Social engineering attacks by phone is also called phishing with a word is a combination of voice and
phishing.
Vicious attacks are highly effective.
If you've done your homework and have all the relevant information and you already know where you get
the information in the first place.
This is where the information gathering phase comes into play.
You need to have a realistic scenario first before you call the victim.
You have to be very well prepared.
Who are you?
Where are you calling from?
What's your expertise?
What's the subject?
What do you want from the victim?
The more you prepare, the more the victim will trust you.
There are some tricks to being more realistic.
For example, if you're in the role of a call center staff, it's better to have a background voices.
If some of the staff are talking with other customers or clients, it's a very effective way to frighten
the victim.
Your computer is blocking a million dollar transaction to the company.
We have to fix it immediately.
Have you recently visited websites that you should not have visited?
Here, then, is the real world social engineering test that we performed in one of our tests, according
to the scenario, we are an IT department staff and want to make sure if all the employees got the critical
security update of the corporate email service, the critical points of the attack are as follows.
First, introduce yourself as one of the personnel from the IT department, now an information gathering
and reconnaissance phase.
If you found the real names working in the IT department, use one of these names.
But prepare yourself.
The victim may know the person whose name you're using.
If you don't know anyone in the IT department, choose a common name.
What's the most common name in that country?
Second, make the victim nervous about his or her mistake.
Well, it's critical and security are important.
You should have got the update up to now, but you haven't.
Third, gain the trust of the victim.
Don't share any information with me or anyone else.
Security is important.
Give the IP address of your malicious website because you share the URL on the phone, don't try to
find a Eurail similar to the company's Web mail service.
IP is good, but it's not understandable since the victim manages the steps, him or herself, he or
she has no doubt that the operation is secure.
The victim visits our Web site, which looks like the Web mail service of the company, and it downloads
our back door as the security patch.
The success rate of this test was.
Ninety percent.
In this course, you learned.
The terminologies and definitions of social engineering, basic social engineering techniques.
Social engineering types in the steps of the social engineering tests.
How to bypass security measures.
How to create malware.
How to create custom payloads to use inside the malware, how to embed the malicious code into the documents.
The social engineering toolkit.
And social engineering via phone, also known as phishing.