A short clip demonstrating a phone-based social engineering trick in which a crying baby in the background is used to pressure a customer service rep. It shows how attackers exploit human sympathy rather than technical flaws.
Why Hacker News points people here: Cited as a funny and effective real example of social engineering whenever support-desk account takeovers and human weak points are discussed.
“Here's a pretty hilarious and effective example where a crying baby background was used”HN comment, 2018
“Hacking human stupidity is a more effective way in to get in to a secure system.”
Example of social engineering to take over accounts
Full comment
That sounds like a very tedious thing to go through to login to your email. Just use a strong password ( link ) The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system. ( as an example, this was on reddit just yesterday this video )
Cites itBugeApr 2018
“It's so reliable it can be done on stage”
Live-on-stage social engineering of support staff
Full comment
>Only if you define easier as 'badly designed process'. I'd be interested to know what a good process is. >That is unfortunate, but why do you believe this will always be the case? I don't believe most (if any) online accounts that I have provide enough profit to the service owner to hire and train employees with enough expertise, time, and resources to properly determine a valid recovery attempt from a fake one. Social engineering employees just seems so easy from what I've seen. It's so reliable it can be done on stage: linkthis video It just takes a single slip up and you lose. Whereas attackers can just keep trying. >Maybe this can be an opt-in for the more 'security-minded' minority. Yeah I agree it's a good idea. In fact that's what I've done on my primary google account link But that implementation isn't perfect, it requires giving up some features and buying U2F keys. Preferably you could opt into exactly the protection you want, so you could get the recovery security without having to buy security keys for example. I agree there could be better implementations, but they would cost more. I think it's a three way tradeoff between cost, easy recover, and security. When I hear someone advocating for easier recovery without advocating for higher cost, then I immediately think there will be a lowering of security.
Cites itmichaelbuckbeeAug 2018
“Here's a pretty hilarious and effective example where a crying baby background was used”
Hilarious example of tricking a CSR using a crying baby background
Full comment
Cellphone accounts can be readily compromised via social engineering (aka tricking the CSR into changing things). Here's a pretty hilarious and effective example where a crying baby background was used: this video
Cites itDerelictsMar 2019
“Human error is still one of the most popular hacking techniques.”
Used as example in a cybersecurity lecture
Full comment
Social hacking is alive and well. During my studies in computer engineering we had lectures on cybersecurity and the person used the following example this video Human error is still one of the most popular hacking techniques. By getting an e-mail address you can check haveibeenpwnd to see if there were any leaks related to that e-mail address and there's already a lot that you have on a person that you don't actually know. Recently there was an increase in phishing schemes where hackers obtained the passwords of really old leaks (from myspace, armorgames etc. etc.) and sent letters to people with legit passwords trying to extort money. This was a hugely successful campaign. I'm not saying don't mention your name in public but for sure use a password manager and a VPN if you're on public wi-fi a lot. And don't shout your cred card number while buying coffee.
