Social Engineering

Social Engineering

1. Phishing

   • Phishing is the act of trying to deceive somebody to give up personal information/sensitive data such as bank details. This can be done in three avenues;
     • Email ( most common method ) - These emails can sometimes look legitimate and typically use malicious links. After clicking the link, you might be directed to a fake website, malware may be secretly installed on your computer, or your browser may be hijacked. Email phishing typically targets many people at a time because it is easy and inexpensive.
     • Telephone ( second most common method ) - A person calls from "IT support", and mentions about your computer being infected. The person then requests you go to a special support website to fix your computer, however this website often secretly installs malware onto your computer.
     • In person ( the least common method ) - Involve a person imitating a technician of sorts that sells a fake story to gain unauthorized access to your facilities.

2. Spear phishing

   • Spear phishing is phishing that targets an individual or a small group of people. More sophisticated than mass phishing attacks; attackers know more about their targets and gain more if the target is compromised.

3. Whaling

   • Whaling is a type of spear phishing that targets high-profile individuals, such as executives at public companies. Whaling attackers often take pains to learn a lot about their targets, as successful attacks can yield higher gains.

4. Vishing

   • Vishing is the official term for phishing via telephone. The goal is to gain sensitive or personal information from the person answering the phone.

5. Tailgating

   • Tailgating is when someone follows an authorized person into a restricted area, without providing their own credentials. Not effective at small companies as all employees know one another, however at large companies it is more likely. Tailgating attacks are dangerous because they give attackers physical access to your environment and computers. Attackers can leave infected USB sticks in key locations or attempt to take over computers. This problem is being tackled with some companies requiring each employee to swipe their badge, even if they arrive at the same time.

6. Impersonation

   • An impersonation attack is an attack where a malicious person attempts to impersonate a legitimate person or entity. Impersonation attacks can occur over email, over the web or in person. An attacker could register a domain name similar to the original of which may go unnoticed in email or when visiting a website.

7. Dumpster diving

   • Attackers sift through trash dumpsters looking for personal or sensitive information that they could use to carry out spear phishing or other attacks or enable them to steal somebody's identity. Electronic waste such as disk drives, USB sticks and backup tapes. Shred all sensitive documents and physically destroy all electronic storage before you discard it.

8. Shoulder surfing

   • When a person secretly watches the computer screen or keyboard of another user. An easy way to obtain passwords, logon methods and other sensitive information. A dangerous attack that often goes unnoticed.

9. Hoax

   • A hoax is a false claim to entice somebody to take a desired action. An attacker might claim that you have won something or that they want to buy something from you so you will provide personal information. To prevent, be sceptical when you see or hear something that seems too good to be true or unusual.

10. Watering hole attack

    • Targets a specific company. The attacker learns of websites that the company frequents (their watering holes) and attempts to place malware on those sites in hopes that someone at the company will get infected.