Social Engineering is The Art of What Three Things?

Last Updated on 2 months by Touhid

Social engineering is a type of manipulation that exploits human psychology, rather than technological hacking techniques to gain or unauthorized access to a computer system. In this post, we’ll discuss on social engineering is the art of what three things, its attacking techniques and prevention methodology.

Social Engineering Is The Art Of What Three Things?

Social engineering attackers take benefit of people’s weaknesses, and faith and influence individuals to visit a vulnerable website or click a malicious link. Now, social engineering is the art of what three things?  So, the things are as follows:

• Manipulating
• Influencing and
• Deceiving

Manipulating

In the context of information security, social engineering is the art of psychological manipulation. Psychological manipulation is a type of social influence or skilful control by an attacker that aims to change the behaviour of victims.

It uses various tactics such as psychological abuse, brainwashing and emotional blackmail so they (victims) give up their sensitive information. It is also known as emotional manipulation.

Influencing

Influencing is another important social engineering art of things, which affect others (victims). Social engineering influences the victims using various tactics and then, gains the victim’s trust and gets unauthorized access to sensitive information and resources.

Deceiving

Social engineering is the art of what three things? The last essential social engineering art of things is deceiving, where the attacker sends an authentic message to the victims. The message seems to be from one of your trusted service providers or from your office, asking you to send personal information.

The message prompts victims to provide their personal information such as usernames, passwords, credit card information and network credentials.

The attacker also provides a link which redirects victims to a malicious website to capture their sensitive information and login credentials.

Social Engineering Attack Techniques

In the above, we have defined social engineering is the art of what 3 things. Now, we will explain social engineering attacking techniques. There are few social engineering attacking tactics, where human interaction is involved. The most common social engineering attacking methods are as follows:

• Phishing
• Spear Phishing
• CEO Fraud
• Vishing
• Pretexting
• Baiting
• Tailgating

Phishing

Phishing is a most common social engineering attack where attackers gain or unauthorized access to sensitive and confidential information such as usernames, passwords, credit card information and network credentials.

The most common form of phishing techniques are as follows:

Phishing Technique 1: In this technique, the attackers send an email message to victims which seems to be a trusted message and ask victims to send their personal information.

Phishing Technique 2: In this technique, attackers send an email message to victims with a URL link. The URL is almost a legitimate link but when hovering over the links it redirects to a vulnerable website.

The redirection site has a serious vulnerability or malware script to gather personal information which is unknown to victims.

Learn more about Phishing attacks.

Spear Phishing

Spear phishing is another social engineering attack that attempts to unauthorized access and steal sensitive information from a specific victim.

Spear Phishing Technique

In this technique, the attacker sends an email or message to the victim with the victim’s data such as name, designation, email, contact number and address.

The reason for including this personal information is to gain the victim’s confidence and, therefore compromise and access the confidential information they (the attacker) are looking for.

Learn more about How to protect Spear Phishing attacks?

CEO Fraud

CEO Fraud is a type of email-based phishing attack in which the attacker acts as your senior company executive to gain access to sensitive data or steal funds or login credentials.

CEO Fraud Technique

In this attacking technique, the attacker sends an email and uses the name of your company CEO but uses another email address.

The attacker’s domain email address is very similar to your company’s email domain except few different letters such as cyberthratprtal.com instead of cyberthreatportal.com. The main target of CEO fraud phishing (attackers) is the company’s finance department.

Vishing

Vishing is a social engineering attack which is a combination of ‘voice’ and ‘phishing’. Already we have discussed phishing attacks. Now, a vishing attack is the illegitimate access of data via VoIP (Voice over Internet Protocol).

It can be conducted by regular phone calls or voice email and requesting to send the victim’s bank account details and also requesting to pay some money. It is very difficult to trace the vishing attack because it occurs within a very short time.

Vishing Technique

One of the most common techniques of vishing attack is as follows:

For example, you will get a phone call with the following message:

“Your account has been compromised. Please call this number to reset your password”.

The vishing perpetrator (Visher) hopes that you will fear after hearing the above message.

In that case, when you call the number, the visher will leave and you hear an automated recording informing you that your bank account has been compromised and asking for information such as bank account numbers and other sensitive information.

Pretexting

Pretexting is another social engineering technique where attackers focus on creating an excellent pretext or a fabricated situation to gain sensitive information from victims.

Typically, faith or trust is one of the most significant aspects of social engineering. So, a strong pretext is an important element in creating trust.

That’s why; to build trust in victims, pretexters (criminals) can impersonate survey firms, police officers, bankers, tax authorities, insurance companies, and audit firms.

Pretexting Technique

Pretexters use different types of strategy to steal victim’s personal information. For example, a pretexter may call the victim a police officer, and ask the victim some questions. In these attacks, the pretexter usually says they need some personal information to verify their (victim’s) identity.

The personal information can be Social Security numbers (SSN), usernames, passwords or other sensitive information. If victims provide his/her information, then pretexter will take action for secondary attacks.

Baiting

Baiting is other types of social engineering which uses a fake promise of a product to attract victim’s interest. They (attacker) bait users into a trap and then steal victim’s sensitive information or damage their systems with malware.

Baiting Technique

In that case, the baiter (cyber-criminal) will give up the malware-infected flash drive in an eye-catching area where victims can easily find them such as bathrooms, elevators, reception desk, and parking place a targeted company.

When curious users plug it into their system and open the flash drive then they compromise their system with the attacker.

Tailgating

In tailgating attack, an attacker looking for entry to a confined area, where access is controlled by electronic access control (e.g. RFID Card) and the attacker has no proper authentication.

The main focus of this type of social engineering attack is to gain unauthorized physical access to the restricted area.

Tailgating Technique

The attacker can simply walk in behind an authorized person who has access to that area. In that case, an attacker impersonates a delivery man to deliver the parcels and waits until a legitimate employee opens their door.

When the employee opens the door, the attacker asks that the employee hold the door, to enter the company.

Prevention of Social Engineering Attacks

Already we have discussed what is social engineering, social engineering is the art of what three things and its attacking techniques.

Now, we will focus on how to prevent social engineering attacks. Here are some useful tips on how to prevent social engineering attacks:

Never Provide Personal Information

Don’t share your personal or organization-sensitive information such as login credentials, network information, or credit card details over the internet to protect from social engineering.

If you want to secure your personal information from phishing and malware attacks, then you should apply the following useful tips:

Tips

• First, check whether the website is trusted or not.
• Don’t provide your information on an unknown site.
• Do not share your login credentials with others.
• Use strong and unique passwords.
• Do not use the same password for multiple accounts.

Delete Suspicious Email And Do Not Click

A suspicious e-mail  may contain a virus or malware to redirect you to a phishing website to hack your sensitive information.

Tips

• To avoid phishing emails, just delete which raises confusion.
• Do not click on that type of suspicious email.
• If your incoming email is suspicious then you can direct a phone call to the sender to confirm as he sends the mail.
• Or, simply delete the email and you can also mark it as spam.

Use Antivirus Software

Antivirus software is a program that helps to protect your computer from virus and malware threats.

Tips

• To protect from viruses and malware you should use professional anti-virus software such as Norton, Bitdefender, Kaspersky, Panda, ESET, Avast, and AVG.
• Keep up to date with the latest version.

Never Download Software From Unreliable Sites

It is strongly recommended that download software and apps from trusted sources to prevent social engineering attacks. So, don’t download the software, or apps from unknown sites because these sites may contain viruses or malware which will infect your computer.

Tips

A trusted website is secure by SSL (Secure Socket Layer) certificate. In URL, it will start with https:// such as: https://cyberthreatportal.com/.

Don’t Browse Untrusted Websites

Don’t visit untrusted websites because the untrusted websites may contain viruses and malware. So, to protect from social engineering attacks you should avoid browsing untrusted websites.

Tips

A trusted website is secure by SSL (Secure Socket Layer) certificate. In URL, it will start with https:// such as https://cyberthreatportal.com/.

Enter Personal Information Only On Secure Website

If you need to provide your sensitive or financial information on a site, then you have to make sure that the site is secure with SSL (Secure Socket Layer) certificate.

In URL, it will start with https:// such as: https://www.google.com/.

Up To Date Operating System

The operating system of your computer has important security functions that can help to protect it from social engineering attempts.

Tips

Steps on how to update the operating system:

• Start button > click control panel > system and security > and click Windows Update.
• Click Check for updates, if updates are found, then click Updates.

Check The Correctness Of Email Addresses

Social engineering scammers typically sending phishing emails, which look like valid or official emails. However, if you scrutinize closely then, you’ll miss something such as:

• An email will end in “.com” or others as it should, but the address may end differently.
• For example, you will get a phishing email from “businesscom.work” instead of “business.com”
• The attacker has included “com” in the domain name to fool you.

So, you should check or examine the email address very carefully.

Conclusion

Social engineering is an attack that manipulates people into breaking normal security and gaining access to systems, networks or physical systems. We have discussed on Social engineering is the art of what three things, its attacking techniques and helpful prevention tips. Hope this article will be helpful for you!!!