Social Engineering and its Importance

The term social engineering covers an extensive list of malicious activities that are executed through human interrelations. It plays around with psychology manipulations of innocent computer users, instead of using technical hacking methods, to lure them into making security blunders and disclosing sensitive information, procure access to networks, premises, information centers, et al. For cyber-attackers, it is the most effective method of breaching security algorithms. Advancement in internet connectivity has granted people the power of interacting with all sorts of people despite the distance barrier. Besides the improvement in communication systems, nevertheless, people have been exposed to vulnerabilities of unknowingly exposing their privacy to the wrong people. For instance, an attacker might call a worker purporting to be the chief IT support official and lure them into disclosing their password. Social engineering is even made dangerous by the fact that it depends upon human mistakes instead of software vulnerabilities. The errors that legitimate computer users make are very hard to predict, making it even harder to recognize when you are about to make an error or halt compared to malware-based infiltrations.

Social engineering is considered a criminal activity that occurs in a series of events. Firstly, the attacker probes their prey – the person of interest – to perform background research and gather information like critical entry points, vulnerable security algorithms necessary to continue with their “mission”. Often, attackers will take a couple of weeks or months before coming to your place or placing a call. They will prepare well to find your organization’s phone list or the org chart to research for the workers who have social networking accounts such as Twitter and LinkedIn. Secondly, the criminal purports to be a “good person”, a fellow employee or the manager to gain the trust of their prey and offer stimuli for consequent activities that breach the security measures like disclosing personal information, or providing entry to sensitive resources. Attacks affiliated to social engineering show up in various forms and can occur anywhere where people are interacting. The commonest forms of social engineering include baiting, scareware, pretexting, phishing, spear phishing, et al.

?

?

Baiting

Just as the name suggests, the baiting form of social engineering involves the use of false promise or any type of “sweet lies” to excite the curiosity of the victim. An attacker lures users into their trap to fetch crucial information or infiltrate into their system using viruses. One best-known form of baiting is the use of physical media such as flash disks to dispense viruses. For instance, a criminal can leave an ordinary virus-infected?USB such as a?flash disk in conspicuous zones – washrooms, elevators, packing zones et al. – where vulnerable people can easily notice them. Often, the bait is characterized by an appealing look like a label of the company, a colorfully branded pet. When a curious person picks the flash disk and inserts it into their laptops or work computer, the malware is automatically installed into their computers. Also, the baiting scams are not only carried using physical media but can as well be found in the internet. While browsing, victims can be enticed to click on malware-infected ads that pop on the computer screen directing them to download viruses into their computers. The malware may expose the user to attackers who steal their personal information to perform fraudulent activities. Also, a social engineer can distribute virus-infected flash disks to their junior workers to spread malicious code. By inserting the bait into their PCs, voila! the social engineer would have achieved their mission. To attest baiting as a form of social engineering, in 2016, researchers surveyed by dropping 297 flash disks around the premises of the University of Illinois. Insides the flash disks were files connected to webpages that could be traced by researchers. Out of the 297 USB flash drives, 290 (98%) flash drives were collected and 135 (45%) flash drives were opened.

Scareware

Also known as deception software or a fraudware, scareware is a fraudulent technique that deceives computer users to believe that they should purchase or download a particular software/program/code – which is either useless or malicious. Scareware is a situation where people are bombarded with forceful and fabricated threats. It is a situation where a computer user is swindled to believe that their networks are infected with viruses, deceiving them to install infectious programs in their computers. The commonest example of scareware a thread reading “your computer may be infected with harmful spyware program” which pops on your browser when surfing. The scareware would either offer to make the installation – infected with a virus – on your behalf or will lead you to a virus-infected website that infects the whole system with malware. Attackers can spread scareware or deception software to vulnerable people using spam emails. One way to protect yourself from scareware is to use verified and updated antimalware software. Another way is to avoid r clicking suspicious ads that pop on your browser when surfing on the web. Nevertheless, whereas scareware ads are fake and opening them is dangerous, they should not be ignored altogether. When they appear, it implies that your computer might be infected with a virus and a third-party solution should be sought. The aim is to remove all signs of malware in the system.

Pretexting

This form of social engineering involves the use of well-crafted lies (elaborate lie) and an invented scene to obtain information from a targeted victim. A pretexter engages a victim in a way that makes them (victims) to disclose the information asked for or respond to what the pretexter demands them to. An attacker may scam an innocent computer user purporting to be in craze need of some sensitive information from the user. Using pretexting, a criminal begins by building trust between them and the victims through impersonation as colleagues, police officers, bank officials, or people who are in authority. The attacker, also the pretexter uses questions that ask for the victim’s identity to collect. In one way, a pretexter is an identity thief. A pretexter gathers all the pertinent details about an individual applying this form of scam like credit card number, social security details, phone number, financial records, private addresses as well as security data regarding a physical plant. Attackers can fool business owners to disclose information about their customers or impersonate private investors to acquire mobile phone numbers, bank details, or any sensitive information. Often, pretexters use authoritative voice with an earnest tone to make them appear to the victims as the people they impersonate.???

Phishing

It’s a social engineering tactic where attackers use emails or other malicious platforms to ask for personal information such as financial details, social security information, credit card number, et al. Criminals send email messages that appear to have come from reputable companies or banks requesting for account details, usually suggesting the accounts have a problem. If the victim is convinced and responds to these emails with the information in questions, the criminals can access those accounts using this information. In other cases, the criminals may send malicious or compromising links that once the recipient clicks on them, their computer or the entire network blows up. In recent years, phishing attacks are leveraged by rival companies to bypass system perimeters of their competitors. For instance, a person that uses an online service may receive an email notifying them of a potential violation of policies that requires immediate correction like password modification. It may involve a link to a malicious website that has much resemblance to the legit website directing the user to update the login credentials. After the modification, the information is submitted to the hackers and it may be used to commit fraudulent activities. One way to avoid being scammed by these kinds of attackers is by nor submitting personal information unless you’re sure about the legitimacy of the senders.

Spear phishing

It is a more specific type of phishing where the criminal targets a particular person or company. An attacker then customizes these scam messages depending upon specific features, occupations, and particular phone contacts and email addresses that belong to these victims to minimize the conspicuity of the attacks. This form of social engineering needs a lot of effort from the attacker, which is hard to detect, and if executed skillfully they've got a substantive success rate. For instance, a spear-phishing scam may be led by a hacker who purports to be the chief IT consultant of a particular company, they send emails to employees of that company. Since the message is framed and signed the same way the consultant does, the employees are tricked into believing that the message is authentic. The message might be requesting the employees to update their credentials on a malicious website that appears legitimate where the criminals obtain their information to commit criminals.

How to prevent social engineering

You should avoid opening emails and links from suspicious senders. If you suspect the source of the emails, ignore the email altogether. If the sender is known but they are untrustworthy, their request should absolutely be ignored. Multifactor authentication is a significant protection tool for keeping attackers away. It prevents attackers from fetching personal credentials from online accounts. People must be wary of an enticing offer. If the deal is too sweet, they should rethink before falling into traps. Computers must be protected with the latest antivirus to prevent malicious intrusions.

Conclusion

Social engineers play around with human feelings like greed and fright to trick vulnerable people into trapping them. Ergo, whenever you feel suspicious or threatened by a particular email or text, or enticed by a particular ad on your website, or come across a disowned physical media in a conspicuous area, wary about them. Staying vigilant protects people against different forms of social engineering attacks that happen in the technological industry.

?

?

?

References

Social Engineering:?https://www.imperva.com/learn/application-security/social-engineering-attack/

Tips to Avoid Phishing Attacks and Social Engineering:?https://www.bankinfosecurity.com/tips-to-avoid-phishing-attacks-social-engineering-a-488

Social engineering explained: How criminals exploit human behavior:?https://www.csoonline.com/article/2124681/what-is-social-engineering.html

What is Social Engineering and Why Should you be Concerned?:?https://geekflare.com/social-engineering-introduction/