Social Engineering: The Art Of Lying

Greetings AntiOnline. I was thinking earlier that I haven't wrote a tutorial in quite some time and that perhaps I should jump back into doing so. As I continue to want to learn about varied topics (at this current moment, I'm into ANYTHING concerning vulnerability scanners) I also continue to want to share the limited knowledge that I can share with the crowd and hope to help someone in someway. So, here's a relatively short tutorial on Social Engineering.

Social Engineering: What Is It?

Social Engineering. Something that sounds flashy.. "cute" even. It probably sounds frightening to the average home user and definitely sounds as if it was something requiring vast technical know-how. However, nothing could be farther from the truth.

This frightening tech term is simply a "technical" way to say lying. A social engineer is a polite version of a bullsh*t artist. In our case, the user who is doing the lying is "engineering", or lying to the other user, in order to gain some form of information from him. Typically, this information could be passwords to accounts (whether e-mail, system, etc), phone numbers, etc. Well, that's there main objective (and the primary objective of social engineering attempts): Lying to a user in some way, shape, or form to obtain information of any kind.

Social Engineering: Example Of

Below, I will provide you with a sample phone call that happens almost everyday and is nothing more than a social engineering attempt.

You: Hello?
Hacker: Hello, this is Donald over at LocalService ISP..
You: Oh, Hey.. umm, when you say "ISP", you guys are the ones who give me my internet, right?
Hacker: That's correct and that's the reason for my phone call.
You: Oh, really? Is there a problem with the service?
Hacker: Well, we had errors this morning with our service provider and some accounts had difficulty with their GUI optional settings*.
You: Oh.. well, I dunno what exactly that means *laughs* but what can I help you with, sir?
Hacker: *laughs* Ah, thats okay.. I'm not going to need much, I just have to reset the optional settings on your account*, so I'm going to need your account information.
You: Will this directly affect me going online or anything?
Hacker: Nope, that's what I'm here to fix, so that it doesn't.
You: Oh, thanks!
Hacker: No problem.... so, whats your account name?
You: It's joey420.. thats the username.
Hacker: Okay.. entering that in now. And your password, sir?
You: Should I change it from the old one or...?
Hacker: It's recommended you use the old one so that the account is up and running faster.*
You: Okay, makes sense.. again, I dunno about these things. Anyways, it's "password1010".
Hacker: Alrighty, give me a sec.... okay, your re-entered into our systems. Your account should be re-activated within minutes.
You: Awesome, thanks a bunch.
Hacker: No problem sir, and you have a nice day now..
You: You too, bye bye.

* - Where these were indicated something that isn't true and/or isn't needed but was used as an example of a "social engineer" trying to confuse the user into his lack of knowledge, thus having to rely on the hacker.

Social Engineer's prey on two main things. These are the main things they prey on:

1. Your lack of knowledge. They will try to make you feel inferior or use "big words" to confuse you. Their biggest advantage is that they know you the user will feel one main thing: If it doesn't seem right or if it's not making sense, it's because they (the user) doesn't know much about it. Enter the hacker who "seems to know about it" thus the user puts the trust into the hacker.

2. Your trust. 'Nuff said IMO.

Social Engineering: How Do I Defend Myself From It?

Defending yourself from this is simple: Use the mentality that if it seems wrong, looks wrong, smells wrong, and overall has that feel to it that it is wrong.. it IS wrong and run away from it. Have self-confidence, try to think before making decisions (especially rational ones), and be careful. Oh, trust me.. you can do it! ;)

Social Engineering (for the most part) only works on the "weak mind". I know thats somewhat "crass" of me to say, but many of todays IT professionals and system administrators are a tad more tech savvy when it comes to this. Yes, it does happen to the "best of us" from time to time. Many people think of Social Engineering (IMO) as something that "only happens to newbs".

That is a misconception, as I have seen it done to MANY people who are professionals and NEVER thought it would happen to them. Sad, eh? :D

Well, that's my mini-tutorial.. I hope somebody enjoyed it and/or learned from it. :)

Bleh,
http://antionline.com/showthread.php...al+Engeneering

Hi Spyder32,

Looks fine to me...reads well...good job!

devpon's link is two years old...so it's good to do it over for the newbies...refresh the mind.

Eg ;)

Quote:

---

You must spread your AntiPoints around before giving it to Spyder32 again.

---

How many tuts do we really need on this topic?


http://www.antionline.com/showthread...hreadid=253867
http://www.antionline.com/showthread...hreadid=247701
http://www.antionline.com/showthread...hreadid=238683
http://www.antionline.com/showthread...hreadid=231674
http://www.antionline.com/showthread...hreadid=140632

Hi NeuTron,

Well...of those you mentioned...2 were done in 2002, 2 in 2003 ( according to the panel below there were actually 3 in 2003 ) , 1 in 2004, and now Spyder's in 2005...if all we need is one then why the members do the other 4? By the look of their antipoint status...I'd say each one got a warm welcome.

if nothings changed since 2002 then we only need the one...still...it's good to get a refresher now and then for the ' new ' people who may not know the others even exist.

no harm no foul as they say.

Eg ;)

Quote:

---

Originally posted here by NeuTron
How many tuts do we really need on this topic?


http://www.antionline.com/showthread...hreadid=253867
http://www.antionline.com/showthread...hreadid=247701
http://www.antionline.com/showthread...hreadid=238683
http://www.antionline.com/showthread...hreadid=231674
http://www.antionline.com/showthread...hreadid=140632

---

At least 50% of the tutorials I read on this site are read by me because I'm like, "Hey, there's a person I know and respect and they wrote some security tutorials. I'll see what they have to say." The other 50% are because I want to know more on a topic. So basically my point is if no one wrote tutorials on stuff already covered I might potentially read half the amount of tutorials I read here. Just my $.02.

- X

Social engineering isn't always about down and out-right lying to people. Its about abusing certain traits and trusts of others. No one has ever asked if im the original |The|Specialist.

Quote:

---

Originally posted here by xierox
At least 50% of the tutorials I read on this site are read by me because I'm like, "Hey, there's a person I know and respect and they wrote some security tutorials. I'll see what they have to say." The other 50% are because I want to know more on a topic. So basically my point is if no one wrote tutorials on stuff already covered I might potentially read half the amount of tutorials I read here. Just my $.02.

- X

---

Guess what? I read the tutorial with an open mind and didn't pass judgement simply because this wasn't the first like it. I wouldn't have said anything if it had been at all original. It was the same concept, looked at in the same way as the other 5 tutorials we have on this site. If you are going to be the sixth person to write one of these, your job gets that much harder because you have to dig deeper than anyone else to bring new information to light. Otherwise, you are just posting a tutorial for the sake of posting a tutorial.

Out with it...

You thought it sucked and so did I.

Hey Hey,

I have to agree with NeuTron and devpon on this one... This is a pretty lousy tutorial and keeps with my theory that Spyder is here solely for status... posts unneeded posts to raise his post count, had to be a moderator (for the status), and posts a useless and repetetive tutorial.

Now many of you will think that this is because of the differences between Spyder and I but I read this objectively, just as I read every tutorial that I look at. I gave greenies to TheSpecialist and him and I have squared off on humerous occasions..

http://<br /> <a rel="nofollow" hre...3867</a><br />
I most likely would have said the same thing about this one had I read it when it first appeared. It gives almost exactly the same script as this one, but at least it covers a few additional details and other methods.

http://<br /> <a rel="nofollow" hre...7701</a><br />
Again not an overly useful thread... very similar to this and the above tutorial.

http://<br /> <a rel="nofollow" hre...8683</a><br />
Another example of the same thing.

http://<br /> <a rel="nofollow" hre...1674</a><br />
Ridiculously detailed and resource-filled. This is a great tutorial.. well more of a reference item with a bit of a tutorial on ways to combat SE.

http://<br /> <a rel="nofollow" hre...0632</a><br />
Not actually a tutorial, a cut and paste from a SecurityFocus article that is actually referenced in another one of the tutorials..

In reality jdenny and whizkid gave the only two valid tutorials... jdenny's for the information provided and whizkid for the first example of a roleplay... Spyder's introduces nothing new... if that's how you want to be known that's fine... but as a moderator on a site that pushes for originality in tutorials this is far from it... It's completely repetetive...

It has been a while since social engineering has been addressed as Eg. said, however rehashing old information isn't the way to address it. A single roleplay teaches nothing about SE... it just gives an example of what happens.. The definition... has been spouted off hundreds of times and the how do I defend myself is pathetic... stating that it only works on "Weak Minds" is awful.. I can show you some people that would blow you away in any subject including IT that have been conned by good SEs... They aren't always these stupid little 'call the person and get their information' bullshit attempts.. As TheSpecialist said there are other ways to do it. Many Socials take weeks or months and a great amount of footprinting and research. Perhaps covering all of that would make for a good tutorial since the last time a good tutorial like that covered anything was a while ago and there are new methods. A tutorial that wasn't a scripted phone call would be a great read and I'd love to see it.. Cover how they get the correct information, how they utilize the information.. tone of voice, time of day, approach... these all factor in.. This tutorial covered none of it..

Spyder: Put some time and effort into something if you're going to post it... don't rehash what others have already done. You can think of this as a personal attack if you want... but you'd be wrong..

Peace,
HT

Quote:

---

No one has ever asked if im the original |The|Specialist.

---

Muhahahahahahahah :)

I do not think that I need DNA old chap..............just poop :D

Good read.

I'm relatively new, and I prefer refresher tuts much more than diggin thru AntiOnline archives, even though theres great stuff there!

Quote:

---

No one has ever asked if im the original |The|Specialist.

---

Probably because no one cares ;) On a sid note nice little read.

To those who appreciated my tutorial and/or thought it was a good read: Thank you. I appreciate it.

To those who didn't appreciate it and/or thought it was an over-done topic: You might be right about it being done before (years ago?) and I thought of re-freshing it a bit. Providing information for newbies, etc.

HT: I don't see that as a personal attack. No offense or anything, but you are allowed to think half of the b/s you think about me (wanting to post, status, blah blah) and I could care less..

Oh well, I know a few people liked my tutorial and thought it was a good read. That's all I ask for, I just want to "reach" someone (or a few). Can't please everyone, eh? :D

It's darn near well impossible to even please a majority around here, which is why I never bother trying to post tuts myself.

Familiar topic or not, it was a very good starting point for someone unfamiliar with social engineering. However, I'd suggest turning this into a series -- You want originality? Then keep digging into this topic; it's a goldmine. People write entire books on this stuff, so I'm sure there's plenty of uncharted areas that have yet to hit AO. Bring them to light.

Quote:

---

him and I have squared off on humerous occasions

---

Now there's a freudian slip if ever I've seen one, HT. ;)

Did a google and the return hit total is 61,900,000. Should we say the subject is saturated? I'd say NOT! There are varying depths (and I presume so as I have yet to get around looking into the first 20 listing) and breadths about it.

This particular thread title is "Social Engineering: The Art of Lying."

Hmmm... there has to be a science side to it, right? I just wonder whether it will be *that* particular side that would be of greater value to newbies like me as such will tip as off on how to go about avoiding such a scam.

Except, of course, that knowing how it is done and why it is being done would be reasons enough to be more security-conscious... or be paranoid, for that matter.

Heh, don't worry spyder, not everyone's tutorial can be as good as my Tracing IP tutorial :p

http://www.antionline.com/showthread...hreadid=256977

Anyone remember that one? What followed was a big debate, similar to this one :p ...

The quality of a tutorial is reflected in the posts that follow it. If it generates constructive discussion, it is usually good; if it generates into a debate about whether or not its good, its usually crap.

It doesn't matter that the topic has been covered before, but it does matter that it has been covered better. Why not bump one of the tutorials with a new comment instead of writing something inferior or less detailed ? Or better yet, why not read through them and give us a best-of with some additions to bring it all up to date ?


I think a tutorial really should have links to similar ones already posted. (Bad tutorials are also usually follwed with posts linking to other ones already done.) It would make people less likely to post something that doesn't stand up.

Again, as long as there are those who appreciate and/or got something from this.. everything else is moot.

Well, IMPO, i see nothing fresh in this tutorial. This is en example of a Mitnick phonecall when he was a skiddie (well, still is), im saying that this example is very old and true, it still works today, this topic may or may not be overdone, but this tut really sucks on THIS topic.

:)

How to stop SE attacks ? Common Sense, every ISP has somewhere on their product or software a note..."Don't give out billing or account information over the phone or online"....even AOL had (dunno if they still do), it printed on their buddy list....

I think i will just go and bump my favourite tutorial instead of rephrasing it and reposting. Its much faster and gets the exact same result excepting comments and antpoints. Why don't we all do this? it will knock this crap off the frontpage and everyone will see all the great tuts, yeahhh

I think we should all bow to the MASTER of social engineering....

Quote:

---

Greetings AntiOnline. I was thinking earlier that I haven't wrote a tutorial in quite some time and that perhaps I should jump back into doing so. As I continue to want to learn about varied topics

---

Quote:

---

Again, as long as there are those who appreciate and/or got something from this.. everything else is moot.

---

So from your opening statement, you want to learn, but from your last statement, you only want to hear how good your tutorial is? What happened to learning from ones mistakes or deficiencies?

A good deal of discussion has taken place and as always am ****in' late ... damn it! :D

Hmmm, I see no harm in Spyder32's tut. quite the contrary it is always good to read something that you don't look for. Am sure that many newbies read this tut. consedring that they did not attend to read such a reading, this is good, right?

I guess every one has the right to post any tutorial that is original written by him/her, in his tutorial there is neither copy/paste nor uncited referencing.

If we are going to say that every covered subject should not be covered again we will discover that many book out there are not necessary .... I think this is wrong! In every reading we will find something special ....

Am not trying to say that it is not good to discuss things, I might be wrong, though! .... so discussing things is really great practice .... so keep it up!

Cheers mates

Enough already ............

If it's links to other similar threads that you need ? .............just look at the bottom of each page........

This thread has five others, already brought up by others for no good reason, as they were always on show.

It was NOT the best tutorial ..............
BUT it was well presented and laid out ........

It will be nigh on impossible to close this thread throught the AP system, so I ask the mods to do their thing.

So:
if we have quite finished on the character assassination, could we please just concentrate on the [perceived] faults with the tutorial, at least until the thread is closed.
That way, others MAY learn about what constitutes a GOOD from a BAD tutorial.

And to the Duck, your 'tutorial' was 'special' :) a one off, and long may it stay that way :D

Quote:

---

If it's links to other similar threads that you need ? .............just look at the bottom of each page........

---

The point, and it is a general one, is only that the person writing the tutorial could acknowledge that they have read and considered the links by including them. The links at the bottom only show up after the post.

devpon: In my opening statement I said "as I continue to learn". Not that it was the focus of this tutorial.

allenb1963: I'd appreciate if you re-iterate via this thread or PM.

hesperus: If I posted the links provided by the similiar threads feature, wouldn't that defeat the purpose of the feature?

Negative: So you know, I didn't ask for greens on that one post. I didn't think it deserved greens myself. Negging it, however, was just as wrong. Don't punish me because someone greened me on a post they thought to do so (I didn't feel it deserved either greens/negs, but whatever..).

Blah, I really wish people would PM me wtf they mean half the time and say their TRUE feelings about me. Because honestly, when it gets held in and comes out in threads like these, it only causes problems and b/s on the forums (as it's doing now?).

*sigh*

Quote:

---

Don't punish me because someone greened me on a post they thought to do so

---

He didnt punish you, HE thought it didnt deserve greens, maybe he thought it sucked big time, if he negged you first, would you complain about someone else GREENING you ? Would you say, dont green me just because someone negged me, this is starting to be an AP bitching thread...let's lay off the APs now and close the thread.

Quote:

---

Blah, I really wish people would PM me wtf they mean half the time and say their TRUE feelings about me.

---

Would you care too much if somebody hated you or loved you, i dont like anybody here, i love everybody here....yes i meant to say that, even though i dont like gore, if he posts a good thread i'll green him because i learned something, if i like and respect Negative, i'll Neg him if he posts bullshit...

Let's close this and be done with it.... :)