CMU6XX

Ethical Hacking

Session 7: Social Engineering

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Understand the psychology of influence used in Social Engineering.
  • Differentiate between Phishing, Spear-Phishing, and Whaling.
  • Design effective pretexting scenarios utilizing OSINT.
  • Evaluate physical security vulnerabilities (Tailgating, RFID Cloning).
  • Understand the capabilities of the Social Engineering Toolkit (SET).

Seminar Structure (3 Hours)

Part 1: Digital Social Engineering (1.5 hrs)
  • The Psychology of Manipulation
  • Phishing Frameworks
  • Task 1: Spear-Phishing Campaign Design
Part 2: Physical Penetration Testing (1.5 hrs)
  • Tailgating & Piggybacking
  • RFID Cloning & Hardware Keyloggers
  • Task 2: Physical Breach Analysis

Part 1: Digital Social Engineering

Duration: 1.5 Hours

The Human Vulnerability

Amateurs hack systems. Professionals hack people.

  • Why spend weeks developing a zero-day exploit for a firewall when you can simply call an employee and ask for their password?
  • Pretexting: The foundation of social engineering. Creating an invented scenario (a pretext) to engage a targeted victim and increase the chance they will divulge information or perform actions that would be unlikely in ordinary circumstances.

Vectors of Attack

Social Engineering takes many forms across different mediums.

  • Phishing: Broad, untargeted emails sent to thousands of users ("Your account is suspended").
  • Spear-Phishing: Highly targeted emails based on OSINT ("Hi John, attached is the Q3 report for the Finance team").
  • Whaling: Spear-phishing specifically targeting C-level executives (CEO, CFO) for high-value payouts.
  • Vishing / Smishing: Voice phishing (phone calls) and SMS phishing (text messages).

Social Engineering Toolkit (SET)

A Python-driven tool inside Kali Linux designed entirely for social engineering.

  • Credential Harvester: Clones a legitimate website (e.g., Office365 login), hosts it on the attacker's machine, and logs any submitted credentials before redirecting the victim back to the real site.
  • Infectious Media Generator: Creates malicious payloads disguised as PDFs or Word documents to be sent via email or dropped on USB drives.
Practical Resource: TrustedSec SET Repository

Introduction to Task 1

A successful spear-phishing attack requires establishing authority, urgency, or trust through meticulous OSINT profiling.

We will design a highly targeted spear-phishing campaign against a corporate HR department.

Task 1: Spear-Phishing Campaign Design

Timing: 45 minutes

Scenario: You have been hired to test the security awareness of "Acme Corp". You found via LinkedIn that Acme recently switched to "Workday" for their HR portal.

  1. Draft the exact text of a spear-phishing email targeting the HR Manager. The email must establish urgency and explicitly reference their new Workday system.
  2. Detail the technical delivery mechanism: How will you spoof the sender address to bypass basic SPF checks? What domain will you register to host the credential harvester?
  3. Identify two Psychological Principles of Influence (e.g., Authority, Scarcity) you used in your email text.

15 Minute Break

Please return promptly for Part 2.

Part 2: Physical Penetration Testing

Duration: 1.5 Hours

Physical Security Bypasses

A multi-million dollar firewall is useless if an attacker can simply walk into the server room and plug in a USB drive.

  • Tailgating: Following an authorized person through a secure door without swiping your own badge. Often aided by carrying heavy boxes to exploit human politeness.
  • Piggybacking: Similar to tailgating, but the authorized person explicitly allows the attacker in (e.g., "I forgot my badge, can you let me in?").

Hardware Exploitation

Tools of the Physical Pentester:

  • RFID Cloners (Proxmark): Devices that can copy the signal of a standard 125kHz HID badge from several feet away, cloning the victim's access card onto a blank card.
  • Rubber Ducky: A USB device that looks like a flash drive but acts as a keyboard. It injects hundreds of keystrokes a second (e.g., opening a reverse shell) immediately upon insertion.
  • Hardware Keyloggers: Small adapters placed between a keyboard and a PC that record all keystrokes, bypassing all software antivirus.

Baiting & USB Drops

Exploiting human curiosity.

  • The Attack: An attacker leaves infected USB drives in the company parking lot or breakroom.
  • The Pretext: The USB drives are labeled with enticing titles like "Q4 Executive Bonuses" or "Confidential Layoffs."
  • The Result: Employees plug the drives into corporate machines to see what is on them, instantly executing the malicious payload.

Introduction to Task 2

Physical pentesting requires extensive reconnaissance to identify weaknesses in building security, employee habits, and camera blind spots.

We will analyze a physical security posture and design a breach methodology.

Task 2: Physical Breach Analysis

Timing: 50 minutes

Target Building: A corporate office occupying floors 3, 4, and 5 of a shared commercial skyscraper. The lobby has a security desk, but elevators to all floors are public. Floor 4 houses the server room.

  1. Identify the primary vulnerability in the building's layout.
  2. Design a multi-stage physical intrusion plan. How will you bypass the lobby security desk? How will you bypass the electronic lock on the 4th floor?
  3. Propose three architectural or policy changes the company must implement to prevent your attack.

Summary & Next Steps

  • Humans are consistently the weakest link in any security architecture.
  • Training and security awareness programs are the only defense against social engineering, as firewalls cannot patch human gullibility.
Next Week: Web Application Hacking (OWASP Top 10)