Everyone is familiar with the case in which the proverbial “little old lady” is duped out of her life savings by a villain contacting her through the phone or email. The “Nigerian Scam” or “Advance-fee Scam” is once such classic scam you may know. The victim is offered a large sum of money on the condition that they help the scammer transfer money out of their country.
The problem is that just knowing about these classic scenarios gives most people a false sense of security. The thought is, “It would never happen to me!” The first problem with this is that there are many types of these sorts of social engineering attacks that may not be so easy to recognize. The second problem is that most think this only happens at home.
In this article we will refresh our understanding of social engineering. We will review the currently known shapes and sizes of such attacks with a special focus on how they are used on employees in the workplace.
Social engineering: A review
Social engineering is a term that encompasses a broad-spectrum of notorious and malicious activities. The common, defining attribute is the ability to exploit the one weakness every person and organization has: human psychology. Instead of relying on programming and code, social engineering attackers use phone calls, e-mails and other methods of communication as their main weapon. They trick victims into willingly handing over either personal information, or an organization’s proprietary secrets and sensitive data.
Let’s focus on the seven most common social engineering attacks.
1. Phishing
Phishing is one of the most common techniques. In most cases phishing uses fake forms and websites to steal vulnerable users’ personal data and login credentials. A phishing attempt commonly tries to accomplish one of three things:
- Obtain sensitive and personal information such as names, date of birth, addresses, debit or credit card number, and Social Security Numbers.
- Redirect users to malicious websites by creating misleading and shortened links and hosting a phishing landing page.
- Incorporate fear, threats, and exploit a sense of urgency to manipulate the users into responding quickly without thinking rationally.
2. Pretexting
As the name implies, in this social engineering attack, the fraudsters focus on creating a fabricated scenario or a good “pretext.” In a basic attack, the scammer typically claims they need certain information from you to confirm your identity. Once obtained, this information becomes the key to stealing your more personal data and/or to stage secondary attacks such as full identity theft.
In advanced pretexting, the target may be corporate. The key piece of information obtained may help them either exploit or abuse a company’s physical or digital weakness. For example, a cyber-fraudster may impersonate a third-party IT auditor and convince the targeted organization’s security team to grant them entrance into a secure building.
Pretexting fraudsters often masquerade as employees, such as HR or finance personnel. Such disguises help them access and target C-level executives. Verizon reported similar findings in its DBIR in 2019.
3. Baiting
Baiting is somewhat similar phishing attack but is distinguished by the fraudster’s promise to giveaway an item or prize. Often the bait may be as simple as free movies or music downloads but will require the victim to hand over login credentials.
That’s not to say that baiting is strictly an online phenomenon. Baiters will use physical media when required. In July 2018, KrebsOnSecurity experienced and reported a baiting attack campaign that was targeting local and state-level government agencies within the United States. The attackers sent out envelopes that were Chinese postmarked and contained a compact disk (CD) along with a confusing letter. The idea was to exploit victims’ curiosity and have them use the CD containing malware that would infect their computer system.
4. Quid pro quo
A quid pro quo attack is similar to baiting but whereas baiting promises goods, quid pro quo promises services. As an example, in recent years fraudsters impersonated the United States Social Security Administration. They contacted the targets, informed them there was an error in the system, and then claimed they needed the victims to confirm their Social Security Numbers. The ultimate goal was identity fraud using these credentials.
5. Tailgating
Tailgating (also known as piggybacking) involves someone without any appropriate authentication following authorized personnel into a restricted area. Often the attacker may impersonate a delivery person and wait outside the target destination. When the unsuspecting employee gains access and opens the door to get in, the attacker will ask them to hold the door for him as well. This type of social engineering attack mostly targets mid-size enterprises as most large companies use keycards for building access.
6. Watering hole
Just as animal predators wait by their prey’s favorite watering hole, cybercriminals target websites that may be popular with a target demographic in order to attack such visitors. If, for example, someone wanted to target financial services professionals, they might inject a popular financial site with malicious code. Merely visiting the site would compromise the website visitors’ browsers with code that could monitor the activities or even reach deeper into the system and control computer microphones and cameras.
7. Vishing
Sometimes known as Voice Phishing, Vishing is a type of attack when a fraudster uses advanced IVR (interactive voice response) software on a standard telephone to entice you into repeating your confidential information on a recorded line. Vishing is not only about requesting your data; it crops your voice to over-come any voice-activated defenses that you may have access to within your company or for any services.
A common attacking technique used along with IVR is to prompt a victim to provide passwords and PINs. Each time the victim tries to enter a password or PIN, it will fail and notify the user that it is an incorrect attempt. This will cause the employee to panic and try several personal passwords. Hackers will harvest and exploit PINs and passwords later.
Ways to recognize a social engineering attack
A social engineering “ask” is often recognizable as one of the following:
Someone asking for assistance
Social engineers are good at using language that instills fear and a sense of urgency in you. The idea will be to rush you into performing an action with no time to think rationally. For example, someone who is urging you to carry out a wire transfer might be a scammer or hacker. Stop, think, and ensure that you will be conducting a legitimate transaction.
Asking for donations
Cyber fraudsters like to exploit your emotions and generosity by asking for donations for a charitable cause over the phone or through emails. They will also give you instructions on how you can send your donation to the hacker’s account. These social engineers may first research social media to learn the types of causes you support to better find a leveraging point.
Asking for information verification
Another notorious tactic that social engineers use is to present a problem that you can solve only by verifying your information. Often the problem requires the victim to fill in an online form asking for your personal information. The messages and form may look legitimate with all the correct branding and logos, but the moment you enter your information, the information immediately goes to social engineers.
Prevention from social engineering
There are five primary ways you can prevent yourself from falling for a social engineering attack:
Know your crown jewels
Learn the specific pieces of information, personal or corporate, that might be valuable to a social engineer or a hacker. Think of this information as the crown jewels. Identifying sensitive information allows you to set up walls to protect it.
In any corporate environment, the specific ‘crown jewels” may be different depending on department or person. Legal, IT and Finance may all have specific areas or sensitive data that others in the company may not have access to or even know about. This means social engineering protection applies to everyone.
Verify identities
Email hacking is a common threat that either imitates or takes control of legitimate email accounts. For example, if there is an unexpected request to take action online, ensure that the person you are dealing with is legitimate by calling that person and confirming that they have sent you the email message in question.
Slow down
Social engineers will go to the extreme lengths to instill panic, fear, and a sense of urgency in you. You must never let anyone rush you or prevent you from taking the time to consider carefully. See any effort to push you to take action quickly as a potential red flag.
Verify before your click
If you see a shortened link such as bit.ly link, etc., be wary. Such links are often used as carriers of malicious URLs or viruses. To verify if the link is legit, check it using a link expander. Search Google for “link expander” to see many resources that are easy to use.
Education
The most crucial and effective preventive measure is subject matter knowledge. Continue to educate yourself on current malicious tactics – they are always changing. If you are a business owner, educate your employees on social engineering threats. The health of your business may depend on it.
Become a Subscriber to receive timely articles on human-centric security issues: