To be honest even I didn't have a high opinion of social engineering conmen, until I watched "Catch Me If You Can" and read about Frank Abagnale[1].
That said, most of the big hacks do involve social engineering angle. It's a cocktail of tech hacking + social engineering + good old plain con.
https://news.ycombinator.com/item?id=27048793 "New book contends that Catch Me If You Can is mostly made up"
Anyone can send an email with a link, chuck some USBs in a parking lot or pretend they're an employee at a company. All you need is one curious or lazy employee.
Sure it has its uses but to compare it to hacking is ridiculous and tbh the only reason I think it is done is because back in the day hacking contests were completely male dominated and they had to save face.
That's like saying running a brute password cracker or port scanner requires no skill or hard work at all, so lumping software work under hacking is really an insult to all the "real hackers" (whatever real means).
Social engineering often requires you to get someone else to do something that they should not, don't want to and often are trained not to do. Very often in direct interactions, not only is it hard (depending on target you might also need a lot of background knowledge, needing significant prework), but it typically involves much higher direct risk (which makes it even harder).
Yet when you receive a phishing email, you can usually find clues it's not legit (such as typos). It takes craft to make a convincing one. Pretending to work somewhere sounds even more hacky: i for one would certainly not be able to do that, and i'm sure many fellow hackers (in the broad sense of the word) are in the same basket.
Understanding human systems to infiltrate an organization is pretty much like reverse-engineering. As someone who's not practicing either, i would say social engineering looks even more complicated for one reason: when you're reverse-engineering a program/API, you usually take some steps to protect yourself. Either you run the program on an isolated network, or you borrow someone else's network (VPN/Tor/etc) to attack an API.
When you're attacking a corporation via social engineering, you're on the front line smiling to the people at the front desk asking why your work badge isn't working anymore or pretending to be the toilet repair crew. Every probing step you take can unmask you, and the consequences of that can be much more quick/severe than if you leaked a random IP address trying some weird request.
If you can recognize them easily, then you could create them easily too. The problem isn't acquiring skills or knowledge, its having weak morals and being desperate.
Its an insult for a very good reason: Con men are dangerous. In the same way actual hackers see computers as targets, they see people as targets, not as human beings. They usually end up with some degree of psychopathy.
“Conning" is just hacking systems consisting of one or more people.
> People have been doing it since the beginning of time and one can do it with very little technical skill.
People do other kinds of hacking with very little skill and a few focussed tricks (often borrowed form others), too. OTOH, deep knowledge of social systems allows doing original hacks of more complex social systems with greater theoretical safeguards (often, they are just as weak if you can identify the right point of attack, but that's where the knowledge comes in; just as with systems composed of things other than humans.)
> It's an insult to those who work hard for deep knowledge and technical ability, to call social engineering "hacking".
No, it's not.
The Project Zero and APT type stuff that hits the news is the exception, not the rule, which is why it hits the news in the first place.
To me hacking entails a thorough understanding of the environment.
[Good] social engineering [Bad] hacking
The vast majority of hacking and social engineering are pedestrians.
This is handy when youa re selling your consulting services.
One of our consultants will con .. We have sone of the best con artists ....
The term itself is a con.
If anything it‘s people like you worshipping technology itself and ignoring their users why social engineers are so effective.