What Is Social Engineering?

Phishing

Phishing is the most common type of social engineering attacks. Attackers steal confidential personal or company information through emails, voice calls, instant messages, online ads, or fake websites.

Phishing can be successful because the fake information and deception appear highly authentic, making it easy for victims to overlook risks and significantly increasing the success rate of social engineering attacks. In addition, phishing often makes victims feel a sense of urgency, fear, or curiosity, directing their focus on the fabricated information for a short period of time so that they become too pre-occupied to verify the authenticity of the information.

The following is an example:

A victim received an email from a bank claiming an account risk and requiring information such as name, ID card number, mobile phone number, bank card number, and bank card password for account security purposes. However, this is not an email sent by the bank, but a phishing email sent by an attacker. To add to the deception, the attacker may also set up a fake bank website that looks real enough to convince the victim to log in, exposing their key personal information. The victim, fearing a monetary loss, would not carefully verify the authenticity of the information in the email or website, thereby falling into the trap.

Spear Phishing

Spear phishing is a targeted form of phishing. Common phishing is relatively random: Attackers cast a wide net without specific details on their victims, disseminating information widely in the hope that a few will fall for the scam. In contrast, spear phishing focuses on specific victims, such as enterprise executives or network administrators, to customize a highly effective phishing scheme based on the characteristics, positions, contacts, and other information of the victims. Such techniques improve the success rate of social engineering attacks.

The following is an example:

A victim who frequently browses car-related websites receives an email that appears to come from a popular automobile website. The email promotes a review of the latest car model and includes a link for more details. Since the topic is highly relevant, the victim is very likely to click, thereby falling into the attacker's trap.

Baiting

As the name suggests, this social engineering approach exploits people's desire for rewards to lure them into a trap. While this approach is similar to phishing in many aspects, baiting emphasizes on the benefits to trap victims.

The bait can be physical or virtual (after all, we are now in the digital era).

Most physical baits are transmitted in the form of storage media. For example, a USB flash drive may be used as bait. Most people assume that a USB flash drive given as a free gift is empty. Attackers take advantage of this mentality to embed malicious programs that—when plugged into a computer—would infect the system. There is a more dramatic form of deception, in which the USB flash drive is left in a conspicuous location (such as the company lobby or washroom) with eye-catching labels (such as salary details). Out of curiosity, many people would be enticed to take a peek, not knowing that they would become exposed to the attackers.

Virtual bait is much simpler. Attackers only need to design something that looks attractive, for example, links to websites that promise free gifts or links to attractive activities. Victims' curiosity or desire leads them to click, allowing malicious programs to compromise their systems.

Watering Hole

The name of watering hole comes from nature, where predators wait near the water source to ambush other animals that come for a drink, increasing the predator's chance of success in hunting.

Based on their research, attackers identify the websites frequented by the victims (usually a specific group) and implant malicious programs on these websites. When victims access these compromised websites, their computers become infected. In fact, many large websites pay a great deal of attention to network security to prevent themselves from being exploited by attackers, as failure to do so would erode user trust and severely damage their reputation. Therefore, many attackers prefer to exploit small and medium websites or websites lacking advanced technologies and funds. Users must exercise caution when visiting such websites.

Vishing and Smishing

Vishing and smishing are phishing attacks that are conducted over the phone, either through calls or SMS messages. The two techniques often target elderly victims who are unfamiliar with the Internet and are therefore less susceptible to email-based attacks.

This group of people are also unaware of attackers' deceptive tactics, and so are especially vulnerable. Many attackers use robots to make the phone calls, as advanced robots can now almost perfectly imitate humans, which significantly improves the efficiency of attackers.

Pretexting

For pretexting, attackers assume a false identity to deceive victims. The attacker usually disguises as a person in authority to compel the victims to provide important information as instructed.

The following is an example:

An attacker impersonates a law enforcement officer to gain the trust of a victim, and then asks the victim to provide some personal information for identity verification. Eventually, the victim would provide the required information, which may be used for identity theft or secondary attacks.

Quid Pro Quo

Quid pro quo attacks rely on offering information or services in exchange, tricking victims into disclosing sensitive personal data. Similar to baiting, quid pro quo also claims to bring benefits to victims, usually in the form of services, while baiting usually takes the form of physical objects.

The following is an example:

Attackers call victims pretending to be IT support personnel that can provide technical support or software upgrades. In this case, they require the victims to provide their account information to gain temporary access permissions. Once victims disclose such information, attackers can exploit it to launch further attacks or steal sensitive data.

Malware

Malware tricks victims into believing that malicious software has been installed on their computers, and convinces them that it can only be removed if they follow the attackers' instructions.

Attackers often demand a payment from victims before claiming to remove the malware. In fact, even if the victims follow the attackers' instructions, the attackers may carry out further exploitations. For example, they might take advantage of this process to obtain key personal information and even install malware.

Tailgating and Piggybacking Attacks

Tailgating attacks are also called piggybacking attacks. For these attacks, an unauthorized person enters a restricted area or system with the authorization of another person.

The following are some common examples:

• An attacker enters a restricted area by closely following the victim as the victim enters.
• An attacker pretends to be an employee who forgets to bring an identity card and asks another employee or doorkeeper to open the door.
• An attacker pretends to borrow a victim's computer and quickly installs malware.