Social Engineering
Download as PPTX, PDF1 like1,682 views
This document discusses social engineering techniques used to manipulate people into revealing sensitive information or performing actions. It defines social engineering as manipulating people to get them to do what you want. Common techniques include pretending to need help, building trust, and creating a sense of urgency. The document also outlines various human-based and computer-based social engineering methods, such as impersonation, phishing emails, and using popup windows. It notes that the best defenses include shredding documents, security policies and procedures, user awareness training, and keeping systems updated.
Social Engineering
- 1. Social Engineering (Because there is no patch for human stupidity)By: Shobhit GautamTwitter @sh0bhit105
- 2. What Is Social Engineering?The art of manipulating people and getting them to do what you want.“Social Engineering - A euphemism for non-technical or low-technology means - such as lies, impersonation, tricks, bribes, blackmail, and threat - used to attack information systems.” "Social engineering" as an act of psychological manipulation was popularized by hacker-turned-consultant Kevin Mitnick.
- 3. Common Types of Social EngineeringHuman-basedComputer-based
- 4. Personality TraitsDiffusion of responsibilityChance for ingratiationTrust relationshipMoral dutyGuiltIdentificationDesire to be HelpfulCooperation
- 5. Techniques for persuasionA Direct Route Systematic and logical statementA Peripheral Route Beat around the Bush Trigger strong emotions such as fear and excitement.
- 6. Human Based methodsImpersonating IntimidationCreating confusionMay I help you?Can you help me?Building TrustAsk and It shall be given unto you seek and ye shall find.Dumpster Diving
- 7. Computer BasedPopup WindowsMail attachmentsSpam, Chain Letters and HoaxesPhishing WebsitesUSB devices Key loggers
- 8. Social Engineering Toolkit The Social Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing.SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. It’s main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed.
- 10. ./set
- 11. How to Identify A Social Engineer?Does not provide contact informationAlways asks for forbidden informationRushing Activities Name-droppingIntimidationObserve for Small mistakes
- 12. MitigationShreddersPolicies and ProceduresAwarenessUpdated patches and Anti Viruses/Malwares
- 13. NOW