Types of Social Engineering
Types of Social Engineering
Pretexting Pretexting is the act of creating and using an invented scenario (the pretext) to engage a targeted victim in a manner that increases the chance the victim will divulge information, Such as credit card information,banking information and financial information. An elaborate lie, it most often involves some prior research or setup and the use of this information for impersonation, The more information you have on your victim is the more likely you are to succeed in convincing them. This flavor can be used to fool a business into disclosing customer information as well as successfully doing a bank transfer over the phone. This flavor can also help patch up missing information on fullz. The information can then be used to establish even greater legitimacy under tougher questioning with a manager, bank tellers or shop supervisors to change financial information or create new accounts/orders or just find out the balance. Pretexting can also be used to impersonate co-workers, police, bank, tax authorities, clergy, insurance investigators, or even the person ho you pretexted or any other individual who could have perceived authority or right-to-know in the mind of the targeted victim. The pretexter must simply prepare answers to questions that might be asked by the victim. In some cases, all that is needed is a voice that sounds authoritative, an earnest tone, and an ability to think fast and sound confident to create a pretextual scenario. See Pretexting for more information.
Diversion theft Diversion theft is basically a con that can be used buy virtual carders and it involves the carder talking out the delivery guy into delivering the package somewhere else other than its original destination. Pretty useful trick if done correctly.
Phishing Phishing is a flavor used by phishers to acquire private information of victims such as username and passwords. A phisher would set up a clone webpage, usually a banking webpage or a social networking webpage, host it with bullet proof hosting( see Bullet Proof Hosting for more information) and then send a spoofed e-mail to a victim which would appear to be from a legitimate business or banking/ social networking site. These e-mails will request for the victim to "verify" some personal information by clicking the cloned web page link and signing in or some serious consequences will transpire like account closing or disabled. When the victim clicks this link and logs in they are redirected to a error page and their login information is sent to the phisher. Sometimes it ill not olny be login credentials alone required but also financial information such as ATM PIN number or Credit Card numbers.
IVR or phone phishing
Phone phishing (or "vishing") uses a rogue interactive voice response (IVR) system to recreate a legitimate-sounding copy of a bank or other institution's IVR system. The victim is told to call the fake IVR number either by phishing e-mails or by pretexting in order to verify some information. A fake IVR will reject information frequently to make sure the victim is entering the right information. More advanced systems transfer the victim to the attacker posing as a customer service agent for further questioning thus combining vishing with pretexting.
Baiting Baiting is the in person form of a Trojan, it relies on the victim either being nosey or too curious. In this flavor the attacker leaves an infected USB flash drive or a CD-ROM infected with malware in a location where it is easy to find. Like bathrooms, Conference rooms, in a hallway or in the parking lot. The attacker would have given the malware infected device a professional look and label like Payroll account information or Salary increase for specific workers or even employees up for promotion. In some cases the device is found by an honest worker and given to the Administrators, as a result of them inserting the device to see the contents, the user would UN-knowingly installed malware on that computer, giving the attacker access to the computer with admin privileges, and even the company's internal computer network. This can be extremely dangerous for the victim.***tip if ever doing this install ransom ware on the device, this way when the victim installs it, the ransom ware will encrypt all the company's data and request a payment. I would say go with 1,000 BTC. The company more or likely will pay because of fear of losing their data.*** See Ransom Ware for more information on ransom ware.
Quid pro quo Quid pro quo means something for something, An attacker calls random numbers at a company, claiming to be calling back from technical support. Eventually this person will hit someone with a legitimate problem, grateful that someone is calling back to help them. The attacker will "help" solve the problem and, in the process, have the user type commands that give the attacker access or launch malware.
Tailgating
An attacker, seeking entry to a restricted area secured by unattended, electronic access control, e.g. by RFID card, simply walks in behind a person who has legitimate access. Following common courtesy, the legitimate person will usually hold the door open for the attacker. The legitimate person may fail to ask for identification for any of several reasons, or may accept an assertion that the attacker has forgotten or lost the appropriate identity token. The attacker may also fake the action of presenting an identity token.
-True wealth comes from knowledge, and true knowledge comes from research, the wages of fraud is equivalent to money by the power of 10 17:13, 24 October 2013 (EDT)