Showing posts with label Social Engineering. Show all posts
SE
Social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures.
A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appeal to vanity, appeal to authority, appeal to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
Social engineering is a component of many, if not most, types of exploits. Virus writers use social engineering tactics to persuade people to run malware-laden email attachments, phishers use social engineering to convince people to divulge sensitive information, ands careware vendors use social engineering to frighten people into running software that is useless at best and dangerous at worst.
Another aspect of social engineering relies on people's inability to keep up with a culture that relies heavily on information technology. Social engineers rely on the fact that people are not aware of the value of the information they possess and are careless about protecting it. Frequently, social engineers will search dumpsters for valuable information, memorize access codes by looking over someone's shoulder (shoulder surfing), or take advantage of people's natural inclination to choose passwords that are meaningful to them but can be easily guessed.
Security experts propose that as our culture becomes more dependent on information, social engineering will remain the greatest threat to any security system. Prevention includes educating people about the value of information, training them to protect it, and increasing people's awareness of how social engineers operate.
How to pick a lock
Lock picking is considered by some to be the original "hack". Long before computers there were locks and someone who wanted to manipulate them. The common misconception when picking a lock is that the process is difficult when, in actuality, it is quite simple. There are my methods to picking a lock but for this post we are going to go over the most basic method, “raking” or “scrubbing”.
Raking a lock is a simple, yet effective, way of manipulating the pins in a lock to open it without a key and can be achieved by the following steps:
- Insert the rake into the lock and make sure you are past the last pin. I like to push all the pins up so I can feel where the rake is placed in the lock. If you do not have a rake, one can be purchased from Bump My Lock
- Insert the tension tool into the lock not to obstruct the rake.
- Apply sight pressure on the tension tool in the direction you want to open the lock. This is the most difficult step in the process and will take some time to learn the right amount of tension. When teaching I like to use a rubber band on the end of the tension tool and pull just to when the rubber band starts to stretch.
- Try not and touch the walls of the key way and pull the rake straight out in one solid fast motion.
- If the lock does not open on the first try don't fret, insert the rake again, adjust your tension, and repeat the process.
Even though this is a simple way of picking a lock it will still take a good deal of practice and time to learn the skills and movements involved. One great tool for learning how to pick locks is the Lock Pick School in a Box and our Clear Practice Locks; both can be found here.
