Impersonation is another type
of social engineering technique,
and it's one that's really effective most of the time.
Now, impersonation is the actor pretending
to be someone or something else.
If you're conducting a physical penetration test,
for example, you may try to pretend to be someone
who you aren't in order to gain access to a facility.
If you're conducting phishing, you may use pre-texting
to first get a general idea of the situation
and then use impersonation to try
and influence the person on the other end of the phone
to take some kind of action that you want performed.
If you're sending a business email compromise-based message
to another employee,
you are definitely conducting impersonation
by pretending to be that executive whose email account it is
that you've taken over and broken into
and sent that message from.
Now, as you can see, there are lots of different ways
to use impersonation during your engagements.
One of my favorite methods though
is to pretend to be a delivery person
or a support technician when trying to gain access
to an organization's facilities during a penetration test.
For example, if you have a UPS shirt on
and carrying a package or two in your hands,
you would be amazed at how many people
will simply open the door and let you walk right in.
Or maybe you have a polo shirt
with the local internet service provider's logo on it,
and you're carrying a tool bag with you.
Again, people are going to open up the door for you,
walk you right over to the telecommunications closet
where the company's main distribution frame is located,
and then leave you there to do your work at peace.
By conducting impersonation in this manner,
you could pretend to be somebody
who has a reason to be let into that building
or into a restricted area like a communications closet.
Now, you might ask,
"Where do you get shirts and uniforms like these?"
Well, it's really not that difficult.
Want to dress up and pretend like you work for Xfinity
and you're there to fix their internet,
or you want to walk in
like you're the friendly delivery man from UPS?
Either way, you can for the low price of 32.99.
Just head on over to eBay
and search for UPS polo shirts and it's yours.
Now, I wonder here,
will the seller actually use UPS to ship it to you?
I know inquiry minds want to know,
but either way, you're going to get your shirt.
Seriously here, eBay is now your best friend
when it comes to getting uniforms from trusted companies
that you can then use to conduct your impersonation
during your engagements.
As my guidance counselor once told me
many years ago back in high school:
"Dress for the job you want."
Well, if you're dressed up as a delivery person,
people are going to believe and assume
that you're a delivery person,
and now you can walk right through the front door
holding a box that needs to be delivered
to Greg in accounting,
and they might even walk you all the way
over to the elevator
and tell you how to get to Greg's office.
Personally, I love using the impersonation attack
that involves a delivery person
because it lets me carry an entire box with me
inside without being questioned.
Now, inside that box,
I can have all my hacking supplies I might need
once I get inside.
Things like my lock pick set,
my wireless network sniffer, some rubber duckies,
and a laptop or notebook with Kali Linux installed.
Now as a penetration tester,
your goal is to use people's inherent trust
of a person in authority or people in uniform against them,
and much of the time, it's going to work
when you're doing these impersonation attacks.
Now, once you're in the building,
what else might you be able to do
using your impersonation skills?
Well, you could work on elicitation
to gather more information
or get people on the staff to take actions for you.
So what is elicitation?
Well, elicitation is the ability to draw, bring forth,
evoke, or induce information from a victim.
Basically, this is a fancy way
of saying you're going to ask them a lot of questions
and try to get them to give you some information
or take some kind of action.
Elicitation can occur face-to-face,
such as during your physical assessments,
or they can occur over chat, email,
or phone calls if you're conducting a remote assessment.
Most people, by their very nature, want to be helpful
and they'll continue to answer questions
without thinking about the information
they may be handing over to an attacker.
For example, if I ask one of the employees to show me
where the copy machine is
because I need to make a copy of the invoice before I leave,
they're likely not going to think twice about it,
but while I'm at that copy machine,
I can get them to enter their access code
so they can be able to make that copy for me.
Or maybe I can print off a test page
or enter the configurations
to see the IP address of that machine.
All this gives me valuable information
that I can use to determine the subnet being used
by the printer
or the internal IP address scheme used by that company.
So remember, as part of your social engineering attacks,
you can use impersonation
and elicitation in combination with each other
as well as in combination with an in-person
or remote attack to get additional information
or access during your engagements.