Regarding #SocialEngineering I love the work of Frank Stajano and Paul Wilson. The documented 7 common principles of #scams.

The principles are (in my adaption)

  1. Need or Greed / Bait: Something the victim/mark wants or wants to avoid.
  2. Deception: A connection to reality
  3. Distraction: an elaborate story around the scam hiding the true intentions.
  4. Authority or Trust: Scams "originate" often trusted or authoritative person, role, or organisation
  5. Time pressure & timing: The victims are pressured to decide or act quickly. And the attacks are timed, often after lunch, or the afternoon were the victim is like less energetic and attentive.
  6. Secrecy (or Dishonesty): keep the mark from asking someone else.

and may slightly less relevant in a digital Social Engineering context:

  1. Herd/Group Principle: Others are doing it as well, so I either have FOMO or think it can't be that bad

You can read more in https://www.cl.cam.ac.uk/~fms27/papers/2011-StajanoWil-scam.pdf

ajuvo ✔ boosted