Social engineering is a nontechnical method of breaking into a system or network. It's the process of deceiving users of a system and convincing them to perform acts useful to the hacker, such as giving out information that can be used to defeat or bypass security mechanisms. Social engineering is important to understand because hackers can use it to attack the human element of a system and circumvent technical security measures. This method can be used to gather information before or during an attack.
A social engineer commonly uses the telephone or Internet to trick people into revealing sensitive information or to get them to do something that is against the security policies of the organization. By this method, social engineers exploit the natural tendency of a person to trust their word, rather than exploiting computer security holes. It's generally agreed that users are the weak link in security; this principle is what makes social engineering possible.
The most dangerous part of social engineering is that companies with authentication processes, firewalls, virtual private networks, and network monitoring software are still wide open to attacks, because social engineering doesn't assault the security measures directly. Instead, a social-engineering attack bypasses the security measures and goes after the human element in an organization.
Types of Social Engineering-Attacks
There are two types of Social Engineering attacksHuman-Based
Human-based social engineering refers to person-to-person interaction to retrieve the desired information. An example is calling the help desk and trying to find out a password.Computer-Based
Computer-based social engineering refers to having computer software that attempts to retrieve the desired information. An example is sending a user an email and asking them to reenter a password in a web page to confirm it. This social-engineering attack is also known as phishing.Human-Based Social Engineering
Human-Based further categorized as follow:Impersonating an Employee or Valid User
In this type of social-engineering attack, the hacker pretends to be an employee or valid user on the system. A hacker can gain physical access by pretending to be a janitor, employee, or contractor. Once inside the facility, the hacker gathers information from trashcans, desktops, or computer systems.Posing as an Important User
In this type of attack, the hacker pretends to be an important user such as an executive or high-level manager who needs immediate assistance to gain access to a computer system or files. The hacker uses intimidation so that a lower-level employee such as a help desk worker will assist them in gaining access to the system. Most low-level employees won't question someone who appears to be in a position of authority.Using a Third Person
Using the third-person approach, a hacker pretends to have permission from an authorized source to use a system. This attack is especially effective if the supposed authorized source is on vacation or can't be contacted for verification.Calling Technical Support
Calling tech support for assistance is a classic social-engineering technique. Help desk and technical support personnel are trained to help users, which makes them good prey for social-engineering attacks.Shoulder Surfing
Shoulder surfing is a technique of gathering passwords by watching over a person's shoulder while they log in to the system. A hacker can watch a valid user log in and then use that password to gain access to the system.Dumpster Diving
Dumpster diving involves looking in the trash for information written on pieces of paper or computer printouts. The hacker can often find passwords, filenames, or other pieces of confidential information.Computer-Based Social Engineering
Computer-based social-engineering attacks can include the following:- Email attachments
- Fake websites
- Pop-up windows
Insider Attacks
If a hacker can't find any other way to hack an organization, the next best option is to infiltrate the organization by getting hired as an employee or finding a disgruntled employee to assist in the attack. Insider attacks can be powerful because employees have physical access and are able to move freely about the organization. An example might be someone posing as a delivery person by wearing a uniform and gaining access to a delivery room or loading dock. Another possibility is someone posing as a member of the cleaning crew who has access to the inside of the building and is usually able to move about the offices. As a last resort, a hacker might bribe or otherwise coerce an employee to participate in the attack by providing information such as passwords.Identity Theft
A hacker can pose as an employee or steal the employee's identity to perpetrate an attack. Information gathered in dumpster diving or shoulder surfing in combination with creating fake ID badges can gain the hacker entry into an organization. Creating a persona that can enter the building unchallenged is the goal of identity theft.Phishing Attacks
Phishing involves sending an email, usually posing as a bank, credit card company, or other financial organization. The email requests that the recipient confirm banking information or reset passwords or PINs. The user clicks the link in the email and is redirected to a fake website. The hacker is then able to capture this information and use it for financial gain or to perpetrate other attacks. Emails that claim the senders have a great amount of money but need your help getting it out of the country are examples of phishing attacks. These attacks prey on the common person and are aimed at getting them to provide bank account access codes or other confidential information to the hacker.Online Scams
Some websites that make free offers or other special deals can lure a victim to enter a username and password that may be the same as those they use to access their work system.The hacker can use this valid username and password once the user enters the information in the website form. Mail attachments can be used to send malicious code to a victim's system, which could automatically execute something like a software keylogger to capture passwords. Viruses, Trojans, and worms can be included in cleverly crafted emails to entice a victim to open the attachment. Mail attachments are considered a computer-based social-engineering attack.More articles
- Hacker
- Hacker Tools 2019
- Hacking Tools For Windows
- Hacking Tools Windows
- Hacker Tools Hardware
- Pentest Tools Subdomain
- Wifi Hacker Tools For Windows
- Pentest Tools Framework
- Pentest Tools Alternative
- Hacking App
- Hacking Tools Name
- Pentest Tools Url Fuzzer
- Hacking Tools For Kali Linux
- How To Install Pentest Tools In Ubuntu
- Hack Tools For Mac
- Hacker Tools For Windows
- Hack Tools
- Hacker Tools 2020
- Hacking Tools 2019
- How To Make Hacking Tools
- Pentest Tools Subdomain
- Pentest Box Tools Download
- Hack Tools Download
- Hacking Tools Github
- Hacker Tools
- Free Pentest Tools For Windows
- Hacker Tools Online
- Hack Tool Apk No Root
- Hacker Tools Hardware
- Best Hacking Tools 2020
- Nsa Hack Tools
- Ethical Hacker Tools
- Pentest Tools Kali Linux
- Hacker Tools Linux
- Hacking Tools Windows
- Hacker Tools For Pc
- Underground Hacker Sites
- Hak5 Tools
- Pentest Tools Find Subdomains
- Easy Hack Tools
- Hacker Tools 2020
- Pentest Tools Android
- Pentest Tools
- Wifi Hacker Tools For Windows
- Hacking Tools Windows
- Wifi Hacker Tools For Windows
- Hacker Tools Github
- Hacker Tools Free Download
- Hack Tools For Pc
- How To Install Pentest Tools In Ubuntu
- Hack Tools For Pc
- Pentest Tools Apk
- Pentest Tools Download
- Hacking Tools Free Download
- Hack Tools For Pc
- Pentest Tools Free
- How To Hack
- Hack Tools Download
- Pentest Tools For Ubuntu
- Pentest Tools Find Subdomains
- Hacker Tools Windows
- Hacking Tools Windows 10
- Hack Tools 2019
- Hacking Apps
- Pentest Recon Tools
- New Hack Tools
- Pentest Tools Nmap
- Wifi Hacker Tools For Windows
- Hacker Tools Hardware
- Hacker Tools List
- Computer Hacker
- Hacker
- Pentest Tools Online
- Pentest Tools Windows
- Pentest Tools Android
- Pentest Box Tools Download
- Top Pentest Tools
- Pentest Tools Kali Linux
- Hacking Tools
- Hacking Tools
- Bluetooth Hacking Tools Kali
- New Hacker Tools
- Pentest Automation Tools
- What Are Hacking Tools
- Easy Hack Tools
- Kik Hack Tools
- Pentest Tools Review
- Hacker Tools Github
- Hack Tools Pc
- Hacker Tools For Windows
- Tools Used For Hacking
- Hackrf Tools
- Physical Pentest Tools
- Hack Tools Online
- Hack Tools Pc
- Pentest Tools List
- Computer Hacker
- Nsa Hack Tools Download
- What Is Hacking Tools
- Hack Apps
- Pentest Tools Website Vulnerability
- Android Hack Tools Github
- Pentest Tools Port Scanner
- Pentest Tools Github
- Android Hack Tools Github
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Pc
- Pentest Tools Tcp Port Scanner
- Pentest Tools Windows
- Hacker Tools
- Game Hacking
- Tools For Hacker
- Hacker Tools Hardware
- Hacking Tools Usb
- Hacking Tools 2020
- Hack Tools Pc
- Github Hacking Tools
- Beginner Hacker Tools
- Hackers Toolbox
- Pentest Tools For Android
- Hacking Tools For Mac
- Hacking Tools Free Download
- Hacker Tools Windows
- Pentest Box Tools Download
- Pentest Tools Url Fuzzer
- Hacker Search Tools
- Hacking Apps
- Bluetooth Hacking Tools Kali
- Pentest Tools Framework
- Hacking App
- Pentest Tools Open Source
- Best Hacking Tools 2019
- Hackrf Tools
- Pentest Tools Review
- How To Make Hacking Tools
- Pentest Tools Subdomain
- Hacker
- Hacker Tool Kit
- Pentest Tools Android
- Hacker Tools For Windows
- Growth Hacker Tools
- Hacker Tools For Windows
- Hacker Search Tools
- Pentest Tools List
- Hack App
- Hacker Tools Apk Download
- Pentest Tools Download
- Pentest Tools Windows
- Computer Hacker
- Pentest Tools Windows
- Best Hacking Tools 2019
- Termux Hacking Tools 2019
- Hacker Hardware Tools
- Pentest Tools Kali Linux
- Nsa Hack Tools
- Hacking Tools And Software
- Black Hat Hacker Tools
- Hack Tools Online
- Hacking App
- How To Make Hacking Tools
- Pentest Tools Url Fuzzer
- Hacking Tools Windows
- Pentest Box Tools Download
- What Is Hacking Tools
- Termux Hacking Tools 2019
- Hacking Tools Windows
- Pentest Tools For Ubuntu
- Pentest Tools For Windows
- Pentest Tools Review
- Pentest Tools Review
- Github Hacking Tools
- Physical Pentest Tools
- Termux Hacking Tools 2019
No comments:
Post a Comment