Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

What is reverse social engineering? Is it something different from normal social engineering?

share|improve this question

3 Answers 3

up vote 9 down vote accepted

Reverse social engineering (RSE) can mean two things - attack where attacker is trustworthy entity (case 1) or attack where attacker becomes victim (case 2).

When we talk about case 1 there are usually three stages of attack. Stage one is called sabotage where initial damage is made. Stage two or advertise is where attacker gains trust of victim and pursue him/her he is the one who can solve problem they have (made in stage 1). Stage three (assist) is where the attacker gains information/property he needs.

Advantage of RSE is that attack is much harder to discover. On the other hand, main disadvantage is complexity.

The best defense against this type of SE (social engineering) is to use trustworthy companies to do whatever job you need to outsource. Also, background checking on persons who has access to your critical areas can prevent such attacks.

Case 2 is situation where initial attacker becomes victim. However, this types of SE is highly unlikely to happen in business environment and it's mostly found in military (or to use fancy word - counterintelligence).

Example of this kind attack could be so called "Reverse sting" where when attack is recognized victim can preform attack on initial attacker or he can redirect attacker to someone who knows how to counter him. E.g. attackers calls front desk and asks for information X. Instead of giving him information X, front desk redirects call to security department. Other example of case 2 RSE is where attacker is fed with false data (law enforcement agencies often preform this attack).

share|improve this answer
RSE? – KnightOfNi Mar 13 '14 at 0:38

Reverse social engineering is a form of social engineering. We can say all reverse social engineering attacks are a social engineering attack.

A reverse social engineering attack is where an attacker makes himself a point of help to a victim. The victim will think of the attacker as a trustworthy person because he is offering help to solve the problem.

An example can be an attacker first sabotaging a network and then posing as a technician to help and resolve the problem for the victim.

This approach is often used because the victim will give up passwords more easily. If you get called by someone and they ask you your password, you will be reluctant to give it. If you call a technician and he requests your password, you are more likely to give it.

Further reading: reverse social engineering in online social networks.

share|improve this answer
The paper defines it as "In a reverse social engineering attack, the attacker does not initiate contact with the victim. Rather, the victim is tricked into contacting the attacker herself." If this is correct it sums it up nicely. – Tie-fighter Aug 16 '12 at 0:27

Reverse social engineering does not differ from 'normal' social engineering in a significant way, beyond the fact that the stance taken could be described as being somewhat "passive".

The reversal lies in the pretext used, and aims to entice a victim to take action on one's own initiative, hence amplifying perceived trust.

An example would be posing as an authority figure to establish initial contact and triggering certain followup actions, as opposed to an attacker approaching victims himself to do the same.

Watering hole attacks are an example of reverse social engineering:

Sinkholing Script Kiddies

share|improve this answer
As stated in a previous answer, the attacker is not necessarily passive (ie. sabotage...), but a keyword in your answer is indeed the term "initiative", since the the victim will contact the attacker on its own initiative, giving him far more trust from the start than in classic social engineering attack. – WhiteWinterWolf May 2 at 21:26
Regardless of preceding events such as (active) sabotage, there would arguably be a passive element that follows. – social engineer May 3 at 16:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.