Social Engineering Overview | Mind Attacks

July 3, 2015 | Views: 4537

Begin Learning Cyber Security for FREE Now!

FREE REGISTRATIONAlready a Member Login Here

Social Engineering Overview | Mind Attacks

What is social engineering?


According to Wiki:

“In the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional “con” in that it is often one of many steps in a more complex fraud scheme.”

 

According to OWASP:

“Social engineering attacks are are typically carried out by email or by contacting users by phone and impersonating an authorized user, in an attempt to gain unauthorized access to a system or application.”

 

According to  my Security Researcher friend:

  1. Social Engineering is being a good actor.
  2. Social Engineering is getting information by lying to other people.

 

Simple and Easy ways to Perform Social Engineering Attacks:

Example Attack 1:

You can just walk to the front desk and ask, “Who is you System Administrator?” If the staff said, “Sir Francis Al Victoriano is our System Administrator and you can find him at room 321,” then you find this man and say, “Hi sir, we have a Security Service to apply to your Server. Can I get to your computer and test it? While you’re waiting, you can take a break at the canteen.” If the server admins leave, you can take advantage and steal information.

Example Attack 2: 

Our target is a high-profile website. You need a non suspicious email, but try to use an email by finding the web hosting of that website. For example, they’re using web hosting at gomommy.com. You can use or buy a slightly similar domain name, like gomommyy.com. As you can see, I used a double y.

You can send an email and try to ask this Server Admin of gomommy.com if you can reset you Cpanel password to 1234qwerty. If you notice the admin of the website is careless, you can get him.

 

Types of Attacks:

  1. Direct Approach
  2. See Important Users
  3. Technical Support
  4. Email Attacks
  5. Social Media: Facebook/Twitter/LinkedIn
  6. Phishing Attacks
  7. IVR and Robocalls for Credit Card Information

 

Social Media Testing Guide:

  1. Protect your identity: use proxies and use other internet connections like Free WiFi to avoid tracking.
  2. Create a fake email and Facebook account. Use an interesting account, like GIRL, BEAUTIFUL PICTURES, SINGLE, 21-23 YEARS OLD.
  3. Select the victim and know her/his friends or family before sending an invitation to her/him.
  4. Become the victim’s friend. Chat and become close to her/him and get some sensitive info. Then, download photos and maybe use an infected site and post to her chat box.

 

Detecting and Stopping Attacks:

  1. Someone pressures you to do something quickly, be suspicious.
  2. Someone is asking you for important information
  3. Someone sends you an email that says you won a million dollars and to send them your bank details.

 

Preventing Attacks:

  1. Never share your password
  2. Verify contacts
  3. Educate staff
  4. Do not post personal information on any social media

 

All you need is PATIENCE.

Please note: this information is for educational purposes only.

 

Resources:

 

Regards from:

Philippine Security Researcher

Share with Friends
FacebookTwitterGoogle+LinkedInEmail
Use Cybytes and
Tip the Author!
Join
Share with Friends
FacebookTwitterGoogle+LinkedInEmail
Ready to share your knowledge and expertise?
7 Comments
  1. Good article. Thank you.

  2. Such a poorly researched article with extremely weak scenarios. I know this is a free resource but take pride in your work. Proof read it. Make sure your information is credible and don’t try and pretend you know something if you don’t

  3. I would like to give him a better rate.

Comment on This

You must be logged in to post a comment.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel