Social Engineering: Manipulative strategy that exploits human psychology to gain unauthorized access to systems/data/spaces.

Best defense is user security awareness training.

Motivational Triggers

The backbone of Social Engineering lies in tricking a user into doing something for an attacker.

1. Authority: The power or right to give orders, make decisions, and enforced obedience. (e.g., pretending to be a manager, important client).
2. Urgency: Compelling sense of immediacy/time-sensitivity that drives individuals to act swiftly or prioritize certain actions (to ignore/bypass normal security procedures).
3. Social Proof: Psychological phenomenon where individuals look to the behaviors and actions of others to determine their own decisions/actions in similar situations. You might not visit a random phishing website, but if a popular website is shared among some friends you may also use it. We believe in products with thousands of reviews.
4. Scarcity: Pressure people feel when they think a product/opportunity/resource is limited or in short supply. Similar to urgency, except the driver is limited resources (e.g., limited supplies).
5. Likability: Being nice, friendly, and socially accepted by others. Forms: Sexual attraction, pretending to be a friend, chatting about common interest (e.g., sports, band, movie, TV, etc.) to gain trust.
6. Fear: Belief something/someone is dangerous/painful/threatening. (e.g., ransomware). Can be combined with authority.

Impersonation

Four types:

1. Impersonation: Adversary assumes identity of another person to gain unauthorized access to resources/steal data. Attacker must collect information about organization so they can more easily earn the trust of their targeted users. Can lead to unauthorized access, disruption of service, complete system takeover. Defense: user education.
2. Brand Impersonation: Attacker pretends to represent a legitimate company or brand. Attackers use brands logos, language, and information to create deceptive communications or websites. Example: Brand impersonation of Eli Lilly tweeting that insulin would become free resulted in 4% drop in stock price over 24 hours. Defense: user education, monitoring brands you work with.
3. Typosquatting: Attacker registers a domain name similar to a popular website but contains some kind of common typographical errors. (e.g., gnail.com, registering a hijacked subdomain using the primary domain of a trusted cloud provider like azure.com). Defense: user education, registering common misspelling or their own domain names, looking for similar domains online.
4. Watering Hole: Attackers compromise a specific website/service target is known to use.

Pretexting

Pretexting: Create a scenario/pretext to manipulate or deceive someone into giving confidential information.¹1. Example: Calling a company under the pretext of being an IT support representative conducting a mandatory system upgrade to trick an employee into revealing their password.

Defense: Training employees not to fall for pretext and fill in the gaps for other people.

Phishing

Attacks

1. Phishing: Fraudulent emails from a trusted source to trick individuals into disclosing personal information like passwords and credit card numbers. (e.g., fake Google login, Spray and pray).
2. Spear Phishing: Tightly focused on specific group of individuals/organizations. More targeted and has a higher success rate.
3. Whaling: Spear phishing that targets high-profile individuals like CEOs or CFOs.
4. Business Email Compromise (BEC): Advanced phishing attack that uses an internal company email account to manipulate employees. Relies on trust established by the compromised account.
5. Vishing (Voice Phishing): Phone-based attack that tricks victims into sharing personal/financial information. Many people are more convinced over the phone instead of email.
6. Smishing (SMS Phishing): Often gives a phone number to call or a website link.

Defense

• User awareness training and anti-phishing campaigns.
• Swiftly respond to reported suspicious messages.
• Triage if a phishing email was opened.

Anti-Phishing Campaigns

Tool for educating individuals about phishing risks and how to recognize potential phishing attempts in user security awareness training.

1. Provide user awareness training: e.g., urgency, unusual requests, mismatched URLs, strange email addresses, poor spelling and grammar.
2. Simulated phishing campaigns: Give remedial training to users who fall victims.

Frauds and Scams

Fraud: Wrongful or criminal deception intended to result in financial or personal gain.

Fraud v. Theft: In fraud, you are tricked into giving your valuables.

Identity Fraud: Use of another person’s Personal Information without authorization to commit a crime, deceive, or defraud another person.

Identity Fraud v Theft: Identity Fraud: Steal victim’s credit card and make changes. Identity Theft: Attacker fully assumes the identity of their victim.

Scam: Fraudulent or deceptive act or operation (e.g., invoice scam).²2. Example: A Business Email Compromise where an attacker poses as a known vendor and sends a fake invoice with updated bank details to route payments to their own account.

Influence Campaigns

Coordinated efforts to affect public perception or behavior towards a particular cause/individual/group.

• Performed by high-level actors like nation-states and hacktivists.
• Leads to misinformation and disinformation.

Misinformation: Inaccurate information shared unintentionally (Honest mistakes).

Disinformation: Intentional spread of false information to deceive or mislead (e.g., Twitter 2020 crypto scam).

Defense: Promoting media literacy, transparency, and regulation.

Other Social Engineering Attacks

• Diversion Theft: Manipulating situation or creating distraction to steal valuable items or information (e.g., DNS spoofing).
• Hoax: Malicious deception often spread through social media/email/etc. Often paired with phishing and impersonation attacks.
• Shoulder Surfing: Looking over someone’s shoulder to gather Personal Information. Can be done with cameras and CCTV. Defense: Require privacy screens.
• Dumpster Diving: Searching through trash to find valuable information. Defense: Shred documents, clean desk policy. Virtual dumpster diving can also be done.
• Eavesdropping: Process of secretly listening to private conversation (e.g., onpath attack). Defense: Use encryption.
• Baiting: Planting a malware-infected device for a victim to find and unintentionally introduce malware to their organization system (e.g., dropping a USB with malware). Defense: train users not to use USB.
• Piggybacking and Tailgating: Tailgating is when attacker follows employee through Access Control Vestibule without knowledge. Piggybacking is when attacker tricks an employee into granting them entry into the facility.