TBW season1-mission9 Social Engineering

Social Engineering Attacks and Techniques

Social Engineering…?

Social Engineering is the act of using persuasive techniques and deceptive tactics to manipulate

people into divulging confidential information.

社会工程学是一种使用具有说服力的技术和欺骗手段让对方泄露机密的行为。

Takes advantage of ingrained cognitive biases.

利用根深蒂固的认知偏见。

Key SE Attacks

Pretexting

Creation of a scenario that would make it easier for a target to reveal information.

设立一个场合,使目标更容易给出信息

Time sensitive & involving authority

时间敏感&涉及权威

Quid Pro Quo

Performing an action that is beneficial to the target in return for favors

执行对目标有利的行动以换取好处

Aim is to create a feeling of indebtedness

目的是让对方觉得欠你的

Pretexting Example

“Mr. Johnson said he needs those company files immediately before he boards his flight, I don’t even want to think of how mad he’ll get if they’re not sent right away. You gotta help me out!”

“约翰逊先生说他登机前必须拿到这些资料,要是拿不到的话我就吃不了兜着走了,你得帮帮我!”

Quid Pro Quo Example

“Hey, Brian from Sales here. Sent a pizza down to you guys in Tech Support for making the transition to the new database so easy! Thanks for your help! By the way, could you reset the password to my company account? It seems like I’m locked out.”

“你好,我是销售部布莱恩,谢谢你们帮忙,数据库浏览速度更流畅了。技术部送了个披萨过去。啊对了,能帮忙重设下我们公司账户的密码么,我不小心把它锁定了。”

Mind Your P’s & Q’s

Very importan that you appear polite and informed about areas your target is interested in

重要的是你对目标感兴趣的话题应具有一定知识,谈论起的时候客气些

Main goal for any social engineering task is to establish legitimacy in the mind of your target

任何社会工程学的目的都是在对方头脑里建立合理性

You’ve got mail!

Social engineering through emails sent to a target has proven to be a successful method for obtaining confidential information

使用社会工程学发送邮件到目标邮箱,获取机密信息

Done by using personal information about the target and appearing trustworthy

利用关于目标的个人信息增加邮件可信度

Fill in the Blanks

A list of highly effective email templates, designed by the SE team at Div 66 are available to you in the archive [GF95YN]

Get all the information you need from the target through OSINT! (Social media, forums, etc.)

填空

档案[GF95YN]中提供了由DIV66的SE团队设计好的高效电子邮件模板,通过OSINT(公开来源情报)从目标处获得需要的信息(社交媒体,论坛等等)

模板:

Hi [TARGET NAME],

I’m new at [TARGET COMPANY], my first week has been great and I was really happy to hear from your friend [CO-WORKER NAME] that you’re are a huge fan of [TARGET FAVORITE MUSICIAN]! I love that kind of music too, looking forward to the next album. I wanted to just introduce myself and ask if you were free next Friday? If so, we should go see [TARGET INTERESTED MOVIE/SPORTS GAME]. I think it’d be a great way to get to know each other.

Also, I wanted to know what the pin for the orders access portal is? They left a note on my desk about it, but I must have misplaced it and I’m a bit embarrassed to ask for another one.

Thanks!

–[FAKE NAME]