Social Engineering

Social engineering is a threat vector that depends heavily on human interaction and infrequently involves manipulating individuals into breaking traditional security procedures and best practices so as to achieve access to systems, networks or physical locations, or for gain.

Fraudulent actors use social engineering techniques to hide their true identities and motives and gain themselves as a trusty individual or info supply. The target is to influence, manipulate or trick users into leaving behind privileged info or access among a company. Several social engineering exploits merely have confidence people’s temperament to be useful. For instance, the offender may fake to be a fellow worker who has some reasonably imperative drawback that needs access to further network resources.

Social engineering is a common tactic among hackers because it is often easier to exploit users’ weaknesses than it is to find a network or software vulnerability. Hackers will often use social engineering tactics as a first step in a larger campaign to infiltrate a system or network and steal sensitive data or disperse malware.

Social engineering could be a well-liked manoeuvre among hackers as a result of it’s usually easier to use user’s weaknesses than it has to seek out a network or computer code vulnerability. Hackers can usually use social engineering techniques as a primary step in an exceedingly larger campaign to infiltrate a system or network and steal sensitive knowledge or disperse malware.

How it works?

Social engineers use a large sort of ways to perform attacks :

The first step in most social engineering attacks is for the offender to perform analysis and intelligence activity on the target. If the target is an enterprise, for example, the hacker could gather intelligence on the employee structure, internal operations, common slang used inside the trade and potential business partners, among alternative data.

One common maneuver of social engineers is to specialize in the behaviors and patterns of staff with low level but initial access, like a watcher or receptionist; hackers will scan the person’s social media profiles for data and study their behavior online and in person.

From there, the hacker will design an attack supported the info collected and exploit the weakness uncovered throughout the reconnaissance phase. If the attack is thriving, hackers have access to sensitive data — like MasterCard or banking data — have created cash off the targets or have gained access to protected systems or networks.

Types of social engineering attacks :

Popular types of social engineering attacks include:

1. Tailgating: Tailgating, generally referred to as piggybacking, is when a hacker walks into a secured building by following somebody with a licensed access card. This attack presumes the person with legitimate access to the building is courteous enough to carry the door open for the creator them, assumptive they’re allowed to be there.
2. Rogue: Rogue security software system could be a sort of malware that tricks targets into paying for the pretend removal of malware.
3. Honey trap: An attack during which the social engineer pretends to be a beautiful person to act with an individual online, faux an online relationship and gather sensitive info through that relationship.
4. Diversion theft: This sort of attack, the social engineers trick a delivery or messenger company into reaching to the incorrect pickup or drop-off location, so intercepting the transaction.
5. Quid pro quo: A quid professional quo attack is one during which the social engineer pretends to offer something in exchange for the target’s data or help. for example, a hacker calls a selection of random numbers inside a corporation and pretends to be calling back from technical support. Eventually, the hacker can notice someone with a legitimate technical issue who they’ll then pretend to assist. Through this, the hacker will have the target sort in the commands to launch malware or will collect password data.
6. Diversion theft: In this type of attack, the social engineers trick a delivery or courier company into going to the wrong pickup or drop-off location, thus intercepting the transaction.
7. Water-holing: A watering hole attack is when the offender tries to compromise a particular group of individuals by infecting websites they’re known to visit and trust so as to achieve network access.
8. Scare ware: Scare ware involves tricking the victim into thinking his computer system is infected with malware or has unknowingly downloaded contraband content. The assaulter then offers the victim solution which will fix the fake problem; in reality, the victim is solely tricked into downloading and installing the attacker’s malware.
9. Pretexting: Pretexting is when one party lies to another to achieve access to privileged information. For instance, a pretexting scam might involve an attacker who pretends to wish personal or monetary information so as to substantiate the identity of the recipient.
10. Vishing: Vishing is also referred to as voice phishing, and it is the use of social engineering over the phone to collect personal and monetary data from the target.
11. Spear phishing: Spear phishing is just like phishing but tailored for particular organization or individual.
12. Phishing: Phishing is when a malicious party sends a fallacious email disguised as a legitimate email, usually purporting to be from a trustworthy source. The message is supposed to trick the recipient into sharing personal or monetary info or clicking on a link that installs malware.
13. Baiting: Baiting is once an attacker leaves a malware-infected physical device, like a USB flash drive, in an exceedingly place it’s certain to be found. The finder then picks up the device and loads it onto his or her pc, accidentally putting in the malware.

Examples of social engineering attacks :

Perhaps the foremost famous social engineering attack comes from the mythological warfare during which the Greeks were ready to get in to town of Troy and win the war by concealing in a large wooden horse that was bestowed to the Trojan army as a gift of peace.

The most recent example of a fortunate social engineering attack was the 2011 data breach of security company RSA. An assaulter sent 2 completely different phishing emails over 2 days to small groups of RSA staff. The emails had the topic line “2011 recruitment Plan” and contained an excel document attachment. The spreadsheet contained malicious code that installed a backdoor through an Adobe Flash vulnerability. Whereas it had been never made clear precisely what info was taken, if any, RSA’s Secure ID two-factor authentication (2FA) system was compromised, and also the company spent some $66 million recovering from the attack.

In 2013, the Syrian Electronic Army was ready to access the Associated Press’ Twitter account by together with a malicious link in an exceedingly phishing email. The e-mail was sent to AP staff beneath the guise of being from a fellow employee. The hackers then tweeted a fake newspaper article from AP’s account that said two explosions had gone off in the White House and then-President Barack Obama had been injured. This garnered such a big reaction that the stock market born a hundred and fifty points in under 5 minutes.

Also in 2013, a phishing scam lead to the massive information breach of Target. A phishing email was sent to an HVAC (heating, ventilation and air conditioning) contractor that was a business partner of Target’s. The e-mail contained the citadel Trojan that enabled attackers to penetrate Target’s point-of-sale systems and steal the data for forty million client credit and debit cards. That very same year, the U.S. Department of Labor was targeted by a watering hole attack, and its websites were infected with malware through a vulnerability in net somebody that put in a foreign access Trojan referred to as Poison ivy.

In 2015, hackers gained access to the personal AOL email account of John Brennan, then the director of the CIA. One of the hackers explained to media outlets how he used social engineering techniques to pose as a Verizon technician and request information about Brennan’s account with the telecom giant. Once the hackers obtained Brennan’s Verizon account details, they contacted AOL and used the information to correctly answer security questions for Brennan’s email account.

Preventing social engineering :

Security experts recommend that IT departments regularly carry out penetration testing that uses social engineering techniques. This will help administrators learn which types of users pose the most risk for specific types of attacks, while also identifying which employees require additional training.

Security awareness training can also go a long way toward preventing social engineering attacks. If people know what forms social engineering attacks are likely to take, they will be less likely to become victims.

On a smaller scale, organizations should have secure email and web gateways that scan emails for malicious links and filter them out, thus reducing the likelihood that a staff member will click on one. Staying up to date with software and firmware patches on endpoints is also important, as is keeping track of staff members who handle sensitive information and enabling advanced authentication measures for them.

Inspired By : searchsecurity.techtarget and whatis.techtarget