Social Engineering Education

(Posted for Wednesday, January 22, 2020)

Tricks of the (Social Engineering) Trade - The Methods a Social Engineer Uses to Trick People into Giving Up Sensitive Information

Phishing

Phishing attacks are the most common type of attacks leveraging social engineering techniques. Attackers use emails, social media and instant messaging, and SMS to trick victims into providing sensitive information or visiting malicious URL in the attempt to compromise their systems.

Phishing attacks present the following common characteristics:

• Messages are composed to attract the user’s attention, in many cases to stimulate his curiosity providing a few information on a specific topic and suggesting that the victims visit a specific website to gain further data.

• Phishing messages aimed to gather user’s information presents a sense of urgency in the attempt to trick the victim into disclosing sensitive data to resolve a situation that could get worse without the victim’s interaction.

• Attackers leverage shortened URL or embedded links to redirect victims to a malicious domain that could host exploit codes, or that could be a clone of legitimate websites with URLs that appear legitimate. In many cases the actual link and the visual link in the email are different, for example, the hyperlink in the email does not point to the same location as the apparent hyperlink displayed to the users.

• Phishing email messages have a deceptive subject line to entice the recipient to believe that the email has come from a trusted source, attackers use a forged sender’s address or the spoofed identity of the organization. They usually copy contents such as texts, logos, images, and styles used on the legitimate website to make it look genuine.

Pretexting

The term pretexting indicates the practice of presenting oneself as someone else to obtain private information. Usually, attackers create a fake identity and use it to manipulate the receipt of information.

Attackers leveraging this specific social engineering technique use adopt several identities they have created during their carrier. This bad habit could expose their operations to the investigations conducted by security experts and law enforcement.

The success of the pretexting attack heavily pretends on the ability’s attacker in building trust.

Most advanced forms of pretexting attacks try to manipulate the victims into performing an action that enables an attacker to discover and exploit a point of failure inside an organization.

An attacker can impersonate an external IT services operator to ask internal staff for information that could allow accessing system within the organization.

Baiting and Quid Pro Quo Attacks

Another social engineering technique is the Baiting that exploits the human’s curiosity. Baiting is sometimes confused with other social engineering attacks; its main characteristic is the promise of a good that hackers use to deceive the victims.

A classic example is an attack scenario in which attackers use a malicious file disguised as software update or as a generic software. An attacker can also power a baiting attack in the physical world, for example disseminating infected USBs tokens in the parking lot of a target organization and wait for internal personnel insert them in the corporate PC.

The malware installed on the USB tokens will compromise the PCs gaining the full control to the attacks.

A Quid Pro Quo attack (aka ‘something for something’ attack) is a variant of baiting and differs in that instead of baiting a target with the promise of a good; a quid pro quo attack promises a service or a benefit based on the execution of a specific action.

In a Quid Pro Quo attack scenario, the hacker offers a service or benefit in exchange for information or access.

The most common quid pro quo attack occurs when a hacker impersonates an IT staffer for a large organization. That hacker attempts to contact via phone the employees of the target organization then offers them some kind of upgrade or software installation.

They might request victims to facilitate the operation by disabling the AV software temporarily to install the malicious application.

Sources:

https://resources.infosecinstitute.com/common-social-engineering-attacks/#gref