Social-Engineering-Penetration-Testing-Executing-S

Fear and paranoia need not always be negative, they
can also be catalysts for positive change when it comes to security.

The dropbox will typically be a fully functional computer that can be plugged
into a network and left behind.

The guys over at http://pwnieexpress.com have been making penetration test dropboxes for some time. It all started with the PwnPlug, which is basically a
mains power plug with a tiny computer built in.

There is nothing better than gaining physical access to something that is well
guarded.

The second somebody thinks they might not get paid, they will be very com-
pliant. Money is certainly one of the very best motivators.

Yes, finding passwords on
Post-It notes would be fantastic, but don’t dismiss other potentially key pieces of
information. For example, what about finding a printout of an e-mail conversation
that someone has binned.

As mentioned many times in this book, the smoking area is a great
place to interact with employees with minimal suspicion.

At this point, the employee says
the card cloner is running out of the store and puts the phone down, but doesn’t
hang up. This keeps the call active, even if the victim hangs up at their end.
At this point, the victim attempts to call their bank, but in their panic they do
not realize that there was no dial tone. The attacker has remained on the line the
entire time. When the victim asks, “Hi, is that Barclays Bank?,” the attacker
answers yes and asks how they can help.

The fact of the matter is that paranoia needs to be taught. People should be
encouraged to question a person for some form of identification, and if they can-
not prove themselves, hang up.

Don’t name names. Don’t shame people. Don’t embarrass people.