5 Types of Social Engineering Attacks

At the root of many ransomware attacks is the art of social engineering, which involves manipulating a person or persons in order to access corporate systems and private information. Social engineering, widely used in ransomware crimes, plays into human nature’s inclination to trust. For hackers, it is the easiest method for obtaining access to a private system. After all, why would anyone spend the time trying to guess someone’s password when they can simply ask for it themselves?

 

Social engineering scams have been going on for years and yet, we continue to fall for them every single day. This is due to the overwhelming lack of basic cybersecurity training available to the employees of today’s organizations big and small. In an effort to spread awareness of this tactic and fight back, here is a quick and dirty overview of today’s most common and deadly social engineering scams. After all, if everyone learns to identify these attacks, avoiding them will be MUCH easier!

 

Phishing

Phishing is the leading form of social engineering attacks that are typically delivered in the form of an email, chat, web ad or website that has been designed to impersonate a real systems and organization. Phishing messages are crafted to deliver a sense of urgency or fear with the end goal of capturing an end user’s sensitive data. A phishing message might come from a bank, the government or a major corporation. The call to actions vary. Some ask the end user to “verify” their login information of an account, and include a mocked-up login page complete with logos and branding to look legitimate. Some claim the end user is the “winner” of a grand prize or lottery and request access to a bank account in which to deliver the winnings. Some ask for charitable donations (and wiring instructions) after a natural disaster or tragedy.

 

Baiting

Baiting, similar to phishing, involves offering something enticing to an end user, in exchange for login information or private data. The “bait” comes in many forms, both digital, such as a music or movie download on a peer-to-peer site, and physical, such as a corporate branded flash drive labeled “Executive Salary Summary Q3 2016” that is left out on a desk for an end user to find. Once the bait is downloaded or used, malicious software is delivered directly into the end users system and the hacker is able to get to work.

 

Quid Pro Quo

Similar to baiting, quid pro quo involves a hacker requesting the exchange of critical data or login credentials in exchange for a service. For example, an end user might receive a phone call from the hacker who, posed as a technology expert, offers free IT assistance or technology improvements in exchange for login credentials. Another common example is a hacker, posed as a researcher, asks for access to the company’s network as part of an experiment in exchange for $100. If an offer sounds too good to be true, it probably is quid pro quo.

 

Pretexting

Pretexting, the human equivalent of phishing, is when a hacker creates a false sense of trust between themselves and the end user by impersonating a co-worker or a figure of authority well known to an end user in order to gain access to login information. An example of this type of scam is an email to an employee from what appears to be the head of IT Support or a chat message from an investigator who claims to be performing a corporate audit.

 

Piggybacking

Piggybacking, also called tailgating, is when an unauthorized person physically follows an authorized person into a restricted corporate area or system. One tried-and-true method of piggybacking is when a hacker calls out to an employee to hold a door open for them as they’ve forgotten their RFID card. Another method involves a person asking an employee to “borrow” his or her laptop for a few minutes, during which the criminal is able to quickly install malicious software.

 

 

For all employees to be aware of the various forms of social engineering is essential for ensuring corporate cybersecurity. Aside from education and awareness, there are other ways to reduce the risk of being hacked. Employees should be instructed not to open emails or click links from unknown sources. Computers should never be shared with anyone, even for a moment. By default, all company desktops, laptops and mobile devices should automatically lock when left idle for longer than 5 minutes (or less).

 

Lastly, ensure your business is prepared to quickly recover from this kind of attack in case an employee does fall victim to one of these schemes. Humans are humans after all. By leveraging a solid backup and recovery solution, everyone can rest easy.

 

Interested in learning more about keeping your business safe from ransomware? Contact us here: https://www.styglerit.com/contact-us/