Social engineering: Opportunity makes the thief

It is understandable that, when cybercrime happens to you, you can feel like you were targeted. And you certainly might be correct. However, more often than not, you weren’t originally the target at all. You just provided the best opportunity to the criminal. In most cases, social engineering involves an opportunistic attack that doesn’t – initially – target anyone in particular. Instead, attackers search broadly for weaknesses or vulnerabilities that they can use to mount a more in-depth attack. If they snare a victim in their net, they can then go to work.

It’s nothing personal

Unwanted messages and calls bombard nearly all of us on a regular basis. For most, these solicitations via junk mail, spam email and robocalls are just incredibly annoying – even inducing a bit of eyerolling. Most of the time, we simply hit ignore, mark as spam, delete or toss junk mail in the rubbish knowing that these messages are most likely so-called mass-market scams. Many people are often surprised by the amount of junk or spam they receive, especially because so many of the scams are so obviously illegitimate. But the reason you still get emails from a Nigerian prince offering cash out of the blue in exchange for something is because people continue to fall for such stories. Not huge numbers, but a few. And that’s all it takes to make a profit.

Opportunist attacks are not personalized to their victims and are usually sent to masses of people at the same time. They are akin to drift netters, casting their nets “out there” – whether it’s ransomware, spyware or spam – and see what comes back. The aim is to lure and trick an unsuspecting victim to elicit as much information as possible using SMS, email, WhatsApp and other messaging services, or phone calls. Their motives are primarily for financial gain. They just want money. They don’t have a vendetta against a particular person or company. It’s a virtually anonymous process.

Phishing scams: Opportunity makes the thief

The Nigerian prince story is on the lower end of the scale in terms of a convincing narrative. However, the grammar errors and simplicity in these attacks are actually intentional as they are serving as a filter. They are filtering the “smart” responders out with the goal of refining their list, allowing them to more strategically target their victims. But have you ever stopped to ask yourself why you got the email in the first place? Spam may be a reality, but you are probably getting unwanted attention because you have a wide personal “attack surface.”

Our digital footprint is more public than we would ever imagine. Every time we perform an online action, there is a chance we are contributing to the expansion of our digital footprint. So, while you and I might be aware that the Nigerian princes of the world are not genuine – more sophisticated and successful attacks are also in circulation. If you have a large and messy digital footprint, you are putting yourself on the opportunist radar and are in line to receive more refined and authentic looking queries.

Since cybercriminals are continuously devising clever ways to dupe us in our personal lives, it is just as easy to hoodwink employees into handing over valuable company data. In fact, according to Verizon’s Data Breach Digest 74% of organizations in the United States have been a victim of a successful phishing attack. Fraudsters know that the way to make a quick buck isn’t to spend months attempting to breach an organization’s security, it’s simply to ask nicely for the information they want so they can walk right through the front door.

Opportunity amid a pandemic

With social engineering opportunists tending to take advantage and capitalize on vulnerabilities exposed, the pandemic created ideal conditions to exploit businesses and corporations. In less than a month into the onslaught of the pandemic, phishing emails spiked by over 600% as attackers looked to capitalize on the stress and uncertainty generated by Covid-19. Businesses that were forced to work remotely became more susceptible to opportunists. The pandemic changed the attack surface, Researchers said,“… security protocols have completely changed – firewalls, DLP, and network monitoring are no longer valid. Attackers now have far more access points to probe or exploit, with little-to-no security oversight.”

To mitigate risk, focus on both threat and vulnerability

The standard corporate security structure is optimized to handle specific, targeted attacks on corporate assets. Unfortunately, social engineering is often overlooked because of the very non-specific nature of it. Attack by opportunity only requires unwitting cooperation by an employee who was not specifically targeted but self-selected simply by clicking on a link.

Social engineering may even be more dangerous in our pandemic-driven distributed work environments. Corporate and personal spheres overlap more than ever and can provide social engineer opportunists more footholds into our confidential lives – both private and corporate. Both individuals and corporate security leaders will do well to shift greater focus on vulnerability reduction to provide less opportunity to social engineers.

Psychology is the social engineer’s best friend

Social engineering cyber-attacks have rocketed to the forefront of cyber-security risk and have wreaked havoc on large and small companies alike. Just like a Renaissance actor drawn to Shakespeare’s genius work, the modern social engineer is attracted to the ever-growing pool of information fueled by data brokers. These criminals ply their trade by exploiting the vulnerabilities of an individual and their tactics are known as phishing, baiting, scareware, and tailgating, just to name a few. What is so unique about the social engineer is that their methods are designed to take advantage of the common traits of human psychology.

Social engineers may simply send phishing emails to the target of their choice, or they could work to build a relationship with the target in person, through conversation, or even through spying. Most victims are only guilty of trust. For example, take the case of Barbara Corcoran, famous Shark Tank judge. She fell victim to a phishing scam in 2020 resulting in a loss of roughly 400,000 USD. The social engineer simply posed as her assistant and sent emails to her bookkeeper requesting renewal payment on real estate investments.

In order to combat social engineering, we must first understand the nuances of the interaction between social engineer and target. First and foremost, we must recognize that social engineering attacks are a kind of psychological scheme to exploit an individual through manipulation and persuasion. While many firms have tried to create technical barriers to social engineering attacks, they have not had much success. Why? Social engineering is more than a series of emails or impersonations. It includes intimate relationship building – the purposeful research and reconnaissance into a person’s life, feelings, thoughts, and culture. The doorway to social engineering success is not a firewall – it is the human response to stimuli. As such, we should analyze these attacks through a psychological lens.

In Human Cognition Through the Lens of Social Engineering Cyber Attacks, Rosana Montañez, evaluates the four basic components of human cognition in psychology centered around information processing: perception, working memory, decision making, and action. Together, these pillars of cognitive processing influence each other and work together to drive and generate behavior. To illustrate by way of example: when driving on a highway, you must first evaluate your surroundings. Where are the cars around you? Is there traffic ahead? What is the speed limit? Next, you must use your working memory to pull information from past experiences. The brain sends out a code; last time there were no cars around you, and you were below the speed limit, you were able to change lanes to go faster. With this new information, you now have a decision to make. As the driver, you use this information, and perform the action of changing lanes.

In the context of cyber-attacks, social engineering is a form of behavioral manipulation. But how is the attacker able to access the complex system of cognition to change the action and behavior of the target? To further dissect cognition, Montañez considers how “these basic cognitive processes can be influenced, for better or worse, by a few important factors that are demonstrably relevant to cybersecurity.” These factors are defined as short and long factors and may be the opening that attackers can leverage to strengthen the success of their attack. Short term factors include concepts of workload and stress. Long term factors evaluate age, culture, or job experience.

In a recent study, researchers evaluated phishing behavior and the likelihood an employee would click a phishing link. It was found that those who perceived their workload to be excessive were more likely to click the phishing email. Cognitive workload causes individuals to filter out elements that are not associated with the primary tasks. More often than not, cyber security is not actively thought about and therefore results in the greater likelihood of being overlooked. This effect is known as inattentional blindness and restricts a person from being able to recognize unanticipated events not associated with the task at hand.

Stress also may be responsible for weakening the ability of an employee from recognizing the deceptive indicators that are present in cyber messages or phishing emails. Other factors such as age or culture, domain knowledge, and experience have anticipatory principles that can determine the likelihood for being deceived. As most would expect, having more cyber-security knowledge and experience in a given job reduces the risk of cyber-attacks victimhood. Similarly, as age increases there is a decrease in risk for cyber-attacks because of job experience and accumulated cyber-security knowledge. However, eventually the impact of age and experience reaches a plateau and inverts when seniors (with less experience in modern technology) become exposed. Interestingly, gender or personality were inconclusive when evaluating their impact on cyber-attack susceptibility.

So how do we go about defending against cyber-attacks and improving the untrustworthy mind? The short answer is we don’t. As the age-old security acronym PICNIC suggests, the Problem exists “in the chair” and “not in the computer.” Across many different studies and the experiences of companies themselves, training methods that ask people to make conscious efforts to defend against social engineering cyber-attacks have been unsuccessful. If technological barriers don’t work and cognitive responses can’t be changed, then what is the answer? The solution requires addressing the condition that attracts the social engineer in the first place – data exposure. Companies that manage data exposure will reduce the attack surface, and thus, take the psychological advantage away from the social engineer.

Ethan Saia