-: In this lesson, we're going to cover
all of the other social engineering things
that we haven't talked about so far.
So the first one of these is
what's known as diversion theft.
Diversion theft occurs when a thief tries to
divert a shipment and take responsibility for it,
and send it to a different location.
So for example, maybe I call up FedEx
because I know you have a new laptop
being shipped to your office today,
and I pretend that I'm you and say,
"Oh, I'm not at my office, I'm actually at my house.
It's at 123 Main Street."
And now FedEx brings that over to me,
that was a diversion theft.
I mean, will they get it diverted to my location.
The next thing we're going to talk about here is a hoax.
Now, a hoax is an attempt at deceiving people into
believing something is false even if it's true,
or making them believe something is true,
even if it's false.
Basically, there's an idea of like a virus hoax.
I might send an email out to all of my friends and say,
"Hey everybody, there's a virus going around.
To protect yourself from it,
go to your C drive and delete your boot.ini file."
Now, there really was no virus,
but if they delete that boot.ini file,
they can mess up their systems and prevent it from booting,
causing them a problem, right?
The hoax was I made them believe there was something there
and made them take action into it.
And again, that makes it part of social engineering.
Now, the next one we have is
what's known as shoulder surfing,
and I think we've mentioned this before in the course.
That's when you're sitting at the office working,
and somebody comes up behind you and uses direct observation
to obtain authentication information.
So for example, as you're sitting there
logging into your computer,
if I look over your shoulder and watch your fingers,
and see you type in "P-A-S-S-W-O-R-D," "password,"
I now know your password, right?
That's the idea here with shoulder surfing.
It can be looking at your hands,
or it can be looking at your screen
and seeing the information on it
that you're not authorized to get.
The next one we have is eavesdropping.
Maybe I'm going to stand around
while you're talking with your boss,
and overhear you telling him some information
that I want to get.
By listening in and doing that direct observation
through my ears, I'm able to listen in to that conversation
and get the information I want.
The next one we have is dumpster diving.
This is when a person actually scavenges
for personal or confidential information
in garbage or recycling containers.
Yes, I know it sounds dirty, but guess what?
Hackers are willing to do it.
If they want to break into an organization,
they're going to look through your trash.
And one of the reasons is because there's good stuff
in the trash that they can find.
For example, maybe I go and I do a dumpster dive
of your organization before I do a pen test,
and from there I find a phone list,
and I find people's names and their position
and their phone numbers.
Now I can use that as part of my social engineering campaign
to get them to do what I need.
The next one we have is baiting.
Baiting is when a malicious individual leaves behind
a malware-infected thumb drive or USB drive or a CD
someplace around that somebody might have curiosity
to pick up and insert into their computer.
One of the ways that you do baiting
if you're not inside the organization,
is you can walk through their parking lot
and drop a nice 64-gigabyte thumb drive in there.
And if you drop it near somebody's car,
they might see it and pick it up, bring it into work,
plug it into the computer to see if it's empty,
and then malware can be installed.
The next one we have is piggybacking,
and we talked about this back in physical security.
This is going to occur when an unauthorized person tags along
with an authorized person to gain access
into a restricted area.
For example, let's say I have a server room door
that's protected by a combination lock or a cipher lock.
I'm authorized because I'm assistant administrator.
If I go in there and I PIN in and open the door,
and somebody walks in behind me, that's called piggybacking.
Now, it can even happen by me letting them in, right?
Because again, social engineers can trick us
into giving them access to things they don't need.
But if they're coming in on my swipe of my badge
or my PIN number, that means that's piggybacking.
Finally, we have a watering hole attack.
Now, watering hole attack we've mentioned before as well.
This is when an attacker figures out
where your users like to go, like a common website,
they attack that website, embed their own malware,
so next time when you go to that website,
you download the malware and again, get access.
Because you're trying to trick a user here
into doing something you want,
it also falls into this larger area of social engineering.
(electronic music)