90 Chapter5·SSHShortcomings Shoulder surfing is the lowest tech attack but does supply login credentials and pin numbers. The attacker stands behind the victim and looks over their shoulder to see their pin number or password. This type of attack works great with administrators who log on to computers locally. The attacker is usually an insider as most employee screens are faced away from public view (We hope). Watch people at the ATM machine: some use their bodies to shield the keypad while they punch in their PINs, while other don't really care who is watching. The human based attack has great advantages over computer based in that the attacker has the ability to adjust the attack based on real-time feedback. Monitoring the victim for physical signs of stress allows the attacker to have full control of the situation and the victim. Blending attacks The accuracy and success rate of SE attacks have increased with the use of blended attacks. The victim gets a phone call, an e-mail, a written letter, and a personal visit just to deliver the request. This complex undertaking is a sign of a highly organized attack and the business is targeted by a specific person or group. Attacking the Psyche The psychology attack refers to the emotions used during the attack. Several standard methods exist for the psychological attack. Aggression We all know this one; it's the typical yelling boss attack. The victim is threatened with their job, the destruction of their business and loss of everything they hold dear. Depression "I'll lose my job if I don't ____" works well on many working people who don't want to be responsible for this poor person looking their job. Confusion Fast requests, rapid in nature, or facts that make sense but the request doesn't follow. Lots of stress induced in the victim. Used commonly with aggression. Misdirection Ask for one thing then change the request to more sensitive information. Ingratiation Doing something nice for others helps people feel they should do something nice for you. Ignorance Asking for help with forms or simple items. The questions or help needed then escalates to the desired request or the small separate bits of information can be combined into a complete SE attack. Friendliness Few people are friendly to low level office people, making them the perfect target for this attack. Politeness and smiles over a period of time do make a successful attack. The first question to ask when performing forensics analysis on the psychological attack is "What technique did they use in making themselves so powerful that staff gives them the requested