Social Engineering

Exploiting the human element

Social Engineering remains one of the most effective hacking techniques

Never underestimate the power of social engineering. Some of the most secure operations in the world are breached by fairly simple social engineering tactics.

Highly Effective Hack

In the modern era of rapidly evolving technology, social engineering has become a significant threat to corporate security. Social engineering is a tactic used by cybercriminals to manipulate human psychology and trick individuals into divulging confidential information or granting unauthorized access to computer systems. Social engineering attacks can have devastating consequences for companies, ranging from financial loss to reputational damage.

Employees are victims

With even less risk, social engineers email, call, and text your employees in order to steal their credentials by deceiving them with realistic requests and websites. Employees who share passwords across multiple accounts may be handing over access to several systems including full wireless or internal network access and even internal email access that can allow the process to start again… with a valid phish from within your network.

Data Is the Target

The goal is not to steal items from your office or retail location. Instead, it’s more about the security of your internal network and the data that you have contained within it. Credit card numbers, product cost data, proprietary business plans, and identity theft are often the drivers for a malicious social engineer. More specifically, they want to gain unrestricted access to your internal network, whether via a device installed onsite or through a wireless connection.

man tailgating through an office door

Test your human element

Social engineering is a highly effective component of a full security penetration test. Most of our customers are very surprised at how easy it is for us to gain access. We’ll use techniques designed to convince your team to give us access to your systems and data center.

Even the toughest security defenses will fall victim

Social Engineering techniques often get our foot in the door to launch exploitation tools or plant a remote access device.

Physical Social Engineering

Our first step involves significant research on your organization’s line of business, communication style, and employee behaviors. We’ll learn as much as we can about your group to find the most effective style of attack, and we’ll also work directly with your security team to ensure we’re targeting the areas you need assessed. Our attack plans range from using branded clothing easily obtained from local sources to creating fake credentials. In many cases, we’ll use no tangible physical items and simply rely on our communication skills to establish credibility with the targeted staff members.

laptop with login prompt

Phishing

Why Phish Your Own Team? Despite training and technical countermeasures, phishing continues to be a highly effective way to breach security defenses. Our team sends a convincing email to your organization in an attempt to gain user credentials and to measure the effectiveness of your security awareness program. From there we can use the credentials to attempt further system access or we can stop there. Either way your report gives you the details you need to train your team not to fall for a phish again.

user appearing confused over a SMS he received

Specialized Phishing

Other phishing techniques can be leveraged as well. Spear phishing uses highly targeted emails to gain information or access without triggering security countermeasures. In vishing, also known as voice or phone phishing, engagements, Raxis calls your team and attempts to convince them to give us access through passwords or other sensitive information. Smishing or SMS phishing is just another way that hackers attempt to gain information, and our team provides individual attacks as well as combined attacks including any of the above.

admin login prompt and laptop

Follow through and finish the hack

It’s not enough to just gain access. During Physical Social Engineering, our team attempts to clone employee badges to gain physical access to your buildings and even higher security areas such as data centers. Once in, we may install a device that allows us to prove we can access your internal systems remotely.

When performing Phishing, we attempt to gain access to company VPNs, email, or any other technology that we can leverage. This proof of concept is invaluable in justifying budgets or uncovering risks further inside the system.

f.a.q.

You have questions. wE have answers.

Social Engineering

I’m sure that Raxis could gain access to our buildings. Should I wait for a physical social engineering test?

If you are installing new systems or performing new training now, then we recommend you complete those before beginning your PSE. Usually, however, there’s no time like the present. If you have known issues that you haven’t corrected, it may be a budget issue. If so, a Raxis PSE engagement can give you the proof your management team needs to see that the changes are a high priority.

I don’t want to upset management. Can I scope my social engineering test to exclude them?

You know your scope best, and our team looks to you during scoping to be sure we include the best sampling for your test. While we are happy to advise you so that understand how you may be limiting results, exclusions of physical locations in PSE tests and of employee targets in phishing tests are common.

What if we fail the social engineering test?

We always recommend that our social engineering tests be used as training instead of as judgements. The employee who falls for a Raxis phish is often the least likely to fall for a malicious phish. Our social engineering engagements all provide clear reports of our attacks and how your team performed. When you use these reports as training tools and reward employees who report suspicious behavior and communications, your whole team becomes stronger.

Real phishing obtains real results

Scottie Cole is one of the best in the business. In this video, he reveals some of his best tips and tricks for setting up phishing campaigns to harvest credentials and/or install payloads on clients’ networks.