SOCIAL ENGINEERING

What is Social Engineering?

Social engineering is that the term used for a broad vary of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into creating security mistakes or giving freely sensitive data.

Social Engineering techniques

Social engineering may happen in different forms anywhere where human interaction is involved. There are five most common forms of digital social engineering techniques.

1. Baiting
2. Scareware
3. Pretexting
4. Phishing
5. Spear Phishing

Baiting

The way attackers do suits with English mean of the baiting. Actually, in Baiting, attackers find something the victim greed or curiosity. After making a friendship with the victim, trap the victim and steal their personal information or inflicts their systems with malware. The most reviled form of baiting uses physical media such as an infected flash drive. 

But through online also attackers may attack using baiting. In this way, attackers might use some advertisements that the user might tend to click. Then it leads to download the malware-infected application. That is how Baiting happens.

Scareware

Scareware is the practice of making false warnings and false threats to victims. Users are made into thinking that their systems are infected with malware and are tempted to install software that has no real benefit or malware itself. As an example, when you are browsing on the web, the message can pop up saying that "your computer is infected with the harmful program and install this tool free" But actually the user downloading the malware itself. That is how scareware works.

Pretexting

Here attackers obtain information by pretending to be someone else who is a responsible professional in the community. As an example think the victim is not satisfied with the job or salary. So the attacker might be pretending an interviewee who offers a high salary with the package. However, the attacker makes the victim for an online interview. and ask how security architecture made like the most secret question which is needed to attack the organization. That is how pretexting works.

Phishing

As one of the most popular types of social engineering attacks, phishing scams are email and SMS campaigns aimed at instilling in victims a sense of urgency, curiosity or fear. It then prompts thems to expose sensitive information, click links to malicious websites, or open attachments containing malware.

Spear Phishing

This is the highly targeted version of fraud in which the attacker selects real people or businesses. They greatly attackers based on their messages, personality, work environment, and relationship status. This may take some time. But it is hard to find even though after the fraud also.

As an example, attackers might spot on the manager of the organization and find their signature and writing style. And send some message or email to the administrator to change the password and send me the credentials. But those credentials actually hand over to the attacker. That is how spear phishing works.

How to prevent Social Engineering.

• Do not open emails and attachments if you feel this is suspicious. If you receive an email from an unknown person you don't want to reply to them. You can hand over to the IT department for further clarrification.
• To protect yourself from revealing user credentials, you can use two-factor authentication.
• Be aware of the offers that you receive. Check twice before accepting the offer. It may be a fraud.
• Keep your antivirus software up to date.

References:

• https://www.webroot.com/us/en/resources/tips-articles/what-is-social-engineering
• https://www.youtube.com/watch?v=hZbgnFeXlr0
• https://www.imperva.com/learn/application-security/social-engineering-attack/