3 ms·

Not sure how it's an insult. It takes same amount of skill, practice, and hard work, if not more, for someone to become good at social engineering. Those two ar

Not sure how it's an insult. It takes same amount of skill, practice, and hard work, if not more, for someone to become good at social engineering. Those two are two orthogonal skills, and one is not necessarily better/harder than the other. To be honest even I didn't have a high opinion of social engineering conmen, until I watched "Catch Me If You Can" and read about Frank Abagnale[1]. That said, most of the big hacks do involve social engineering angle. It's a cocktail of tech hacking + social engineering + good old plain con. https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale

yesenadam 5y ago
Abagnale gave a google talk too. But the last thing I read on the subject (I forget what, sorry) suggests it's most likely he just made most of his life story up.
- cammikebrown 5y ago
  The ultimate conman fools everyone into thinking he’s a conman.
  - rob74 5y ago
    ...or fools everyone into thinking he invented his life story, when it was actually true.
- homarp 5y ago
  > suggests it's most likely [Frank Abagnale] just made most of his life story up. https://news.ycombinator.com/item?id=27048793 https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"
to1y 5y ago
I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.
- cycomanic 5y ago
  But dropping USB sticks or sending phishing emails (which could just as well be called technical hacking btw) is not what social engineering is about. That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means). Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).
- southerntofu 5y ago
  > Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API. When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.
  - to1y 5y ago
    >i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.
aortega 5y ago
>Not sure how it's an insult. Its an insult for a very good reason: Con men are dangerous. In the same way actual hackers see computers as targets, they see people as targets, not as human beings. They usually end up with some degree of psychopathy.
- FartyMcFarter 5y ago
  Is psychopathy something you can develop by lying?

yesenadam 5y ago

Abagnale gave a google talk too. But the last thing I read on the subject (I forget what, sorry) suggests it's most likely he just made most of his life story up.

cammikebrown 5y ago
The ultimate conman fools everyone into thinking he’s a conman.
- rob74 5y ago
  ...or fools everyone into thinking he invented his life story, when it was actually true.
homarp 5y ago
> suggests it's most likely [Frank Abagnale] just made most of his life story up. https://news.ycombinator.com/item?id=27048793 https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"

to1y 5y ago

I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.

cycomanic 5y ago
But dropping USB sticks or sending phishing emails (which could just as well be called technical hacking btw) is not what social engineering is about. That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means). Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).
southerntofu 5y ago
> Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API. When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.
- to1y 5y ago
  >i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.

aortega 5y ago

>Not sure how it's an insult. Its an insult for a very good reason: Con men are dangerous. In the same way actual hackers see computers as targets, they see people as targets, not as human beings. They usually end up with some degree of psychopathy.

FartyMcFarter 5y ago
Is psychopathy something you can develop by lying?