How I attacked a fellow student • Hacker News Board

Re: How I attacked a fellow student

#31

Post by enjo » Tue, Apr 30, 2013, 4:01 AM UTC

shmageggy wrote: post #24

I thought "Please find attached herewith my resume for your kind perusal" was a joke but apparently that's how this person really responded. Recruiters: how does this forced, over-formal tone affect your impression of a candidate?

Not at all. When we have an opening I get dozens of those a day. I honestly skim them to see if there is any relevant information (there usually isn't)... and then go straight to the resume. So the language just doesn't register with me, at least not consciously.

Well done versions include a couple of nuggets of information telling me why I should open that resume, but that's surprisingly rare.

Re: How I attacked a fellow student

#32

Post by cbhl » Tue, Apr 30, 2013, 4:04 AM UTC

Found this a rather amusing read. Best of luck on your exam!

Re: How I attacked a fellow student

#33

Post by sohamsankaran » Tue, Apr 30, 2013, 4:08 AM UTC

ballstothewalls wrote: post #30

shaananc wrote: post #25

Earlier quoted context omitted.

The other student was an international student, his English overall was quite formal. Really lovely guy though :)

I suspect the other student was more susceptible to this sort of thing since he was a non native speaker. I'd be curious to see if it would've worked on an American.

Speaking as an Indian who's had the opportunity to try this sort of thing on various Americans (and a lone Australian), it would've worked. The success of the attack probably has more to do with the susceptibility of each individual victim than their specific native language, though (and this is a sweeping generalization) many Indians do tend to have greater deference to authority (real or imagined) than their American counterparts.

Re: How I attacked a fellow student

#34

Post by sohamsankaran » Tue, Apr 30, 2013, 4:12 AM UTC

Interesting. If the author is still around, I have a question - would the whois data have given you away, or was this faked/spoofed in some way?

Re: How I attacked a fellow student

#35

Post by girvo » Tue, Apr 30, 2013, 5:18 AM UTC

guylhem wrote: post #13

The title is a bit misleading. It's not an attack, more like well done social engineering. But the context is very helpful - especially with the amount of detail you provide, along with the email exchange, one can see the target was totally abused. The lanyard, laptop, false recruiting - you really overdid it, but I mean that in a positive way. I like it, it's so great - you could almost make a movie out of it ;-) Th…

Y'know what, I disagree. It's not misleading. Social Engineering _is_ an attack, as far as I am concerned, and honestly when he mentions that it's Social Engineering in the third sentence of the article itself, I don't find it misleading at all.

To the guy who did it: Bloody well done. I agree with guyhelm, it's overkill, and we all know that's the best kind of kill ;)

Social engineering is actually quite scary, especially when put together with targeted attacks against the individual. It's a one-two punch that is very hard to defend against.

I wish the Uni's here in Brisbane would do stuff like that! Well done again, and I'm quite jealous!

Re: How I attacked a fellow student

#36

Post by jmonegro » Tue, Apr 30, 2013, 6:21 AM UTC

sohamsankaran wrote: post #34

Interesting. If the author is still around, I have a question - would the whois data have given you away, or was this faked/spoofed in some way?

You can quite cheaply (for around $3 depending on the registrar) opt into Whois privacy protection.

Re: How I attacked a fellow student

#37

Post by justx1 » Tue, Apr 30, 2013, 6:31 AM UTC

Well played...

Missing to redact X.com's phone number allows "social engineering" of the company name, though.

Re: How I attacked a fellow student

#38

Post by lostlogin » Tue, Apr 30, 2013, 6:56 AM UTC

justx1 wrote: post #37

Well played... Missing to redact X.com's phone number allows "social engineering" of the company name, though.

It's an interesting time now. It used to frustrate me how I couldn't find an address with just the phone number - despite having a white pages that contained the info. I know this was buy design, for privacy. Now if you search for a number, your bound to get a hit for it, and can work out who it belongs to. I'm sure this will fail me one day, but it hasn't yet.

Re: How I attacked a fellow student

#39

Post by [deleted] » Tue, Apr 30, 2013, 8:05 AM UTC

guylhem wrote: post #13

The title is a bit misleading. It's not an attack, more like well done social engineering. But the context is very helpful - especially with the amount of detail you provide, along with the email exchange, one can see the target was totally abused. The lanyard, laptop, false recruiting - you really overdid it, but I mean that in a positive way. I like it, it's so great - you could almost make a movie out of it ;-) Th…

[deleted]

Re: How I attacked a fellow student

#40

Post by lotsofcows » Tue, Apr 30, 2013, 8:35 AM UTC

girvo wrote: post #35

guylhem wrote: post #13

The title is a bit misleading. It's not an attack, more like well done social engineering. But the context is very helpful - especially with the amount of detail you provide, along with the email exchange, one can see the target was totally abused. The lanyard, laptop, false recruiting - you really overdid it, but I mean that in a positive way. I like it, it's so great - you could almost make a movie out of it ;-) Th…

Y'know what, I disagree. It's not misleading. Social Engineering _is_ an attack, as far as I am concerned, and honestly when he mentions that it's Social Engineering in the third sentence of the article itself, I don't find it misleading at all. To the guy who did it: Bloody well done. I agree with guyhelm, it's overkill, and we all know that's the best kind of kill ;) Social engineering is actually quite scary, espe…

Rule 37. There is no "overkill".