All right, social engineering.
When you can, you go after the human
because they're the weak link in the security chain, always.
Humans are not always programmed, don't always act as programmed.
And if there's a process or procedure to
be followed, the human is the one that actually typically carries that out.
So most of your security issues involve humans.
Hate to say it, but that's just the way it is.
So social engineering is manipulating a
human to give up access to information versus trying to attack a system directly.
It's manipulation, con artistry, grifting, etc.
Pulling on hard strings, scarcity, authority attacks,
a variety of psychological traits are attacked through social engineering.
Impersonation, for example.
I'm impersonating a legitimate user.
I could pose as a legitimate end user.
I could pose as an important user.
Vishing is voice phishing or over the phone.
Ring, ring, phone rings.
Hi, this is desk support or the home office or whatever, and you
think you're talking to a legitimate employee or help desk or so
forth and you're not, it's an impersonation attack.
That's social engineering, voice phishing, and a lot of variants of that.
The scams about un filed tax returns and
things like that, those are also examples of phishing.
Our eaves dropping, shoulder
surfing and dumpster diving are pretty straightforward.
We know that eaves dropping is listening in on a conversation.
We know what shoulder surfing is looking
over somebody's shoulder when they type in a password.
Then dumpster diving is looking for something useful in the trash, which
people invariably throw things away that should be destroyed before they're thrown
away, jotted down passwords, internal memos, corporate phone directories, etc.
All potentially useful to an attacker.
Reversed social engineering, piggybacking and tailgating.
Reversed social engineering is where I break something, sabotage something of
yours, and then I advertise myself as somebody who can be assistive in helping
fix your broken resource, whatever that is that I broke to begin with.
The attacker presents themselves an authority and the target seeks their
advice because after all, they can help them with their problem.
Piggybacking and tailgating is following
somebody through a badged entrance without a valid ID.
Then hoax letters, instant chat messenger and spam email.
Pretty straightforward, but a hoax is, for
example, warning, nasty virus floating around.
Install this patch and your system will be protected.
This patch that's included as an
attachment or download link is actually the malware itself.
Instant chat messenger, spam email.
I think everybody knows what spam is.
Quite often that is definitely not from who we think it's from.
Then instant chat messenger is just social
engineering through an instant chat session, which you can transfer files and
give screen control and all sorts of crazy stuff through instant chat.
So really, any way I can communicate with
the human is a potential social engineering manipulation channel.
Attack fishing.
All right, fishing.
An email that is meant to elicit useful information from the victim.
A lot of times look really legitimate.
A lot of times they look really horrible.
It's like, really, is that your best effort?
But phishing will typically impersonate a legitimate company.
A lot of times they have links to fake web pages that gather user credentials.
You'll be playing with that in a lab with the Social Engineering toolkit.
Good stuff.
Credential Harvesting and Type of Squadding.
Credential Harvesting, you're stealing
credentials from a login request, typically through a phishing email, which
again, you're going to be doing a lab on that.
Then typo squatting is registering domain
names that are intentionally misspelled versions of well known websites
to send unsuspecting visitors to malicious websites.
You've got facebick.
Com or Facebook with three Os or whatever
where somebody mistypes, they visit the malicious version of the site
and you capture credentials or malicious downloads or whatever.
The elicitation is extracting the
information for the victim by drawing them into normal and disarming conversations.
Cover stories, plans may even need to involve conspirators.
So your use of flattery, bracking, use of
false statements, in response to use that thing.
Sounding board, these are all examples of elicitation.
Identity theft, not a fun thing to clean up after, at least so I'm told.
I've had several friends over the years who had their identity stolen, credit
cards applied for in their name, tax returns, utilities, etc.
Not a fun thing to clean up after.
But identity thieves are after personally
identifiable information for some other purpose, like again,
finding a tax return or getting benefits or utilities or credit cards.
The influence campaigns are the
accumulation of tactical data by the target along with the distribution of
propaganda to gain a competitive edge over an adversary.
It's mud slinging and there's lots of
examples of that on social media these days.