phishing and social engineering

a little background on something that just happened >get a random text from a girl (pic semi related, lewd tummy pic) >said she got the wrong number from a dating site (understandable) >talk back and forth, generic answers, but sounds like most girls my age anyway (and the pictures match) >I try to play a game: try to get as much information as possible without giving out any of mine (this has worked a few times in the past when girls accidentally texted me and after a little bit of small talk, i got hate mail from her bf which was quite hilarious to be honest "idk you brah, but if you come near my GF ill fukin kill you") >get name, address (general area), days she will be traveling >seems like she is giving up information too easy >"my ex broke my phone, im using my sisters" (area codes dont match) >sister is going to her BF, but we can hang, plz ill use my computer >suspected phishing attempt, but whatev >expect to get social media information >get a scam url >probably just a bot how practical are scams like this, government and military all around the world have had state secrets leaked because of phishing/scams, but are people really that stupid? what are some techniques used in social engineering that you know of or have used with success?

>government and military all around the world have had state secrets leaked because of phishing/scams Because they're tech illiterate boomers who would love to get a chance to cheat on their wives, what the hell did you expect? also tfw no brown tomboy /fit/ gf

I fall occasionally for scams of all sort and usually it's because I'm in a depressed state and just consider it more a form of self-harm than anything else. In my experience scams don't need to be smart at all and most of the success rate is gonna depend on selecting a target who does not care about protecting whatever you're trying to scam them for.

I know in Nigeria they do this, have 20 tabs open talking to several people at one. When it comes to phishing in general is how big you cast your net. Email lists will sell on skiddy forums for $1 for 100,000,000 emails. People built web scraping bots just to harvest more emails for scammers.

helo

>>5817 >are people really that stupid? Yes, yes they are. Companies have security awareness programs for a reason. Even my father is a dumbass sometimes. For example, the phone rings, he doesn't look at the caller ID and picks it up. He quickly figures out that it's a robocall and proceeds to speak with the robot. He just likes to "mess with them." I told him not to do that because of two reasons: 1. Now they know you might pick up the phone if they call again 2. Don't even give yourself the chance to slip up in the first place and release your info. There have been many before him who have done the same and have wound up with a stolen credit card number instead of a few jollies Any information, no matter how seemingly trivial, is good information to give out. And people still fall for email/text scams all the time. It's absurd. As for techniques, finding the stupidest people is your best bet but that's not always an efficient option. It's truly a quantity over quality operation. The more suckers you can cast your hooks out too, the greater your chances of one sucker actually getting suckered.

>>5841 >Even my father is a dumbass sometimes Can you imagine? Even anon's father!

>>5842 >Even anon's father! NOT HIM TOO does anybody have textbooks on social engineering techniques? I know there are classes on how to social engineer, but I think that those are just scams to make money off information that is already out there

>>5845 I know this is not exactly what you are looking for, but I'l dump what I have.

>>5846 Not him, but if you have anything specifically on cognitive biases, I'd appreciate it.

>>5841 Another reason not to talk to cold calls is some are targeted attacks to get recordings of your voice, to defeat the soykafty "vocal biometrics" systems that some banks or other places use as a 'security' measure.

>>5845

>>5847

>>5871 Thanks mate.

Are there some worthy courses on social engineering on internet or all need to know I can find in those books?

Wait a second. Is OP trying to tell us he spent more than 20 seconds talking to a robot?

>>5889 A lot longer, and then tried to "social engineer" it.

nowadays having a password is useless, they are so many security layers on top of a simple login form. double authentication, phone SMS and so on... it seems to be a dead end

>>5886 That's where you're nice to people and they are nice back to you, right? It sounds ingenious.

>>6456 SMS is hilariously weak. You could harvest everyone's texts if you had the right hardware.

>>6464 i think he's saying having someone else's password is useless. which is also not entirely true, but it probably won't get you into anything really important any more. you'd be hard pressed to even get into their social media if all you have is a username:password combo.

>>5817 Yes people are that stupid. >>>>5845 Find attached.