Social Engineering is a technical skill, defined as the art of manipulating and penetrating human beings unknowingly skillfully in order to gain access and getting anything for free against the intended target. It is defined also as manipulating a person into knowingly or unknowingly giving up information; essentially ‘hacking’ into a person to steal valuable information. Nowadays, many people are unaware of sharing data with people, a matter which allows others to steal data and make use of it. Social Engineering relies on the goal of its user, who gives truthful illusive questions, proofs and information to fulfill the goal he intendeds to access. It is utilized stealthily in everyday life there are many types of Social Engineering for example, when parents convince their children to take up a medicine because of illness or something like that and they reply; here the parents managed successfully to penetrate their children’s mind and convince them to do what they want. Political speeches are one of the types of social engineering when the government intends to frame their messages truly, they choose to use the power of manipulation and deception to persuade the people that what they say is totally true. Advertising is another type of social engineering when a company manager aspires to distribute a product widely; he cunningly makes-up his product whether by adding false promises, background and information to the public. Even spies are experts in this field, they are taught how to fool and manipulate people to make them believe what they say. This art depends on two fundamental elements performed by the social engineer such as credibility and trust; those elements enable the one to the final path which is gaining access to someone’s mind. A social engineer should have enough skills and power of knowledge to perform those attacks, a matter which depends on the human weakness or may be called “Vulnerability”. Performing Social Engineering may take people deeply into the infrastructure of the human being, analyzing its weakness and ways of penetrating it skillfully differs from one to one. Human being infrastructure in Social Engineering can be viewed as a building which may be insecure or vulnerable full of security holes; in this case the task comes to the social engineer to scan it showing its weakness points and penetrate it. Social Engineering can take on many forms, it can be malicious and it can be friendly; it can build up and tear down. A successful social engineer who makes use of knowledge and education in a practical way to distract and manipulate the target, as knowledge represents the power element of logical persuasion in the attack against the target. Social Engineering consists of significant techniques performed by the attacker in his or her way to gain access such as information gathering, elicitation and pretexting etc.
Information gathering is one of the effective primary phases in which the social
engineer counts on at first to gain information about a certain target. It is
the social engineer primary stage, of collecting data about the target using
skillful methods of reconnaissance or surveillance stealthily. This technique
drives the skillful social engineer to active interactions with the target and
opening up discussions lead to some valuable information which may later help
the social engineer. Gathering information is like building a house. If you try
to start with the roof your house will surely be a failure. A good house will
be built using a solid foundation and from there it will be built literally
from the ground up. As you gather information you may be overwhelmed with how
to organize and then use this data, so starting a file or an information
gathering service to gather this data in is a good idea. Social Media has
become one of the effective ways of streaming information of people; it touches
a large number of critical information of its users a matter which provides
anyone of identifying someone’s identity. Many of the skills or methods that a
social engineer may use come from other fields. One field that is great at
gathering information is sales. Salespeople tend to be very talkative,
easygoing, and very good at collecting data about those with whom they
interact. Using simple wording can get a person to open up and refer family,
friends, and maybe even coworkers. Harvesting, or gathering this information
and then storing it, allows the sales people to have what they call “warm
leads” to call on. A warm lead is where they have a person with an “in,” a way
to get in the door without having to cold call. The salesperson gathers
information from his present client, and then he relays that information in a way
that will make the new “target” more susceptible to listen and let him in. This
technique is effective in that it builds trust, uses familiarity, and allows
the target to feel comfortable with the salesperson, or the social engineer,
giving their mind a bridge over the gap that normally would exist there. The
first ingredient in any recipe for a social engineer is information. Every
attacker utilizes some tactics or tools for gathering information such as
pretexting, which is creating fake scenarios or incidents to convince the
victim with it and to gain information unknowingly. Identity theft is one of
the tactics used in surveillance processes; with it a social engineer can
disguise himself as another one to the target to collect information. Every tiny
piece of information may help greatly in penetrating someone rapidly.
Elicitation is another powerful technique often used by social engineers to
extract information from the targets. Elicitation is a technique used to
discreetly gather information. It is a conversation with a specific purpose:
collect information that is not readily available and do so without raising
suspicion that specific facts are being sought. It is usually non-threatening,
easy to disguise, deniable, and effective. The conversation can be in person,
over the phone, or in writing, Conducted by a skilled collector, elicitation
will appear to be normal social or professional conversation. A person may
never realize she was the target of elicitation or that she provided meaningful
information. It is used by spies, con men, and social engineers, as well as
doctors, therapists, and law enforcement. Elicitation means to bring or draw
out, or to arrive at a conclusion (truth, for instance) by logic.
Alternatively, it is defined as a stimulation that calls up (or draws forth) a
particular class of behaviors, as in “the elicitation of his testimony was not
easy”. Many competitive business intelligence collectors and foreign
intelligence officers are trained in elicitation tactics. Their job is to
obtain non-public information. A business competitor may want information in
order to out-compete your company, or a foreign intelligence officer may want
insider information or details on US defense technologies. It is not uncommon
for people to discover information about a person without letting on the
purpose. For example, have you ever planned a surprise party for someone and
needed to know their schedule, wish list, food likes and dislikes or other
information without that person finding out you were collecting the information
or for what purpose? The problem comes when a skilled elicitor is able to
obtain valuable information from you, which you did not intend to share,
because you did not recognize and divert the elicitation. There are many elicitation
techniques, and multiple techniques may be used in an elicitation attempt. The
following are descriptions of some of those techniques such as Assumed
Knowledge, Bracketing, Confidential Bait, Criticism, Deliberate False
Statements etc.
Pretexting is another effective technique of Social Engineering which is utilized by the most of social engineers to infiltrate people, organizations and companies etc. Pretexting is better defined as the background story, dress, grooming, personality, and attitude that make up the character you will be for the social engineering audit. Pretexting encompasses everything you would imagine that person to be. The more solid the pretext, the more believable you will be as a social engineer. Often, the simpler your pretexts, the better off you are. In social engineering playing a role or being a different person to successfully accomplish the goal is often imperative. Pretexting is also used in areas of life other than social engineering. Sales; public speaking; so-called fortune tellers; neurolinguistics programming (NLP) experts; and even doctors, lawyers, therapists, and like all have to use a form of pretexting. They all have to create a scenario where people are comfortable with releasing information they normally would not. The difference in social engineers using pretexting and others are the goals involved. A social engineer, again, must live that persona for the goals involved. A social engineer, again, must live that persona for a time, not just act a part. A very important aspect to remember is that the quality of the pretext is directly linked to the quality of the information gathered. The more, the better, and the more relevant the information the easier it will be for the pretext to be developed and be successful. For example, the classic pretext of a tech support guy would utterly fail if you went to a company that either had internal support or outsourced to a very small company of one or two people. As natural as you are when you converse with someone about who you really are is how easy applying your pretext should be. As with every skill, certain principles dictate the steps to performing that task. There are various principles of pretexting that may be used. By no means are these the only principles out there; maybe others can be added, but these principles embody the essence of pretexting: Extensive researching, providing personal interests, practicing dialects or expressions, simplifying the pretext, spontaneous pretext and providing logical conclusions.
In conclusion, Social Engineering plays a vital role in our everyday life, encountered by many people who are being deceived unknowingly. Social Engineering suggests an intensive analysis which delves deeply into the human being psychology to figure out its weakness points. This technique consists of many influential methods and tactics such as information gathering which is one of the skillful ways of collecting data and information about the target. Elicitation is one of Social Engineering powerful method of collecting data through conversations. Pretexting is another technique which is pretending to be someone else in order to fool and manipulate people to access particular information.