There are a few very popular social engineering attacks people who have little children know these attacks
from daily life.
The first one is based on diffusion of responsibility.
This is the attack which can be tagged.
John said that he would shoulder the blame.
The fear of punishment for acting to the detriment of the company you work for such as sharing a file
starting certain applications or allowing remote access is usually enough to stop you.
However you would be more likely to fall prey to manipulation if someone assured you that there would
be no consequences attached to your actions.
This can be done by impersonating a high ranking supervisor whom the potential victim hasn't had the
chance to meet in person.
Suppose you work in the I.T. Department you know all too well.
One of the basic rules of security is not to reveal passwords during a phone conversation a situation
where someone calls the I.T. Department asking for a password that he or she forgot is unthinkable.
But how do you react if you pick up the phone and it turns out to be the director's secretary informing
you that she is about to get you through to the director himself.
And what if after a while you really are talking to the director he's asking for his password because
he's on a business trip and he really needs to check his e-mails but he's forgotten his password.
Well in a company which implemented a security policy you must say that in accordance with the policy
you're not allowed to tell the password via phone.
But the director tells you that this is in order.
And in case of any trouble he'll take all the responsibility.
Now it's no longer appropriate to oppose.
And you tell your superiors the password he demands.
The principle behind the second kind of social engineering attack is a banal truth.
Everyone has their price.
Please look at the photographs of employees at the bottom of the slide.
They don't look motivated.
These people have worked for the same company and doing the same job for five 10 or 15 years.
They mean to do no harm to their company such people know that they will have worked for another five
years doing the exact same thing.
Now if such an employee is approached at lunchtime by someone who is offering him or her $50000 for
connecting a certain USP flash drive to the company laptop.
How can we be sure that this employee rejects the offer.
Another manipulation technique is based on a willingness to help others.
This is something people learn in childhood.
It's a natural reaction to try to help someone who has lost or in need were willing to help especially
if it doesn't take much energy or risk on our part.
Let's imagine that your company hires a new person.
It's a young lady and this is their first real job.
She doesn't seem to fit into the new workplace yet.
She turns to us and says that she is so nervous because it's her first day.
She's forgotten her password and she tells you that she has an important presentation in half an hour
but she left the report.
She's been working on at home and she needs your help.
You'll help her to recover her password or get remote access to the computer because it costs you nothing.
Another effective technique is abusing previously gain trust.
The easiest way to gain Somali's trust is to help them the easiest way to help is by solving a problem
you have cost yourself.
Let's imagine another situation using social networking sites and programs such as multi-game.
You've discovered that a company is a local network is operated by a certain internet provider.
You can call the company and impersonate someone from the internet provider in order to obtain a company
employs password before you do that you have to cause the companies network to go down.
It's enough to cut off the internet connection just for a while.
You can do that by redirecting DNS queries sent by the company.
This is enough for the lady at the front office not to be able to serve her favorite Web site or do
her work.
Suppose you've managed to cause a problem you call the victim.
You introduce yourself as the Internet providers employee and you inform the victim that you've discovered
that users may experience temporary connection problems.
This will give you the confirmation of the problem we've caused the problem which you then proceed to
solve.
The lady from the front desk is thankful for saving the day you add that the problem may reoccur but
that there is a way to prevent it.
You then ask for the password we illegibly need to check network settings that may cause the problem
you assure the lady that it won't interfere with her job or that her help will then no longer be required.
That's how you gained remote access to a company computer
moral pressure is another form of manipulation.
If someone says to you if you don't help me I'm dead or for you it's a trifle but it means life to me.
You'll help them for the sake of your conscience.
We're eager to help even people we don't know if the cost seems noble to us.
We identify with anonymous people who have a specific goal in mind.
Such a situation is easy to arrange
another technique is based on the feeling of community.
We're most likely to help people we identify with suppose you're hired to perform an attack.
You've learned that the administrator of the targeted Web site eats his lunch at a specific time and
place.
You've also learned the breed of his dogs and their names.
You could arrange a meeting at the place see Edes and start a conversation about dogs would be best
if the victim approached you and started the conversation first noticing that you are reading a dog
magazine thanks to a shared interest.
The person you haven't met before will treat you as if you'd known each other for years and if you've
known someone for years you can do them small favors.
There is a technique that everyone will fall prey to.
It's guilt parents of little children know that if they try to make someone feel guilty they will either
back out or try to redeem their false.
You just have to play the victim
another form of attack is connected with willingness to work people rarely take the initiative even
if they're motivated workers.
However the prospect of working on an interesting subject with a larger group of people is more appealing.
A cynical worker may use that as an opportunity to gain something at the expense of others.
This is what the attackers take advantage of.
They offer a solution that will help them to achieve their goals
and other effective manipulation technique is based on fear.
You don't have to draw a bead on someone to make them afraid.
It's enough if you threaten them with revealing certain information.
Especially if they've wrote on their blog or their Facebook profiles some critical information about
their superior.
If you know about it you can blackmail them.
Now you know basic manipulation techniques.