[mothered]

Wow, that's really impressive.

It certainly Is.

A company may have the very latest security measures In place on the technological side of things, but when the user simply hands over Information, the Implementations are useless.

Yeah. Is there even anything I can do to protect myself from someone who wanted to do this to me?

Nothing.

Your security/anonymity Is only as secure as the entity storing It. Using a combination of technical and social engineering attacks, "anyone" can be exploited. I've personally yet to fail.

[pwnGlobal]

Phone Company is basic...

Wait till you get to doing stuff like pretending to be a amazon employee, spoofing your number to look like a department in the same building, then getting access to the admin site of amazon!

[PhoneHomeIndia]

Gotta check this book out if you're interested in SE or want to up your game!
Im 99.9999% sure that is Chris Hadnagy sitting next to her in the video. His book is amazing!

Actually,, a new addition JUST came out too,,,

but DOPE DOPE DOPE book,, honestly got me into netsec. Check the free Amazon/Kindle cloud version out

https://www.amazon.com/Social-Engineerin...0470639539

[mothered]

Phone Company is basic...

Wait till you get to doing stuff like pretending to be a amazon employee, spoofing your number to look like a department in the same building, then getting access to the admin site of amazon!

Been there, done that and still going to date.

[DragonicRek]

One advantage over other social engineers - from my personal experience- is that she is a female and that by default gives her advantage over other male SE'ers.

[mothered]

One advantage over other social engineers - from my personal experience- is that she is  a female and that by default gives her advantage over other male SE'ers.

I definitely agree.

It can be performed by males using a voice changer software. That said, they're not 100% perfect so those who have a very fine attention to detail, can actually detect Inconsistencies.

[mind4last]

The best way to get the information??? Just to ask for it.

[ATU/M/ISK]

Back in high school, I was incredibly into Gaiaonline. I actually got involved with SE after being an honest player and I was "hacked".
I did some scooby-dooing and found a website called "Gaminggutter", the game-hacking forum that my "hacker" resided in.
I joined to try and get him back, but I eventually fell in with the community.

They repeated over and over again that you "Absolutely Cannot" SE with Jotform anymore. Anyone who even brought the idea up was mocked and harassed for being a noob.
(To those of you who aren't aware, Jotform is just a regular form-building website that lets you make a basic form (they were trying to replicate Gaiaonline Gold generators and Item generators, etc.) that you send to people.)
https://www.jotform.com/
Its intended use is for regular polls, newsletters, things of that nature.

So I took it upon myself to create a free Forum site, similar in style to this one.
The topic was Anime, Manga and Gaiaonline discussion and tips.
The form was a regular registry form for my forum board, but I made it with Jotform instead.
I went all over Gaiaonline towns and in the forums, promoting my new forum where gaians can discuss the game, make friends, talk anime and manga, and just be an overall great community, and providing them with the link to check it out.
They were obviously interested, Anime Manga and Gaia are the 3 boner-wielding topics there.
I accrued a little over 300 members in 2 weeks (this was in 2008, 2009)
They all joined the forum, and filled out the required information.
---------------------
Desired Username:
Desired Password:
Re-Type Password:
E-Mail:
*insert disclaimer about caring about personal privacy and protecting their information*
3 Security Questions [dropdown list of common e-mail security questions]
3 Security Answers:
Captcha
Submit [Still registered them to my fake forum, but since it was made with Jotform, I had each registrations answers to those Q's e-mailed to me as well]
-----------------------------

Just under 300 of those accounts were the same exact Username and Password as their Gaiaonline accounts.
(Most everybody uses the same exact password for everything).

The very small amount of people who used different UNs and PWs still gave me their E-mail and Security Questions, so even if that password didn't work with their e-mail, I was still able to answer their security questions and access their e-mails to change their Gaiaonline accounts, and every other account and website they signed up for with that e-mail address.

I thought I was "Cool" back then so I wreaked havoc under the "Laughing Man" tag for fun, and changed all of their gaia avatars to "Laughing Man Victim # whatever" with a laughing head emote or "Laughing Man Wuz Here" tags.
GG didn't like that though since they swore up and down it couldn't be done with Jotform anymore. They were pretty petty about it and banned me, but the one valuable lesson I learned from all of it was this:

Everybody typically uses the same information for everything, and more often than not, it's easy to just "ask" for it.

also on topic: nice video

[mothered]

The best way to get the information??? Just to ask for it.

When the objective Is Information gathering, that's exactly what social engineering does- In a manipulative manner.

[Xexboss]

social engineering at its finest haha very interesting though never seen this before