oracle mind
4 HN mentions · mentioned in 4 months, 2016–2019
2:31 · 1.8M views · May 1, 2016
A short clip demonstrating a phone-based social engineering trick in which a crying baby in the background is used to pressure a customer service rep. It shows how attackers exploit human sympathy rather than technical flaws.
Cited as a funny and effective real example of social engineering whenever support-desk account takeovers and human weak points are discussed.
4 comments from Hacker News
>Only if you define easier as 'badly designed process'. I'd be interested to know what a good process is. >That is unfortunate, but why do you believe this will always be the case? I don't believe most (if any) online accounts that I have provide enough profit to the service owner to hire and train employees with enough expertise, time, and resources to properly determine a valid recovery attempt from a fake one. Social engineering employees just seems so easy from what I've seen. It's so reliable it can be done on stage: [LINK] this video It just takes a single slip up and you lose. Whereas attackers can just keep trying. >Maybe this can be an opt-in for the more 'security-minded' minority. Yeah I agree it's a good idea. In fact that's what I've done on my primary google account [LINK] But that implementation isn't perfect, it requires giving up some features and buying U2F keys. Preferably you could opt into exactly the protection you want, so you could get the recovery security without having to buy security keys for example. I agree there could be better implementations, but they would cost more. I think it's a three way tradeoff between cost, easy recover, and security. When I hear someone advocating for easier recovery without advocating for higher cost, then I immediately think there will be a lowering of security.
Social hacking is alive and well. During my studies in computer engineering we had lectures on cybersecurity and the person used the following example this video Human error is still one of the most popular hacking techniques. By getting an e-mail address you can check haveibeenpwnd to see if there were any leaks related to that e-mail address and there's already a lot that you have on a person that you don't actually know. Recently there was an increase in phishing schemes where hackers obtained the passwords of really old leaks (from myspace, armorgames etc. etc.) and sent letters to people with legit passwords trying to extort money. This was a hugely successful campaign. I'm not saying don't mention your name in public but for sure use a password manager and a VPN if you're on public wi-fi a lot. And don't shout your cred card number while buying coffee.
That sounds like a very tedious thing to go through to login to your email. Just use a strong password ( [LINK] ) The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system. ( as an example, this was on reddit just yesterday this video )
Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things). Here's a pretty hilarious and effective example where a crying baby background was used: this video