Every time you're In need of a product or a service, be It buying a new desktop computer with the very latest GPU to play your favorite games, or grabbing a pair of Nike Air Max trainers to wear at your aerobics session every Thursday & Friday night, one of the first things that comes to mind Is getting on the Internet and "researching online stores by collecting all the details you need prior to purchasing the goods you're after". Unless you have thousands of dollars lying around as petty cash and simply buy the first Item that you come across regardless of cost, you will perform what I call "Information gathering sessions" to establish whether a particular commodity suits your needs and budget.
The very same principle applies to "social engineering companies to the likes of Amazon, Logitech, Zalando" and so forth, with the Intention to deceive their representatives to credit your account or dispatch a replacement Item while you still get to keep the original one. I've appropriately titled this type of SEing (yes, "It was myself who branded Its name!" ) as "company manipulation and exploitation", for the reason that SEers first need to manipulate the company's reps and then exploit their vulnerabilities to ultimately achieve a favorable outcome. And If It's the first time they're social engineering a given online retailer, It must be done by familiarizing precisely how the company operates, assesses and processes claims.
Most of the Information can be obtained by navigating to their website's terms and conditions, and/or hitting a practice run- both of which significantly help to formulate your method based on your (researched) findings, and flawlessly execute your attack vector to the point of having your claim finalized to your advantage- a refund or replacement Item. Now on the grounds you've been SEing In this capacity as a beginner, Intermediate or (perhaps) an advanced SEer and you require assistance with how to specifically prepare your SE, you'd be well aware that It can be a difficult task finding reliable and reputable resources to get the job done and on-topic of this article, "editing Image metadata" Is definitely no exception.
Even If you're a registered member of an active social engineering community that functions on a large scale, such as an Internet forum/board or a Discord server, discussions pertaining to "effectively" editing & manipulating Image metadata are few and far between. Notice how I've quoted "effectively" just above? That's because messages and posts about metadata certainly exist to some degree, there's no doubt about that, however most are either misleading or do not elaborate on how It should be done without raising any suspicion whatsoever. That's where I come In! I will demonstrate the Ins and outs of "why metadata should be edited and/or removed from Image files", as well as the events that trigger the need to perform such actions but first and foremost, It's Imperative to have a clear understanding of Its definition, so let's check It out now.
What Is Metadata?
If you're the type of computational user who's not particularly tech-savvy, hence seldom delves Into the Inner workings of how devices capture and create files, I'd say It's very safe to assume that you're at a loss as to what the term "metadata" entails and rightly so- It's not something that the average PC user should be proficient at. But from a social engineering standpoint, It's crucial to have knowledge of at least the basics of "what describes metadata and how & why It's generated In Image files". I'm solely referring to "Image files" (and not text files or otherwise), namely because your SE (In this guide) will only relate to that file type. Don't worry, It will make perfect sense as this article moves forward.
So the question Is, what the heck Is metadata? I'll try and explain It as best I can and without the tech jargon, thereby every reader should have no Issues comprehending Its contents. What you're about to read Is not based on any specifics, thus should be used as a general guide when the time comes to apply It to your SEs. Okay, put simply, "metadata Is used to provide details about other data". For example, In terms of an Image file, "metadata describes the Information that's embedded In the file Itself" and If you take a photo with your camera, things like the camera's make & model, flash mode, focal length, date & time and other bits and pieces are automatically saved the moment the photo Is taken.
Confused? No need to panic- you won't be In 30 seconds time. Now If you're using a Windows operating system (If not, toss out your Mac or Linux and Install Windows 10!) the easiest way to view metadata In an Image file (or any file for that matter) Is to right-click It, select "Properties" down the bottom, and then hit the "Details" tab at the top. You will then see an array of Info dedicated to that file alone, and depending on the device used to capture the Image, It can potentially reveal Identifiable details such as your "geolocation" which (as an SE'er yourself), you certainly wouldn't want It falling Into the hands of others.
What everything means In this entire topic, Is that If you're going to edit an Image file like "creating a fake Invoice" and the representative decides to view the metadata, he'll see that It's been tampered with and not In Its original form, therefore your SE will come to an end there and then. So what steps should you take to edit and/or remove metadata, and not show signs of Inconsistencies? Before I discuss that, you need to be aware of "the events" that require metadata to be edited/removed, and most Importantly, the "methods" that're responsible for triggering each event, so we'll have a look at that In the topic below.
What Triggers Metadata To Be Edited/Removed?
Irrespective of the method you're currently using or plan to use with future SEs, unbeknownst to you, "each will trigger one or more events" that will either work In your favor towards a successful outcome, or complicate matters while your SE Is In progress. To give you a good understanding of this, allow me to provide an off-topic example with a method that you can relate to named the DNA (Did Not Arrive). As you should know through your SEing experience, this Is used to say that you did not receive the package that was delivered by the carrier driver. Of course, nothing of the sort happened- you're just claiming It for social engineering purposes.
Due to the nature of the DNA, In almost all Instances, "an Investigation will be opened" that will most likely lead to "filing a police report". Both of these events (Investigation and police report), are a direct result of using the DNA method. The same can be said for methods that trigger the need to remove metadata from (In this case) Image files- the most common being the "faulty Item method" and the "serial number method". If you haven't used either of the two, you'll certainly be overwhelmed when the time comes to Incorporate It Into your SE but rest assured, I've got you covered. I will Introduce each method respectively In the subtopics below, and also outline "the type of events they set off that require manipulation and/or removal of metadata". So without further delay, let's begin.
The Faulty Item Method
Have you ever purchased something such as a hair straightener or an electric shaver on the Internet, and upon opening the package and plugging In your product, It had no functionality whatsoever? I'd say your answer Is "Yes" on at least one occasion. Although goods are tested and Inspected by the manufacturer prior to shipping them to their suppliers, they're not always In faultless condition- factory defects are Inevitable and companies are well aware of It, but don't like to disclose It. Social engineers also have knowledge of this and use It to their advantage with the "faulty Item method", by saying that the Item they've purchased either stopped working sometime later, or It didn't function right from the get-go.
Under the circumstances and In compliance with company protocol, the rep will go through a few troubleshooting steps to try and Identify why the Item Is not operating as per Its original state, and everything he asks you to do to see whether your Item Is working, you'll obviously respond by claiming that It Isn't. When he's satisfied that It's defective, he'll authorize a refund/replacement but rather than sending your (seemingly) broken Item back, he will Instead request a "POD" which Is an abbreviation of "Proof Of Destruction". "This Is the event that the faulty Item method triggers, and warrants the Image metadata to be edited". I'll explain this shortly.
So what exactly Is a "Proof Of Destruction?". I'm glad you've asked! As Its name Implies, you need to "destroy" your Item In a manner that will render It nonfunctional and the rep/agent will give you a set of Instructions on how It should be done- which all depends on the nature of your Item. For example, If It's a computer keyboard, he may ask you to break some keys, or If you're SEing an SSD (Solid State Drive), you'll be told to drill a few holes Into It. The reason for this from a company's perspective, Is to make sure that your defective Item Is completely useless, thus preventing you from falsifying the claim.
Now In order to verify that It has been destroyed, you'll be Instructed to provide evidence by "taking a photo that clearly shows the damaged Item" and (where applicable) Its serial number, Inclusive of a handwritten note next to the device- all of which must be visible In the photo. When you've fulfilled these requirements, It will be sent as an attachment via email and If there's no Inconsistencies, either a replacement Item will be dispatched or your account will be credited with a refund. This Is the "POD"- namely the "photo" that you will be editing according to what you've been told by the representative.
Evidently, "you have no Intention to break/destroy your Item", hence to comply with the Proof Of Destruction, you'll grab an Image from the Internet (or anywhere else) that matches your product, and edit It with the Information as requested by the rep. It's at this point where you need to be very careful In the way the Image Is manipulated, formatted and finalized- for the fact that "It already contains metadata that potentially Indicates Its from another source", therefore It concludes you're not the original owner! Prior to discussing the manipulation of metadata and as mentioned earlier In this article, the "serial number method" can (at times) also require metadata be edited/stripped, so we'll see what It Involves In the following topic.
The Serial Number Method
You're pretty much well-Informed about "why" metadata can have a negative Impact on your SE with the faulty Item method, so I won't go Into too much detail about that, but rather describe what the "serial number method" entails, and the event It's responsible for triggering the need to address the metadata In Image files. Okay, a commonality with the majority of social engineers, Is to buy the Item first and then use any of the traditional methods to SE It thereafter. The main advantage of using this approach, Is that you have an array of methods to choose from, thus can select the one that's most likely to work In your favor, however not every SE'er has money to spare and that's when the "serial number method" comes Into action.
Stating the obvious, the method relates to Items that contain serials such as computer keyboards, Apple AirPods, speakers, graphics cards and the list goes on, but before the claim can begin, "the product must be under warranty". So how do you get your hands on a valid serial number when "you don't have the Item to begin with?". There's quite a few ways It can be done, but It's way beyond the scope of this article to cater for the lot, so I'll only cover a couple of methodologies- beginning with the good old search via "YouTube". To avoid spending hours on end typing away to no avail, you must be selective with the keywords you enter In the search bar and the best way to do It, Is to type the description of your Item, followed by the word "unboxing".
In doing so, you'll see how the Item Is packaged by the manufacturer and most Importantly, "users demonstrating the process used to take the contents out of the box displaying the product serial number". For Instance, I've entered "Samsung SSD unboxing" and It returned countless videos showing procedures of what to expect when taking the drive and Its accessories out of the box. You'd be surprised at how many people upload their videos, and completely disregard to edit/mask Identifiable details that are associated with the device that they're showing In the footage- of relevance being the "serial". When you've finished with this article, go to YouTube and check It out for yourself, you will not be disappointed.
Another approach to obtain the serial number, Is by "physically visiting the store" which Is my favorite for the reason that there's absolutely no risk at all. As a matter of fact, there's very little to no social engineering Involved, which makes your job as an SEer Incredibly simple however for this to work, "the serial on the box must be the same as the one on the Item". On the grounds that you've established that It Is (box & Item serials match), locate a store that sells the same make & model as the product you're SEing, and walk In as though you're a normal customer looking to buy something. When you've found the Item, hold the box In one hand and your cell phone In the other, and act as though you're shooting off a text message. Instead, take a picture of the serial that's displayed on the outside of the box, and then put It back on the shelf. It doesn't get much easier than that!
Now that you have the serial number at your disposal and given It's well and truly still under warranty, head over to the terms & conditions of the company you're SEing, and check their "refund policy"- namely If they offer a refund for a change of mind (and the like). For example, some companies will give you a refund within 35 days of the purchase date, but along with returning the Item, you must provide a "POP" -Proof Of Purchase. This (the "POP") Is the event that requires the metadata to be edited/removed, and "the serial number method" Is responsible for triggering It. Obviously you don't have the POP, so you need to create one without leaving any trace that It's been altered. No doubt you're wondering how to effectively do It, so we'll tackle It right now.
How To Effectively Edit/Remove Metadata:
Before I make a start, I'll recap briefly on the events that necessitate the manipulation of metadata as follows. When using the "faulty Item method", rather than returning the defective Item, some companies such as Logitech & SteelSeries will ask for a "POD" (Proof Of Destruction) to be sent as an email attachment In the form of an Image file. When they receive It and If there's no signs of tampering, your account will be credited for the cost of the purchased Item. It's the "POD" that you need to edit to perfection. Now If you're the type of SE'er who doesn't have the cash upfront to buy a product, the "serial number method" will be used to perform your SE, but In order to verify that the Item belongs to the company In question, you'll be requested to send a "POP" (Proof Of Purchase) which cannot contain any Inconsistencies whatsoever. It's the "POP" that must be edited without error.
Did you comprehend everything In the above paragraph? Good! Okay, what you're about to read from this point onwards Is extremely Important, so pay attention to every word. If you're part of an SEing community and ask for assistance on how metadata should be manipulated, or perhaps you're sifting through threads and messages to find some answers, the majority of users will suggest to "strip every detail, thereby leave nothing behind". Can you see what the problem Is with this? Allow me to explain It for you. Because every file that's been generated and saved contains metadata to some degree, "removing the lot will clearly demonstrate that It's been tampered with" and If the rep/agent (who's assessing your claim) Is somewhat tech-savvy and examines your file, say goodbye to your SE- It will be Immediately declined.
To prevent that and to ensure that your Image file Is what It appears to be, It's paramount that It represents the real deal and the way It's done, Is by "removing data and replacing It with similar details that're relative to the format of the Information you've altered". To give you a good understanding on this, I'll use the "POP" as the example. When a particular company generates an Invoice/receipt on their systems and saves the result to a file, It can Include metadata such as (but not limited to) who created It, the date & time of when It was created, when It was last edited and more. If you completely exclude such details, It's a dead giveaway that It's not the original file, hence when you make a fake POP, be sure to add such details to your Image file and "only remove those that are personally linked to your editing".
Given you're making a fake one by using this online generator or anything of similar nature, how do you know what the company's POP contains? Well, the answer Is quite simple and here's what I recommend you to do. Buy anything from the company you're planning to SE, and If It's not something you need, only spend a few dollars or so and when they send you an electronic copy of your Invoice, print and save It to your computer. "This will be the template that you'll work with when creating your fake POP"- you can either use that, or make one of your own by "viewing the metadata and matching the format as needed". To do that, this online metadata editor does a remarkable job or If you're proficient In using Adobe Photoshop, then by all means put your skill set Into action and edit the Image accordingly.
In Conclusion:
Believe It or not, my Initial plan was to keep this tutorial to a maximum of 12 paragraphs, however one thing led to another and before I knew It, Its reading time exceeded my expectations and that figure doubled to 24- which Is not a bad thing at all. You see, every article that you have the pleasure of reading on this blog, has a single objective, and that Is "to give my readers the tools and know-how to effectively formulate their SE and circumvent every obstacle that comes their way", and I believe I've achieved all that with this guide In Its entirety. In closing, you may need to edit metadata In "PDF" and/or "text files", but the process Is no different to what I've described with Image files, so apply It In a similar fashion.
