(The Art of Psychological Manipulation)
Definition:
Social Engineering is the application of psychological tricks to deceive, influence, and manipulate individuals into disclosing private or sensitive information by taking specific activities. In this kind of cyber-attack, social engineers take advantage of human weaknesses rather than vulnerabilities in technology.
In this article, we shall examine Social Engineering, its mechanisms/common techniques, and the steps we may take to safeguard ourselves against being potential victims.
Common types of Social Engineering
Social Engineers use the underlisted popular tactics below in carrying out their fraudulent activities:
i. Phishing
Phishing is the practice of scammers sending fake emails, messages, or webpages that appear to be from reputable businesses or individuals you know, such as your bank or a well-known internet service. These fraudulent messages frequently trick you into revealing private information, such as your credit card PIN or password, by claiming and making you think that you need to take an urgent action on a particular matter.
Example: When you receive an email into your inbox claiming to be from your bank, asking you to click on a link to resolve an issue with your account. After clicking, the link directs you to a fake website that imitates the design of your original bank, but the actual purpose is to illegally obtain your login credentials.
ii. Smishing
Smishing is essentially phishing via text messages. Scammers send text messages that appear to come from reliable sources, requesting that you click a link or provide personal information. Most times, the link directs you to a fake website, or they may ask you to reply with some kind of confidential data.
For example; When you receive a text message claiming that you have won a prize and that you must click a link to claim it. You click the link out of excitement, only to have it download malicious software to your phone or ask for personal data.
iii. Pretexting
This is a situation whereby a fraudster fabricates a story in order to win your trust and obtain personal information from you. In order to give credibility to his/her story, they might appear as a significant other or familiar person, such as a coworker or an official.
For instance, you get a call from someone posing as an IT officer of your organisation, asking for your password to fix a computer issue. You might offer your password to them because they sound genuine and professional.
iv. Baiting
The whole point of baiting is to entice you with something alluring so that you would accept the bait. Scammers may give away hazardous free downloads or keep a USB stick contaminated with malware in a location where people are likely to find it.
Example: Lets say you discover a USB drive in your office break room which is labeled “Secret documents.” Out of curiosity to see what really is in it, you plug it into your computer and in few seconds, malware is installed unknowingly to you, thereby granting the attacker access to your files and vital documents.
v. Quid Pro Quo
This is in the form of offering anything in exchange for information. Fraudulent individuals will promise to offer assistance, products, or advantages if you grant them their requests.
For example: You may receive a call from an impostor claiming they can assist you with troubleshooting your internet connection, but they require remote access to your computer first. By the time you may allow them access believing that they are providing technical support, your data is already compromised or possibly get lost.
Vi. Vishing
Voice phishing, also known as phishing over the phone or simply vishing, is a tactic scammers usually use to trick people into sharing personal information. They may pose as representatives of a bank or government agency and at the same time use fear or a false sense of urgency to get victims to hand over personal information.
Here is a typical example; You get a call from someone claiming to be from your credit card company or bank, alerting you to suspicious activity on your account. They request for your PIN and account number to confirm their identity, but in reality, they are attempting to steal your personal information.
vii. Whaling
This is a kind of targeted attack on high-ranking individuals, such as executives or top government officials. These scams are more convincing and mostly individualized; they frequently use particulars from the victim’s job or organization to give the impression that the fraud is authentic.
Example: A CEO receives an email requesting a fast money transfer from what appears to be a reliable partner in order to seal a lucrative commercial deal. The CEO may accept the email, thinking it is legitimate, and then approve the payment because it makes reference to particular projects or individuals.
Psychology and principles behind Social Engineering
Social Engineering is more effective because it focuses on our natural behaviors: the desire to be helpful, avoiding trouble, obeying authority, and having trust in others. This gets us to behave without fully considering our options, social engineers manipulate us by instilling feelings of urgency, fear, or curiosity.
Imagine someone trying to trick you into disclosing your most private information, and the person doesn’t have to use technical hacking tools rather, they just happen to ask you some properly crafted questions with minimal iota of suspicion. Social engineering is a form of psychological exploitation in which attackers (social engineers) take advantage of your emotional feelings and behavioral actions to extract secret and vital information from you.
In Social Engineering, attacker do not use sophisticated code to breach networks or systems, they hack into your mind to gain trust and persuade you to give them very important information.
Similar to an act of fraud, Social Engineering involves someone trying to lure you into sharing personal information or taking action against what is right. They deceive you using psychological tactics to make you lower your guard. An example can be seen in a scammer calling you and requesting your password under the guise of your bank. A Phishing attempt could be disguised as a legitimate-looking email.
Although, Social Engineering is not a cyber-attack at its core, it is all about the psychology of persuasion and manipulation.
To avoid being a victim as an individual and also as an organization, use caution when opening any kind of attachments or link sent to you. Make sure everything is authentic and from trusted source, use strong passwords and two-factor authentication, update your system software, use antivirus/internet security software, Educate both yourself and other people within an organisation. Recall that social engineering assaults are predicated on human error rather than technical flaws. Therefore, the secret to remaining safe is to be alert and careful all the time.
It is actually not about breaking into or hacking into computers or network systems but all about getting into your mind. You will agree with me that, human’s tendency to make mistakes is higher when we are under pressure or in a hurry.
Below are some psychological elements that makes Social Engineering effective:
- Gaining Trust
People who seem to have a good reason to ask for anything stand a good chance to gaining our trust. Social engineers frequently present themselves as reliable individuals, such as a coworker, an IT support agent, or an official company representative. We are more at ease and ready to assist when this happens.
For instance, you receive a call from someone claiming to be from your bank, requesting your account number or other detail in order to resolve a problem. If you believe the individual is sincerely attempting to assist you, you can decide without hesitation feed that individual with your personal information. - Sense of urgency and Scarcity
We sometimes act without thinking when we believe that something is scarce or when we are pressed for time. To get people to take quick action, Social Engineers instill a sense of shortage or urgency on their victim.
For example; you receive an email warning you that your account will be locked unless you change your password right away. You may click the malicious link and enter your information in a panic mood not realizing that it’s a hoax. - Respect for Authority
Government officials like, police officers, and managers are examples of authority individuals that we are told to obey. Social Engineers know this so they take advantage of this by impersonating authority. When they appear as authority, we are less likely to question their requests.
An example would be if someone sent you an email posing as your boss and requesting private and highly sensitive information. You might react without scrutinizing it right away because it seems to be from someone in a higher position. - Curiosity
Humans are naturally inquisitive; we want to know more about anything that captures our interest or seems to appear strange to us. Social Engineers grab this opportunity and use this curiosity to their advantage. For instance, you come across a USB stick labelled “Top Secret” on the floor. You picked and plug it into your computer out of curiosity, not realizing that it can contain malicious software in it. - Fear
We can act without thinking first when we are afraid. Fear is a tool used by social engineers to manipulate individuals into making sudden decisions.
Take for instance, a threatening message sent to you may claim that you have had your bank account compromised and that you must send information urgently to protect it. Your fear of losing money may cause you to act rashly and share private information.
The Risks
Being a victim of social engineering can have negative consequences such as:
Theft of Identity: They can use your personal information to initiate credit card and loan applications fraudulently in your name.
Data infringements: When private information such as financial or customer details are taken, it can result in serious financial losses as well as harm to one’s reputation.
Operational Chaos: It is possible to restrict or interfere with access to vital systems, which can result in loss of productivity and revenue, customer dissatisfaction, and downtime.
Financial Loss: Fraudulent transactions, ransomware attacks, and scams can cause financial losses for both individuals and corporations.
How to protect yourself against Social Engineering Attacks
- Education and Awareness: Try becoming aware of the strategies adopted by Social Engineers is the best defense against them. It is essential to train both you and your staff to spot suspicious activity and to question unforeseen requests.
- Be Wary of Unsolicited Requests: Whenever you get an unexpected request for information or access, find out more about it by using a different technique. For instance, if you receive a call purporting to be from your bank, end the call and give the bank another call at the number listed on their website.
- Multi-Factor Authentication (MFA): MFA makes account logins require additional steps, including inputting a code that is texted to your phone. Without the second factor, someone can’t access your account even if they manage to get their hands on your password.
- Frequent Security Audits: Examine your security protocols on a regular basis to identify any vulnerabilities. This can assist in preventing social engineers from easily gaining access to your facilities or systems.
- Double Check Links and Attachments: Pause for a second before opening an attachment or clicking on a link. Ask yourself; are i expecting this email at this moment? Does the URL appear strange to you? Use an antivirus program to check attachments or hover over it to view the real URL.
- Restrict Physical Access: Make sure that only authorized personnel may enter secure areas and encourage staff members to confront any strangers they encounter around there.
useful links for more reading resources: (https://www.cisco.com/c/en/us/products/security/what-is-social-engineering.html)
