‫Social engineering terminologies and techniques.
‫Hackers, ethical hackers or pen testers use social engineering tactics because it's usually easier
‫to exploit people than it is to discover ways to hack the software.
‫For example, it's much easier to fool someone into giving you their password than it is for you to
‫try hacking their passwords.
‫Social engineering is psychological manipulation of people into performing actions or divulging confidential
‫information.
‫The types of information that you seek can vary, but you usually try to trick the targeted victim into
‫giving you their passwords or bank information or access to their computer to secretly install malicious
‫software that will give you access to their passwords and sensitive information.
‫As well as giving you control over their computers, you usually use the human relations and the intentions
‫of the people in social engineering attacks.
‫If you have enough information about the company, send a phishing emails to the victims as the employer
‫instead of someone they don't know.
‫You won't believe the results in a social engineering attack.
‫You get the best results if you use the fear and curiosity of the victims.
‫Scare them, there is abnormal traffic from your computer to the others.
‫It's probably a worm trying to spread.
‫Have you ever visited a website that you shouldn't or downloaded something that you shouldn't trust
‫or make them curious?
‫Prepare a CD.
‫Drop it next to the victim accidentally.
‫And curiosity killed the cat.
‫Let's explain why the human being is always under attack with the writings of Rick Ferguson, who's
‫the director of security research and communications at Microsoft.
‫People are always the weakest link in information security.
‫You can deploy all the technology you want, but people simply cannot be programmed and can't be anticipated.
‫As long as an attacker makes their delivery vehicle credible enough, a target is likely to click the
‫link or open the file.
‫The bugs in the human hardware are exploited in various combinations to create attack techniques, some
‫of which are listed on this slide.
‫Let's talk about the most famous techniques briefly.
‫Shoulder surfing is simply the technique used to obtain confidential data, such as pin numbers and
‫passwords by observing the information without getting the victim's attention.
‫For example, by looking over the victim's shoulder, this attack can be performed either at close range
‫by directly looking over the victim's shoulder or from a longer range by, for example, using a pair
‫of binoculars or similar hardware.
‫Shoulder surfing is likely to be performed best in crowded places because it's easy to observe the information
‫without getting the victim's attention.
‫Dumpster diving, also known as trashing, is another popular method of social engineering.
‫It's briefly looking for valuable things in someone else's waste bin.
‫A huge amount of information can be collected through company dumpsters, company phone books, organizational
‫charts, company policy manuals, calendars of meetings, events and vacations, system manuals, printouts
‫of sensitive data or login names and passwords, printouts of source code, etc. All of this information
‫can be used to assist a social engineering attack to gain access to the target company's network.
‫The dictionary meaning of tailgating is to drive to closely behind another vehicle.
‫But as a social engineering attack technique, tailgating is seeking entry to a restricted area secured
‫by unattended electronic access control, for example, by an RFID card.
‫In this technique, you simply walk in behind a person who has legitimate access following common courtesy.
‫The legitimate person will usually hold the door open for you, or you yourself may ask the employee
‫to hold it open for you.
‫The legitimate person may fail to ask for identification for any of several reasons, or may accept
‫an assertion that the attacker has forgotten or lost the appropriate identity token.
‫You may also fake the action of presenting an identity token or the action of looking through your pockets
‫to find your identity token.
‫During this course, we will see fishing in detail.
‫For now, let's just talk about the concept in a phishing attack.
‫Typically, the attacker sends an email that appears to come from a legitimate business a bank, a credit
‫card company requesting verification of information and warning of some terrible consequences if it's
‫not provided.
‫The email usually contains a link to a fraudulent web page that seems legitimate with company logos
‫and content, and has a form requesting everything from a home address to an ATM cards pin or a credit
‫card number.