Social Engineering Testing

Condition Zebra will perform passive information gathering on public resources for instance website, Google Hacking, WHOIS, reverse IP Lookup to gain more knowledge on the organization.

Information obtained including:

•       IP addresses
•       URLs
•       Email addresses
•       Contact numbers

Condition Zebra will test the awareness of malicious hyperlinks, giving of credentials (Quid pro quo) and executable files among the staff. For example, a giveaway URL is embedded in a phishing email. The hyperlink will redirect the staff to the phishing website created by Condition Zebra. The website will capture the data key-in by the staff.

This method could also examine whether the employees will report/document a cyber-security incident to the relevant department.

Remark: On the occasion that the malicious emails sent are filtered by the company’s email filtering system, then it will be responsible to whitelist/ release the email to reach the recipients’ inbox

Condition Zebra will impersonate as a trusted third-party vendor to call and ask for credentials from the staff to allow them access to sensitive company information, like passwords.

Email spoofing works parallel with phishing assessment. Phishing mail will be sent to impersonate the email from a trusted organization or the email from higher management to increase the trust of the victim and increase the chance of phishing attack success.

Condition Zebra will test the awareness of company staff by presenting malicious hyperlinks. For example, a giveaway URL is embedded in a phishing message via WhatsApp. The hyperlink will redirect the staff to the phishing website created by Condition Zebra. The website will capture the credentials key in by the staff.

Condition Zebra will attach malicious documents in email, followed by monitoring and identifying the person who executed the document.

The Malware is customized to allow the devices to send the request to Condition Zebra’s monitoring machine. Once the staff click on the malware from a phishing email or a USB drive, the malware will be triggered.

Condition Zebra’s testers will move around the target location to check on sensitive information leakage. Shoulder surfing is performed to get the login credentials from staff when they are typing.

Other than that, Condition Zebra’s engineer will jot down when staff is leaving the computer screens turned on when they leave their desk. The environment in the office is examined such as passwords written on the whiteboard or stickers on the desk.

A tailgating attack also referred to as “piggybacking,” involves attackers seeking entry to a restricted area without proper authentication. In it, the perpetrators can simply follow an authorized person into a restricted location. They can impersonate delivery men carrying tons of packages, waiting for an employee to open the door.

After tailgating is completed, the attackers have successfully infiltrated the restricted area.

Condition Zebra will impersonate a promoter to encourage the staff to download the malicious mobile application in order to get a secret code to unlock the promotion. This method tests the awareness of staff for application permission before installing any apps on their mobile phone. Once the application is installed and executed, the mobile phone number of the staff will be sent to the Condition Zebra monitoring server.

The way to conduct this testing is similar to a mobile application. A USB drive will be given to the staff. If the filtering agent is not implemented, the Malware will be executed to send the IP address and the MAC address of the victim to the Condition Zebra monitoring server.