Unlocking the Hidden Potential

Delves into the untapped potential of reverse psychology in overturning social engineering tactics. It highlights the effectiveness of using reverse psychology as a proactive defense mechanism to thwart attempts at manipulation and deception. Click this link.

1. EricaCiko:ReversePsychologyCan
OverturnSocialEngineering
Don’tbeasheepamongwolves.Nooneisinvulnerabletosocial
engineering—evensecurityprofessionals.
Socialengineeringisacruelpsychologicalattackthatpreysonhumannature,
exploitingourinnatedesiretotrustothers.Thisdangerouscyberthreatposes
apotentialrisktoanyone,regardlessoftheirtechnicalprowessorstatusin
society.Eventhemostvigilant,high-profilesecurityprofessionalscanfall
victimtosocialengineeringattempts.Infact,manyofthemostprolificand
successfulcyberattacksinhistorystartedwithsocialengineeringschemes.
Take,forexample,the2018TwitterBreach,inwhichhackersgainedaccess
tohigh-profileaccountsbelongingtohighprofileindividualssuchasElon
Musk,JeffBezos,andBarackObama.Thecybercriminalsused
spear-phishingtogainaccesstothetargetedaccountsbysendingTwitter
employeesconvincingmessages.Thesehigh-profileaccountswerethenused
totweetbitcoinscammessages,defraudingpeopleofover$100,000.

2. Eventhoughthisstrangesituationsoundslikea1990shackermovie,it’sjust
oneofmanysocialengineeringschemesthathavecausedalotoftroubleand
moneyloss.So,ifevenElonMuskcanbehurt,howcanyouoryourbusiness
staysafefromthisgrowingdanger?EricaCikoknowstheanswer:allyou
needisalittlebitof“reversepsychology.”
UnderstandingYourSocialEngineeringEnemyis
PainfulbutNecessary
Tobeatthesocialengineersattheirowngame,youneedtogetinsidetheir
twistedminds.Youmustunderstandhowtheyoperate,whatmotivatesthem,
andwhattheirweaknessesare.Firstandforemost,youneedtothinklikethe
enemytooutsmartthem.
Solet’sperformalittlethoughtexperiment,shallwe?
Imagineyourselfasacybercriminal,scouringtheinternetforeasyprey.You’re
lookingfortheweak,thegullible,andtheunsuspecting.Youmanipulatethem
intogivinguptheirpersonalinformationordownloadingmalicioussoftwareby
knowingtheirfearsanddesires.Youusesocialmediatogatherinformation
aboutyourunsuspectingtargets.Finally,youcreatefakeemailsandwebsites
thatappealtoyourprey’sinterestsandapproachthemcoldly.
Inotherwords,asasocialengineer,youuseeverytrickinthebooktoget
whatyouwant.
Butwhatifyoucouldturnthetablesonthesocialengineers?Whatifyou
couldusetheirowntacticsagainstthem?Spendingtoomuchtimeinsidethe
maliciousmindofasocialengineerisunappealingtomostethicalhackers:
Butbythinkinglikeacybercriminal,youcananticipatetheirmovesand
outmaneuverthemateveryturn.

3. Howto“WeartheSkin”ofaSocialEngineerand
LearnTheirTactics
Tounderstandtheenemy,firstyoumustre-evaluatethebasicprinciplesof
socialengineering.Weallknowthatsocialengineerspreyonthegoodwillof
others.Theirmethodsarefar-reachingandrelentless,spanningeverything
fromphishingemailsandphonescamstofakejoblistings,andphysical
impersonation.
Atruesocialengineerhasnoissuedamagingtheirvictim’slivelihood,
finances,orprofessionalreputation.Butwhy?
AccordingtoEricaCiko,herearesomeofthemostcommonmotivationsthat
drivesocialengineerstofine-tunetheirmanipulativeart:
●Stealingpersonalinformationforfinancialgain.
●Accessingsensitivecorporatedata(thesesocialengineersare
alsoknownas“insiderthreats”).
●Gainingaccesstophysicallocations.
●Compromisingnetworksecuritytospreadmalwareorviruses.
Theattackerusessocialengineeringtoachievetheirgoal,whichtheyoften
planbeforefirstcontact.
Nowthatyouknowtheirmotives,pretendyou’reasocialengineertargeting
yourhomenetwork,smallbusiness,orlargeorganization.Thinkaboutwhat
informationyouwouldwanttoobtainandhowyouwouldgoaboutobtainingit.
AThoughtExperimentofSocialEngineeringUsed
forHomeNetworkInfiltration
Thisexercisewillhelpyouidentifykeyweaknessesinyourhomenetwork
securityanddevelopstrategiestodefendagainstthem.

4. Pictureyourselfasaroguehackerinfiltratingahomenetworklikeaskilledspy
onamission.Yourobjective?Toplunderthepersonaldataofunsuspecting
victims,fromcreditcardinformationtosocialsecuritynumbersandanyother
juicypersonallyidentifiableinformation(PII)thatcanbesoldonthedarknet.A
successfullycompromisedhomenetworkcanquicklybecomealaunchpadfor
afull-scalecyberinvasion,openingthedoortothevictim’sworkplace,
financialinstitution,andsocialmediaaccounts.
Byimaginingyourselfasasocialengineertargetingahomenetwork,sniffing
forinformationoneverydevicelikearatscroungingthroughagutter,youcan
gainanenlightenednewperspectiveontheirtricksandschemes.Then,you
cantakeproactivemeasurestoguardagainstthemandleavetheminthe
dust.
Althoughthisexercisefocusedonahomenetworkinvasion,youcanrepeat
theexperimentasmanytimesasyouwantfordifferentsocialengineering
scenarios.Andbeforeyouknowit,you’llunderstandthat,attheendofthe
day,socialengineersaresimplyhumanswhocanbedefeatedand
outsmartedlikeanyoneelse.Andmostimportantly,you’llknowhowtospot
theirwickedgamesandstopthembeforetheystart.
RecognizetheCommonReasonsVictimsFallfor
SocialEngineers
Ourexercisewouldn’tbecompletewithoutrevisitingthescenariofromthe
otherside.Nowthatyouknowwhatit’sliketoslipintotheskinofanattacker,
whataboutthevictim?Whatmotivatesaninnocentusertogive
in—sometimeswithlittletonoresistance—tothesecriminalswhoperpetuate
thedarkartofmanipulationwithnoremorse?
AccordingtoEricaCiko,herearesomeofthemostcommonreasonspeople
fallforsocialengineersandtheirnefariousschemes:

5. ●Fear
Fearisthebestwaytokillyourmind,andsocialengineersknowhowtouseit
tocontrolpeople.Peopleactonimpulsewhentheyarescaredorfeel
insecure.Theyknowthatpeoplearenaturallycuriousandwilloftenclickon
linksordownloadfileswithoutthinkingaboutwhatmighthappen.Bytaking
advantageofthesehabits,socialengineerscaneasilyaccessyourcomputer
systemsorstealyourpersonalinformation.
●Greed
Greedisanotherstrongfeelingthatsocialengineersusetogetwhatthey
want.Theypromisetheirvictimsabigpayofforachanceofalifetimetoget
themtolettheirguarddown.Aclassicexampleofthisiswhenavictimis
askedtoaninterviewforajobtheydon’trememberapplyingto.Mostofthe
time,thesejobspayverywellorseemtoogoodtobetrue.Still,manypeople
fallfortheseschemesbecausetheywantsomethingrightawayanddon’tcare
abouttheconsequences.
●Trust
Everysocialengineerspitsinthefaceofthetruth.Theymakeupfake
identitiesorusewell-knownbrandstogetyoutotrustthemandtellthem
sensitiveinformation.Insomecases,theyevenformfriendshipsor
relationshipswiththeirvictimsthatcanlastformonthsoryears.Catfishing
schemescancausealotofemotionalandfinancialharmtothepersonwho
fallsforthem.
●Urgency
Urgencyisanotherimportanttoolthatmanysocialengineerscan’tdowithout.
Theywanttomaketheirvictimsfeelscaredsotheywillactquicklywithout
thinking.Theyknowthatwithenoughprodding,peopleoftengrowflustered

6. andmakerashdecisions—andtheworstdecisionsareoftenmadeunder
pressure.
Inshort,youcanlearnmoreabouthowsocialengineeringworksifyouthink
likebothavictimandathreatactor.Thinkabouthowyoucouldusewhat
you’velearnedsincethelastexercisetogetsomeonetotellyouprivate
informationordosomethingthatisnotintheirbestinterest.Thiscanhelpyou
comeupwithastrongplantoprotectyourselffromsocialengineeringattacks.
FliptheTablesonSocialEngineeringForever
Socialengineeringisadangerousandalways-presentthreatthatisn’tgoing
awayanytimesoon.Butthebestwaytoavoidsocialengineeringistobe
awareofitandlearnaboutit.Byunderstandingthepsychologybehindsocial
engineeringandpromotinga“cultureofawareness”atworkandathome,you
canprotectyourselfandyourfriendsfromthesesneakyattacks.
Cybercriminalstakeadvantageofpeoplewhoarescaredordesperate,so
don’tgiveintotheirplans.Rememberwhatyou’velearnedfromourthought
experimentanduseitthenexttimeyoumeetastrangepersononline.Inthe
end,you’llbeabletospotthiscruelandcommoncybercrimeandprotectboth
yourwalletandyourreputationifyoustayuptodateonsocialengineering
techniquesandknowwhoyourenemyis.