all social engineering techniques are based on specific attributes of human decision-making known as cognitive biases. these biases, sometimes called "bugs in the human hardware," are exploited in various combinations to create attack techniques, some of which are listed here:

pretexting

pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is typically done over the telephone. it's more than a simple lie as it most often involves some prior research or set up and the use of pieces of known information (e.g. for impersonation: date of birth, social security number, last bill amount) to establish legitimacy in the mind of the target.

this technique is often used to trick a business into disclosing customer information, and is used by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. the information can then be used to establish even greater legitimacy under tougher questioning with a manager (e.g., to make account changes, get specific balances, etc).

as most u.s. companies still authenticate a client by asking only for a social security number, date of birth, or mother's maiden name, the method is effective in many situations and will likely continue to be a security problem in the future.
pretexting can also be used to impersonate co-workers, police, bank, tax authorities or insurance investigators, or any other individual who could have perceived authority or right-to-know in the mind of the target. the pretexter must simply prepare answers to questions that might be asked by the target. in some cases all that is needed is a voice of the right gender, an earnest tone and an ability to think on one's feet.
voice over ip programs are starting to become a standard in pretexting, as it is harder to track an ip address than a phone number, making the pretexter less vulnerable to being caught.

phishing

phishing is a technique of fraudulently obtaining private information. typically, the phisher sends an email that appears to come from a legitimate business — a bank, or credit card company — requesting "verification" of information and warning of some dire consequence if it is not done. the letter usually contains a link to a fraudulent web page that looks legitimate — with company logos and content — and has a form requesting everything from a home address to an atm card's pin.

ivr/phone phishing

this technique uses a rogue interactive voice response (ivr) system to recreate a legitimate sounding copy of a bank or other institution's ivr system. the victim is prompted (typically via a phishing email) to call in to the "bank" via a provided (ideally toll free) number and verify information. a typical system will continually reject logins ensuring the victim enters pins or passwords multiple times, often revealing several different passwords. more advanced systems will even transfer the victim to the attacker posing as a customer service agent for further questioning.

someone could even record the typical commands ("press one to change your password, press two to speak to customer services" ...) and play them back manually in real time, giving the appearance of being an ivr without the expense.

trojan horse/gimmes

gimmes take advantage of the victims' curiosity or greed to deliver malware. also known as a trojan horse, gimmes can arrive as an email attachment promising anything from a "cool" or "sexy" screen saver, an important anti-virus or system upgrade, or even the latest dirt on an employee. victims succumb by opening the attachment. since naive users will blindly click on any attachments that seem even mildly legitimate, the technique can be quite effective.

road apple

a road apple is a real-world variation of a trojan horse that uses physical media and relies on the curiosity of the victim. the attacker leaves a malware infected floppy disc, cd rom or usb flash drive in a location sure to be found (bathroom, elevator, sidewalk, parking lot), gives it a legitimate looking and curiosity-piquing label, and simply waits.

for example: an attacker might create a disk featuring a corporate logo, readily available off the target's web site, and write "executive salary summary q1 2007" on the front. the attacker would then leave the disk on the floor of an elevator or somewhere in the lobby of the target company.

an unknowing employee might find it and subsequently insert the disk into a computer to satisfy their curiosity, or a good samaritan might find it and turn it in to the company.
in either case as a consequence of merely inserting the disk to see the contents, the user would unknowingly install malware on their computer, likely giving an attacker unfettered access to the victim's pc and perhaps the target company's internal computer network.
unless other controls block the infection, pcs set to "autorun" inserted media may be compromised as soon as a rogue disk is inserted.

note that the term 'road apple' has been re purposed from an older use meaning horse manure.

quid pro quo

something for something:

    * an attacker calls random numbers at a company claiming to be calling back from technical support. eventually they will hit someone with a legitimate problem, grateful that someone is calling back to help them. the attacker will "help" solve the problem and in the process have the user type commands that give the attacker access and/or launch malware.

    * in a 2003 information security survey, 90% of office workers gave researchers what they claimed was their password in answer to a survey question in exchange for a cheap pen. similar surveys in later years obtained similar results using chocolates and other cheap lures, although they made no attempt to validate the passwords (some respondents probably made up false passwords on the spot just to claim the prize, thereby socially-engineering the surveyors!).

other types

even if they lack hacking skills, common confidence tricksters or fraudsters could also be considered social engineers in the wider sense in that they deliberately deceive and manipulate people, exploiting human weaknesses to obtain personal benefit. they may, for example, use social engineering techniques as part of an it fraud.



notable social engineers

kevin mitnick
reformed computer criminal and security consultant kevin mitnick popularized the term social engineering, pointing out that it's much easier to trick someone into giving you his or her password for a system than to spend the effort to hack in. he claims it to be the single most effective method in his arsenal.

the badir brothers
ramy, muzher, and shadde badir - brothers, all of whom were blind from birth, managed to set up an extensive phone and computer fraud scheme in israel in the 1990's using social engineering, voice impersonation and braille-display computers.

others
other noted social engineers include frank abagnale, david bannon, peter foster and steven jay russell.