Don’t Be a Victim: Protecting Yourself Against Social Engineering

In today’s interconnected world, social media has revolutionized the way we communicate and seek assistance. With just a few clicks, we can connect with customer support representatives and find solutions to our problems in an instant. It’s convenient, efficient, and seemingly harmless. However, lurking beneath this convenience lies a lurking danger: social engineering.

In our rush to find quick solutions, we often unintentionally divulge personal details in public forums, leaving ourselves vulnerable to potential misuse by fraudsters.

This article explores the deceptive tactics employed by cybercriminals and provides practical insights for navigating the digital landscape safely. By understanding these tricks, you can arm yourself with the necessary awareness to prevent becoming a victim.

What is social engineering?

Social engineering encompasses a range of malicious activities that exploit human psychology to deceive individuals into divulging personal information, performing actions, or falling victim to scams. It involves fraudsters building trust through various tactics, such as pretending to offer assistance or exploiting vulnerabilities in human nature.

Social engineering, sometimes called human hacking, is a broad category of different types of attacks.

How does it work?

Social engineering attacks occur in a series of steps. The attacker begins by researching the target, gathering information to identify vulnerabilities and weak security measures. Once equipped, they gain the victim’s trust and manipulate them into compromising security practices. This can involve sharing sensitive information or granting access to critical resources.

Social engineering attack techniques

This entry will cover some of the most common forms of digital social engineering assaults.

Baiting

This involves use of false promises that entices victims, leading them into traps that result in the theft of personal information or the infiltration of malware into their systems.

The most reviled form of baiting uses physical media to disperse malware. For Example, attackers leave physical devices —  such as USB drives — in public places or company premises, labeled with enticing names like “Employee Payroll” or “Confidential Data.” Curious individuals who pick up and connect these devices to their computers unknowingly install malware, allowing the attacker to gain unauthorized access.

Shoulder surfing

Shoulder surfing is looking over someone’s shoulder while they are using a computer and visually capturing logins or passwords or other sensitive information. This can also be called Spying.

For example, in a crowded coffee shop, an attacker might position themselves strategically to glimpse a person’s PIN code as they enter it at an ATM or watch them enter their login credentials on a laptop in a public space.

Pretexting

Pretexting involves an attacker gaining trust by impersonating someone in authority. They ask questions that seem necessary for identity verification but are actually designed to gather personal data from the victim.

For example, someone might impersonate a tech support representative and ask for remote access to a victim’s computer, claiming it’s for troubleshooting purposes.

Phishing

As one of the most popular social engineering attack types, Phishing is designed to get victims to click on links to malicious websites, open attachments that contain malware, or reveal sensitive information. Attackers use cunning techniques, such as impersonating trusted entities or creating urgency, to manipulate individuals into taking actions that compromise their security.

An example is an email sent to users of an online service, claiming a policy violation and urging immediate action. The email contains a link to a fake website that looks almost identical to the legitimate one. Users are tricked into entering their current credentials and a new password, which is then captured by the attacker.

Spear phishing

Spear phishing is a more targeted form of phishing where attackers tailor their attacks to specific individuals or organizations to make them less noticeable. Whaling, on the other hand, targets high-profile employees like CEOs or CFOs.

Scareware and ransomware

Scareware tricks victims into believing their system is infected and urges them to install unnecessary or malicious software. Ransomware is when victims are prevented from accessing their system or personal files until they make a ransom payment in order to regain access.

Scareware often manifests as deceptive pop-up banners on websites, displaying alarming messages like “Your computer is infected with spyware.” —  These banners may prompt users to install malware-infected tools or lead them to malicious websites that infect their computers.

A distribution method is through spam emails, which contain false warnings or offers for purchasing worthless or harmful services.

Tailgating

Tailgating is the act of following an authorised person through a secure door or access point into a restricted area.

For example, an attacker disguised as an employee approaches a legitimate employee entering a secure area. Carrying a large box, the attacker convinces the employee to open the data center door using their own RFID pass.

Dumpster Diving

This is a method of gathering information from discarded items like phone lists, calendars, or organizational charts. Attackers can use this seemingly innocent information, along with access codes or passwords, to exploit social engineering techniques and gain unauthorized access to a company’s computer network.

How to mitigate attacks

Social engineering relies on exploiting people’s natural tendency to trust, making them vulnerable to attack. As a result, it’s a highly effective method for gaining access to sensitive information and systems. Penetration tests often identify social engineering tactics as the weakest point in an organization’s security.

The following tips can help decrease your chance of being exploited by a social engineer:

• Be cautious online — Avoid sharing personal information through phone calls, emails, or unsecured websites. Refrain from clicking on links, downloading files, or opening email attachments from unfamiliar sources.

• Keep your accounts and devices safe — Use anti-virus software, and spam filters, and update and patch your devices regularly.

• Stay vigilant and be wary of your surroundings — exercise skepticism when encountering email links or web forms that ask for personal information, even if the email appears to be from a trusted source. Avoid clicking on suspicious pop-ups or entering sensitive data into them.

• frequent awareness campaigns: posters, presentations, emails, information notes;

• Use multifactor authentication

• staff training and exercising

Conclusion

Despite having physical barriers, network hardware configurations, access controls, and patched software, social engineering can still bypass these defenses. The most effective defense against social engineering lies in awareness and training. Educating individuals and employees about social engineering techniques empowers them to recognize and thwart these attacks. In conclusion, a well-informed and vigilant workforce is the key to combating social engineering.

References / More Resources