Lecture

LESSON 3:
SOCIAL ENGINEERING

SEC 101 – SECURITY AWARENESS

Lesson Objectives:

1. To be aware of the
most common social engineering techniques and the
psychology of influence (for instance: scarcity, urgency
and reciprocity), in order to combat these threats.
2. Understanding the Social Engineering Techniques
3. Understanding the Social Engineering Attacks and to know
how to avoid those attacks.

SEC 101 – SECURITY AWARENESS 1-2

 Social engineering is the art of
manipulating people so they give up
confidential information. The types of
information these criminals are seeking can Criminals use social engineering tactics because it is
vary, but when individuals are targeted the usually easier to exploit your natural inclination to trust than
criminals are usually trying to trick you into it is to discover ways to hack your software. For example, it
giving them your passwords or bank is much easier to fool someone into giving you their
information, or access your computer to password than it is for you to try hacking their password
secretly install malicious software–that will (unless the password is really weak).
give them access to your passwords and
bank information as well as giving them
control over your computer.

SEC 101 – SECURITY AWARENESS 1-3

 Security is all about knowing who and Ask any security professional and they will tell you that the
what to trust. It is important to know when weakest link in the security chain is the human who accepts a
and when not to take a person at their word person or scenario at face value. It doesn’t matter how many
and when the person you are communicating locks and deadbolts are on your doors and windows, or if have
with is who they say they are. The same is guard dogs, alarm systems, floodlights, fences with barbed wire,
true of online interactions and website usage: and armed security personnel; if you trust the person at the gate
when do you trust that the website you are who says he is the pizza delivery guy and you let him in without
first checking to see if he is legitimate you are completely
using is legitimate or is safe to provide your
exposed to whatever risk he represents.
information?

SEC 101 – SECURITY AWARENESS 1-4

 What Does a Social Engineering Attack Look
Like?
Taking advantage of your trust and curiosity, these
Email from a friend
messages will:
If a criminal manages to hack or socially  Contain a link that you just have to check out–and
engineer one person’s email password they have because the link comes from a friend and you’re
access to that person’s contact list–and because curious, you’ll trust the link and click–and be infected
most people use one password everywhere, they with malware so the criminal can take over your
probably have access to that person’s social machine and collect your contacts info and deceive
networking contacts as well. them just like you were deceived
Once the criminal has that email account  Contain a download of pictures, music, movie,
under their control, they send emails to all the document, etc., that has malicious software embedded.
person’s contacts or leave messages on all their If you download–which you are likely to do since you
friend’s social pages, and possibly on the pages of think it is from your friend–you become infected. Now,
the person’s friend’s friends. the criminal has access to your machine, email account,
social network accounts and contacts, and the attack
spreads to everyone you know. And on, and on.

SEC 101 – SECURITY AWARENESS 1-5

 EMAIL FROM ANOTHER TRUSTED SOURCE

Phishing attacks are a subset of social engineering strategy that imitate a trusted source and
concoct a seemingly logical scenario for handing over login credentials or other sensitive personal
data. According to Webroot data, financial institutions represent the vast majority of impersonated
companies and, according to Verizon's annual Data Breach Investigations Report, social
engineering attacks including phishing and pretexting (see below) are responsible for 93% of
successful data breaches.

SEC 101 – SECURITY AWARENESS 1-6

 USING A COMPELLING STORY OR
PRETEXT, THESE MESSAGES MAY:
Urgently ask for your help. Your ’friend’ is stuck in
country X, has been robbed, beaten, and is in the Present a problem that requires you to "verify" your
hospital. They need you to send money so they can get information by clicking on the displayed link and
home and they tell you how to send the money to the providing information in their form. The link location
criminal. may look very legitimate with all the right logos, and
Use phishing attempts with a legitimate-seeming content (in fact, the criminals may have copied the exact
background. Typically, a phisher sends an e-mail, IM, format and content of the legitimate site). Because
comment, or text message that appears to come from a everything looks legitimate, you trust the email and the
legitimate, popular company, bank, school, or phony site and provide whatever information the crook is
institution. asking for. These types of phishing scams often include a
Ask you to donate to their charitable fundraiser, or warning of what will happen if you fail to act soon
some other cause. Likely with instructions on how to because criminals know that if they can get you to act
send the money to the criminal. Preying on kindness before you think, you’re more likely to fall for their
and generosity, these phishers ask for aid or support for phishing attempt.
whatever disaster, political campaign, or charity is
momentarily top-of-mind.

SEC 101 – SECURITY AWARENESS 1-7

Notify you that you’re a ’winner.’ Maybe the email
claims to be from a lottery, or a dead relative, or the
millionth person to click on their site, etc. In order to
give you your ’winnings’ you have to provide Pose as a boss or coworker. It may ask for an update on
information about your bank routing so they know how an important, proprietary project your company is
to send it to you or give your address and phone currently working on, for payment information
number so they can send the prize, and you may also be pertaining to a company credit card, or some other
asked to prove who you are often including your social inquiry masquerading as day-to-day business.
security number. These are the ’greed phishes’ where
even if the story pretext is thin, people want what is
offered and fall for it by giving away their information,
then having their bank account emptied, and identity
stolen.

SEC 101 – SECURITY AWARENESS 1-8

 BAITING SCENARIOS
These social engineering schemes know that if you dangle something people want, many people will take
the bait. These schemes are often found on Peer-to-Peer sites offering a download of something like a hot new
movie, or music. But the schemes are also found on social networking sites, malicious websites you find
through search results, and so on.

Or, the scheme may show up as an amazingly great deal on classified sites, auction sites, etc.. To allay
your suspicion, you can see the seller has a good rating (all planned and crafted ahead of time).

People who take the bait may be infected with malicious

software that can generate any number of new exploits against
themselves and their contacts, may lose their money without
receiving their purchased item, and, if they were foolish enough
to pay with a check, may find their bank account empty.

SEC 101 – SECURITY AWARENESS 1-9

 RESPONSE TO A QUESTION
YOU NEVER HAD
Criminals may pretend to be responding to your ’request for help’ from a company while also
offering more help. They pick companies that millions of people use such as a software company or bank.
If you don’t use the product or service, you will ignore the email, phone call, or message, but if you do
happen to use the service, there is a good chance you will respond because you probably do want help
with a problem.
For example, even though you know you didn’t originally ask a question you probably a problem
with your computer’s operating system and you seize on this opportunity to get it fixed. For free! The
moment you respond you have bought the crook’s story, given them your trust and opened yourself up for
exploitation.
The representative, who is actually a criminal, will need to
’authenticate you’, have you log into ’their system’ or, have you
log into your computer and either give them remote access to
your computer so they can ’fix’ it for you, or tell you the
commands so you can fix it yourself with their help–where some
of the commands they tell you to enter will open a way for the
criminal to get back into your computer later.

SEC 101 – SECURITY AWARENESS 1-10

 CREATING DISTRUST
Some social engineering, is all about creating distrust, or starting conflicts; these are often carried
out by people you know and who are angry with you, but it is also done by nasty people just trying to
wreak havoc, people who want to first create distrust in your mind about others so they can then step in as
a hero and gain your trust, or by extortionists who want to manipulate information and then threaten you
with disclosure.
This form of social engineering often begins by gaining access to an
email account or another communication account on an IM client, social
network, chat, forum, etc. They accomplish this either by hacking, social
engineering, or simply guessing really weak passwords.
 The malicious person may then alter sensitive or private
communications (including images and audio) using basic editing
techniques and forwards these to other people to create drama,
distrust, embarrassment, etc. They may make it look like it was
accidentally sent, or appear like they are letting you know what is
’really’ going on.
 Alternatively, they may use the altered material to extort money
either from the person they hacked or from the supposed recipient.

SEC 101 – SECURITY AWARENESS 1-11

 There are literally thousands of variations to social engineering attacks.
The only limit to the number of ways they can socially engineer users
through this kind of exploit is the criminal’s imagination. And you may
experience multiple forms of exploits in a single attack. Then the
criminal is likely to sell your information to others so they too can run
their exploits against you, your friends, your friends’ friends, and so on as
criminals leverage people’s misplaced trust.

SEC 101 – SECURITY AWARENESS 1-12

 DON’T BECOME A VICTIM

While phishing attacks are rampant, short-lived, and need only a few
users to take the bait for a successful campaign, there are methods for
protecting yourself. Most don't require much more than simply paying
attention to the details in front of you. Keep the following in mind to
avoid being phished yourself.

SEC 101 – SECURITY AWARENESS 1-13

 TIPS TO REMEMBER

Don’t let a link be in control of where you land. Stay in control

Slow down. Spammers want you to act first and
by finding the website yourself using a search engine to be sure
think later. If the message conveys a sense of
you land where you intend to land. Hovering over links in email
urgency or uses high-pressure sales tactics be
will show the actual URL at the bottom, but a good fake can still
skeptical; never let their urgency influence your
steer you wrong.
careful review.
Email hijacking is rampant. Hackers, spammers, and social
Research the facts. Be suspicious of any
engineers taking over control of people’s email accounts (and
unsolicited messages. If the email looks like it is
other communication accounts) has become rampant. Once they
from a company you use, do your own research.
control an email account, they prey on the trust of the person’s
Use a search engine to go to the real company’s
contacts. Even when the sender appears to be someone you
site, or a phone directory to find their phone
know, if you aren’t expecting an email with a link or attachment
number.
check with your friend before opening links or downloading.

SEC 101 – SECURITY AWARENESS 1-14

 Beware of any download

If you don’t know the sender personally AND expect a file from them,
downloading anything is a mistake.

Foreign offers are fake

If you receive an email from a foreign lottery or sweepstakes, money

from an unknown relative, or requests to transfer funds from a foreign country
for a share of the money it is guaranteed to be a scam.

SEC 101 – SECURITY AWARENESS 1-15

 WAYS TO PROTECT YOURSELF
Set your spam filters to high. Every email program
has spam filters. To find yours, look at your settings
Delete any request for financial information or options, and set these to high–just remember to
passwords. If you get asked to reply to a message with check your spam folder periodically to see if
personal information, it’s a scam. legitimate email has been accidentally trapped
Reject requests for help or offers of help. Legitimate there. You can also search for a step-by-step guide
companies and organizations do not contact you to to setting your spam filters by searching on the
provide help. If you did not specifically request name of your email provider plus the phrase ’spam
assistance from the sender, consider any offer to ’help’ filters’.
restore credit scores, refinance a home, answer your Secure your computing devices. Install anti-virus
question, etc., a scam. Similarly, if you receive a request software, firewalls, email filters and keep these up-
for help from a charity or organization that you do not to-date. Set your operating system to automatically
have a relationship with, delete it. To give, seek out update, and if your smartphone doesn’t
reputable charitable organizations on your own to avoid automatically update, manually update it whenever
falling for a scam. you receive a notice to do so. Use an anti-phishing
tool offered by your web browser or third party to
alert you to risks.
SEC 101 – SECURITY AWARENESS 1-16