What is social engineering?
Social engineering is manipulating people into performing actions or divulging confidential information, often to gain unauthorized access to systems, data, or physical locations. It is a form of attack that exploits human psychology rather than technical vulnerabilities. Here are a few key concepts related to social engineering:
- Types of Social Engineering Attacks:
Pretexting: An attacker creates a fabricated scenario (pretext) to obtain information from a target. For example, an attacker might pose as an HR representative and ask an employee for personal details.- Phishing: Typically, a cyberattack where the attacker impersonates a trustworthy entity to deceive targets into revealing sensitive data, such as login credentials or credit card numbers. This often happens through fraudulent emails, messages, or websites.
- Tailgating or Piggybacking: An attacker seeks entry to a restricted area by following closely behind a legitimate user.
- Baiting: An attacker uses something enticing to lure a victim into a trap. This might involve tricking a user into downloading malicious software, thinking it’s a free game or software.
- Quizzing: The attacker asks questions under the guise of a survey or quiz to gather information about the target, which can be used in further attacks.
- Human Factors: Social engineering exploits human behaviors, such as trust, fear, curiosity, or the desire to be helpful. By understanding these emotions, attackers can craft compelling scams.
- Prevention and Defense: Awareness and skepticism are the best defenses against social engineering.
- Training: Regularly train and inform employees about the types of social engineering attacks they might encounter and how to respond.
- Authentication Protocols: Implement robust two-factor authentication processes, especially for accessing sensitive information.
- Information Sharing Policies: Clearly define what information can and cannot be shared and with whom.
- Regular Updates: Keep employees informed about social engineering scams and tactics.
- Real-life Examples: Famous instances of social engineering include Kevin Mitnick’s exploits, where he successfully hacked into dozens of systems primarily through manipulation, and the 2016 spear-phishing attack on John Podesta, which led to the release of a large number of emails.
In essence, while firewalls, encryption, and other technical solutions are vital for cybersecurity, the human element remains one of the most significant vulnerabilities. Protecting against social engineering requires a mix of technical controls, policies, procedures, and, most importantly, education and awareness.
What is Social Engineering and Manipulation?
Social engineering uses psychological manipulation to get users to give up sensitive information such as passwords and PINs. These are designed to trick you into thinking you’re verified your information with or using a service from a source you trust. This information is then either sold or used to manipulate your accounts.
It’s a term that is used in IT security. Google even did a study that showed phishing had a 45% success rate with specific sites.
You may have come across a form of social engineering yourself. Maybe you saw through a malicious site’s attempts to get your information. Whether you have it or not, social engineering is everywhere.
Different Types of Social Engineering
Anyone online needs to be wary of the most common social engineering techniques currently plaguing the Internet. Social engineering attacks can come from your email, web browser, or anywhere else you commonly go online.
Phishing is one of the most common social engineering tactics. At first glance, these sites and emails look pretty legit; some might look like sites you use and trust or appear to be from people you know. But careful inspection reveals something slightly off about them. For example, they could have the brand name in the URL, but it may not be part of the main domain. This is a sure sign that you’re looking at a phishing site.
Planting malware into out-of-date software or tools is another of the most common types of social engineering techniques. These can stow away in plugins or add-ons that, when activated, steal sensitive information from your site.
What to Watch for (Tell Tale Signs)
When discussing “social media engineering,” you’re likely referring to how social engineering techniques are adapted and applied to social media. Because of the vast amounts of personal information available on social media platforms, they have become fertile grounds for social engineers to carry out their tactics. Here’s what to watch for:
- Impersonation of Friends or Family: Attackers can create fake profiles mimicking your friends or family, then send friend requests. Once accepted, they can send malicious links or request personal information.
- Messages with Malicious Links: You might receive news, even from a trusted contact whose account has been compromised, containing a link that might lead to malware or phishing sites.
- Fake Contests and Giveaways: These may require you to provide personal information, share the post, or tag friends. While some are harmless, others can be malicious or aimed at harvesting data.
- Profile Cloning (Catfishing): Attackers copy pictures and information from a person’s public profile to create a near-identical profile. They can then send friend requests to the victim’s friends and attempt various scams.
- Emotional Manipulation: Posts that tug at the heartstrings and ask for donations for fake causes or fabricated stories.
- Quizzes and Games: Some quizzes can be designed to extract personal information under the guise of fun. For instance, a quiz titled “What’s your celebrity twin?” might ask for your birthdate, a common security question.
- Suspicious Friend Requests: From profiles with limited personal information, few photos, or a recent creation date.
- Publicly Sharing Sensitive Information: Users often unknowingly share information that could be used against them, like vacation plans, which might alert burglars to an empty house.
- Unusual or Urgent Requests: A “friend” might message claiming they’re stranded and need money immediately.
- Clickbait Headlines: Sensational or shocking headlines designed to pique curiosity. Once clicked, they may lead to phishing websites, malware downloads, or intrusive ads.
- Endorsement Scams: Fraudulent claims of celebrities or known entities endorsing a product, often tied to malicious links or sites.
- Fake Customer Support Accounts: These impersonate real customer support accounts and attempt to “help” users by leading them to phishing sites or having them divulge sensitive account information.
Protecting Yourself:
- Always be skeptical of unusual requests, even from known contacts.
- Check the authenticity of profiles sending friend requests.
- Be cautious about the personal information you share on social media. Adjust privacy settings accordingly.
- Regularly audit the apps and websites connected to your social media profiles.
- Use two-factor authentication where available.
- Be cautious about clicking on links, especially if they seem out of character for the sender.
- Download Malwarebytes. If you get injected with PUP (potentially unwanted programs), this will help find and eliminate them.
You can protect yourself against most social media engineering attempts by being vigilant and informed.
