Social engineering tests
What are social engineering tests?
Social engineering tests, is a set of methods that use the weaknesses of people and organizations (companies, offices, hospitals and others).
Social engineering testing, just like a typical social engineering attack, involves impersonating the identity of another person or organization in order to persuade the attacked person to perform or abandon certain activities.
The simplest , but at the same time very effective, social engineering attacks are mass mailing to multiple recipients from false invoices or malware . Infected mail can encrypt victim's files, and their decryption will only be possible after paying the ransom.
Advanced social engineering activities are usually targeted at a specific organization or selected people. The attacker obtains information about the functioning of the company, processes and dependencies, which allows the most common large-scale theft.
White interview (OSINT)
Open Source Intelligence (OSINT), i.e. white interview, consists in collecting and analyzing information about people, events and organizations from publicly available sources.
The purpose of the white interview is to search for as much information as possible that may be useful for the purpose of deepening the penetration or social engineering penetration of the organization.
All information available on the Internet, in the press, radio and television, also from people, is a source of information for the purposes of white intelligence.
We conduct a white interview to seal information that flows out of the organization in an uncontrolled manner. We show and verify the value of this information in the context of the risk it generates. We indicate and secure various variants of the attack.
What methods do we use?
We most often use types of phishing (spear, clone, whaling) based on manipulation of links or e-mails.
For the most demanding customers, we prepare pharming , because this method gives great results (in real conditions it is very dangerous and involves introducing a vulnerable DNS server to information directing to a fake website placed under the correct domain , which allows the acquisition of confidential data).
We also use SMS phishing because a small number of attacks are carried out using it. We find that this kind of test is very effective, which of course is disturbing.
We also prepare fake websites that interactively trick users into submitting various information.
What kind of tests are we running?
In order to conduct social engineering tests, we often impersonate various entities, registering domains from which we send fake messages in the next steps .
We also use various types of direct actions involving our employees who play different roles to obtain information.
The number of scenarios and ways of obtaining information is large, and because we are creative, we often introduce new ideas.
We also have proprietary technical solutions that enable us to obtain information in various ways, most often as a result of human mistakes.