238 Chapter 10 ■ Social Engineering
In many of the cases discussed in this book, you have seen social engineering play a role.
One such example, is that of Trojans which exploit social engineering to entice a victim
to open an executable or attachment that is infected with malware. A Trojan is a piece of
malware that relies primarily on the element of social engineering as a mechanism to start
an infection. Using the social-engineering aspect, virus writers can entice an unsuspecting
victim into executing malware with the promise of giving them something they expect
or want.
Another example of how social engineering works is the case of scareware. This type
of malware is designed to frighten a victim into taking action when none is necessary. The
best example is the case of fake antivirus products that prompt users with very realistic, but
fake, messages that they should download an “antivirus” to disinfect their system.
In both cases, simple training and awareness could easily stop an attack before a security
incident occurred. You should know the signs of social engineering plus include a dose of
common sense prior to implementing social engineering in your testing. Some common
signs that may indicate a social-engineering attack include, but are not limited to, the
following:
■ Use of authority by an attacker, such as making overt references to who they are or
who they know or even making threats based on their claimed power or authority.
■ Inability to give valid contact information that would allow the attacker to be called or
contacted as needed.
■ Making informal or off-the-book requests designed to encourage the victim to give out
information that they may not otherwise.
■ Excessive name-dropping as to who the attacker knows inside the organization.
■ Excessive use of praise or compliments designed to flatter a victim.
■ Show of discomfort or uneasiness when questioned.Why is Social Engineering Successful?
Why has social engineering been successful, and why will it continue to be so? To answer
this, you must first understand why it works and what this means to you as a pentesters.
Going after the human being instead of the technology works for a number of reasons:Trust Human beings are a trusting lot. It’s built into the species. When you see someone
dressed a certain way (such as wearing a uniform) or hear them say the right words, it
causes you to trust them more than you normally would. For example, if you see someone
dressed in a set of scrubs and carrying a stethoscope, it causes you to trust them. This
tendency to trust is a weakness that can be exploited.Human Habit and Nature Human beings tend to follow certain default habits and actions
without thinking. People take the same route to work, say the same things, and take the
same actions without thought. In many cases, humans have to consciously attempt to
act differently from the norm in order to break from their learned habits. A good social