Social Engineering

Prior to performing social engineering attack, an attacker gathers information about the target organization from various sources such as:

Official websites of the target organizations, where employees’

IDs, names, and email addresses are shared

◆

Advertisements of the target organization through the type of print media required for high-tech workers trained in Oracle

◆

databases or UNIX servers Blogs, forums, etc. where employees share basic personal and organizational information.

◆

attack using various approaches such as impersonation, piggybacking, tailgating, reverse social engineering, and so on.

• Social engineering is an art of manipulating people to divulge sensitive information to perform some malicious action. Despite security policies, attackers can compromise organization’s sensitive information using social engineering as it targets the weakness of people. Most often, employees are not even aware of a security lapse on their part and reveal organization’s critical information inadvertently. For instance, unwittingly answering the questions of strangers and replying to spam email.

A social engineer uses the vulnerability of human nature as their most effective tool.

Usually, people believe and trust others and derive fulfillment from helping the needy.

Discussed below are the most common targets of social engineering in an organization:

• Receptionists and Help-Desk Personnel: Social engineers generally target service-desk or help-desk personnel of the target organization by tricking them into divulging confidential information about the organization. To extract information, such as a phone number or a password, the attacker first wins the trust of the individual with the information. On winning their trust, the attacker manipulates them to get valuable information. Receptionists and help-desk staff may readily share information if they feel they are doing so to help a customer.
• Technical Support Executives: Another target of social engineers are technical support executives. The social engineers may take the approach of contacting technical support executives to obtain sensitive information by pretending to be a senior management, customer, vendor, and so on.

responsible for maintaining the systems and thus he/she may have critical information such as the typical version of OS, admin passwords, and so on, that could be helpful for an attacker in planning an attack.

• Users and Clients: Attackers could approach users and clients of the target organization, pretending to be a tech support person to extract sensitive information.
• Vendors of the Target Organization: Attackers may also target the vendors of the organization to gain critical information that could be helpful in executing other attacks

Social engineering does not seem to be a serious threat, but it can lead to heavy losses for organizations. The impact of social engineering attack on organizations include:

• Economic Losses: Competitors may use social engineering techniques to steal sensitive information such as development plans and marketing strategies of a target company, which can result into a economic loss to the target company.
• Damage to Goodwill: For an organization, goodwill is important for attracting customers. Social engineering attacks may damage that goodwill by leaking sensitive organizational data.
• Loss of Privacy: Privacy is a major concern, especially for big organizations. If an organization is unable to maintain the privacy of its stakeholders or customers, then people can lose trust in the company and may discontinue the business association with the organization. Consequently, the organization could face losses.

pose a threat to an organization’s

assets - people and property.

Terrorists may use social engineering techniques to make blueprints of their targets to infiltrate their targets.

• Lawsuits and Arbitration: Lawsuits and arbitration result in negative publicity for an organization and affects the business’s performance.
• Temporary or Permanent Closure: Social engineering attacks can result in loss of goodwill. Lawsuits and arbitration may force a temporary or permanent closure of an organization and its business activities.

• Natural human tendency to trust others is the basis of any social engineering attack
• Ignorance about social engineering and its effects on the workforce makes the organization an easy target
• Fear of severe losses in case of non-compliance with the social engineer’s request
• Social engineers lure the targets to divulge information by promising something for nothing (greediness)
• Targets are asked for help and they comply with as a moral duty

These are human behaviours that attackers take advantage of:

• Trusting nature People naturally trust others, which makes it easier for attackers to trick them.
• Lack of awareness If employees don’t understand social engineering, they won’t recognize attacks.
• Fear and pressure Attackers may scare victims (e.g., “you’ll lose your job”) to force quick decisions.
• Greed or temptation Promises like free rewards or money can trick people into sharing information.
• Willingness to help People often feel morally obligated to help, even when they shouldn’t.

Many factors make companies vulnerable to social engineering attacks, some of them are as follows:

• Insufficient Security Training Employees can be ignorant about social engineering tricks used by an attacker to lure them into divulging sensitive data about the organization. Therefore, the minimum responsibility of any organization is to educate their employees about social engineering techniques and the threats associated with them to prevent social engineering attacks.
• Unregulated Access to the Information For any company, one of the main assets is its database. Providing unlimited access or allowing everyone an access to the sensitive data might land them in trouble. Therefore, companies must ensure proper surveillance and training to key personnel accessing the sensitive data.

different geographic locations making it difficult to manage the system. On the other hand, it becomes easier for an attacker to access the organization’s sensitive information.

• Lack of Security Policies Security policy forms the foundation of security infrastructure. It is a high-level document describing the security controls implemented in a company. An organization should take extreme measures related to every possible security threat or vulnerability. Implementation of certain security measures, such as password change policy, information sharing policy, access privileges, unique user identification, and centralized security, prove to be beneficial.

Like other techniques, social engineering does not deal with network security issues instead, it deals with the psychological manipulation of the human being to extract desired information. Following are the reasons why social engineering continues to be effective:

• Despite various security policies, preventing social engineering is a challenge because human beings are most susceptible to variation.
• It is challenging to detect social engineering attempts. Social engineering is the art and science of manipulating people into divulging information. And using this trick, attackers sneak into an organization’s vault of information.
• No method guarantees complete security from social engineering attacks.
• No specific hardware or software is available to safeguard from social engineering attacks.
• This approach is relatively easy to implement and free of cost

• In a social engineering attack, the attacker uses social skills to trick the victim into disclosing personal information such as credit card numbers, bank account numbers, phone numbers, or confidential information about their organization or computer system, and use them to either launch an attack or to commit fraud. Social engineering attacks are categorized into three parts: human-based, computer-based, and mobile-based.
• Human-based Social Engineering

Human-based social engineering involves human interaction. On the pretext of a legitimate person, the attacker interacts with the employee of a target organization to collect sensitive information about the organization such as business plans, network, etc. that might help him/her in launching an attack. For example, impersonating as an IT support technician, the attacker can easily access the server room.

• Eavesdropping
• Shoulder Surfing
• Dumpster Diving
• Reverse Social Engineering
• Piggybacking
• Tailgating
• Vishing((voice or VoIP phishing) )

Computer-based social engineering relies on computers and Internet systems to carry out the targeted action.

Following techniques can be used for computer-based social engineering:

• Phishing
• Spam mail
• Instant chat messenger
• Pop-up window attacks

• Attackers use mobile applications to carry out mobile-based social engineering. Attackers trick the users by imitating popular applications and creating malicious mobile applications with attractive features and submitting them with the same name to the major app stores. Users unknowingly download the malicious app, and thus malware infects the device.
• Listed below are techniques an attacker uses to perform mobile-based social engineering:
• Publishing malicious apps
• Repackaging legitimate apps
• Using fake security applications
• SMiShing (SMS Phishing)

An insider is any employee (trusted person) having access to critical assets of an organization. An insider attack involves using privileged access to violate rules or intentionally cause a threat to the organization’s

information or

information systems. Insiders can easily bypass security rules, corrupt valuable resources, and access sensitive information. It is difficult to figure out an insider attack. Insider attacks may also cause great loss to the company.

About 60% of attacks occur from behind the firewall. It is easier to launch an insider attack, and preventing such attacks is difficult.

Insider attacks are generally performed by:

• Privileged Users: Attacks may come from most trusted employees of the company such as managers, system administrators, who have access to company’s confidential data, with a higher probability to misusing the data, either intentionally or unintentionally.
• Disgruntled Employees: Attacks may come from unhappy employees or contract workers. Disgruntled employees, who intend to take revenge on their company, first acquire information, and then wait for the right time to compromise the organization’s resources.

• Accident-Prone Employees: Accidentally if an employee has lost his device or an email is send to incorrect recipients or system loaded with confidential data is left logged-in, leads to unintentional data disclosure.
• Third Parties: Third parties like remote employees, partners, dealers, vendors, etc. have access to company s information. Security of the systems ’ used by them and about the persons accessing company s information is ’ unpredictable.
• Undertrained Staff: A trusted employee becomes an unintentional insider due to lack of cyber security training. He/she fails to adhere to cyber security policies, procedures, guidelines, and best practices

Reasons for Insider Attacks

• Financial Gain An attacker performs insider threat mainly for financial gain. The insider sells sensitive information of the company to its competitor, steals a colleague’s financial details for personal use, or manipulates companies or personnel financial records.
• Steal Confidential Data A competitor may inflict damage to the target organization, steal critical information, or put them out of business, by just finding a job opening, preparing someone to get through the interview, and having that person hired by the competitor.
• Revenge It takes only one disgruntled person to take revenge and your company is compromised. Attacks may come from unhappy employees or contract workers with negative opinions about the company.

start their own competing business and by using company’s confidential data. These employees may access and alter

clients list.

company’s

• Perform Competitors Bidding Due to corporate espionage, even the most honest and trustworthy employees are forced to reveal company’s critical information by offering them bribery or through blackmailing.
• Public Announcement

A disgruntled employee may want to announce a political or social statement and leak or damage company’s

confidential

data.

• Social engineers exploit human behavior (manners, enthusiasm toward work, laziness, innocence, etc.) to gain access to the targeted company’s information resources. Social engineering attacks are difficult to guard against, as the victim might not be aware that he or she has been deceived. They are very much similar to other kinds of attacks used to extract the company’s valuable data. To guard against social engineering attacks, a company needs to evaluate the risk of different kinds of attacks, estimate possible losses, and spread awareness among its employees. This section deals with countermeasures that an organization can implement to be more secure against social engineering attacks

• Netcraft Source: http://toolbar.netcraft.com

The Netcraft Toolbar provides updated information about the sites users visit regularly and blocks dangerous sites. The toolbar provides you with a wealth of information about the sites you visit. This information will help you make an informed choice about the integrity of those sites.

Features:

• Protect your savings from Phishing attacks
• Observes the hosting location and risk rating of every website visited (as well as other information)
• Helps in defending the Internet community from fraudsters
• Checks if a website supports Perfect Forward Secrecy (PFS)
• Observes if a website is affected by the aftermath of the Heartbleed vulnerability
• PhishTank Source: http://phishtank.com

PhishTank is a collaborative clearinghouse for data and information about phishing on the Internet. It provides an open API for developers and researchers to integrate anti-phishing data into their applications.