It’s time to take a closer look at everything you know about how you make decisions in order to avoid social engineering attacks. 

What is Social Engineering? Meaning, Examples, and Prevention Hacks

 

(Alt Text: Small Multi-Colored Puppet On A String) 

Human nature is such that we are motivated by our emotions. According to research, these emotions are instinctive and are encoded within our genes. 

What does this tidbit have to do with social engineering?

Well, it is often stated that humans are the fragile connection in cybersecurity, and the reason for this rests in our emotional nature. Even when you know you should make careful decisions, intense emotions like anger, fear, and sadness can undermine your ability to make rational decisions. Instead, you might prefer symbolic, weirdly satisfying solutions to problems over more constructive ones.

And cybercriminals are nothing if not opportunistic: cue in social engineering.

What is Social Engineering? 

 

Unlike conventional cyberattacks, which rely on flaws in your cybersecurity practices, such as not using a strong and secure password, social engineering techniques target the human vulnerability that emotion presents when making rational decisions.

Cybercriminals use social engineering to trick you into disclosing confidential and sensitive information (typically through digital communication), which they then use fraudulently. They’ll typically contact you posing as a legitimate organization such as your bank or a popular social media platform such as Facebook in order to obtain sensitive personal information such as passwords or your account number.

 

In other words, hackers who commit cybercrime through social engineering behave similarly to con artists ( Aka yahoo-yahoo and 419ers). The only difference is that instead of using intimate interactions to establish rapport and persuade you to take specific actions, they bet on your lack of understanding of digital tools or eagerness to share on digital platforms once they have established rapport with you.

The result is the same: emotional manipulation leads to the disclosure of sensitive information or the exchange of money.

 

Note: cybercriminals who conduct social engineering attacks are referred to as social engineers.

How Does Social Engineering Work?

 

While each social engineer’s style and execution may differ, in general, social engineering is usually done in three stages, which we have highlighted below.

Stage 1: The Research Stage

Hackers who use social engineering are constantly attempting to persuade you that they represent a credible institution. One of their go-to methods for selling this ruse is to provide information about you – hence the research. 

They will scour the internet (including social media) for easily accessible information such as your phone number, birth date, and any other publicly available information you may have.

Stage 2: The Contact Stage

Equipped with all the information they may have gathered about you, social engineers will then initiate contact. It is at this stage in the social engineering attack that you’ll be asked to provide private information the cybercriminal can exploit.

 

Stage 3: The Attack Stage

Using the data they have covertly collected, social engineers launch their assault.

 This could include committing a traditional case of identity theft, gaining access to your systems using obtained passwords, or using the information for political or personal gain.

 

The Five Most Common Types of Social Engineering Attacks

Even though social engineering is a method of extracting sensitive details through human manipulation, social engineers employ a wide range of manipulation tactics to obtain this information.

Here are the top five to keep an eye out for:

1. Pretexting

Pretexting is a popular social engineering tactic in which the social engineer impersonates a representative from a trusted organization, such as your bank, in order to obtain sensitive information. 

To pull this off successfully, the social engineer conducts extensive research on you before making contact with you.

 

2. Tailgating

 

You’ve probably seen tailgating in spy movies, particularly in the depiction of corporate espionage, but you probably didn’t know what it was until now. Unlike the other social engineering techniques on this list, which are strictly digital, a social engineer will have to be physically present to carry out this type of social engineering attack. 

And the social engineer relies on luck rather than research.

For example, pretending to be on the phone while an access door is being opened to gain access to restricted areas of a building using an employee’s valid security credentials. They will sometimes also impersonate delivery people or other service personnel who work in a building. 

 

3. Phishing 

 

Phishing is a category of social engineering attack that can be delivered via phone, email, or text. Still, the goal is always the same: get you to click on a sinister link or divulge sensitive information. The communication will appear to be from a valid source, as with all other social engineering techniques. However, if you make the mistake of clicking the attached link, your system or device will be swarmed with malware, compromising all of your data.

 

Pro Tip: there is a variation of a phishing attack called Whaling and Spear Phishing. This term refers to phishing attacks aimed at high-profile individuals.

 

4. Baiting

 

As the name implies, this type of social engineering attack is frequently disguised as an enticing treat, and if you fall for it (click the link), you’re hooked! All the social engineer has to do is reel you in.

The bait in question can range from a free movie download to a chance to win the latest iPhone (you’ve probably seen one of these), and it will almost always be relevant to your interests.

In some cases, the bait is offered as a form of Quid Pro Quo –  which means that the social engineer will provide a benefit or service in exchange for you complying with their request.

5. Reverse Social Engineering

 

Reverse Social Engineering is an evil twist on the “Damsel in Distress and Knight to the Rescue” story trope.

The social engineer will create a scenario in which they will appear to have a serious problem that requires your attention while positioning themselves with a bogus solution. The irony of this type of engineering attack is that if you fall for it, you will have a major problem on your hands.

 

How to Guard Against Social Engineering Attacks 

 

The strongest type of protection strategy you can put in place against social engineering attacks is precautionary. It would be best if you were vigilant for the tell-tale signs of an attack. 

Here are some ideas to get you started:

• Click on attachments only from trusted sources – take the time to research and safelist the email addresses of institutions you expect communication from, such as your school or bank. If a social engineer attempts to contact you by impersonating any of these institutions, you will be able to tell right away that it is fake communication.
• Even if the source of the request appears to be legitimate, delete any text or email requesting for personally identifiable information (PII) or passwords, such as your full date of birth or password.
• Do not read emails that promise prizes or notify you of your winnings. Especially if you know you haven’t entered any competitions. Remember, Santa Claus is a myth, and no one sends free gifts out of nowhere – sorry!

• Download software only from trusted sources, such as the software provider’s official website, GooglePlay, and the Apple App Store.

Check that your antivirus and spam filters on your devices have been activated.

• Be wary of urgent solicitations or requests for assistance: bless your generous heart, but unless you run a charity organization, ignore emails like this.

Finally, contact customer service to confirm any technological upgrade request via email.

Did we miss out on anything? Let us know in the comment section.