Social Engineering, Part 1: Scoring a Free Cell Phone « Null Byte :: WonderHowTo

ThisNull Byteis the first part in a mini-series on the art ofSocial Engineering. I will be teaching you how to effectively defend yourself against it.What is Social Engineering?Social Engineeringis the art of hacking humans. It's when a person is manipulated into doing something that they do not realize, or wouldn't normally do. Social Engineering plays on human trust in fellow people. People naturally want to trust others.When you see a not-so-well-to-do looking homeless person, you would occasionally give them money because they need it, right? What if that was wrong? What if that person dressed the way they do because they just want sympathy money? That is a Social Engineer.In this Null Byte, I'm going to show you how I "could" use Social Engineering to my advantage to getfreecell-phones. This is not something anyone should do in real life, but it does happen. The best way to defend yourself is to know your attacker, know how they think, and know their motivations: "If you know the enemy and know yourself, you need not fear the result of a hundred battles".Now, before we begin, you must know thatthis isn't 100% effective. The only way to become a highly effective Social Engineer is to practice, have confidence, and know your target. Without these things, a person will listen to their gut, and not fall victim to your manipulative techniques. If that happens, how are you supposed to be weary when you fall victim to it? When the attack is transparent, how could you notice when it's happening? Learn the in's and out's of how the process works.Step1Prepare for the AttackIf an attacker were to attempt social engineering, there are a few things he or she would set up and prepare before going through with the manipulation. For the sake of redundancy, I am going to refer to this person as "he" from here on out.He would have two cell phone stores in mind, of the same variety (Ex: Verizon). Preferably close together, so he would not have to drive or travel far.He would use a service likeTelespoof, a caller ID spoofing service that allows one free call. You can make your number appear on someone's caller ID as anything you choose.A phone is needed to use with Telespoof. He could also use aVoIPservice, such asSkypeorGoogle Voice.Step2Calling Target "A"The attacker would call the cell phone store of choice, in this case, Verizon (preferably, the one that is furthest away because this isn't the store the he would be traveling to).When an employee answers the phone, the attacker asks for the manager's name. He could say that he wants the name because he's calling corporate headquarters to say what great service the store provided last week. At this point, the attacker could use any story he desired, as long as it sounds legitimate. This will ensure that they don't know who the caller is, and will gladly give up the name. If the manager of the store isn't a male, he would have to try a different store until he found one, as this would obviously pose a problem when he tries to impersonate the manager later.The attacker then records the name of the manager, as well as the location of the store.Step3Calling Target "B"After the attacker gets the information needed, he then follows the below steps:Call the other phone store usingTelespoof, and enter the first target's phone number as the displayed caller ID.Impersonate being the manager, using their name that he got from the other store.Use a story similar to the following:"Hello, it's <insert name here> from the <insert location of the store> Verizon store. I have a customer here named <attackers name>, and this is embarrassing. They just bought one of those deals we are having on the new Moto Droid, the one where you get the phone free, and they signed the contract and everything, but we are all out of free phones. Can you help me out? If I send him down there, can you give him the phone?"More than likely, the person will say yes, because people love to help out their fellow human beings.Step4Going in for the ScoreTo finish the deal, the attacker then:Goes into the store called in Step 3, and asks for the employee whom he spoke with on the phone.Tells them who he is, and that he was told to speak with them regarding the phone ordeal that the "manager" of the other store spoke with them about.Receives his free phone, and walk out.Registers the phone to any plan he wants, sign up for a prepaid plan, or just sell the phone for profit.Can you see how simple it would be to manipulate someone using simple mind-trickery, and pretending to be an "insider"? This is why Social Engineering is scary, and people need to be educated.WarningsImpersonating someone is illegal, this guide is made as a forewarning, and to educate people on how easy it can be to be manipulated, do not attempt or use this information in an illegal or malicious way. This is made so you can see an example of a technique a skilled Social Engineer would use to manipulate their target.What You Should Have LearnedBe more cautious, and alert to potentially manipulative traps.Ask for ID when speaking to someone. Always verify someone's identity when doing business of ANY kind, it's good practice.Ask questions or start a thread in theForums!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Learn the Secrets of PsychologyHow To:Use Social Engineering to Find Out More Information About a CompanyHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHow To:Create Double Exposures with Your Cell PhoneHack Like a Pro:The Ultimate Social Engineering HackNews:Artificial Viruses Provoke the Immune System to Fight CancerListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Week 2)Listen In:Live Social Engineering Phone Calls with Professional Social EngineersListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Final Session)Weekend Homework:How to Become a Null Byte Contributor (2/17/2012)How To:Score Free Game Product Keys with Social EngineeringWeekend Homework:How to Become a Null Byte Contributor (2/10/2012)News:Students Exposed To Ringing Cell Phones Score Worse On TestsXbox LIVE Achievement:How to Earn Free Microsoft Points with Social EngineeringNews:Live Social EngineeringHow To:Proof of Social Engineering Success!Social Engineering, Part 2:Hacking a Friend's Facebook PasswordNews:Welcome to Phone Snap!News:This Wooden DIY Cell Phone Is Way Cooler Than Any Shiny SmartphoneHow To:Social Engineer Your Way Into an Amusement Park for FreeNews:Using Your Cell Phone Overseas.Weekend Homework:How to Become a Null Byte Contributor (2/3/2012)How To:Create DIY Filters for Your Cell PhoneHow To:Create Cool Holiday Lights with Excess Film CannistersNews:Google social web engineer Joseph Smarr talks about lessons from Google+Social Engineering:The BasicsNews:Block Cell Phone Signals on the Carrier of Your Choice by Hacking a Radio Frequency JammerHow To:recognize Crowd Control - Part 1How To:Become a Better InstagrammerNews:And the Winner of the Phone Snap Funny Face Challenge Is...Filter Photography Challenge:Make a WishHow To:Understand The Process of InflammationNews:Get Inspired! 20 Funny Faces Captured with Cell PhonesSUBMIT:Self Portrait Cell Phone Photo by January 16th. WIN: Portable USB Power SupplySUBMIT:Your Best Insect Photo by October 17th. WIN: Cell Phone Macro/Wide Angle Lens [Closed]SUBMIT:Photo Self-Portrait by September 5th. WIN: Bottle Cap Tripod Mount [Closed]SUBMIT:Your Best Camera Phone Photo by August 29th. WIN: Your Photo Custom-Framed in Hatchcraft's "Boo Box" [Closed]News:Hipstamatic Gets Social and Announces D-Series Disposable Camera AppHow To:The Social Engineer's Guide to Buying an Expensive LaptopSUBMIT:Your Best Cell Phone Filter Photo by November 14th. WIN: Touchscreen-Friendly Digits for Winter Gloves [Closed]