely stopped, and I felt my health and energy come back completely cured. It’s hard to explain the relief of finally feeling free, but I am so grateful for it always, he’s still there now. his handle on email; agbakaherbalhome@gmail.com & WhatsApp +18033418845
To everyone around this world, I’m telling you all about the great and powerful spellcaster DR SPIRITUAL SPELL CASTER the almighty man. My boyfriend left me 6 months ago all because he saw my ex-boyfriend send me a message thinking I was cheating on him, so he left me alone I have begged him and done all I can do yet he hasn’t come back I have almost got frustrated all because he left me a day can’t go without I didn’t think about him because we share our thought together. One day I was browsing on the internet when I saw the great testimonies about DR SPIRITUAL SPELL CASTER and I went through them and saw his spiritual powerful works, it was fantastic. I made up my mind to send him a message so that he could help me bring my boyfriend back, so luckily he did everything he told me and returned my boyfriend within 24 hours. Now my boyfriend and I are living a good life. DR SPIRITUAL SPELL CASTER thank you so much, sir. His WHATSAPP: +2347046030096 Email: drisaspellcaster@gmail.com
WEBSITES: https://drisaspellcaster.wixsite.com/dr-isa