Author Topic: [Question] Protection from Social Engineering  (Read 2797 times)

0 Members and 1 Guest are viewing this topic.

Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
[Question] Protection from Social Engineering
« on: March 27, 2015, 09:27:52 am »
I had once a person knocking on my door and telling me that there was an article in the newspaper that announced his arrival and asking me if I had read that article (there was never any article like that, though).

He told me he wanted to ask some questions. I said shoot. He wanted to write something down, but had nothing to write on and asked to come in. At that moment I knew this was fake, he was unprepared on purpose. Nevertheless I let him take one step in my home (just one step away from the door, nevertheless I let him in, which was a mistake). He proceeded to ask questions involving my opinion towards drug addicts and if they should get a second chance. I refused to give a definite answer, because these questions were just too broad and depend on the situation and the person involved. It turned out that this guy wanted to sell me abonnements for several magazines, and he claimed he had been a drug addict himself, but wants a second chance and needs money to get a proper education. I refused.

"But you told me earlier that drug addicts deserve a second chance"
"I did not. Did you even listen?"

I also knew that this whole interview was just to get me later with this argument, so I feel forced to act in accordance with what I said.
He tried really hard to convince me by other means. He was not successful in getting my money, but he was so hard to get rid off, because he had one foot in my door. I regret that I allowed him to come in and that I did not throw him out immediately later.

Very often I know that something is fishy, but find myself in the position that I don't want to come off as rude and I can watch myself saying or doing things although I know at this very moment that I will regret them.

I want to know, how I can get myself to react in a better way and protect myself better? How can I get over my own politeness?

Once I had a similar situation with a person asking me three questions, which were all meant to be answered with "yes". It was like: "Do you care about your environment" "Do you prefer to buy stuff that is good for the environment?"
I was somewhat in a weird mood and answered all them with "no" (which was an honest answer at that moment). The face of the interviewee was hilarious, though. The next day three people stood at my door and wanted to come in to give me a present, because I won something for this interview. I refused to let them in, I had only a 7 qm room and no space for three people. I said they can give me the present and go away, why would they need to sit somewhere to give me a present? Turned out they actually wanted to sell something and I was glad that I refused.

But I really felt bad after both of these incidents. I still felt like a victim and for the whole day I was in a bad mood because of that.
It is always like that. I somewhat manage to get out of the situation without paying or buying or signing, but my time is wasted and my mood is down.
« Last Edit: March 27, 2015, 09:32:07 am by Deque »

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: [Question] Protection from Social Engineering
« Reply #1 on: March 27, 2015, 10:34:33 am »
I had posted an article how to protect yourself, but dunno how relevant is it to your situation: https://evilzone.org/tutorials/social-engineering-for-the-rest-of-us-protection-for-humans/
As for protecting yourself, I recommend the book: https://evilzone.org/ebooks/liespotting-proven-techniques-to-detect-deception/
When it comes to refusing, I can imagine how being too polite can be an issue :D I  have no tips for that tho, I'm just rude myself when I need to be, and I don't seem to have a problem with shooing someone away...
Tho since I also live outside of city, I don't get such idiots at my door at all :D

Offline iTpHo3NiX

  • EZ's Pirate Captain
  • Administrator
  • Titan
  • *
  • Posts: 2920
  • Cookies: 328
    • View Profile
    • EvilZone
Re: [Question] Protection from Social Engineering
« Reply #2 on: March 27, 2015, 09:36:03 pm »
Seems like basic salesmen tactics. Salesmen are actually great social engineers. They make you buy shit you don't need, happens all the time. To beat a social engineer, you need to SE the SE. read their body language, see what they're trying to do. Read the posts Kulverstukas just posted about NLP great information there.
« Last Edit: March 27, 2015, 09:36:43 pm by DeepCopy »
[09:27] (+lenoch) iTpHo3NiX can even manipulate me to suck dick
[09:27] (+lenoch) oh no that's voluntary
[09:27] (+lenoch) sorry

Offline cyberdrifter

  • Knight
  • **
  • Posts: 176
  • Cookies: -90
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #3 on: March 27, 2015, 10:26:16 pm »

General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.






x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).
.- / .-.. .. - - .-.. . / -... . - - . .-. --..-- / . ...- . .-. -.-- / -.. .- -.-- .-.-.-
Go ahead tubby, you clearly want/need those cookies more than me.  :P

Offline v32itas

  • Peasant
  • *
  • Posts: 123
  • Cookies: -4
  • coup de grâce
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #4 on: March 28, 2015, 03:34:37 am »
My advice would be something offensive. If you want to be able to detect deception I'd say don't waste too much time on readings about how people can lie. But train yourself to lie. There is a good book 'Kevin Mitnick - The art of Deception' or something like that with real examples. For me SE comes naturally. I grew up among thieves ant deceivers. When you start persuading people daily you'll start to see that same things goes over and over again just in different package.  And you'll start to spot manipulation attempts in others.

General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.






x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).

These are good advices, but in countries like UK gun deterrence is not an option. People often gets stabbed with knives and skrewdrivers, but guns is only for serious businesses here.
"There is nothing more deceptive then an obvious fact." - SH

“There was no such thing as a fair fight. All vulnerabilities must be exploited.”
― Cary Caffrey





Offline d!amond

  • Peasant
  • *
  • Posts: 60
  • Cookies: 15
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #5 on: March 28, 2015, 04:36:21 pm »
Very often I know that something is fishy, but find myself in the position that I don't want to come off as rude and I can watch myself saying or doing things although I know at this very moment that I will regret them.

I think thats where your problem is located.  You have to learn to say "no" in special occasions. For example, don't let random people into your room. If there is a strange guy in front of my door talking about crazy stuff, who is not the postman or the police or whatever, I wouldn't think twice to tell him to fuck off.

Offline HTH

  • Official EZ Slut
  • Administrator
  • Knight
  • *
  • Posts: 395
  • Cookies: 158
  • EZ Titan
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #6 on: March 29, 2015, 12:26:15 am »
General advice on neighborhood safety:

1. When Solicited by someone at your door that you don't know/are wary of. Always walk outside and close the door behind you. Having people trying to "sell" you something is a common tactic of theives, it gives them an inside look at your home and what property you may have and allows them to spot alarm system riggings.
2. I've lived in pretty rought neighborhoods, over time I developed a habbit of answering the door with a visible handgun in my belt. (Overkill for most, but it's what I do, I also have a habbit of walking to and from my mailbox with a shotgun over my shoulder from time to time, simple displays of power send strong messages in a non-aggressive manner).
3. Build rapport with locals (especially kids ages 10-20 and the homeless) a little kindness goes a long way in developing a system of observers that keep you in touch with the goings on of your neighborhood. It also makes people less likely to view you as a "justified" target.
4. Don't have overt displays of wealth outside of your home if you can avoid it. Keep your blinds shut, especially when the sun is low/down (from the outside at night you can see straight into windows from a good distance if lit internally, this also creates a situation that makes it very hard to see threats outside.) also turn on lights outside at sundown.
5. Use locks on your doors even when in good neighborhoods.
6. Get a security alarm, if you can't afford one, get a sign that says you have one. Dogs that bark are also good deterrents
7. Get a shotgun for home protection. Alternating birdshot (for spread, pain, less lethality) and buckshot (to ensure penetration, stoping power, and devestating lethality). in a close quarters situation this is the best weapon. It takes very little effort to aim at a short distance, has good spread, and max penetration. This type of round is also less likely to penetrate as far beyond the walls as a bullet is (minimizing callatoral damage in your neighborhood). With this said, it's always better to advertise your protection assets that needing to use them... so sitting on your front porch cleaning said shotgun isn't a bad idea either.
8. When in a conversation. You need to be willing to assert dominance in a situation by asking the person soliciting your probing and uncomfortable questions if you suspect they're up to something. If they are up to something, they're more likely to turn tail and run when they feel like someones caught on to them.


My advice is kind of the nuclear option, for the simple answer. Just learn to read people. Stay paranoid. Trust no one you don't know... anyone coming to your home uninvited should be treated with a healthy dose of caution and skepticism.

x. Strap a gun to the back of your door (mine is set so when my door is open, it's hidden against the wall and can't be seen).

I like this option and it is pretty close to the way I deal with people I dont want to talk, see a questionable motherfucker walking across the street towards me? Get the gun(whatever it happens to be) out of the backseat or trunk of my car and walk inside, he is NOT gonna follow you, he doesnt know its not loaded. (Assuming we're following the law here).

That being said, one thing, If I see someone shoulder carrying a long arm there's an instant assumption of "has no idea what he's doing" since it is literally the worst way to carry a firearm and any safety instructor worth his salt would smack the shit out of you for doing so. Not saying thats the case here and its probably just because the gun is unloaded that you don't care about safer carries but it's still worth considering. I'd just be more wary of someone whom I felt was in total control and at total ease with the rifle/shotgun. (obviously lots goes into that, the carry type is just the only thing in the post)

But I'm also not a criminal, and I also grew up handling firearms about as often as tonka trucks (for legal reasons) so I might be the wrong person to comment on the mentality of some street thug whose gonna be casing a place.

@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.
« Last Edit: March 29, 2015, 12:27:20 am by HTH »
<ande> HTH is love, HTH is life
<TurboBorland> hth is the only person on this server I can say would successfully spitefuck peoples women

Offline v32itas

  • Peasant
  • *
  • Posts: 123
  • Cookies: -4
  • coup de grâce
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #7 on: March 29, 2015, 01:32:38 am »
I was reading over and over again about your gun deterrence. And it gave me an idea, of something more SE than bruteforce. Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent. And talking in even more poor english than I am. That would even be a good and harmless practice of SE as well as practical evasion of talking.
"There is nothing more deceptive then an obvious fact." - SH

“There was no such thing as a fair fight. All vulnerabilities must be exploited.”
― Cary Caffrey





Offline Teapot

  • Peasant
  • *
  • Posts: 127
  • Cookies: -2
  • E-Book Whore
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #8 on: March 29, 2015, 03:52:58 am »
Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent.
lol me and my dad pretend to be Mexican immigrants whenever telemarketers call.
Works like a charm.

Offline cyberdrifter

  • Knight
  • **
  • Posts: 176
  • Cookies: -90
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #9 on: March 29, 2015, 03:59:08 am »

1. The shotgun I refer to is a Pump-action Mossberg 500 Cruiser 8-shot link.  The thing about a pump action shotgun is that the rounds are secured in a tube magazine below the barrel of the weapon.


This weapon needs to be charged, and placed on fire, Making it highly unlikely to discharge on its own.


2. Anyone that would tell you resting a shotgun against your shoulder is unsafe, is an idiot that has no idea what they're talking about. The shotgun would be pointing skyward to prevent it from flagging someone (In the very unlikely case that it could discharge). While this isn't an aggressive, tactical ready position, and there are safer positions (two hands are always better than one) it is safe.


3. I learned how to shoot a rifle when I was 10, I've been around them my entire life.


4. As for your "following the law comments" The rules on carrying a weapon are heavily dependent on the state you live in. However in mine so long as you hold a concealed carry license it's quite legal to possess a loaded firearm, both in your home, in your car, and on your person (certain locations excluded).

I like this option and it is pretty close to the way I deal with people I dont want to talk, see a questionable motherfucker walking across the street towards me? Get the gun(whatever it happens to be) out of the backseat or trunk of my car and walk inside, he is NOT gonna follow you, he doesnt know its not loaded. (Assuming we're following the law here).

That being said, one thing, If I see someone shoulder carrying a long arm there's an instant assumption of "has no idea what he's doing" since it is literally the worst way to carry a firearm and any safety instructor worth his salt would smack the shit out of you for doing so. Not saying thats the case here and its probably just because the gun is unloaded that you don't care about safer carries but it's still worth considering. I'd just be more wary of someone whom I felt was in total control and at total ease with the rifle/shotgun. (obviously lots goes into that, the carry type is just the only thing in the post)

But I'm also not a criminal, and I also grew up handling firearms about as often as tonka trucks (for legal reasons) so I might be the wrong person to comment on the mentality of some street thug whose gonna be casing a place.

@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.
.- / .-.. .. - - .-.. . / -... . - - . .-. --..-- / . ...- . .-. -.-- / -.. .- -.-- .-.-.-
Go ahead tubby, you clearly want/need those cookies more than me.  :P

Offline Kulverstukas

  • Administrator
  • Zeus
  • *
  • Posts: 6627
  • Cookies: 542
  • Fascist dictator
    • View Profile
    • My blog
Re: [Question] Protection from Social Engineering
« Reply #10 on: March 29, 2015, 10:17:07 am »
Yeah, I somehow expected to get "guns and shit" replies from muricans. You people seriously can't expect europeans to show off guns while taking out the trash, so basically the suggestions are useless.

Offline v32itas

  • Peasant
  • *
  • Posts: 123
  • Cookies: -4
  • coup de grâce
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #11 on: March 29, 2015, 10:56:08 am »
Yeah, I somehow expected to get "guns and shit" replies from muricans. You people seriously can't expect europeans to show off guns while taking out the trash, so basically the suggestions are useless.
I agree with that. Because it's like question about SE not about deterrence, like razor wires around your house with dogs and stuff, and some kind of cold war about who has a bigger guns on display. Especially when its all about evading social engineers, not about digging up defences around your fortified bunker with fallout shelter preparing for terrorists attacks...
EDIT
In Europe no one is waving guns. They are using guns in very serious cases. And having shotgun on your shoulder might even get you stabbed. Cause if talking about close quarter combat such shotgun is ineffective in close quarter combat, its too long.  Deadliest weapon in close quarter combat is knife, even more deadlier then a pistol(which is fairly effective in close quarter) And knives intended to be felt not seen. And by the moment you felt stab its usually to late. So when people comes to talk to you my suggestion would be to talk. In case you're not interested in talking I'll just quote my self
I was reading over and over again about your gun deterrence. And it gave me an idea, of something more SE than bruteforce. Like acting like some kind of eastern european immigrant which barely speaks in english and with russian accent. And talking in even more poor english than I am. That would even be a good and harmless practice of SE as well as practical evasion of talking.
Practice Social Engineering.
« Last Edit: March 29, 2015, 11:15:18 am by v32itas »
"There is nothing more deceptive then an obvious fact." - SH

“There was no such thing as a fair fight. All vulnerabilities must be exploited.”
― Cary Caffrey





Offline Deque

  • P.I.N.N.
  • Global Moderator
  • Overlord
  • *
  • Posts: 1203
  • Cookies: 518
  • Programmer, Malware Analyst
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #12 on: March 29, 2015, 01:59:21 pm »
Thanks to all of you for your valuable advice.

To everyone telling me to learn SE:
SE is something that interests me a lot. I read books (including the mentioned one from Mitnick) and articles on the topic. However, conversations are already hard for me as is. I am easily overwhelmed. I can only concentrate on one-on-one conversations, and even then it is something that often just goes too fast for me.
I am a bad social engineer as I feel I am already worse in social stuff than the majority of people.
I know the theory and cannot apply it, especially in situation I did not expect. So that's why I often see things coming, but feel that I have not enough time to think about how to react as I am already trying to listen at the same time.

I usually know of perfect answers and reactions afterwards.

Some simple rules have helped me out, which includes never to buy anything on the door, never to sign anything without sleeping over it a night or better a week. But my politeness really annoys me.

@Kulver
Your articles are very interesting and I've read most of them. Thanks for posting them.


@cyberdrifter
Very interesting read, but I am European too. :D
However, it reminds me of my father. When Zeugen Jehovas came to his house, he threatened them with his chainsaw. They never showed up again.

Quote
@Deque, you seem to have the same issue lots of people have where they are too polite. Gotta learn to just say "no, leave" or "no you may not come in" right off the bat rather than listening for the sake of being polite.

How can I learn it, though? Role play?
« Last Edit: March 29, 2015, 01:59:50 pm by Deque »

Offline Lenoch

  • EZ's Menstruator
  • VIP
  • Serf
  • *
  • Posts: 49
  • Cookies: 37
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #13 on: March 30, 2015, 09:33:20 am »
I would play the ball right back at the guy. Say you have to finish something for work and if you can't finish it you may loose your job. It will put him in a position of guilt giving you control over the conversation.

Also if you question the morality. I would say its morally justified to lie in that situation since he wants to decieve you into buying stuff you don't need and playing you into that way.

Edit: Deque, it's normal that you can't apply the theory as easy. social interactions are quite complex. and people are also infinitly complex. you will never get the reactions exactly like they are explained. best that theory can make you do is to make you adaptable in such situations.
« Last Edit: March 30, 2015, 10:07:05 am by Lenoch »


Quote
<m0dem> I find evilzone is a really HQ community

Offline shome

  • Peasant
  • *
  • Posts: 81
  • Cookies: 8
    • View Profile
Re: [Question] Protection from Social Engineering
« Reply #14 on: April 02, 2015, 12:39:23 pm »
The first thing this thread reminded me of was the money laundering scene from the movie, "Office Space." lol