International Conference on Computing, Communication and Automation (ICCCA2016)

A Literature Survey on Social Engineering Attacks:

Phishing Attack
Surbhi Gupta Abhishek Singhal Akanksha Kapoor
Department of CSE Department of CSE Department of CSE
Amity University Uttar Pradesh Amity University Uttar Pradesh Amity University Uttar Pradesh
Noida, India. Noida, India Noida, India
[email protected] [email protected] [email protected]

Abstract— Phishing is a network type attack where the it is sent by banks to disclose the information for financial
attacker creates the fake of an existing webpage to fool an gain. For Example, the attacker sends you an email such as
online user into elicit personal Information. The prime “you have won a prize”, in this mail they define some
objective of this review is to do literature survey on social causes such as you have won the Rs.10000000 and your
engineering attack: Phishing attack and techniques to detect
attack. Phishing is the combination of social engineering and
mobile number is selected randomly by the computer so fill
technical methods to convince the user to reveal their personal the given information. Fake details such as, we will transfer
data. The paper discusses about the Phishing social the money directly in your account are given. They ask the
engineering attack theoretically and their issues in the life of account number, credit card number and the password etc.
human Beings.Phishing is typically carried out by Email in order to capture our details. It uses social engineering
spoofing or instant messaging. It targets the user who has no techniques with brilliantly arranged tricks to bait users for
knowledge about social engineering attacks, and internet elicit data. The bait can be delivered message, phone, and
security, like persons who do not take care of privacy of their spoofed emails. Phishersend spoofed emails to millions of
accounts details such as Facebook, Gmail, credit banks internet users in hope that at least a few of them might bite
accounts and other financial accounts. The paper discusses
various types of Phishing attacks such as Tab-napping,
it. It targets the people who don‟t have Knowledge about
spoofing emails, Trojan horse, hacking and how to prevent online attack, Internet security and make them believe that
them. At the same time this paper also provides different the emails are coming from true organization. Phishing
techniques to detect these attacks so that they can be easily attacks main aim is to find the weaknesses of the target user.
dealt with in case one of them occurs. The paper gives a Attacker always finds the ways that causes users to visit a
thorough analysis of various Phishing attacks along with their phishing website. The Spoofed emails are designed in such
advantages and disadvantages. a manner that they often look professional and the users are
easily targeted and befooled.
This paper consists of four sections. First section consists of
Keywords—Phishing attack; Social engineering attack;
spoofed email; Personal data;
introduction; section 2 illustrates Literature Survey and
types of Phishing attacks, Section 3 explains widely
Prevention from Social engineering attacks, Section 4
I.INTRODUCTION explains Analysis on social engineering attacks detection
techniques, followed by Conclusion in Section 5.
The main aim of information security is to protect the
sensitive information from the social engineering attack
such as phishing attack, and money laundering. Social II. LITERATURE SURVEY
engineering attack is an art of manipulating the people who Phishing attack is a cybercrime; the attacker manipulates
have less knowledge about these types of attack. Every people to elicit their personal data. It is a great security issue
organization has security issues thathave been of great in the society. There are many techniques and numbers of
concern to users, site developers, and specialists, in order to solutions present today in order to prevent from these types
defend the confidential data from this type of social of attack; however users are providing personal information
engineering attack. on phishing webpage making it difficult for Programmers.
Phishing is a serious problem in the progressively limitless Many toolbars are available for different browsers which
service of the internet. There are many ways to trick the attempt to warn the people of likely phishing sites,
people to disclose the information from the user by using attempting users to further open them. Now this attack is
social engineering attack [1]. Phishing attack is one of the known as spear phishing. It makes harder for users to
common and popular amongst all. In this, the attacker bait distinguish between legitimate and spoofed email. Spoofed
the users by sending mails such as prize winning, send email being starting of Phishing attacks causes great harm to
message from fake account on social networking sites, user‟s authentication.
hacking password , send emails to victims which seems like

ISBN:978-1-5090-1666-2/16/$31.00 ©2016 IEEE 537

Various types of Phishing Attacks are:- or better interest rate than other banks. Victims who fill the
information with the dream to save money or make more
A. Spoofing email:it is a type of phishing attack. Spoofing is from interest charges are encouraged to transfer existing
when a spammer sends you an email using other email accounts and fall prey to Trojan horse attack.
address. It seemslike that the message is for them, and
tricks people into opening it [4].
Email spoofing is possible because of SMTP(simple mail III. APPROACHES TO PREVENT PHISHING SOCIAL
transfer protocol), It is used in sending mail, doesn‟t include ENGINEERING ATTACK
an authentication process.[12] So this type of attack can be
manipulating user easily to disclose the secret information A. Spoofed Email Detection: - There is no way to stop email
by reading (sometimes even clicking) that e-Mail. spoofing. Only possible trick is to set your spam filtering to
identify spoofed email. The best method to stop Phishing is
to block malicious emails before reaching the customer with
B. Fake Social Network Accounts: The end users of social DMARC (Domain based message Authentication Reporting
sites such as facebook, twitter, LinkedIn, orkut are not and conference)[14] by the company. Do not trust display
conscious about their accounts. A fake account is easily name of the email because many attacker use brand name.
created on social networking sites [2] by the attacker. By Attacker also uses spelling mistake method to make a fake
these fake profiles, the attacker can access to secret data that email. In this type of emails only “anchor test” is shown in
the user discloses when he creates an account. These the web browser but not URL. Link Guard algorithm [7] is
popular networking sites have policies against fake accounts used to solve that type of situations. The characteristics of
however there are many fake accounts still available on links of phishing emails generate an algorithm with a set of
these sites, because they have a lack of real system which rules such as finding hyperlinks with the difference of actual
determines the validity of user [7]. Eg: - The attacker link.
creates a fake account with associative women name and her
picture or famous athlete. This fake user sends the request to
the target, fooling them and portraying her to be the popular B. Fake social networking accounts detection:
athlete. Social networking sites have many rules against creating
fake profiles but there is lack of a right conformity to
C. Hacking: A hacking is any technical effort to manipulate identify the user [8]. In, this attacker makes their fake
access the system or resources. A hacker is a person who account to manipulate someone. The user usually shares
engages in that process. Hacking and hacker are most their personal information in their profile and status. They
commonly association with malicious programming attacks give chance to hacker to assemble the information about
on the internet. Hacker can be motivated by a multiple of them in order to perform spear phishing. For example: if a
reasons such as challenge, profit and enjoyment [13]. user were to post something simple as “I Love Football” a
Hackers use vulnerability scanner and port scanner to check potential hacker could take the information and make a
computers on a network for known weaknesses [6]. In this unique spear phishing attack intended for the user[9]. To
type of attack, the hacker may use Brute Force attack, prevent this type of attack, the user should maintain a
Password cracking, dictionary attack for obtaining constant awareness of what they post, what they share, and
passwords from data. In this, Social engineering is very user must be especially aware of media that they share with
efficient, because the users are most vulnerable part of an others through the use of links.
organization. If an employee reveals a password to an
unauthorized person, No security device can keep an C. Hacking Detection: - Detection of hacking attack is not a
organization safe. So the user is the weakest point in the simple task. Especially for that type of users who have no
security. information about accounts security and no knowledge
about internet attacks. The most important thing is that to
D. Trojan horse: Trojan horse attack is the most deliberate keep your password as a secret. If you give your password
threat to the system security. Trojan is the executable to someone, you should change your password after they are
program, example: - when you click on any file, it will done using its access. Our personal computers should not
implement some action. There are many ways to fool have any type of virus or key logger etc. for this one must
someone easily. It is a set of line of code, contained inside download updated programs, software, and anti-viruses
apparently harmless programming which is harmful for the from a trusted site. One must keep upgraded versions of the
system. It is a type of program (code) designed in such a latest anti-virus software for their computers and
way that it can get control over the system, example: - blogs[16].You should be aware while using internet; your
running the file allocation table on your hard disk. There are email can be hacked if you click on a fraud link. Your
many job offers present which requires the person to enter password strength should be strong that can‟t be easily
their personal information and their security numbers. Eg:- guessed by the attacker. It is especially important to keep
scammer use false banking sites to offer lower credit costs your banking and other financial accounts password to be

538
secure and secret. You have to use antivirus software to  You should take care of hidden file extension, windows
prevent from these types of attack. Antivirus software is hides the last extension of a file by default. Eg: looking
crucial to keep your computer good and healthy. The as “Susie.jpg” may be “Susie.jpg.exe”- it is an
password should be 3D; it can use numbers, alphabet and
executable Trojan, this helps to reduce the chances of
special character.
being tricked .
D. Trojan horse detection: -There are some points to
prevent system from Trojan horse. IV.ANALYSIS OF SOCIAL ENGINEERING ATTACK
 You must be careful when you download a file from the DETECTION TECHNIQUES
internet, it is often just a matter of time before you fall
Other techniques to preventing phishing attack and their
victim to a Trojan horse. result, we discuss some technique which is used to prevent
 If a file comes from your office friend, you must be from social engineering attack as phishing attack. Now
confident what the file is, before disclosing it because day‟s phishing have become too smart such that sometimes
many Trojans will try to spread themselves in the friend skillful people can‟t be able to distinguish between
list using an email address book. suspicious and legitimate pages then we used surf [9]
technique to distinguish.

Sr. Techniques Developer Year Methodology Advantage Disadvantage

No
1. SURF(speed up robust Herbert Bay 2006 It is a feature detector technique that Matching speed is There are more chances
Features)[11] can be used as object recognition, good. It takes of false matching point
registration, and 3D reconstruction. Less computation and and less accuracy in the
We used this technique to compare it is short time surf process.
the similar point between legitimate consuming process.
and suspicious pages.
2. SEADM(social Monique 2010 This model is based on decision tree To Be Experienced in Less knowledge about
engineering attack Bezuidenhout by breaking the process into more this type of attack. this type of attack.
detection model) manageable component and Totally depend on mind
guidelines to make decision. In this, making decision.
they describe the emotional state of
the user when he takes a decision in
the social engineering attack process.

3. Ontological model to Francois Mouton 2014 In this model we describe about an Provide depth This model doesn‟t
detect social attack framework how the attacker knowledge about social provide security to the
engineering attack[12] easily targets the user and what is the engineering attack. information but its help
process to be done by the attacker. This frame work is us to how can I prevent
The process of this model is based on used for education and our data.
kevinmitnick„s social engineering awareness purpose.
attack cycle.

4. Anti Phishing tool Jordan crain 2010 These tools are effective in Protected from all Lack of knowledge
identifying phishing websites but attack factors, provide (many number of user
even if they were mostly correct, user a reliable means of can‟t understand that
ignore their warning anyway. detecting phishing type of warning).
emails.

5. Authentication SudanthaGunawar 2013 In this we used steganography It is more secure For password securing
technique to reduces dena techniques to hide our profile. The technique to hide our no proper formwork is
phishing attack password strength should not be password from the suggested in social
weak. This methodology is that the attacker. engineering.
user password may be an image that
is the authentication process to
identified user.
6. Link Guard NareshVidya 2013 This technique is used to analyzing The false negative The main disadvantage
Algorithm[17] Sagar the difference between visual and point is less in this of this technique is that
actual link. It is also used to calculate technique and 95% it works with windows
the similarities of a URI with a phishing website is XP. Now, many users
legitimate website(trusted site) recognized by this are using widow‟s other
algorithm. version e.g. windows7,
windows 8 and
windows 10.

539
 V. CONCLUSION [9] H.Bay, T.Tuytelaars and L. Van Gool, “SURF: Speeded
UP robust Features.” European Conference on Computer
Vision (ECCV), Springer Berlin,2006, pp. 400-417.
Social engineering attack as we discussed is a [10] F. Mouton, L. Leenen, M. M. Malan and H.S. Venter, “
technique where attackers try to manipulate or fool Towards an Ontological Model Defining the Social
users. Our paper dealt with one of the most Engineering Domain” 11th Human Choice and Computers
International Conference, Turku , pp. 266 - 279, July 2014
common type of Social Engineering attack named [11] M. Fujikawa and M. Nishigaki, “A Study of Prevention
Phishing Attack. Phishing attack is very difficult to for Social Engineering Attacks using Real/Fake
detect because many people are unaware of it. Organization‟s Uniforms,” Sixth International Conference
There are many numbers of tools present to on Availability, Reliability and Security , 2011, pp. 597-
602
identify a phishing websites which warns the
[12] searchsecurity.techtarget.com/definition/email-
clients about the malware present in the website,
spoofing{accessed.online 10 October, 2015}
but most of the users ignore the warning. There are [13] https://en.wikipedia.org/wiki/hacker {accessed. online 28
many techniques to detect social engineering attack October, 2015}
however we cannot stop it. We discuss in our paper [14] https://blog.returnpath.com/10-tips-on-how -to-identify-
types of phishing attack and how to prevent from it. a-phishing-or-spoofing-email-v2 {accessed. online 2
How can people escape from attacks and what they December, 2015}
can do in such type of situation? [15] searchsecurity.techtarget.com/definition/Trojan-Horse
One solution to these attacks is that the user should {accessed. online 12 November, 2015}
copy the linkand open it with a new browser; from [16] [www.wikihow.com/prvent-hacking {accessed. online 12
this the user can recognize that the webpage is January, 2016}
suspicious or legitimate. There are a number of [17] U. Naresh, U. VidyaSagar and C. V. Madhusudan Reddy,
open source websites available which identifies the “Intelligent Phishing Website Detection and
authenticity of the link, website, or a webpage. Prevention System by Using Link Guard Algorithm” IOSR
Apart from this there are many algorithms which Journal of Computer Engineering (IOSR-JCE) 2013, vol.
can be used to detect Phishing attack, example: - XIV, pp 28-36
link guard algorithm and surf detector. Though
there is a weakness associated with these [18] www.wikihow.com/Tell-if-Your-Computer-Is-Infected-
algorithms, they have been implemented up to by-a-Trojan-Horse {accessed. Online 17 January , 2016}
windows XP only. In future we would like to
implement it for the windows 7, 8, 10 and updated
windows versions, since most of the users today
use these versions.
REFERENCES
[1] F. Mouton, M. Malan, L. Leenen and H.S. Venter, “Social
Engineer Attack Framework,” IEEE Conference on
Information Security for South Africa , 2014, pp. 1 - 9.

[2] J. Allen, L. Goman, M. Green, P. Ricciardi, C. Sanabria

and Steve Kim, “Social Network Security Issues: Social
Engineering and Phishing Attack ,“ CSIS, Pace University
, 2012, pp. B1.1 - B1.7.
[3] M. Bezuidenhout, F. Mouton and H. S. Venter,” Social
Engineering Attack Detection Model: SEADM,” IEEE
Conference on Information Security for South Africa,
2010, pp. 1 - 8,
[4] S. H. Gunawardena, D. Kulkarni and B. Gnanasekaraiyer,
“A steganography-based Framework to Prevent Active
Attacks during User Authentication,” 8thInternational
Conference on Computer science & Education (ICCSE),
2013, pp. 383 - 388.
[5] R. S. Rao and S. T. Ali,” A Computer Vision Technique
to Detect Phishing Attacks,” Fifth International
Conference on Communication System and Network
Technologies, 2015, pp. 596 - 601.
[6] C.handnogy and P.willson, “Social Engineering: The Art
of Human Hacking,” Wiley, 2010
[7] J. Chen and C. Guo, “Online Detection and Prevention of
Phishing Attack”, First International Conference on
Communication and Networking in china, chinacom06,
2006, pp. 1 – 7.
[8] B. Zhang, Y. Jiao,Z. Ma, Yongchen Li and Junchao Zhu
“An Efficient Image Matching Method using Speed Up
Robust Features,” IEEE international Conference on
Mechatronicsand Automation(ICMA), 2014, pp. 553-558.

540