Chapter 5. Physical Security and Social Engineering
"If you think you can or can't - damn you are right"
-Henry Ford
Social engineering is the art of extracting information from humans. This can be more effective especially when combined with physical access to the target system. It is the single most successful attack vector used for penetration testing or an actual attack. The success of social engineering attacks relies on two key factors:
- The knowledge that is gained during the reconnaissance phase. The attacker must know the names and usernames associated with the target; more importantly, the attacker must understand the concerns of the users on the network.
- Understanding how to apply this knowledge to convince potential targets to activate the attack by impersonating, talking to them over the phone, sending them asks, clicking on a link, or executing a program. For example, if the targeted company has recently finished the year-end appraisal, every employee in the company would be very...
