Scribd
Upload
138 views7 pages

Attack Techniques & Prevention: Social Engineering

This document discusses social engineering attacks and how to prevent them. It describes common social engineering techniques like phishing, spear phishing, baiting, pretexting, and tailgating that manipulate users into revealing sensitive information or installing malware. While social engineering relies on human error rather than software vulnerabilities, organizations can reduce risk through employee training, secure email practices, using security tools, and following physical security procedures.

Uploaded by

Vyankatesh Muley
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
138 views7 pages

Attack Techniques & Prevention: Social Engineering

This document discusses social engineering attacks and how to prevent them. It describes common social engineering techniques like phishing, spear phishing, baiting, pretexting, and tailgating that manipulate users into revealing sensitive information or installing malware. While social engineering relies on human error rather than software vulnerabilities, organizations can reduce risk through employee training, secure email practices, using security tools, and following physical security procedures.

Uploaded by

Vyankatesh Muley
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 7

Social Engineering

Attack Techniques & Prevention

Social engineering attacks include phishing, CEO fraud,

ransomware, spear phishing, and more. Learn about

different attack methods and how you can manage this

ongoing problem.

Hacker Combat LLC


Social engineering is the term used for a

broad range of malicious activities

accomplished through human interactions. It

uses psychological manipulation to trick

users into making security mistakes or giving

away sensitive information.

What makes social engineering especially

dangerous is that it relies on human error ,


rather than vulnerabilities in software and

operating systems. Mistakes made by

legitimate users are much less predictable,

making them harder to identify and thwart

than a malware-based intrusion.

Hacker Combat LLC


Though social engineering is rather non-technical, it’s one

of the major threats that organizations face today. Using

social engineering tactics, hackers manage to break into

networks of large companies and organizations and get

away with loads of confidential data- sensitive personal

data and corporate data as well.

To be remembered is the fact that cybercriminals who carry

out social engineering attacks exploit either the

weaknesses of users or their natural helpfulness. These

hackers would come up with messages that make appeals

for help but actually designed to infect the user’s

system/device with malware and steal data.

Social engineering thrives by exploiting fear, greed,

helpfulness, curiosity etc, which could lead users to open

emails, click on links, download attachments etc. This could

eventually lead to malware infection, stealing of data etc.

Hacker Combat LLC


Different Kinds Of Social Engineering Attacks:

Phishing:
Phishing, as we know, is one of the most popular kinds of

cyberattacks. A hacker would communicate with a user,

pretending to be or disguised as a legitimate, trusted

person and tricking the user into opening malicious emails,

clicking on malicious links etc. The most popular mode

adopted is email. Email phishing scams involve the sending

of emails that would seem to come from legitimate sources-

banks, insurance firms, clients, government agencies etc.

Once the user opens such an email, he would be tricked

into clicking on a link or downloading an attachment. He

would be told that it’s important to do so, in order to pay a

fine, make a renewal, re-confirm his address etc. The user

may even be asked to fill a form with personal details. The

unsuspecting user would follow the instructions, and this

would ultimately lead to a data breach or malware

installation in his system/device.

Phishing attacks are also carried out via phone calls, instant

messengers, the social media etc. The call or message

would urge the user to make a donation for a charity or to

help someone affected by a natural disaster, but the real

intentions would definitely be malicious.


Spear Phishing:
Spear phishing is a more targeted kind of phishing attack in

which a hacker uses personal information pertaining to a

user to gain trust and make things look legitimate. Thus, a

hacker, using information that he has gathered from the

victim’s social media accounts or other online activities,

would send an email that the victim would take for a

legitimate one. Thus, those behind spear phishing attacks

manage to get more successful compared to other general

phishing attacks.

Baiting:

The name says it all! Hackers could leave, as some kind of a

bait, a CD or a USB flash drive, in a place where someone

would easily find it. Curiosity would lead the person who

finds it to try opening it and consequently, unknown to that

person, malware would be installed in the system.

Pretexting:
A hacker would fabricate some false circumstances, pretend

to be in need of some information and thus make a user

provide access to critical, protected systems or divulge

sensitive data.

An example of such an attack is a hacker pretending to be

someone from a company’s IT department and asking the

victim (some employee of the company) to grant computer

access or give out login credentials.


Tailgating:

An unauthorized person following an authorized user into

an otherwise secure area – that’s what tailgating (or

piggybacking) is.

Thus, a person impersonating as a delivery guy can get

some employee who is making his entry to hold the door for

him. Then, after entering the premises, he could go to the

data room or gain access to some system and thus gain

access to the network.

Tailgating can also be mixed with baiting; a person who

tailgates can leave a USB drive or CD that could ultimately

be used for a social engineering attack.

Quid pro quo:

Quid pro quo attacks involve hackers asking for sensitive

information in exchange for a benefit. It could be a gift,

the promise of some services etc.

For example, a hacker can get some login credentials in

exchange for a gift and then use the data to gain access

to a whole network itself.


How To Prevent Social Engineering
Attacks
Since social engineering attacks are on the rise, it’s important

that organizations adopt measures to counter them. Some

basic things that can be done to prevent social engineering

attacks include:

Educating employees as regards the common types of

social engineering attacks, prevention strategies etc.

Training employees as regards adopting prevention

strategies.

Ensuring that emails from untrusted sources are not

opened.

If emails that seem to be coming from known sources

contain any content that raises suspicion (like asking

for personal data), it’s always best to contact the

sender directly and ascertain things.

Ensuring that no user gives in to temptations or

divulges details after yielding to curiosity, greed etc.

Ensuring that computers and laptops are locked when

someone moves away.

Using antivirus/antimalware software, data monitoring

tools, email filters etc and ensuring proper firewall

protection.

Having a clear idea about the company’s privacy

policy as it would help prevent things like tailgating,

baiting etc.

You might also like