160

There are some basic social engineering approaches to use that work in most situations, not just tailgating: urgency authority curiosity pretexting Urgency Be someone with a specific task to perform that needs to be done right now. The classics are a delivery person with full arms and someone looking to pick someone else up. A family member needing to ...


137

This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be very security aware and not let anyone in, 95% of your collegues will act differently. You have to work with human nature, not against it. So if you want to ...


118

If you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up: Name of the company/service the account is for. What is the nature of the issue/offer the caller wants to discuss? Is there a reference ID (e.g.: ticket #) ...


117

If you spoke to the FI on a separate channel, you actually spoke to the FI, and they know about this, then by definition, it is not a phish. What strikes me as odd is "but they can't (won't) provide any more information", and "refusing isn't really an option". These 2 facts cannot co-exist if you are a separate entity from the FI. Your push-back is ...


100

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and stored sites. The results are also ordered, i.e. the sites which fit the query best and which also have the highest reputation for good answers in general are at ...


84

Let me use an analogy: It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money. Or more technically: The difference is that in the first case you receive something you did (likely) not ask for, in the second case you yourself look out for ...


82

Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don't engage in conversation. Just let the person open the door and go through. Then in the last second before it closes and lock, you calmly walk through still ...


73

A few scams I've seen making the rounds: Use it to dial a premium rate number owned by the group. In the UK, 09xx numbers can cost up to £1.50 per minute, and most 09xx providers charge around 33%, so a five minute call syphons £5 into the group's hands. If you're a good social engineer, you might only have a 10 minute gap between calls as you wander around ...


69

Yes, Target did have their account hacked. In fact, quite a lot of verified account holders have been hacked to further this scam. The scammers do this to impersonate other accounts, including Elon Musk's, by changing their name while retaining their verified status. In this case, it just looks like the scammer is using Target's account directly. This scam ...


68

Because Human Factor vulnerabilities are complex, undefined, non-linear, and often not repeatable in a predictable way. Being able to successfully soceng one person is not enough for an organisation to use as a basis for action. In short, if you could do a soceng test, the results would not be useful. SQLi on a web form, on the other hand, is simple, defined,...


63

You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the simple phrase, "I'm sorry, I do not know who you are so I cannot just let you in. May I escort you to reception?" If they resist, I monitor them and quietly inform ...


51

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded. And one special key being significantly more used than the others - unless it's "{", "}" or ";" and you happen to be a programmer - could allow to ...


47

No, HTTPS does not necessarily mean that a site is not malicious. HTTPS means very little as to the security of a site. It's specifically geared to keep your communication with the site secure from eavesdroppers and tampering, but offers nothing as to the security of the site itself. Yes, a site serving content over HTTPS has a certificate. That means ...


44

Not at all a guarantee. HTTPS means that the web page has SSL, which simply means that your connection to the page is encrypted. The content on the page could be anything that could be posted on any web site whether encrypted by SSL or not. Additionally, as listed in the answers in the comments below, you can be fooled into a false sense of security when (...


42

The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door. Useful props (that would explain your presence) would include: Cigarette or e-Cig. Lunch-bag(s). Coffee(s) from a local distributor. Box of doughnuts. Having a bulky item ...


40

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures -- is this line: "If you aren't doing anything wrong, what do you have to hide?" Some clever answers: "If I'm ...


39

I would lean away from this being a social engineering attempt and more towards a peer FI being uber-cautious regarding information disclosure - they may have had some kind of incident involving these IPs and are not at the stage where they want to disclose anything further. Look at it this way: what would an apparent threat actor really have to gain from ...


39

The cheap solution is to put up scary “no tailgating - everyone must badge in at this door - no exceptions - don’t risk your job - report all tailgate requests to Joe at 123-456-7890” signs at each unattended controlled portal. Make sure there are obvious cameras in the vicinity. If you want people to challenge someone, it’s much easier for them to do so ...


38

Once your information is made public, you cannot make it private again. That is unfortunately one of the things the Internet gives us. You can make formal complaints to sites hosting the information, but assume it will be there, available in large stores of PII, for bad guys to do with as they will. So all you can do is decide which of those things you need ...


35

We want to find unknown, fixable vulnerabilities The goal of penetration testing is to obtain actionable results - to have someone find vulnerabilities that the organization did not know that they have, but could fix if only they know that they exist. Social engineering does not fit this purpose, it reveals vulnerabilities that are neither new nor fixable. ...


33

They could dial their own number to get yours (assuming your number isn't private.) I think I just invented a new, somewhat forceful and creepy, pick-up move.


32

There are even Chinese people in the US. They name their children 李某. Would that be a problem? No. Some systems support these names, some use versions converted to ASCII through romanization (李某 → pinyin Lǐ Mǒu → Li Mou). The only non-ASCII character in X Æ A-12, Æ, is used e.g. in Danish names like Ægidius, converted to ASCII Aegidius. A good example of ...


32

One reason might be that links in emails can be "personalized", links in web searches can not. A common tactic that spammers use is to send out links containing some token representing your email address. This can be as simple as: http://totallylegit.domain/?mail=your.email@address.tld but can also be hidden in various ways (by assigning some ...


31

They could use it to send the detonation signal to that nuclear weapon they've secreted in a warehouse in Manhattan. That's pretty much the worst-case scenario.


31

Target has since confirmed my suspicion: Hard Fork article “Early this morning, Target’s Twitter account was inappropriately accessed” a company spokesperson told Hard Fork in an email. “The access lasted for approximately half an hour and one fake tweet was posted during that time about a Bitcoin scam.” “We’re in close contact with Twitter, have deleted ...


30

Ask for their extension, then call the bank back with a number you trust. Most office phone systems allow you to get directly to any employee if you know that employee's extension, so hanging up and calling the bank back will not take more than a few seconds. If you have been called on an old style landline you should phone back on a different phone line or ...


30

Positive reasons Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school. I leapt into the road and saved a toddler's life. I just walked away because I don't want any fuss. Controlling dissemination My wife is pregnant, great news! We want to tell close family ...


28

the user did some actions that they won't do as usual Clicking on a link does seem like a usual action for most users. See for example this study, in which 56% of users clicked on links in E-Mails from an unknown sender, and ~40% clicked on links send via Facebook (despite 78% being aware of the possible danger). 50% said that they didn't click the link ...


28

(Just a passer-by opinion) Obviously, a physical gate would work the best. In case you don't want to install these, you may try to request all employees to challenge tailgaters, as schroeder suggests. However, I want to underline one distinction that I find important. One my employer had the policy "do not allow strangers in, but allow people that you ...


25

When I've been asked to setup some presentations about security awareness, I've always used something that is familiar to the user base to demonstrate weaknesses that can be exploited. Let's take a simple organization, Acme. Acme has about 200 employees, a robust IT infrastructure, top-of-the-line firewalls, secure applications, a smart CISO, etc. Their ...


Only top voted, non community-wiki answers of a minimum length are eligible