Cybersecurity: Social Engineering

Social engineering

An activity where the goal is to use deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines

Impersonation

A social engineering attack where an attacker pretends to be someone they are not

Pretexting

A social engineering tactic where a team communicates, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood.

Phishing

An email-based social engineering attack in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.

Vishing

A human-based attack where the attacker extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP).

Smishing

A form of phishing that uses SMS text messages to trick a victim into revealing information.

Pharming

A type of attack that redirects users from a legitimate website to a malicious one.

Typosquatting

An attack in which an attacker registers a domain name with a common misspelling of an existing domain, so that a user who misspells a URL in a browser is taken to the attacker's website.

Business email compromise

An impersonation attack in which the attacker gains control of an employee's account and uses it to convince other employees to perform fraudulent actions.

Watering hole attack

An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites

Moral obligation

An attacker uses moral obligation and a sense of responsibility to exploit the target’s willingness to be helpful.

Innate human trust

Attackers often exploit a target’s natural tendency to trust others. The attacker wears the right clothes, has the right demeanor, and speaks words and terms the target is familiar with so that the target will comply with requests out of trust.

Threatening

An attacker may try to intimidate a target with threats to make the target comply with a request. This is especially the case when moral obligation and innate human trust tactics are ineffective.

Offering something for very little to nothing

Offering something for very little to nothing refers to an attacker promising huge rewards if the target is willing to do a very small favor. The small favor can include sharing what the target thinks is a very trivial piece of information for something the attacker offers.

Ignorance

Ignorance means the target is not educated in social engineering tactics and prevention, so the target does not recognize social engineering when it is happening. The attacker knows this and exploits the ignorance.

Authority and fear

Authority techniques rely on power to get a target to comply without questioning the attacker. The attacker pretends to be a superior with enough power that the target will comply right away without question. The attacker could also pretend to be there in the name of or upon the request of a superior. Authority is often combined with fear. If an authority figure threatens a target with being fired or demoted, the target is more likely to comply without a second thought.

Social proof

With a social proof technique, the attacker uses social pressure to convince the target that it is okay to share or do something. In this case, the attacker might say, "If everybody is doing it, then it is okay for you to do it, too."

Scarcity

Scarcity appeals to the target's greed. If something is in short supply and will not be available, the target is more likely to fall for it.

Likeability

Likeability works well because humans tend to do more to please a person they like as opposed to a person they do not like.

Urgency

To create a sense of urgency, an attacker fabricates a scenario of distress to convince an individual that action is immediately necessary.

Common ground and shared interest

Common ground and shared interest work because sharing a hobby, life experience, or problem instantly builds a connection and starts forming trust between two parties.