Question

• Write a 3 to 4 page paper where you discuss the social engineering process. Pick a fictitious person and explain how you would attempt to use social engineering on that person.     

Answer 1

Ans 1.
Engineering is the application of science/math to solve real life problems. Engineers find out that how things
work .
And science is a systematic study of any thing.
social science is a systematic study of society.
a systematic study of society can help the society in various ways.
but in context of Information security.
social engineering means to study the psychology of
of an individual(victim) to take his/her(victim's) confidential information(such as PIN, passwords, credit card number and so on.
After having such confidential information, the attacker can misuse this information.

So, a person who is attempting to grab the victim's confidential information should be shrewd.
and should have the tendency to cheat his/her friends colleague and so on.
because social engineering is always applied to the persons who are familiar with the attacker.

It is very difficult to know the password of a victim by cracking/guessing.
the easiest way,that victim reveals his/her confidential information to the attacker.
An attacker can make it possible by following methods

Baiting:
If an attacker knows about the victim's internet habits, hobbies( such as listening audio, watching video).
Attacker can set the bait for the victim in following ways.
a)False lottery email
there is a chance, that the victim clicks some link and the malware may take its place on the victim's computer.for example key logger can record all the key strokes made by the victim.
b)Too much trust
An attacker can gain the trust of the victim by helping him/her in various ways.
and victim can give his/her confidential information to the attacker.
c)Phishing:False web page can be sent to the victim's computer such as bank account login page to steal the password(by key logger).
d)online shopping:- if a victim uses credit/debit card for online shopping,victim enters credit/debit card number and other confidential information, which can be taken by the attacker(using key logger).
e)installation of the malware(key logger) on the victim's computer:-
if victim's hobby is to watch videos, and attacker knows victim's choice,attacker can send such videos.
when victim downloads such videos,malware will be installed with the downloaded videos.

Ans 2.

Attacker:-Mr. ABC
target/victim:- Mr. XYZ

As stated earlier, social engineering is a game of psychology.
So, first of all, attacker should make up his/her mind to cheat some one.
and attacker should also be shrewd.

Now, attacker will increase the interaction with the target/victim.
for example: shop together, lunch together, and other social activities.

It this way attacker can study victim's habits such as internet habits, hobbies( such as listening audio, watching video).

Now attacker should try phishing.

Attacker can also plant the malware on the victim's computer by giving audio/video to the victim.

Attacker can gain trust of target/victim.

and can take the advantage of this trust.