The Concept of Social Engineering Practiced on You Almost Daily on the Internet and Social Media Platforms
What Is Social Engineering, Its Methods and Types
Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or divulging sensitive information.
Social engineering attacks occur in one or more steps. The perpetrator first investigates the intended victim to gather necessary background information, such as potential entry points and weak security protocols, needed to proceed with the attack. Then, the attacker moves to gain the trust of the victim and provide incentives for subsequent actions that break security practices, such as revealing sensitive information or granting access to critical resources.
Social Engineering Attack Life Cycle
What makes social engineering particularly dangerous is that it relies on human error, rather than vulnerabilities in software and operating systems. Mistakes made by legitimate users are less predictable, making them harder to identify and thwart than malware-based intrusions.
Attack Techniques
Social engineering attacks come in many different forms and can be carried out anywhere human interaction is involved. The following are the five most common forms of digital social engineering assaults.
Baiting
As its name implies, baiting attacks use a false promise to pique a victim's greed or curiosity.
They lure users into a trap that steals their personal information or infects their systems with malware.
The most vilified form of baiting uses physical media to disperse malware. For example,
attackers leave the bait – typically malware-infected flash drives –
in conspicuous areas where potential victims are sure to see them (e.g.,
bathrooms, elevators, and the parking lot of a targeted company). The bait has an authentic appearance to it, such as a label presenting it as the company's payroll list.
Victims pick up the bait out of curiosity and insert it into a work or home computer,
resulting in automatic malware installation on the system.
Baiting scams don't necessarily have to be carried out in the physical world.
Online forms of baiting consist of enticing ads that lead to malicious sites or encourage users to download a malware-infected application.
Scareware
Scareware involves victims being bombarded with false alarms and fictitious threats.
Users are tricked into thinking their system is infected with malware,
prompting them to install software that has no real benefit (other than to the perpetrator) or is malware itself.
Scareware is also referred to as deception software, rogue scanner software, and fraudware.
A common example of scareware is the legitimate-looking popup banners appearing in your browser while surfing the web,
displaying text such as, “Your computer may be infected with harmful spyware programs.
” It either offers to install the tool for you (often infected with malware), or it will direct you to a malicious site where your computer becomes infected.
Scareware is also distributed via spam email that dispenses bogus warnings,
or makes offers for users to purchase worthless/harmful services.
Pretexting
Here the attacker obtains information through a series of cleverly crafted lies.
The scam is often initiated by a perpetrator pretending to need sensitive information from the victim in order to perform a critical task.
The attacker usually starts by establishing trust with their victim by impersonating co-workers, police, bank and tax officials, or other persons,
who have right-to-know authority. The pretexter then asks ostensibly required questions to confirm the victim's identity, through which they collect important personal data.
All sorts of pertinent information and records are gathered using this scam,
such as social security numbers, personal addresses, phone numbers, phone records, employee vacation dates, bank records, and even security information related to a physical plant.
Phishing
As one of the most popular types of social engineering attack,
phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity, or fear in victims.
It then drives them to reveal sensitive information, click on links to malicious websites, or open attachments that contain malware.
An example is an email sent to users of an online service alerting them of a policy violation requiring immediate action on their part,
such as a required password change. It includes a link to an illegitimate website –
nearly identical in appearance to its legitimate version – prompting the unsuspecting user to enter their current credentials and new password.
Upon submitting the form, the information is sent to the attacker.
Because identical or near-identical messages are sent to all users in phishing campaigns,
detecting and blocking them is much easier for mail servers that have access to threat-sharing platforms.
Spear Phishing
This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises.
They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous.
Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off.
They are much harder to detect and have better success rates if carried out skillfully.
A spear phishing scenario might involve an attacker, impersonating an organization's IT consultant,
sending an email to one or more employees. It is crafted and signed exactly as the consultant normally does,
thereby deceiving recipients into thinking it is an authentic message.
The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.
Social Engineering Prevention
Social engineers manipulate human emotions, such as curiosity or fear,
to execute schemes and draw victims into their traps. Therefore,
be wary whenever you feel alarmed by an email,
are attracted to an offer displayed on a website, or when you encounter stray digital media.
Being alert can help protect you from most social engineering attacks that occur in the digital world.
Furthermore, the following tips can help improve your vigilance regarding social engineering hacks.
- Do not open emails and attachments from suspicious sources – If you don't know the sender in question,
- you don't need to reply to their email. Even if you do know them and are suspicious of their message,
- cross-check and confirm the news from other sources, such as by phone or directly from the service provider's website.
- Remember that email addresses are spoofed all the time;
- even an email purportedly coming from a trusted source may have actually been initiated by an attacker.
- Use multi-factor authentication – One of the most valuable pieces of information attackers seek is user credentials.
- Using multi-factor authentication helps ensure your account is protected in the event of a system compromise.
- Login Protect is an easy-to-deploy 2FA solution that can increase account security for your applications.
- Be wary of tempting offers – If an offer seems too enticing,
- think twice before accepting it as real. Googling the topic can help you determine whether you are dealing with a legitimate offer or a trap.
- Keep your antivirus/anti-malware software up to date – Make sure automatic updates are turned on,
- or make downloading the latest signatures the first thing you do each day as a habit. Check periodically to make sure that updates have been applied,
- and scan your system for possible infections.
You might also be interested in:
