4 ms·

I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email wi

by to1y 5y ago

I would say it takes next to no practice or hard work at all. That's the problem with putting it under the "hacking" umbrella term. Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.

cycomanic 5y ago
But dropping USB sticks or sending phishing emails (which could just as well be called technical hacking btw) is not what social engineering is about. That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means). Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).
southerntofu 5y ago
> Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API. When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.
- to1y 5y ago
  >i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.

by to1y 5y ago

cycomanic 5y ago

But dropping USB sticks or sending phishing emails (which could just as well be called technical hacking btw) is not what social engineering is about. That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means). Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).

southerntofu 5y ago

> Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee. Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API. When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.

to1y 5y ago
>i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket. If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.