6 ms·

Possibly unpopular view: social engineering is not hacking. It is conning. People have been doing it since the beginning of time and one can do it with very l

Possibly unpopular view: social engineering is not hacking. It is conning. People have been doing it since the beginning of time and one can do it with very little technical skill. It's an insult to those who work hard for deep knowledge and technical ability, to call social engineering "hacking".

protontorpedo 5y ago
As a counter argument, social engineering is hacking through a different interface. You're still exploiting vulnerabilities, but in a low-tech, process-based system. But I agree that we should use different terms.
ThinkBeat 5y ago
Social Engineering is marketing speak to make [swindle, con, defraud, dupe, etc] to make it sound fancier and more palatasble- This is handy when youa re selling your consulting services. One of our consultants will con .. We have sone of the best con artists .... The term itself is a con.
PickledHotdog 5y ago
Yes, I mean, if you consider hacking to be purely technology based and not about, in part, accessing forbidden systems or manipulating components of the system to perform unintended functions then you may be right
kalium-xyz 5y ago
Hacking is a very broad category. I think you’re right to say this tho, it doesnt agree much with what the public considers hacking now
sen 5y ago
Good social engineering is a lot harder to do than 90% of online hacks, which are generally just skiddies downloading some PoCs from GitHub and spamming them until they get results. The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.
- to1y 5y ago
  I would be tempted to argue script kiddies =/= hackers. But that's getting too pedantic I suppose. To me hacking entails a thorough understanding of the environment.
- ThinkBeat 5y ago
  You are defining an unfair comparison. [Good] social engineering [Bad] hacking The vast majority of hacking and social engineering are pedestrians.
- throwaway675309 5y ago
  False. Social engineering has the same equivalent concept of script kiddies, just con artists who are reusing well-known types of patter/cons to be able to exploit age old evolutionary psychological vulnerabilities in humans that unlike computers, we are not able to easily patch.
endymi0n 5y ago
How is social engineering any different to lying to a JSON API and conning it into accepting a SQL query inside the request? If anything it‘s people like you worshipping technology itself and ignoring their users why social engineers are so effective. https://xkcd.com/538/ https://xkcd.com/538/
vishnugupta 5y ago
Not sure how it's an insult. It takes same amount of skill, practice, and hard work, if not more, for someone to become good at social engineering. Those two are two orthogonal skills, and one is not necessarily better/harder than the other. To be honest even I didn't have a high opinion of social engineering conmen, until I watched "Catch Me If You Can" and read about Frank Abagnale[1]. That said, most of the big hacks do involve social engineering angle. It's a cocktail of tech hacking + social engineering + good old plain con. https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale
- yesenadam 5y ago
  Abagnale gave a google talk too. But the last thing I read on the subject (I forget what, sorry) suggests it's most likely he just made most of his life story up.
  - cammikebrown 5y ago
    The ultimate conman fools everyone into thinking he’s a conman.
    - rob74 5y ago
      ...or fools everyone into thinking he invented his life story, when it was actually true.
  - homarp 5y ago
    > suggests it's most likely [Frank Abagnale] just made most of his life story up. https://news.ycombinator.com/item?id=27048793 https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"
- to1y 5y ago
  I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.
deleted 5y ago
[deleted]
sundarurfriend 5y ago
I was with you until the last sentence. They're very different skills being conflated because the end result is similar from a narrow view (and because "we got hacked (via social engineering)" sounds better than "we got conned"). But one is not inherently less difficult than the other. It's just inaccurate and kinda misleading to call one the other, not an insult to anyone.
user-the-name 5y ago
The hidden assumption here is that only "technical" skill counts. It's a skill. It's a difficult skill to master. And it is certainly an "insult" to dismiss it like you do here.
serverlessmom 5y ago
I would argue that the combination of the two skills is what makes a hacker like Thunder particularly scary. As a general rule I would say that most folks who are technical in a hacking capacity would struggle to learn social engineering and vice versa.
holoduke 5y ago
You need both to be the best. The technical only hacker will sooner or later face walls he can't pass. Same for the social engineering hacker.
dragonwriter 5y ago
> Possibly unpopular view: social engineering is not hacking. It is conning. “Conning" is just hacking systems consisting of one or more people. > People have been doing it since the beginning of time and one can do it with very little technical skill. People do other kinds of hacking with very little skill and a few focussed tricks (often borrowed form others), too. OTOH, deep knowledge of social systems allows doing original hacks of more complex social systems with greater theoretical safeguards (often, they are just as weak if you can identify the right point of attack, but that's where the knowledge comes in; just as with systems composed of things other than humans.) > It's an insult to those who work hard for deep knowledge and technical ability, to call social engineering "hacking". No, it's not.
madrox 5y ago
This may be a generational thing, but most IT security even a mere 20 years ago focused heavily on the human elements. Networks were different back then and people were far easier to dupe. You usually had to be on site to gain access to anything interesting. The social engineering tricks people roll their eyes at these days were invented back then for this purpose. Hacking is a broad term with deep roots. Let’s not gatekeep it too hard.

protontorpedo 5y ago

As a counter argument, social engineering is hacking through a different interface. You're still exploiting vulnerabilities, but in a low-tech, process-based system. But I agree that we should use different terms.

ThinkBeat 5y ago

Social Engineering is marketing speak to make [swindle, con, defraud, dupe, etc] to make it sound fancier and more palatasble- This is handy when youa re selling your consulting services. One of our consultants will con .. We have sone of the best con artists .... The term itself is a con.

PickledHotdog 5y ago

Yes, I mean, if you consider hacking to be purely technology based and not about, in part, accessing forbidden systems or manipulating components of the system to perform unintended functions then you may be right

kalium-xyz 5y ago

Hacking is a very broad category. I think you’re right to say this tho, it doesnt agree much with what the public considers hacking now

sen 5y ago

Good social engineering is a lot harder to do than 90% of online hacks, which are generally just skiddies downloading some PoCs from GitHub and spamming them until they get results. The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.

to1y 5y ago
I would be tempted to argue script kiddies =/= hackers. But that's getting too pedantic I suppose. To me hacking entails a thorough understanding of the environment.
ThinkBeat 5y ago
You are defining an unfair comparison. [Good] social engineering [Bad] hacking The vast majority of hacking and social engineering are pedestrians.
throwaway675309 5y ago
False. Social engineering has the same equivalent concept of script kiddies, just con artists who are reusing well-known types of patter/cons to be able to exploit age old evolutionary psychological vulnerabilities in humans that unlike computers, we are not able to easily patch.

endymi0n 5y ago

How is social engineering any different to lying to a JSON API and conning it into accepting a SQL query inside the request? If anything it‘s people like you worshipping technology itself and ignoring their users why social engineers are so effective. https://xkcd.com/538/ https://xkcd.com/538/

vishnugupta 5y ago

Not sure how it's an insult. It takes same amount of skill, practice, and hard work, if not more, for someone to become good at social engineering. Those two are two orthogonal skills, and one is not necessarily better/harder than the other. To be honest even I didn't have a high opinion of social engineering conmen, until I watched "Catch Me If You Can" and read about Frank Abagnale[1]. That said, most of the big hacks do involve social engineering angle. It's a cocktail of tech hacking + social engineering + good old plain con. https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale

yesenadam 5y ago
Abagnale gave a google talk too. But the last thing I read on the subject (I forget what, sorry) suggests it's most likely he just made most of his life story up.
- cammikebrown 5y ago
  The ultimate conman fools everyone into thinking he’s a conman.
  - rob74 5y ago
    ...or fools everyone into thinking he invented his life story, when it was actually true.
- homarp 5y ago
  > suggests it's most likely [Frank Abagnale] just made most of his life story up. https://news.ycombinator.com/item?id=27048793 https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"
to1y 5y ago
I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.

deleted 5y ago

[deleted]

sundarurfriend 5y ago

I was with you until the last sentence. They're very different skills being conflated because the end result is similar from a narrow view (and because "we got hacked (via social engineering)" sounds better than "we got conned"). But one is not inherently less difficult than the other. It's just inaccurate and kinda misleading to call one the other, not an insult to anyone.

user-the-name 5y ago

The hidden assumption here is that only "technical" skill counts. It's a skill. It's a difficult skill to master. And it is certainly an "insult" to dismiss it like you do here.

serverlessmom 5y ago

I would argue that the combination of the two skills is what makes a hacker like Thunder particularly scary. As a general rule I would say that most folks who are technical in a hacking capacity would struggle to learn social engineering and vice versa.

holoduke 5y ago

You need both to be the best. The technical only hacker will sooner or later face walls he can't pass. Same for the social engineering hacker.

dragonwriter 5y ago

> Possibly unpopular view: social engineering is not hacking. It is conning. “Conning" is just hacking systems consisting of one or more people. > People have been doing it since the beginning of time and one can do it with very little technical skill. People do other kinds of hacking with very little skill and a few focussed tricks (often borrowed form others), too. OTOH, deep knowledge of social systems allows doing original hacks of more complex social systems with greater theoretical safeguards (often, they are just as weak if you can identify the right point of attack, but that's where the knowledge comes in; just as with systems composed of things other than humans.) > It's an insult to those who work hard for deep knowledge and technical ability, to call social engineering "hacking". No, it's not.

madrox 5y ago

This may be a generational thing, but most IT security even a mere 20 years ago focused heavily on the human elements. Networks were different back then and people were far easier to dupe. You usually had to be on site to gain access to anything interesting. The social engineering tricks people roll their eyes at these days were invented back then for this purpose. Hacking is a broad term with deep roots. Let’s not gatekeep it too hard.