Social Engineering Grade 8

Define the term Social Engineering

• occurs when a cybercriminal creates a social situation that can lead to a potential victim dropping their guard.

• It involves the manipulation of people into breaking their normal security procedures and not following best practice.

• is malicious code installed on a user’s computer or on an infected website.

• occurs when a cybercriminal sends out legitimate-looking emails to users.

Is social engineering manipulating of people and breaking into security network systems?

• Disagree

• False

• True

• Not sure

List 5 social engineering threats

• Instant Messaging

• Fake Anti Virus Software

• Email Phising Scams

• Baiting & Phone Calls

The cybercriminal leaves a malware-infected memory stick somewhere where it can be found; the finder picks up the memory stick and plugs it into their computer (just to see who it belongs to) and unwittingly downloads malicious malware (relies on user curiosity)

• Phone Call

• Baiting

• Email Phishing Scams

• Instant Messaging

For example, a so-called IT professional calls the user on their mobile claiming their device has been compromised in some way; the user is advised to download some special software that allows the cybercriminal to take over the user’s device giving them access to personal information (relies on fear

• Baiting

• Instant Messaging

• Email Phishing Scams

• Phone Calls

The user is tricked by the apparent genuineness of an email and opens a link in the email; this redirects their browser to a fake website (relies on user’s trust of well-known companies

• Fake Anti Virus Software

• Phone Call

• Email Phishing Scams

• Baiting

Malicious links are embedded into instant messages; for example, an important software upgrade (relies on user’s curiosity

• Email Phishing

  Scams

• Phone Calls

• Instant Messaging

• Baiting

How does the hacker exploit human emotions in social engineering ?

• fear – the user is panicked into believing their computer is in immediate danger and isn’t given time to logically decide if the danger is genuine or not; fear is a very powerful emotion that can easily be exploited by a cybercriminals

• curiosity – the user can be tricked into believing they have won a car or they find an infected memory stick lying around; their curiosity gets the better of them and they give their details willingly to win the car (for example, credit card details to pay for delivery or road tax) or they are curious who the memory stick belongs to; without thinking clearly, their curiosity gets the better of them and the damage is done

• empathy and trust – a real belief that all genuine-sounding companies can be trusted, therefore emails or phone calls coming from such companies must be safe; a dangerous assumption that the cybercriminal can exploit fully

• Taking the user to lunch