The Hustlers of Naples

Social engineering is a fascinating and diverse attack vector because it exploits human nature and people are generally predictable in their responses. We focus on malicious social engineering, especially when it facilitates cyber attacks upon organisations. However social engineering and its precursor, the good old ‘con’, is alive and kicking out there on the street […]

Simone – A social media investigation

Speaking around the world about social engineering one question comes up almost every time. Why is social engineering so successful? A key success factor in a targeted attack is good research, knowing the target and how to manipulate them. I have been gathering and analysing intelligence on people, places and companies for many years now. […]

Interview with DIGIT

Here’s a link to an interview with DIGIT who organise the excellent Scot-Secure event in Edinburgh (among many other things). It focuses on social engineering in the context of social media reconnaissance, manipulation and how to minimise your attack surface when using social media. Check it out here

Reconnaissance for Social Engineering: Tales from the Road

When it comes to reconnaissance and open source intelligence, research often seems like a digital battle. Using endless pieces of software, sites and APIs, we use technology to fight for the data we want. It is easy to forget how much valuable information is out there in the real world, being given away unwittingly, if […]

Can I borrow your swipecard?

This case involves an accountancy firm based in South East England.  The firm had just lost a big client and as a result had to make some cuts which included letting a few members of staff go. Jamie had been one of these staff members.  He was disgruntled to say the least.  He’d expected better […]

Stay calm and (don’t) pay the hackers

This social engineering case study highlights how attackers can use curiosity, urgency and fear to manipulate victims into breaking company protocols and get a finance employee to willingly transfer £152,000 into the attackers bank account. Miranda worked in Finance for Troy Ltd.  One morning she received an email with the subject line “Urgent C.V resend: FAO […]

The enthusiastic law student

This case involves a law firm based in the south of England.  The firm was of a reasonable size and, like most law firms, held a lot of very sensitive customer data. One morning one of the solicitors received a Facebook message purporting to be from a young law student.  The message read: “Dear Jennifer, […]

Criminal Justice Evolution podcast

Patrick Fitzgibbons was kind enough to invite me on to his US based Criminal Justice Evolution podcast.  We talked about the social engineering threats facing businesses worldwide, how cyber-crime is evolving and the difficulty law enforcement faces when tracking down cyber criminals.  There are also some excellent tips on how to protect yourself from this […]

The not-so-secret life of boarding passes

  Have you ever thought about what your boarding pass might say about you? I don’t mean “oh look at me, I’m flying in Emirates Business Class”, but what data you might be leaking publicly on that anachronistic piece of paper you discard in the seat in front of you. Turns out it is an […]