Social Engineering Attacks

What is Social Engineering?

Let’s kick things off with the fundamentals. What exactly is it?  Simply put, “any act that influences a person to take action that may or may not be in their best interest,” according to Security Through Education.

Criminals who engage in social engineering are trying to take advantage of human nature for their nefarious purposes. Unlike black hat hackers who use technology to break into systems, these attackers use words to try to get inside your head.

Anatomy? of a Social Engineering Attack

All social engineering attacks follow a familiar pattern, broken down into a series of steps. Not every attack uses every level, but the following sequence is the most common approach.

• The Investigation: The attacker identifies their victim(s), gathers information on them, and figures out what their best approach is
• The Hook: Engage the target, create a cover story, take control of the interaction
• The Play: Secure a foothold in the target’s mind/emotional state, launch the attack, commit the crime
• The Exit: Remove all traces of intrusion, leave without arousing suspicion, cover all tracks

What Types of Social Engineering Exist?

As is the case with other kinds of cyber attacks, those who use social engineering have a variety of techniques. The following are the most common social engineering attacks, with some overlap between them.

• Baiting

  Hackers lure people in with promises of gain, get scammed instead, and ultimately wind up suffering some loss. Baiting scams work on people’s greed or curiosity. Ever get a message online about how you can download a first-run movie for free before it even hits a pay-per-view service? That’s a baiting scam.

• Pretexting
  

  The attacker poses as a representative of a trusted authority (law enforcement or tax officials, for example) to trick you into giving them sensitive information, such as social security numbers, passwords, or account numbers. Pretexting can also be used to gather certain information that’s not as harmful, but irritating nonetheless, such as your cell phone number or mailing address.

• Phishing

  Not to be confused with baiting, although the methods share some of the same characteristics, phishing attacks are email or text-based scams that attempt to frighten or coerce victims into visiting suspicious websites or offering up sensitive information.  Scammers send out a mass emailing or texting blitz, in the hopes of getting even a few returns. They can pose as your internet provider and ask for you to “confirm” your password or pose as a charity that asks for help (e.g., “Just click here to feed hungry children!”).

  In one real-world case, perpetrators who claimed to work for Microsoft sent out emails looking for personal information to “re-authorize” some existing Office software. The request looked very convincing, even down to the corporate logos. However, many words were misspelled, ultimately debunking the claim.

• Scareware

  This one is, admittedly, very effective and frankly very unsettling. As the name implies, a scareware social engineering attacks are designed to frighten you into compliance by inundating you with false alerts, made-up threats, and “urgent” warnings. Usually, these false threats tell the victim to install some special software that will remove the threat. Many scareware threats are couched in terms like “Your computer may be infected with harmful spyware programs.”

• Spear Phishing

  This is phishing in a more focused form, much in the same way as stabbing a fish with a spear is a more direct method of fishing than dragging a net through the water. With spear phishing, the attacker has some information about you and will use it to make their scam seem more convincing.  They will use anything to gain your trust.

  For instance, maybe they managed to find some of your friends’ or family’s names, or have learned where you work. They can use that personal information to make a more convincing message. They can impersonate your IT department and ask you to confirm your login by clicking on a link that will send you to an “official” page, for instance. However, when you get there, the page steals your credentials.

• Tailgating

  Regrettably, this has nothing to do with eating food in a stadium parking lot before going in to see your favorite team play. This form of social engineering is more of a physical action, where the scammer follows authorized users right into a secure area, bypassing security measures such as swiping an identification card. Hence, we have the term “tailgating.”

  This is especially common in businesses that require keycard authorization. Human nature tends to lean towards being polite and helpful, so a legitimate employee could conceivably gain legal entry then, out of courtesy, hold open the door for the would-be scammer. Once again, we see how social these attackers exploit a fundamental characteristic of human nature to further their agenda!

How to Prevent Social Engineering Attacks

After being inundated with all these forms of social engineering attacks, who could blame anyone for shutting down their notebook, pad, or mobile phone and backing away from it slowly? Fortunately, we don’t need to resort to such drastic actions. Many tried and tested means of social engineering prevention exist, and we’re going to take a look at some.

Just remember, many social engineering attacks hinge on human emotions such as fear, curiosity, greed, or compassion. Keep in mind that these unscrupulous individuals are trying to manipulate you for their gain.

• Don’t react impulsively. Get into the habit of taking a deep breath, sitting back and looking at new information calmly and dispassionately. Don’t just immediately click on unusual links or open strange emails and texts.
• Don’t open emails or file attachments from suspicious sources. If you don’t recognize the email address, don’t open the email or click on the link. In fact, delete the email outright.
• Watch out for enticing offers. As the old saying goes, “If it seems too good to be true, then it probably is!”.
• Keep your antivirus software current. While no antivirus app can give you 100% security, most reputable brands do an excellent job of screening? out malware and phishing attacks. But see to it that the antivirus software is up to date. Antivirus software companies regularly release new versions designed to handle the latest attack schemes.
• Set your email spam filters to “high.” Go to the “Settings” option in your email and set the spam filter to “high.” Just remember to check the folder occasionally, in case some legit emails end up there. It happens.
• NEVER give out passwords or financial information online! Companies or government agencies that you deal with won’t ask you for your personal information online.
• Ignore messages asking for or giving away money. Charitable giving is commendable, but make sure you have checked out the charities you’re giving money to. Even if you get an email from one of them asking for one-time donations, take some time and check out their website to see if the offer/appeal exists there.
• Practice proper onsite security protocol. Never let a stranger accompany you into your workplace if they don’t have a card. Some companies require each person to swipe their card even if the door is already open.

Would You Like to Learn More About Social Engineering Attacks?

There’s much more to learn, and it’s a good idea to stay as informed as possible. Simplilearn offers several online courses that will hone your skills and sharpen your cybersecurity savvy.

Even if you’re already working in the cybersecurity field, it always pays to upskill. After all, the more extensive your security knowledge, the better you function in your role, not to mention making yourself more marketable should you choose to find a new position in the future.

The CISSP Certification Course prepares you for the globally recognized certification for information technology security professionals. Aligned with (ISC)² CBK 2018, the training covers all areas of IT security so you can become a strong information security professional.

The Cybersecurity Expert Master’s Program equips you with the skills needed to become an expert in this rapidly growing field. You will learn comprehensive approaches to protecting your infrastructure, including securing data and information, running risk analysis and mitigation, architecting cloud-based security, achieving compliance, and much more with this best-in-class program.

The Certified Information Systems Auditor (CISA) certification course provides you with the skills required to govern and control enterprise IT and perform an effective security audit. Aligned with the latest edition of the CISA exam (2019), it upskills you to protect information systems.

And finally, the CISM (Certified Information Security Manager) is a key certification for information security professionals who manage, design, oversee, and assess enterprise information security. This CISM certification course, closely aligned with ISACA’s best practices, helps you learn about IT security systems.

How strong is your knowledge in the information security concepts? Try answering these CISSP Practice Test Questions and find out now!

How Would You Like to be Cyber Security Certified?

If all of this information about common social engineering techniques and cybersecurity has piqued your interest in a career, then Simplilearn has you covered here as well.

There is a huge demand for Certified Ethical Hackers, and you can be on your way towards filling that demand by taking the CEH (v10) – Certified Ethical Hacking Course. In this online hacking course, you will learn advanced processes, and master advanced network packet analysis and system penetration testing techniques to build your network security skill-set and prevent hackers.

Whether you choose Blended Learning or a corporate training solution, this hacking course provides you with 40 hours of learning, six months’ worth of free access to CEH v10 labs, study materials, and an exam pass guarantee.