EvilZone

Hacking and Security => Hacking and Security => : Deque March 27, 2015, 09:27:52 AM

: [Question] Protection from Social Engineering
: Deque March 27, 2015, 09:27:52 AM
I had once a person knocking on my door and telling me that there was an article in the newspaper that announced his arrival and asking me if I had read that article (there was never any article like that, though).

He told me he wanted to ask some questions. I said shoot. He wanted to write something down, but had nothing to write on and asked to come in. At that moment I knew this was fake, he was unprepared on purpose. Nevertheless I let him take one step in my home (just one step away from the door, nevertheless I let him in, which was a mistake). He proceeded to ask questions involving my opinion towards drug addicts and if they should get a second chance. I refused to give a definite answer, because these questions were just too broad and depend on the situation and the person involved. It turned out that this guy wanted to sell me abonnements for several magazines, and he claimed he had been a drug addict himself, but wants a second chance and needs money to get a proper education. I refused.

"But you told me earlier that drug addicts deserve a second chance"
"I did not. Did you even listen?"

I also knew that this whole interview was just to get me later with this argument, so I feel forced to act in accordance with what I said.
He tried really hard to convince me by other means. He was not successful in getting my money, but he was so hard to get rid off, because he had one foot in my door. I regret that I allowed him to come in and that I did not throw him out immediately later.

Very often I know that something is fishy, but find myself in the position that I don't want to come off as rude and I can watch myself saying or doing things although I know at this very moment that I will regret them.

I want to know, how I can get myself to react in a better way and protect myself better? How can I get over my own politeness?

Once I had a similar situation with a person asking me three questions, which were all meant to be answered with "yes". It was like: "Do you care about your environment" "Do you prefer to buy stuff that is good for the environment?"
I was somewhat in a weird mood and answered all them with "no" (which was an honest answer at that moment). The face of the interviewee was hilarious, though. The next day three people stood at my door and wanted to come in to give me a present, because I won something for this interview. I refused to let them in, I had only a 7 qm room and no space for three people. I said they can give me the present and go away, why would they need to sit somewhere to give me a present? Turned out they actually wanted to sell something and I was glad that I refused.

But I really felt bad after both of these incidents. I still felt like a victim and for the whole day I was in a bad mood because of that.
It is always like that. I somewhat manage to get out of the situation without paying or buying or signing, but my time is wasted and my mood is down.
: Re: [Question] Protection from Social Engineering
: Kulverstukas March 27, 2015, 10:34:33 AM
I had posted an article how to protect yourself, but dunno how relevant is it to your situation: https://evilzone.org/tutorials/social-engineering-for-the-rest-of-us-protection-for-humans/
As for protecting yourself, I recommend the book: https://evilzone.org/ebooks/liespotting-proven-techniques-to-detect-deception/
When it comes to refusing, I can imagine how being too polite can be an issue :D I  have no tips for that tho, I'm just rude myself when I need to be, and I don't seem to have a problem with shooing someone away...
Tho since I also live outside of city, I don't get such idiots at my door at all :D
: Re: [Question] Protection from Social Engineering
: iTpHo3NiX March 27, 2015, 09:36:03 PM
Seems like basic salesmen tactics. Salesmen are actually great social engineers. They make you buy shit you don't need, happens all the time. To beat a social engineer, you need to SE the SE. read their body language, see what they're trying to do. Read the posts Kulverstukas just posted about NLP great information there.
: Re: [Question] Protection from Social Engineering
: cyberdrifter March 27, 2015, 10:26:16 PM

General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.






x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).
: Re: [Question] Protection from Social Engineering
: v32itas March 28, 2015, 03:34:37 AM
My advice would be something offensive. If you want to be able to detect deception I'd say don't waste too much time on readings about how people can lie. But train yourself to lie. There is a good book 'Kevin Mitnick - The art of Deception' or something like that with real examples. For me SE comes naturally. I grew up among thieves ant deceivers. When you start persuading people daily you'll start to see that same things goes over and over again just in different package.  And you'll start to spot manipulation attempts in others.

General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.






x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).

These are good advices, but in countries like UK gun deterrence is not an option. People often gets stabbed with knives and skrewdrivers, but guns is only for serious businesses here.
: Re: [Question] Protection from Social Engineering
: d!amond March 28, 2015, 04:36:21 PM
Very often I know that something is fishy, but find myself in the position that I don't want to come off as rude and I can watch myself saying or doing things although I know at this very moment that I will regret them.

I think thats where your problem is located.  You have to learn to say "no" in special occasions. For example, don't let random people into your room. If there is a strange guy in front of my door talking about crazy stuff, who is not the postman or the police or whatever, I wouldn't think twice to tell him to fuck off.
: Re: [Question] Protection from Social Engineering
: HTH March 29, 2015, 12:26:15 AM
General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.

x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).

I like this option and it is pretty close to the way I deal with people I dont want to talk, see a questionable motherfucker walking across the street towards me? Get the gun(whatever it happens to be) out of the backseat or trunk of my car and walk inside, he is NOT gonna follow you, he doesnt know its not loaded. (Assuming we're following the law here).

That being said, one thing, If I see someone shoulder carrying a long arm there's an instant assumption of "has no idea what he's doing" since it is literally the worst way to carry a firearm and any safety instructor worth his salt would smack the shit out of you for doing so. Not saying thats the case here and its probably just because the gun is unloaded that you don't care about safer carries but it's still worth considering. I'd just be more wary of someone whom I felt was in total control and at total ease with the rifle/shotgun. (obviously lots goes into that, the carry type is just the only thing in the post)

But I'm also not a criminal, and I also grew up handling firearms about as often as tonka trucks (for legal reasons) so I might be the wrong person to comment on the mentality of some street thug whose gonna be casing a place.

@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.
: Re: [Question] Protection from Social Engineering
: v32itas March 29, 2015, 01:32:38 AM
I was reading over and over again about your gun deterrence. And it gave me an idea, of something more SE than bruteforce. Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent. And talking in even more poor english than I am. That would even be a good and harmless practice of SE as well as practical evasion of talking.
: Re: [Question] Protection from Social Engineering
: Teapot March 29, 2015, 03:52:58 AM
Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent.
lol me and my dad pretend to be Mexican immigrants whenever telemarketers call.
Works like a charm.
: Re: [Question] Protection from Social Engineering
: cyberdrifter March 29, 2015, 03:59:08 AM

1. The shotgun I refer to is a Pump-action Mossberg 500 Cruiser 8-shot link (http://www.mossberg.com/products/shotguns/mossberg-500-tactical/500-6-shot-8-shot).  The thing about a pump action shotgun is that the rounds are secured in a tube magazine below the barrel of the weapon.


This weapon needs to be charged, and placed on fire, Making it highly unlikely to discharge on its own.


2. Anyone that would tell you resting a shotgun against your shoulder is unsafe, is an idiot that has no idea what they're talking about. The shotgun would be pointing skyward to prevent it from flagging someone (In the very unlikely case that it could discharge). While this isn't an aggressive, tactical ready position, and there are safer positions (two hands are always better than one) it is safe.


3. I learned how to shoot a rifle when I was 10, I've been around them my entire life.


4. As for your "following the law comments" The rules on carrying a weapon are heavily dependent on the state you live in. However in mine so long as you hold a concealed carry license it's quite legal to possess a loaded firearm, both in your home, in your car, and on your person (certain locations excluded).

I like this option and it is pretty close to the way I deal with people I dont want to talk, see a questionable motherfucker walking across the street towards me? Get the gun(whatever it happens to be) out of the backseat or trunk of my car and walk inside, he is NOT gonna follow you, he doesnt know its not loaded. (Assuming we're following the law here).

That being said, one thing, If I see someone shoulder carrying a long arm there's an instant assumption of "has no idea what he's doing" since it is literally the worst way to carry a firearm and any safety instructor worth his salt would smack the shit out of you for doing so. Not saying thats the case here and its probably just because the gun is unloaded that you don't care about safer carries but it's still worth considering. I'd just be more wary of someone whom I felt was in total control and at total ease with the rifle/shotgun. (obviously lots goes into that, the carry type is just the only thing in the post)

But I'm also not a criminal, and I also grew up handling firearms about as often as tonka trucks (for legal reasons) so I might be the wrong person to comment on the mentality of some street thug whose gonna be casing a place.

@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.
: Re: [Question] Protection from Social Engineering
: Kulverstukas March 29, 2015, 10:17:07 AM
Yeah, I somehow expected to get "guns and shit" replies from muricans. You people seriously can't expect europeans to show off guns while taking out the trash, so basically the suggestions are useless.
: Re: [Question] Protection from Social Engineering
: v32itas March 29, 2015, 10:56:08 AM
Yeah, I somehow expected to get "guns and shit" replies from muricans. You people seriously can't expect europeans to show off guns while taking out the trash, so basically the suggestions are useless.
I agree with that. Because it's like question about SE not about deterrence, like razor wires around your house with dogs and stuff, and some kind of cold war about who has a bigger guns on display. Especially when its all about evading social engineers, not about digging up defences around your fortified bunker with fallout shelter preparing for terrorists attacks...
EDIT
In Europe no one is waving guns. They are using guns in very serious cases. And having shotgun on your shoulder might even get you stabbed. Cause if talking about close quarter combat such shotgun is ineffective in close quarter combat, its too long.  Deadliest weapon in close quarter combat is knife, even more deadlier then a pistol(which is fairly effective in close quarter) And knives intended to be felt not seen. And by the moment you felt stab its usually to late. So when people comes to talk to you my suggestion would be to talk. In case you're not interested in talking I'll just quote my self
I was reading over and over again about your gun deterrence. And it gave me an idea, of something more SE than bruteforce. Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent. And talking in even more poor english than I am. That would even be a good and harmless practice of SE as well as practical evasion of talking.
Practice Social Engineering.
: Re: [Question] Protection from Social Engineering
: Deque March 29, 2015, 01:59:21 PM
Thanks to all of you for your valuable advice.

To everyone telling me to learn SE:
SE is something that interests me a lot. I read books (including the mentioned one from Mitnick) and articles on the topic. However, conversations are already hard for me as is. I am easily overwhelmed. I can only concentrate on one-on-one conversations, and even then it is something that often just goes too fast for me.
I am a bad social engineer as I feel I am already worse in social stuff than the majority of people.
I know the theory and cannot apply it, especially in situation I did not expect. So that's why I often see things coming, but feel that I have not enough time to think about how to react as I am already trying to listen at the same time.

I usually know of perfect answers and reactions afterwards.

Some simple rules have helped me out, which includes never to buy anything on the door, never to sign anything without sleeping over it a night or better a week. But my politeness really annoys me.

@Kulver
Your articles are very interesting and I've read most of them. Thanks for posting them.


@cyberdrifter
Very interesting read, but I am European too. :D
However, it reminds me of my father. When Zeugen Jehovas came to his house, he threatened them with his chainsaw. They never showed up again.

@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.

How can I learn it, though? Role play?
: Re: [Question] Protection from Social Engineering
: Lenoch March 30, 2015, 09:33:20 AM
I would play the ball right back at the guy. Say you have to finish something for work and if you can't finish it you may loose your job. It will put him in a position of guilt giving you control over the conversation.

Also if you question the morality. I would say its morally justified to lie in that situation since he wants to decieve you into buying stuff you don't need and playing you into that way.

Edit: Deque, it's normal that you can't apply the theory as easy. social interactions are quite complex. and people are also infinitly complex. you will never get the reactions exactly like they are explained. best that theory can make you do is to make you adaptable in such situations.
: Re: [Question] Protection from Social Engineering
: shome April 02, 2015, 12:39:23 PM
The first thing this thread reminded me of was the money laundering scene from the movie, "Office Space." lol
: Re: [Question] Protection from Social Engineering
: Darkvision April 02, 2015, 11:51:10 PM
Thanks to all of you for your valuable advice.

To everyone telling me to learn SE:
SE is something that interests me a lot. I read books (including the mentioned one from Mitnick) and articles on the topic. However, conversations are already hard for me as is. I am easily overwhelmed. I can only concentrate on one-on-one conversations, and even then it is something that often just goes too fast for me.
I am a bad social engineer as I feel I am already worse in social stuff than the majority of people.
I know the theory and cannot apply it, especially in situation I did not expect. So that's why I often see things coming, but feel that I have not enough time to think about how to react as I am already trying to listen at the same time.

I usually know of perfect answers and reactions afterwards.

Some simple rules have helped me out, which includes never to buy anything on the door, never to sign anything without sleeping over it a night or better a week. But my politeness really annoys me.

@Kulver
Your articles are very interesting and I've read most of them. Thanks for posting them.


@cyberdrifter
Very interesting read, but I am European too. :D
However, it reminds me of my father. When Zeugen Jehovas came to his house, he threatened them with his chainsaw. They never showed up again.

How can I learn it, though? Role play?

A lot of great advice above but two things:
1. id say that you should realize that it is not IMPOLITE to say no. So when they ask to come in just say that. or tell a white lie(that may not even be a lie) such as sorry but your to busy.
2. I find that people are less likely to come around(again) when you either waste their time or piss them off(or better yet both). However that would be the "impolite" way to do things, so option one is probably better for you.
: Re: [Question] Protection from Social Engineering
: CyberNox April 05, 2015, 04:47:17 AM
I hate sales people at my door. Regardless if they're scams or not.
: Re: [Question] Protection from Social Engineering
: Deque April 06, 2015, 08:28:34 PM
A lot of great advice above but two things:
1. id say that you should realize that it is not IMPOLITE to say no. So when they ask to come in just say that. or tell a white lie(that may not even be a lie) such as sorry but your to busy.
2. I find that people are less likely to come around(again) when you either waste their time or piss them off(or better yet both). However that would be the "impolite" way to do things, so option one is probably better for you.

You are right. It does not have to be impolite to say no. I've got to get that in my head and add the rule "never let someone in".

I would play the ball right back at the guy. Say you have to finish something for work and if you can't finish it you may loose your job. It will put him in a position of guilt giving you control over the conversation.

Also if you question the morality. I would say its morally justified to lie in that situation since he wants to decieve you into buying stuff you don't need and playing you into that way.

Edit: Deque, it's normal that you can't apply the theory as easy. social interactions are quite complex. and people are also infinitly complex. you will never get the reactions exactly like they are explained. best that theory can make you do is to make you adaptable in such situations.

Thank you.
I find it hard to lie. But it might make things easier sometimes.
: Re: [Question] Protection from Social Engineering
: sh4d0w_w4tch April 07, 2015, 06:26:52 PM
If someone is actually trying to run a scam, don't be afraid to be rude.  People who are afraid to be rude or say no will always be stomped on by con artists and salesmen.  There is nothing wrong with being rude to them.  If you worry about being wrong, then you can make up some reason why you can't do what they ask.  If they ask to use your shower and say that they're at risk of failing a job interview, tell them that the water has just been turned off.  You can also admit that nobody is allowed to see the inside of the house for security.

If a homeless person asks for a 20, offer 5.  I've taken some awkward white boys into the city who think they're going to get stabbed if they don't turn over money when a homeless person asks.  We're not going into a ghetto either.  Certainly old and urban, but not a ghetto by any means.
: Re: [Question] Protection from Social Engineering
: Kulverstukas April 07, 2015, 07:42:51 PM
If a homeless person asks for a 20, offer 5.
Normally I tell them that all of my money is on the card right now :P
: Re: [Question] Protection from Social Engineering
: sh4d0w_w4tch April 07, 2015, 08:25:53 PM
Normally I tell them that all of my money is on the card right now :P

That's the way to go.  Usually it's what I do when it's the third person that day and I've been giving enough free handouts.