Social Engineering Overview | Mind Attacks

Social Engineering Overview | Mind Attacks

What is social engineering?According to Wiki:"In the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud scheme." According to OWASP:"Social engineering attacks are are typically carried out by email or by contacting users by phone and impersonating an authorized user, in an attempt to gain unauthorized access to a system or application." According to  my Security Researcher friend:

1. Social Engineering is being a good actor.
2. Social Engineering is getting information by lying to other people.

 Simple and Easy ways to Perform Social Engineering Attacks:Example Attack 1:You can just walk to the front desk and ask, "Who is you System Administrator?" If the staff said, "Sir Francis Al Victoriano is our System Administrator and you can find him at room 321," then you find this man and say, "Hi sir, we have a Security Service to apply to your Server. Can I get to your computer and test it? While you're waiting, you can take a break at the canteen." If the server admins leave, you can take advantage and steal information.Example Attack 2: Our target is a high-profile website. You need a non suspicious email, but try to use an email by finding the web hosting of that website. For example, they're using web hosting at gomommy.com. You can use or buy a slightly similar domain name, like gomommyy.com. As you can see, I used a double y.You can send an email and try to ask this Server Admin of gomommy.com if you can reset you Cpanel password to 1234qwerty. If you notice the admin of the website is careless, you can get him. Types of Attacks:

1. Direct Approach
2. See Important Users
3. Technical Support
4. Email Attacks
5. Social Media: Facebook/Twitter/LinkedIn
6. Phishing Attacks
7. IVR and Robocalls for Credit Card Information

 Social Media Testing Guide:

1. Protect your identity: use proxies and use other internet connections like Free WiFi to avoid tracking.
2. Create a fake email and Facebook account. Use an interesting account, like GIRL, BEAUTIFUL PICTURES, SINGLE, 21-23 YEARS OLD.
3. Select the victim and know her/his friends or family before sending an invitation to her/him.
4. Become the victim's friend. Chat and become close to her/him and get some sensitive info. Then, download photos and maybe use an infected site and post to her chat box.

 Detecting and Stopping Attacks:

1. Someone pressures you to do something quickly, be suspicious.
2. Someone is asking you for important information
3. Someone sends you an email that says you won a million dollars and to send them your bank details.

 Preventing Attacks:

1. Never share your password
2. Verify contacts
3. Educate staff
4. Do not post personal information on any social media

 All you need is PATIENCE. Please note: this information is for educational purposes only. Resources:

• https://en.wikipedia.org/wiki/Social_engineering_%28security%29
• https://www.owasp.org/index.php/Social_Engineering

 Regards from:Philippine Security Researcher