Going back hundreds and thousands of years, we find that hypocrisy was used by the majority of the humans: from the ancient times to the Middle Age and to our Era. Even the Christian Church used hypocrisy in the Middle and Dark Age to manipulate the Christianity into believing rules which were not found in the Holy Bible and saying that “it is the will of God”.
This article is about the strong relation between hypocrisy and social engineering (or the art of manipulation). Some of us may be very naive so we can end-up trusting everybody and thinking that everyone has good intentions. Wrong!
The problem that can appear is when we start trusting some not very well intentioned people and making them our friends. This is a big problem when it comes down to IT Security. That person will try to manipulate us and make us give him personal information. In this scenario you face not just social engineering, but an act of pure hypocrisy as that person is thought to be your friend.
Voltaire says:
May God defend me from my friends; I can defend myself from my enemies.
What is the solution for this scenario?
You can stop trusting that person if he asks you for personal information like: account passwords from work, personal account passwords etc. In many cases, if the victim gives up that information, the ending is not very pleasant, as the victim can lose access to her/his account.
Let’s take another scenario into account: you, the victim, work for a big company and the attacker wants to break the company’s security. The attacker can use social engineering, so he must start to find information about the employees of the company: names, phones, addresses, identity card numbers etc. When he is done, then he can phone the company requesting the password for the X account, for which he has information: the account belongs to Y, with the identity card Z etc. In the majority of cases, the victim will give up that information so the security has been broken.
What is the solution for this scenario?
As head of the security department in that company, you can set up a secret question in the company like: “what’s today’s color?” or “what’s X’s favorite book?”. The attacker doesn’t have access to the secret question nor to the answer of it so the victim mustn’t give the X account password.
The next scenario is about communities on the Internet. The administrators are often manipulated and they end up giving extra rights or ranks (for instance: moderator) to people which do not have good intentions. The community can then suffer a so called ”deface” which is not pleasant.
What is the solution for this scenario?
The administrator(s) must try to find extra information about that person talking to them or searching the Internet. One single doubt could be enough for the administrator to not give the attacker a new rank/right.
From these three presented scenarios the most dangerous one is the first because not only you can give account passwords (and so you can end-up having no money), but you also can give him intimate information which can be used to damage the way people think about you.
I am not saying you can’t trust anybody, just be careful when it comes down to IT Security!
