Social Engineering

This talk covers about What is social engineering? Steps involved in social engineering and how to prevent yourself from social engineering.

Presented at WAP Chennai Chapter.

Follow and Share!

Reach me at:
Facebook
Instagram
Twitter
Linkedin

Transcript

1. The art of replacing what works with what sounds good. Sudhakar Muthumani SOCIAL ENGINEERING
2. DISCLAIMER The content, information, opinions, and viewpoints are purely for educational purposes. Any violation can lead to the enforcement of laws. Don’t use this without proper guidance and knowledge.
3. TABLE OF CONTENTS Social Engineering Here we will discuss the introduction and steps. 01 Attack Vectors Here we will see what are attack vectors involved in social engineering. 02 Practical Examples Here we will manually see how phishing works. 03 Prevention & Laws Prevention techniques and laws to be followed when doing social engineering. 04
4. • Psychological manipulation of people into performing actions or divulging confidential information • Any act that influences a person to take an action that may or may not be in their best interests • Getting the required data by manipulating the human mind WHAT IS SOCIAL ENGINEERING?
5. SOCIAL ENGINEERING LIFECYCLE INFORMATION GATHERING • Gather the required information to attack the target • Use OSINT tools for gathering information • Close interactions • Cover tracks • Engage with the target • Create a story • Interact with the target • Maintain the story • Extract information ESTABLISHING A RELATIONSHIP WITH THE TARGET EXPLOITATION EXIT
6. INFORMATION GATHERING ➔ OSINT to gather information ➔ Extracting information from google search ➔ Prioritize the information ➔ Verify the information ➔ Plan the attack
7. ELICITATION • Casual conversation • Using cover stories • How to become anyone? • More than creating a lie • Doctors, Sales Person,etc PRETEXTING 7
8. • Plan well • Using their accents • Say no to emotions • Using their interests • Understanding microexpressions • Building Rapport • Testing Rapport APPROACHING THE TARGET 8
9. MICROEXPRESSIONS ANGER 1. Pull your eyebrows down and together; pretend you are trying to touch your nose with the inner parts of your eyebrows 2. While your brows are down, try to open your eyes wide, without adjusting your brow position 3. Press your lips together tight. Do not pucker your lips, just tense them together 4. Glare
10. MICROEXPRESSIONS SADNESS 1. Drop your mouth open slightly 2. Pull the corners of your lips down 3. Hold your lips in place, and while doing that try to raise your cheeks as if you are squinting 4. While maintaining that tension, look down and let your upper eyelids droop
11. MICROEXPRESSIONS HAPPINESS Fake smile Real smile
12. HUMAN BUFFER OVERFLOW Read the colors
13. NEURO LINGUISTIC PROGRAMMING(NLP) ➔ Human Thinking ➔ Using correct payloads ➔ Structuring the statements
14. INTERVIEW • Subject talks, you listen • Soft in nature • You gather information • Early in investigation • You talk to subject about his statements • Hard in nature • If you reveal certain information, you can learn details • Final questioning session INTERROGATION 14
15. • Have a clear goal • Get the required information • Get the job done 15 EXPLOITATION
16. • Close the relationship • Cover the tracks • Don’t get caught EXIT 16
17. PHISHING Sending mails as an reputable organisation and gather information VISHING Making calls as an reputable organisation SMISHING Using SMS to gather required information IMPERSONATION Pretexting as another person ATTACK VECTORS
18. PHISHING CHARITIES GOVERNMENT CURRENT EVENTS FINANCIAL /
19. VISHING SUPPORT BANK EMPLOYEE
20. SMISHING FINANCIAL INSTITUTIONS JOB RELATED
21. SETTING UP WAITING SENDING ARE WE DOING IT? GETTING THE INFORMATION
22. INTO AN COMPANY NETWORK • There is a high chance of being caught when exiting • Clear footages and logs COVER THE TRACKS • Gather information about targets • Dressing up • Plan what exactly are you going to do • Execute and have a backup plan PLANNING & EXECUTION GATHER INFORMATION
23. TOOLS FOR SOCIAL ENGINEERING - PHYSICAL LOCK PICKS CAMERAS RECORDERS GPS TRACKER
24. TOOLS FOR SOCIAL ENGINEERING - ONLINE METASPLOIT ZPHISHER CALLER ID SPOOFER
25. TOOLS FOR SOCIAL ENGINEERING - ONLINE MALTEGO SOCIAL ENGINEERING TOOLKIT COMMON USER PASSWORD PROFILER
26. 26 PREVENT FROM SOCIAL ENGINEERING THINK BEFORE YOU CLICK RESEARCH THE SOURCES IDENTIFY THE FAKE DON’T DOWNLOAD ANYTHING FROM UNKNOWN SOURCES NEVER TRUST ANYTHING ON SOCIAL MEDIA
27. LAWS FOR SOCIAL ENGINEERING DON’T USE IT FOR MAKING SCAMS NEVER INTIMATE AS AN GOVERNMENT OFFICIALS
28. ANY QUESTIONS?
29. sudhakar.muthumani@owasp.org www.sudhakar-muthumani.me THANKS facebook.com/sudhakarmuthumani04 @sudhakar_._m sudhakarmuthumani