2KKUU7ita

74
Part II: Putting Ethical Hacking in Motion
often takes time. Crafty social engineers can gain it within minutes or hours.
How do they do it?
✓ Likability: Who can’t relate to a nice person? Everyone loves courtesy.
The friendlier social engineers are — without going overboard — the
better their chances of getting what they want. Social engineers often
begin to build a relationship by establishing common interests. They
often use the information they gain in the research phase to determine
what the victim likes and to pretend that they like those things, too.
They can phone victims or meet them in person and, based on information
the social engineers have discovered about the person, start talking
about local sports teams or how wonderful it is to be single again. A few
low-key and well-articulated comments can be the start of a nice new
relationship. Of course, good looks don’t hurt either.
✓ Believability: Believability is based in part on the knowledge that
social engineers have and how likable they are. Social engineers also
use impersonation — perhaps by posing as new employees or fellow
employees that the victim hasn’t met. They may even pose as vendors
who do business with the organization. They often modestly claim
authority to influence people. The most common social engineering trick
is to do something nice so that the victim feels obligated to be nice in
return or to be a team player for the organization.
Exploiting the relationship
After social engineers obtain the trust of their unsuspecting victims, they coax
the victims into divulging more information than they should. Whammo — the
social engineer can go in for the kill. Social engineers do this through face-toface
or electronic communication that victims feel comfortable with, or they
use technology to get victims to divulge information.
Deceit through words and actions
Wily social engineers can get inside information from their victims in many
ways. They are often articulate and focus on keeping their conversations
moving without giving their victims much time to think about what they’re
saying. However, if they’re careless or overly anxious during their social engineering
attacks, the following tip-offs might give them away:
✓ Acting overly friendly or eager
✓ Mentioning names of prominent people within the organization
✓ Bragging about authority within the organization