It's time for the practical part I would like to show you how easy it is to fix someone's identity using
websites such as fake name generator dot spoof tell Dot com or fake my text does come.
I would also like to show you social engineer toolkit some techniques collected and described as social
engineering.
Then we'll use an Internet platform called Meadow split to make a social engineering attack automatic.
Let's start with creating a new identity suppose you're not very creative and you don't feel like inventing
a birthplace.
Mother's maiden name and such.
Here's where a fake name generator dot com comes in handy
using this Web site.
All you have to do to fake an identity is to choose nationality and country of origin.
This is all the basic information required.
The Web site generated a fake identity.
Our new name is William Ward.
We live in Fort Washington.
You can see our new telephone number email address website password mother's maiden name date of birth
credit card number and expiration date and much more interesting data.
It takes one click to create a new online identity.
If you really need to make it look convincing you can start up a blog.
Add some photos and write some entries and if you write that you're a millionaire or a sportsman and
that you like light music it may turn out that the fake profile will have more followers than the real
one and that everyone will know you one real life example is a man who after creating a Web site got
seven hundred thousand messages with birthday wishes from people whom he didn't know at all.
Not all the personal information you find on the Internet is real.
Let's now go to spoof telecomm the site allows you to fake a phone number you're calling from.
It can also change the voice of the speaker.
If your telephone display shows an incoming call from Warsaw and even if it seems that you're speaking
with a 10 year old child this is not necessarily so.
It may turn out to be your colleague calling from the other room using services provided by spoofed
tel.
If you can fake phone calls can you also fake text messages.
Of course you can a phone call lets you pretend that you're working for a certain company.
Text message lets you lure a person you'd like to see out of a company's building.
For example we could arrange a meeting at a spot where we've lost a memory stick.
A person who finds it will probably try to see what's on it.
Out of sheer curiosity if the person has left the company is building just for a little while he or
she will not go home to see what's on the memory stick.
Rather they return inside and just connect it to any available computer.
This operation is enough for a successful social engineering attack.
To fake text messages you can use fake my text dot com.
Let's say something more about attack methods and social engineering.
You can find a very interesting website useful not only for people who want to actively engage in social
engineering.
You can also learn to be able to tell when somebody is trying to manipulate you.
Please note the framework of the Web site the information provided there gives you an insight to the
tools used by the attackers.
Please look at the pen you see in the slide this elegant pen surely writes well but it can also be used
as a sensitive microphone and a memory stick.
If you give it to someone as a gift you will know what that person talks about at work.
In the section principles of psychology you can find an article describing the human buffer overflow
attack.
The pictures show simple messages with a closer look though things get confusing.
The picture presents contradictory pieces of information.
The writing which says yellow is green.
The one saying black is yellow.
The purpose of that is to confuse our perceptive skills.
Not that you don't get confused listening to a fast speech.
On average a person utters 150 words per minute.
The brain however can process even 500 to 600 words per minute.
People generally don't speak at a pace that would make it impossible to follow their train of thought.
But you don't need to speak fast to confuse people.
You just have to provide them with contradictory information containing simple commands.
If a person wants to understand you you just have to give them hints.
Simple instructions discernible in your intonation pattern people naturally follow such hands.
They'll do what you want them to.
I encourage you to visit the website because you can read about a few interesting techniques there.