Social engineering is an attack vector that exploits human psychology and susceptibility to manipulation victims into divulging confidential information and sensitive data or performing an action that breaks usual security standards.
In general, social engineering success relies on a lack of cyber security awareness training and a lack of employee education. Employees are the first line of defense and are frequently the weakest link in an otherwise secure defense in depth strategy.
And it’s not just employees organizations need to worry about. Third-party vendors are frequently the largest security threat, all it takes it one third-party to be breached to expose sensitive data..
Why do cybercriminals use social engineering?
Cybercriminals use social engineering techniques to conceal their true identity and present themselves as a trusted source or individual. The objective is to influence, manipulate or trick victims into giving up personal information or gain unauthorized access in an organization.
Most social engineering exploits people’s willingness to be helpful. For example, the attacker may pose as a co-worker who has an urgent problem e.g. an overdue invoice.
Social engineering is an increasingly popular way to subvert information security because it is often easier to exploit human weaknesses than network security or vulnerabilities.
That said, social engineering can be used as the first stage of a larger cyber attack design to infiltrate a system, install malware or expose sensitive data.
How does social engineering work?
Social engineers use a wide range of social engineering tactics that rely on the six principles of influence.
That said, the first step for most social engineering attacks is to gather information on the target.
For example, if the target is an organization, attackers can exploit poor OPSEC practices to gather intelligence on corporate structure, internal operations, industry jargon, third-party vendors and other publicly accessible information listed social media profiles, online and in person.
In many cases, the first target will be a low level employee whose login credentials can be used to gain access to internal information that can be used for spear phishing or other more targeted cyber threats.
Social engineering attacks expose sensitive information, like social security numbers or credit card numbers, and lead to data breaches and data leaks of personally identifiable information (PII) and protected health information (PHI).
What are the six principles of influence?
All social engineering techniques rely on exploiting aspects of human interaction and decision-making known as cognitive biases. Think of biases as vulnerabilities in human software which can be exploited just like software-based vulnerabilities listed on CVE.
Social engineering relies heavily on Robert Cialdini’s, Regents’ Professor Emeritus of Psychology and Marketing at Arizona State University and best-selling author, theory of influence based on six principles:
- Reciprocity: People tend to want to return a favour, which explains the pervasiveness of free samples in marketing. A scammer may give the target something for free and then request access to sensitive information.
- Commitment and consistency: If people commit, orally or in writing, to a goal or idea, they are likely to honor the commitment because it fits with their self-image, even if the original motivation is removed.
- Social proof: People tend to do things other people are doing.
- Authority: People tend to obey authority figures even if asked to do objectionable acts. This is why spear phishing campaigns that use the CEO’s name and target low-level employees can be successful.
- Liking: People are easily persuaded by people they like, hence why spear phishers will often masquerade as a colleague or friend in their spear phishing campaigns.
- Scarcity: Perceived scarcity increases demand, hence why social engineers often create a sense of urgency.
What are the types of social engineering attacks
Common social engineering attacks include:
- Baiting: A type of social engineering where an attacker leaves a physical device infected with a type of malware in a place it will be found, e.g. a USB. The victim inserts the USB into their computer and unintentionally infects the computer with malicious software.
- Diversion theft: Social engineers trick a delivery company into sending the package to a different location and intercept the mail.
- Honey trap: A con artist poses as an attractive person online to build up a fake online relationship to make money or gather personally identifiable information (PII) like the victim’s phone number and email account.
- Phishing: Phishing attacks gather sensitive information like login credentials, credit card numbers, bank account details by masquerading as a trusted source. A common phishing scam is use email spoofing to masquerade as a trusted source like a financial institution to trick the victim into clicking a malicious link or downloading an infected attachment. Phishing emails often create a sense of urgency to make the victim feel that divulging information quickly is important. Despite being a relatively unsophisticated attack, phishing represents one of the largest cybersecurity risks.
- Pretexting: Pretexting is lying to gain access to personal data or other privileged information. For example, a fraudster may pose as a third-party vendor, saying they need to know your full name and title to verify your identity.
- Quid pro quo: A quid pro quo attack uses the human tendency of reciprocity to gain access information. For example, an attacker may provide free technical support over a phone call to a victim and request that they turn off their anti-virus software or install a trojan that takes control of their operating system.
- Rogue security software: Rogue security software or scareware is fake security software that claims malware is on the computer. The end user receives a pop-up that demands payment for removal. If a payment isn’t made, pop-ups will continue but files are generally safe.
- Spear phishing: Spear phishing is an email spoofing attack targeting a specific organization or individual. Spear phishing emails aim to infect the victim with ransomware or trick them into revealing sensitive data and sensitive information.
- Smishing: Smishing or SMS phishing is phishing performed over SMS rather than the traditional medium of email.
- Tailgating: Tailgating or piggybacking is when an attacker follows a person into a secure area. This type of attack relies on the person being followed assuming the person has legitimate access to the area.
- Vishing: Vishing or voice phishing is conducted by phone and often targets users of Voice over IP (VoIP) services like Skype. Vishing paired with voice deep fakes is a massive cybersecurity risk. According to The Wall Street Journal, the CEO of a UK-based energy firm sent $243,000 to an attacker’s bank account believing he was on the phone to his boss.
- Waterholing: A watering hole attack is when an attacker targets a specific group of people by infecting a website they know and trust, e.g. by exploiting an outdated SSL certificate, typosquatting, lack of DNSSEC or domain hijacking.
- Whaling: Whaling is a form of spear phishing targeting high-profile individuals like public company executives, politicians or celebrities. For example, whaling attacks often come in the form of a fake request from the CEO asking the HR department to change their existing payroll details to those set up by the phisher.