Socially Engineered Attacks: What They Are and How to Prevent Them

Social engineering generally implies influencing a person into taking an action they wouldn’t otherwise. As such, malicious social engineering within cybersecurity refers to manipulating humans to access private information or restricted systems.

A 2020 report by Verizon estimated 22% of confirmed data breaches involved social engineering attacks, which are scams based on psychological manipulation that fall under cyber crime. For this reason, they are also sometimes known as human hacking.

Most common people are vulnerable to these attacks because of lack of awareness, which helps the hackers deceive unknowing targets.

Common Socially Engineered Attacks

Socially engineered attacks have been around since the early days of computer networks. Over the years, they have developed into a few popular scams. These include not just fraudulent calls or messages but elaborate websites, cleverly crafted emails, and even in-person and physical scams.

Phishing attacks

Phishing attacks involve pretending to be a trusted authority to get the information needed to recover credentials and ultimately gain access to protected data.

Two popular methods attackers use include spam phishing and spear phishing. Spam phishing is a general message shot across widespread users in an attempt to catch someone. In contrast, spear phishing, or whaling, is more targeted and is often aimed at people with higher authority.

Phishing attacks could use voice, SMS, or emails leading to fraudulent links. Although, a more recent method, called angler phishing, takes place on social media, where an attacker will pose as a company representative and channel your interactions to himself.

Other methods include search engine phishing, which tries to rank malicious links on a search engine, and URL phishing, which directs you to a malicious website through hidden links that have either been deceptively spelled or that promises to give free access to information.

Baiting attacks

Baiting attacks do precisely as the name suggests. They typically involve offering links with access to anything from freebies to promissory posts, which lure users into opening these links, either out of greed or curiosity. Once lured in, the attacker can infect the user’s system with malware and gain access to sensitive data and networks.

Attackers are even known to use physical media, in which they leave something like a flash drive in a public area, where you wouldn’t suspect any malicious intentions. And when you try to plug it into your system, it spreads malware to your system.

Scareware

Scareware refers to any cyberattack that poses a fictitious threat and demands urgent action. The solution offered is, in fact, the attacker’s attempt at infecting your device or network with malware by downloading malicious software to your device or taking you to a fraudulent site.

It commonly appears as pop-ups that talk about antivirus expiration, infection, or detection of harmful spyware. Although, it may also spread through the circulation of certain emails. Often, it is intended to make you buy unnecessary software or act as malicious software itself.

Spamming

Email spamming is the oldest way for hackers to use online social engineering. It is ideally filtered into your junk inbox by your email provider. Unfortunately, spam is more than just an annoyance. Malicious spam can be dangerous if it slips through the filters into your inbox.

Also read: Email Security Tips to Prevent Phishing and Malware

Tailgating

Tailgating is physically accessing a restricted area through ill means. The most direct example involves entering a door that needs authentication by simply sneaking behind someone with access. Although, tailgating can include any similar means such as chatting with the reception staff or pretending to be a delivery driver.

Pretexting

In pretexting, an attacker sometimes impersonates someone in a critical position, such as a bank officer or an IT member. Here, the scam often begins with harmless questions that escalate to questions regarding sensitive information. Then, under the pretext of confirming the victim’s identity, the attacker can collect information such as social security numbers, phone numbers, or bank records.

Measures against Social Engineering

Social engineering is based on psychological factors such as our cognitive biases. The most commonly identifiable traits of any socially engineered scam are urgency and over-friendliness.

You can take certain measures to prevent unwanted access to your information, including:

Security tools

While no tool is perfect, most are efficient against a bulk of scams. Moreover, with regular updates and support, they can form the first line of defense against unwanted access.

• Keep your anti-malware and antivirus software up to date.
• Set spam filters to high safety.
• Use internet security solutions.
• Make internet security mandatory on official devices.

Passwords

You can level up your security by taking simple steps like choosing a strong password and updating it regularly.

• Don’t use the same password for multiple accounts.
• Never share your password.
• If you think your password is compromised, change it at the earliest.
• Consider using two-step authentication.

Devices

A single compromised device can make a secure network vulnerable. Take appropriate measures to ensure your devices are not open on public networks or that there are no unidentified devices on your network.

• Don’t leave your devices unsecured in public.
• Always lock your screens when leaving your desks.

Network

Some of the easiest ways to secure your data can occur at the network level.

• Never let strangers connect to your primary Wi-Fi. Instead, enable the use of guest Wi-Fi.
• Use a VPN to fend against people trying to circumvent your security solutions.
• Secure all the devices connected to your network.

Personal

The common denominator of all attacks is human psychology. Teams should be trained to be actively on the lookout for an attempt at a socially engineered attack.

• Always check the credibility of the number or email through which you are being contacted.
• In physical situations, always ask for an ID and ensure your employees wear their IDs somewhere visible.
• Make tailgating a serious offense.
• Look out for unexpected behavior by a caller, such as urgency, pressure, or attempts to scare you into divulging certain information.

Others

To stay on top of cyber threats, make sure to incorporate other methods of security.

• Educate your employees about security measures and design relevant policies.
• Do a regular check of  known data breaches.

Social Engineering: A Constant Threat

In 2020, the Twitter accounts of Elon Musk, former U.S. President Obama, and U.S. President Biden were hacked to push crypto sales. This proves that no one is safe from social engineering scams, not even tech giants or celebrities.

Social engineering is the shortest way for someone to access your devices. While stealing your credentials would consume time and effort, someone could get the necessary information over a phone call, email, or even an in-person meeting. As digital security improves, social engineering may be the easy way out for attackers.

You and your security teams should remain proactive about emerging threats and measures, as the technology available to security engineers is also available to cyber criminals.

Cyberattacks can be a costly affair for the victim organization. However, you can take necessary measures to reduce the chances and impact of an attack. Preparedness will also allow you to spot a breach and recover fast.

Read next: Cybersecurity Awareness for Employees: Best Practices