Kevin Mitnick Lessons
Pretexting
Creating a fabricated scenario to gain trust and extract information. Example: Mitnick could pose as a vendor representative, claiming they need an employee's login credentials to update their account.
Phishing
Sending deceptive emails or messages to trick recipients into divulging sensitive information or clicking on malicious links. Example: Mitnick might send an urgent email claiming to be from a bank, asking users to verify their account details by clicking a link.
Baiting
Luring victims with the promise of something enticing, like a free movie download, that is infected with malware. Example: Mitnick could leave infected USB drives labeled as "New Movie Release" in a company's parking lot, hoping employees will plug them into work computers.
Quid Pro Quo
Offering something of value in exchange for information or access. Example: Mitnick could call employees, posing as a software vendor, offering free licenses in return for their network login credentials.
Tailgating/Piggybacking
Gaining unauthorized physical access to a secure area by following an authorized person through a locked door. Example: Mitnick could tailgate an employee entering a secure building, pretending to have forgotten his access card.
Diversion Theft
Creating a diversion to distract a target's attention while the attacker steals information or access. Example: Mitnick might spill coffee on an employee's desk, causing a distraction while he quickly accesses their computer.
Reverse Social Engineering
Convincing a victim that they need assistance, and the victim unknowingly provides sensitive information. Example: Mitnick could call a company's IT department, posing as a remote employee, and request help while divulging personal details.
Fear and Urgency
Creating a sense of urgency or fear to manipulate victims into making hasty decisions. Example: Mitnick might send a fake email to employees, warning them of a security breach and instructing them to change their passwords using a link he controls.
Elicitation
Extracting information through casual conversation without arousing suspicion. Example: Mitnick could strike up a conversation with an employee at a café, pretending to be a consultant, and gather information about the company's security protocols.
Authority Exploitation
Pretending to be a person of authority or influence to persuade victims to comply with requests. Example: Mitnick could call a company's HR department, posing as a high-level executive, and request confidential employee records for a fictitious project.
Impersonation
Pretending to be a specific individual to deceive others. Example: Mitnick could create a fake social media account in the name of a company executive and use it to request confidential information from employees.
Piggybacking on Events
Taking advantage of major events or crises to increase the likelihood of success. Example: During a natural disaster, Mitnick might call individuals, posing as a charity worker, and request donations, including credit card information.
Establishing Rapport
Building trust with a target over time to increase the chances of cooperation. Example: Mitnick could join industry-specific forums under a false identity, gain credibility, and later use that credibility to request sensitive information.
Employment Scams
Posing as a recruiter or potential employer to obtain personal information from job seekers. Example: Mitnick could post fake job ads and collect applicants' personal data, such as Social Security numbers, under the guise of a background check.
Tech Support Scams
Pretending to be technical support personnel to gain remote access to victims' computers or obtain sensitive information. Example: Mitnick might cold-call individuals, claiming to be from a reputable tech support company, and offer to fix non-existent computer issues.
Romance Scams
Building online romantic relationships to exploit emotional connections and extract personal information or money. Example: Mitnick could create a fake dating profile and manipulate emotions to convince a target to disclose private details.
Name Dropping
Mentioning familiar names or organizations to create legitimacy and trust. Example: Mitnick could call an employee, mentioning they were referred by a high-ranking executive, to increase the likelihood of cooperation.
Guilt Tripping
Manipulating targets through guilt or sympathy to extract information or cooperation. Example: Mitnick might claim to be a former employee in dire need of specific information, pressuring the current staff to provide it.
Playing "Dumb"
Pretending to be uninformed or inexperienced to prompt victims to offer assistance. Example: Mitnick could call an organization's help desk and act confused, leading the help desk personnel to provide excessive information or access.
Creating False Urgency
Using urgent language or pretending to have limited time to prompt quick decisions. Example: Mitnick could call a company's finance department, claiming to be a vendor, and requesting immediate payment to avoid service disruption.
Trust Exploitation
Taking advantage of established trust relationships to gain access. Example: Mitnick might impersonate a colleague, claiming they forgot their access card, and request temporary access to a secure area.
Spreading False Information
Sharing false information to manipulate decisions or actions. Example: Mitnick could send anonymous emails to employees, falsely claiming that the company's security system has been compromised, leading them to bypass normal security protocols.
Creating a Sense of Familiarity
Pretending to know the victim personally or providing details to create familiarity. Example: Mitnick might call an employee, addressing them by their first name, and use this familiarity to extract sensitive information.
Sympathy Ploys
Appealing to victims' emotions, such as financial hardships or personal struggles, to elicit cooperation. Example: Mitnick could send emails to employees, posing as a colleague in need of a loan and requesting their bank details.
Posing as Authorities
Impersonating law enforcement or government officials to instill fear and compliance. Example: Mitnick might call individuals, pretending to be from the tax department, and threaten legal action if they don't provide personal financial information.
False Job Offers
Sending emails claiming the victim has been offered a job, requiring them to click a link for onboarding details, which leads to a malicious website.
Email Spoofing
Faking the sender's email address to appear as someone trusted to trick the recipient into taking action.
Customer Feedback Scams
Pretending to be conducting a customer satisfaction survey and asking for personal details that can later be exploited.
Fake Support Calls
Impersonating technical support personnel and guiding the victim through steps that compromise their security.
Lottery or Prize Scams
Sending messages claiming the target has won a prize or lottery and needs to provide personal information to claim it.
Survey Scams
Conducting fake surveys with enticing rewards to lure participants into revealing sensitive data.
Watering Hole Attacks
Compromising a website frequented by the target's employees and injecting malware to gain access.
LinkedIn Scams
Posing as a recruiter on LinkedIn to build connections and gain access to sensitive information.
Impersonating Coworkers
Sending emails or messages pretending to be coworkers and asking for favors or information.
Social Media Quizzes
Creating fake quizzes on social media platforms to gather personal information from participants.
Voice Phishing (Vishing)
Calling individuals and pretending to be from a bank, requesting account details under the guise of a security check.
Physical Distraction
Distracting victims physically while an accomplice gains access to sensitive areas.
USB Drop Attacks
Leaving infected USB drives in public areas, hoping curious individuals will plug them into their computers.
Forging IDs
Creating fake identification cards to gain access to restricted areas.
Tailored Scams
Researching individuals' interests, hobbies, or affiliations to craft targeted scams.
Falsifying Emergency Situations
Impersonating a person in distress to manipulate others into providing assistance or information.
Business Email Compromise (BEC)
Compromising an executive's email account and using it to request fund transfers or sensitive data from employees.
Conference and Event Exploitation
Gathering information at conferences and events to use in subsequent targeted attacks.
Free Wi-Fi Honeypots
Setting up rogue Wi-Fi hotspots to intercept data from unsuspecting users.
Charity Scams
Posing as a charity representative to solicit donations and extract financial information.
Friendly Help
Approaching employees in public places, acting friendly, and using charm to gather information.
Manipulating Job Descriptions
Sending tailored job descriptions to target specific individuals for recruitment scams.
Impersonating IT Support
Cold-calling employees, claiming to be from IT support, and requesting login credentials.
Fake Data Breach Notifications
Sending fake data breach notifications with instructions to "verify" credentials.
Executive Impersonation
Posing as a high-ranking executive and instructing employees to perform actions that compromise security.
Tailgating:
Following an authorized person through a secured entrance to gain access to a restricted area. Example: Mitnick could closely follow an employee entering a building by swiping their access card.
Shoulder Surfing:
Observing login credentials or sensitive information by looking over someone's shoulder. Example: Mitnick could discreetly watch an employee enter their PIN at an ATM.
Dumpster Diving:
Searching through discarded documents or hardware to find sensitive information. Example: Mitnick might rummage through a company's trash bins to find printouts of passwords or customer data.
Lock Picking:
Physically picking locks to gain unauthorized access to a building or room. Example: Mitnick could use lock-picking tools to gain entry to a server room.
Bypassing Physical Barriers:
Circumventing physical barriers like fences or walls to enter restricted areas. Example: Mitnick might climb over a fence to access a data center.
Badge Cloning:
Copying an access badge to gain entry to secure areas. Example: Mitnick could clone an employee's access badge using a card reader/writer.
RFID Skimming:
Intercepting RFID signals from access cards to clone them. Example: Mitnick might use an RFID reader to copy an employee's access card data.
USB Dropping:
Leaving infected USB drives in public areas for unsuspecting individuals to plug into their computers. Example: Mitnick might drop infected USB drives near a company's premises.
Hardware Keylogging:
Placing physical keyloggers on keyboards to record keystrokes. Example: Mitnick could discreetly attach a keylogger to an employee's keyboard.
Wiretapping:
Tapping into communication lines to intercept sensitive data. Example: Mitnick might tap into a company's telephone lines to eavesdrop on conversations.
Hidden Cameras:
Placing hidden cameras to monitor and record activities in sensitive areas. Example: Mitnick could place a hidden camera near an ATM to capture PINs.
Badge Swapping:
Switching badges with an authorized person to gain access. Example: Mitnick might swap his badge with an employee's to gain entry to secure areas.
Signal Jamming:
Disrupting wireless signals, such as Wi-Fi or cellular, to create opportunities for unauthorized access. Example: Mitnick might use a signal jammer to disable a company's Wi-Fi network temporarily.
Acquiring Uniforms or Disguises:
Dressing up as an employee or a service technician to blend in and gain access. Example: Mitnick could dress as a janitor to access restricted areas.
Power Supply Manipulation:
Disconnecting or tampering with power supplies to disable security measures. Example: Mitnick might cut power to surveillance cameras before attempting to breach a facility.
Impersonating Employees:
Pretending to be an employee to deceive others and gain access. Example: Mitnick could impersonate an employee to enter a company's building during non-business hours.
Physical Sniffing:
Intercepting network traffic by connecting a device to a network cable. Example: Mitnick might connect a sniffer device to an exposed network cable in a server room to capture data.
Planting Rogue Devices:
Installing rogue hardware or network devices to intercept data. Example: Mitnick could install a rogue access point to redirect Wi-Fi traffic.
Badge Duplication:
Using 3D printers or other methods to duplicate access badges. Example: Mitnick might use a 3D printer to create fake access badges.
Disguised USB Devices:
Concealing USB drives as innocent objects like pens or keychains to evade suspicion. Example: Mitnick could disguise an infected USB drive as a pen and leave it on a coworker's desk.
Physical Eavesdropping:
Listening in on sensitive conversations using hidden listening devices. Example: Mitnick might use a hidden microphone to eavesdrop on a confidential meeting.
Exploiting Shared Workspaces:
Taking advantage of shared workspaces or coworking areas to gain access to other organizations' systems. Example: Mitnick could pose as a freelancer and access another company's unattended devices.
Badge Loaning:
Borrowing an employee's badge temporarily to access secured areas. Example: Mitnick could convince an employee to lend him their badge under the pretense of a quick errand.
Brute-Force Attacks on Physical Locks:
Using force or tools to break open physical locks. Example: Mitnick might use a crowbar or hammer to break a padlock on a storage room.
Mail Theft:
Stealing sensitive information from mailboxes to gather intelligence. Example: Mitnick could steal company mail to find confidential documents.
Fake Maintenance Calls:
Calling employees and posing as a maintenance worker to gain access to a building or device. Example: Mitnick might call a company's IT department, claiming to be from the HVAC company, and request access to the server room.
Physical Social Engineering:
Using persuasive tactics in face-to-face interactions to manipulate individuals into granting access. Example: Mitnick could strike up a conversation with an employee and use charm to convince them to provide access.
Interception of Hardware Shipments:
Intercepting and tampering with hardware shipments to install backdoors or malicious components. Example: Mitnick could tamper with a router being delivered to a company to allow remote access.
Physical Data Theft:
Physically stealing hardware containing sensitive data. Example: Mitnick might steal a company laptop or external hard drive left unattended in a coffee shop.
Vehicle Tailgating:
Following an employee's vehicle closely to enter a secured parking lot. Example: Mitnick could tailgate an employee's car into a restricted parking area.
Impersonating Authorized Personnel:
Dressing up as a repair technician, security guard, or maintenance worker to gain access. Example: Mitnick could impersonate a repair technician to gain access to a company's server room.
Socializing with Employees at Bars or Events:
Engaging in casual conversations to extract sensitive information or gather intelligence. Example: Mitnick might strike up a conversation with an employee at a company-sponsored event and gather information about their work.
Insider Assistance Exploitation:
Manipulating insiders into assisting with unauthorized access or information disclosure. Example: Mitnick could bribe or blackmail an employee to help him gain access.
Physical Dumpster Diving for Hardware:
Searching for discarded hardware that might contain sensitive data. Example: Mitnick could look for old hard drives or servers in a company's trash to extract data.
Badge Manipulation:
Altering or forging access badges to gain unauthorized access. Example: Mitnick might alter an expired badge to make it appear valid.
Cable Tampering:
Cutting or modifying network cables to intercept or disrupt data flow. Example: Mitnick could cut a network cable to disable communication between devices.
Wearable Device Hacking:
Hacking or tampering with wearable devices to gather personal or sensitive data. Example: Mitnick could tamper with an employee's fitness tracker to obtain personal information.
Physical Extortion:
Using threats or physical force to coerce individuals into granting access or revealing information. Example: Mitnick might threaten an employee with harm if they don't provide access.
WiFi Pineapple Attacks:
Setting up rogue Wi-Fi access points to intercept traffic or perform man-in-the-middle attacks. Example: Mitnick could deploy a WiFi Pineapple in a public area to capture data from unsuspecting users.
Manipulating Security Cameras:
Disabling or tampering with security cameras to avoid detection. Example: Mitnick could cover security cameras with tape or spray paint to obscure his actions.
Trash Interception:
Intercepting sensitive documents or hardware being discarded. Example: Mitnick might pose as a janitor to gain access to a company's trash area and retrieve valuable information.
Facility Reconnaissance:
Visiting a facility under the pretense of being a customer or job seeker to gather intelligence. Example: Mitnick could tour a company's facility, noting security measures and potential vulnerabilities.
Social Media Stalking:
Gathering personal information about targets from their social media profiles. Example: Mitnick could use information from an employee's social media accounts to craft a convincing phishing email.
Public Workspace Snooping:
Observing employees working in public areas, such as cafes or airports, to gather sensitive information. Example: Mitnick could discreetly watch an employee working on sensitive documents in a café.
Intercepting Mail or Packages:
Intercepting mail or packages containing sensitive information or hardware. Example: Mitnick might intercept a package containing access cards being delivered to a company.
Access Code Guessing:
Attempting to guess access codes or PINs through trial and error. Example: Mitnick could try common access codes (e.g., "1234" or "0000") to gain entry to a keypad-protected area.
Social Engineering in Public Conversations:
Pretending to be on the phone while speaking loudly about sensitive information, hoping someone nearby will take the bait. Example: Mitnick could pretend to talk on the phone about a supposed confidential project while in a public place.
Bathroom Planting:
Hiding devices, such as cameras or keyloggers, in bathrooms to capture sensitive information. Example: Mitnick could plant a hidden camera in a company's restroom to record employees entering their access codes.
Socializing with Security Personnel:
Building friendly relationships with security personnel to gain their trust and potentially access to secure areas. Example: Mitnick could engage in conversations with security guards during their breaks to establish rapport.
Hiding Devices in Office Equipment:
Concealing devices, such as cameras or recording devices, inside office equipment to monitor activities. Example: Mitnick could hide a tiny camera inside a printer or air conditioning unit to observe a company's activities.
Relevant Note(s): Physical Security Social Engineering