Social Engineering

Social Engineering is a tool hackers use to extract information without the use of any coding. One common attack is email Phishing. This is often done by appearing to be an authentic source in order to get sensitive information. By gaining enough personal information, a hacker is then able to take advantage of weak security protocols and potentially cause more damage. This can be done in several steps. For example, information gathering>hook>execution.

The information gathering stage relies on using little information to gain more. They will also scout companies that the target is associated with; to see how strong or weak their security protocol is. By this I am referring to how much information those companies will reveal. For example, usually banks have a much more secure protocol. (You’ll find that banks will not be willing to speak to you if get a security question wrong).

However, a utilities company (phone, broadband, water, etc) is more lenient/forgiving in comparison. By identifying an associated company with a weak security protocol, you’ll be surprised how much information you’re able to gather with such little information to start with. The method above is called Vishing, a combination of voice and phishing. The following image is an example of a email phishing attempt.

Email Phishing

I’m sure we all know someone who thought they received an email from HMRC, PayPal or from some type of finance company; saying they were due a refund. Only for them to enter their details and end up hundreds down. This is a prime example of how hackers/scammers will implement social engineering.

By using emails to acquire confidential information. They do this in the hope the target will follow the instructions. This could be by opening a link to their own page; where they can collect further information. Or asking the target to download their evil file; which can have all sorts of spyware. Here are some ways to recognise a fake email.

Scareware

Scareware is created to literally scare victims into downloading malware. Warning messages, such as the one included in this section, pop up. Often with an alarm or automated voice emphasising that something should be done to remove some sort of virus. Or to ‘clean your computer’. They will try to lure you to another website or to download their own software (which often has malware).

The ads are made in a way to make you act quick, so you don’t have time to think about the situation. In order to make you act quickly they will try many things, such as; say you’re infected with all sorts of malware, tell you to act quick or you’ll lose all your documents, make it difficult to close the pop-up, appear to do a scans which say your infected and many more.