SOCIAL ENGINEERING

 What is Social Engineering?

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. Psychological manipulation of people into performing actions or divulging confidential information. Getting the required data by manipulating the human mind.

Social Engineering Lifecycle

InformationGathering

Gather the required information to attack the target.

use OSINT to gather information.

Extracting information from google search.

prioritize the information.

verify the information.

plan the attack.

Establishing a Relationship with the target

Engage with the target.

create a story.

Interact with the target.

Exploitation

Maintain the story.

Extarct information.

Exit

Closes interaction.

Cover tracks.

Traits of Social Engineering Attacks

Social engineering attacks center around the attacker’s use of persuasion and confidence.

Heightened emotions : Emotional manipulation gives attackers the upper hand in an any interaction.The following emotions are all used in equal measure to convince you.

• Fear
• Excitement
• Curiosity
• Anger
• Guilt
• Sadness

Social engineering comes in many forms.

Phishing Emails

The most popular social engineering attack types, phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims.

Spear Phishing

Spear phishing does require more effort from the attacker’s side, as he needs to perform a full OSINT investigation on the victim(s), perform extensive research about everything surrounding them and customize the email, which makes it much harder to distinguish from a legitimate email and ups the attacker’s chances of succeeding.

Voice Phishing, AKA Vishing

Vishing uses phone calls to trick people into giving away their private data. The attacker creates a fake phone number, calls an individual posing as a bank or some other service provider, and asks for their credentials or bank account details.

Baiting

This attack abuses your natural curiosity to coax you into exposing yourself to an attacker.

Popular methods of baiting can include:

• USB drives left in public spaces, like libraries and parking lots.
• Email attachments including details on a free offer, or fraudulent free software.

Physical Breach Attacks

Physical breaches involve attackers appearing in-person, posing as someone legitimate to gain access to otherwise unauthorized areas or information.

Pretexting

 

Pretexting may be hard to distinguish from other types of social hacking attacks. It can be performed using different attack vectors, including email, phone calls or even face-to-face communication.

Access Tailgating Attacks

Tailgating is the act of trailing an authorized staff member into a restricted-access area. Attackers may play on social courtesy to get you to hold the door for them or convince you that they are also authorized to be in the area.

Scareware Attacks

Scareware is a form of malware used to frighten you into taking an action. Scareware is often seen in pop-ups that tell the target their machine has been infected with viruses.

Social engineering is not only on virtual, it also affects physical security.

The friendly guy you just held the door open for carrying the donut boxes could be a hacker in disguise, who sneakily plugs a USB Ninja Cable into a company computer and injects it with malicious software when no one is looking.

Examples of Social Engineering Attacks

Worm Attacks

A computer worm is a type of malware that spreads copies of itself from computer to computer. A worm can replicate itself without any human interaction, and it does not need to attach itself to a software program in order to cause damage.

• The LoveLetter worm that overloaded many companies’ email servers in 2000. Victims received an email that invited them to open the attached love letter. When they opened the attached file, the worm copied itself to all of the contacts in the victim’s address book. This worm is still regarded as one of the most devastating, in terms of the financial damage that it inflicted.
• The Mydoom email worm — which appeared on the Internet in January 2004 — used texts that imitated technical messages issued by the mail server.
• The Swen worm passed itself off as a message that had been sent from Microsoft. It claimed that the attachment was a patch that would remove Windows vulnerabilities. It’s hardly surprising that many people took the claim seriously and tried to install the bogus security patch — even though it was really a worm.

Tools For Social Engineering(physical)

Lock picks

Button Camera

Hat Camera

Recorders

Gps Tracker

Tools For Social Engineering(online)

HackSearch Pro Plugin

Shodan

Peekyou

Maltego

Social Engineering toolkit

Common user password profiler

Spoofcard

Unshredder

Metagoofil

How to Prevent Social Engineering Attacks?

Online communication is where you’re especially vulnerable. Social media, email, text messages are common targets, but you’ll also want to account for in-person interactions as well.

Don’t open emails or messages and attachments from suspicious sources.

Use multi-factor authentication.

Use strong passwords (and a password manager).

Avoid sharing names of your schools, pets, place of birth, or other personal details.

Be very cautious of building online-only friendships.

Never let strangers connect to your primary Wi-Fi network.

Keep your antivirus/antimalware software updated.

Use a VPN.

Keep all network-connected devices and services secure.

Don’t ever leave your devices unsecured in public.

Be wary of tempting offers.

Identify the Fake.