Social engineering: The art of deception

Individuals and companies alike face a growing cyberthreat now that information flows freely and sensitive data is often just a simple click away. This threat, known as social engineering, does not rely on advanced software or sophisticated hacking tactics.It's a deceitful technique that uses psychological manipulation to target human behavior and emotions as opposed to computer flaws and vulnerabilities.

We will dig further into the field of social engineering, look at what it is, how it can look, and how to protect yourself and your business against falling for these devious tricks.

We have a blog post on the six principles of social engineering here.

Fundamentally, social engineering is a technique for accessing important data, systems, or geographical locations by taking advantage of people's psychological tendencies. It's the art of deception, in which attackers employ a variety of strategies to persuade targets to:

Share sensitive information.
Do activities that are opposite to their interests.
Grant unauthorized access.

Social engineering preys on the weakest link in the security chain: people. Traditional hacking concentrates on exploiting software or hardware flaws whereas social engineering targets the people behind the technology.

In order to understand social engineering, we need to understand the fundamental psychological concepts that hackers use in order to be successful in their attacks. Some important psychological elements that social engineering relies on include:

Trust and positive evaluation: People often have a tendency to put their faith in other people or other authoritative persons that they like and respect. Hackers often adopt a trustworthy persona to trick targets into exposing private information.
Fear has the potential to blur a victim's judgment and increase the likelihood of impulsive, mindless behavior. Threats and intimidation are used by attackers to create a sense of urgency and coerce their victim into compliance.
Curiosity: Humans are inherently curious creatures, and attackers typically use this characteristic to lure victims into clicking on malicious links or downloading infected files.
Social acceptance: People tend to follow others and carry out the actions they see or hear others do. Hackers can take advantage of this by referring to other persons in their phishing e-mails, and that is often someone the victim knows.
Lack of knowledge: Many people are not aware of the numerous social engineering techniques used by attackers, which leaves them open to manipulation.

There are many different types of social engineering, and each has its own set of strategies and goals. Some of the most typical methods of social engineering are:

Phishing attacks involve creating fake emails, messages, or websites that look like legitimate organizations in an effort to fool recipients into sharing private information, such login credentials or financial information.
In pretexting, the attacker fabricates a situation or pretext in order to convince the target to share sensitive data. They can use persuasive methods to get information while imitating an official figure or organization.
Baiting attacks persuade people by offering them something they want, such as a free download or software update - but what they are really getting is malware. Once the victim accepts the bait, the attacker has access to the victim's computer.
Tailgating, often referred to as piggybacking, is the act of physically following a person who has access to a particular place. The perpetrators take advantage of people's inherent politeness to hold the door or not ask questions when they enter secure areas or structures, even with people they don't know have authorization or not.
Quid pro quo: In these types of attacks, the hacker provides something of value, like technical assistance or a gift, in exchange for access to or knowledge of sensitive information. To influence the target, they use the principle of reciprocity; you get something, then I get something.
Impersonation: Hackers may imitate trustworthy employees, service providers, or other people in order to get information or access restricted areas.

To give you a better understanding of how social engineering can look like, we’ve gathered a few examples of the devious methods:

Exploiting a safe website

In this case, attackers choose a website that their target audience often browses and then breach it by installing malware onto that website - or make a fake website that either looks exactly like the genuine or one that relies on typos, this is also known as typosquatting. Users' devices are thus hacked when they access the malicious website without paying particular attention to the website.

CEO Fraud

Attackers impersonate high-ranking executives within an organization, usually via email, and ask staff members for urgent wire transfers or sensitive data under the impression that the employees are doing it at the direction of their superior.

Tech Support Scams

Scammers call people and tell them that their computer is infected with malware while posing as a representative from a respectable tech support business. Then, the victims are instructed to download software to "help" solve their problem - this software is malicious software that, therefore, will either install viruses or infect the device.

Pharming

Attackers hack routers or change the DNS (Domain Name System) settings to redirect users to fake websites that look legitimate. Unknowingly, victims provide these fraudulent websites personal information that hackers then can sell on the dark web or exploit for financial gain.

Common for all of them is, that the hackers impersonate people or organizations we trust. That is why social engineering is even more devious than other types of cybercrime.

Protecting Yourself and Your Organization

Given how common social engineering attacks are, it is crucial to be informed and vigilant when fighting them. The following tactics can help you and your company improve your cybersecurity.

First and foremost, education and awareness training is key to staying one step ahead of the hackers. With training, you learn how to spot phishing and social engineering characteristics and thus circumvent the malicious files and links. Secondly, it’s important to keep your systems updated. Even though social engineering targets the human and exploits human error, we need to have a safety net if we should fail to discover the phishing. So, our technology should be as safe and secure as possible - you ensure this by updating your software and devices, so they have all the recent patches and security updates.

You should also be cautious about any unsolicited messages and calls - especially if they request personal and sensitive information. A good rule of thumb is to verify the person you’re communicating with before providing any information.

Next, it’s recommended that you use MFA (multi-factor authentication). This adds an additional layer of security to your accounts and devices. It makes it more difficult for the hackers to force their way into your account since they would need this additional authentication.

Lastly, your physical security is essential as well. You can implement different security measures to your workplace such as keycards, security badges, access control systems. This way you make sure that no unauthorized people can access your workplace and offices. You should thus report any suspicious activity - both physical and online. Creating awareness of this suspicion minimizes the risk of being exploited. Once organizations know that this is a risk, many implement security audits to be updated on security risks and flaws - which can be fixed before they are exploited by malicious actors.

In a cyberworld

A dangerous threat known like social engineering preys on people's emotions to take advantage of their weaknesses. Attackers continue to modify their strategies as technology advances, making it necessary for people and organizations to remain vigilant and educated about the various types of social engineering and cyberthreats.

We can all protect ourselves against the ever-evolving cyberthreat landscape by understanding the thinking behind these attacks and implementing strong (cyber)security measures in our lives. Keep in mind that knowledge is your strongest weapon in the cyberworld, and that being cautious can help you prevent even the most ingenious attackers.