social engineering methods

Social engineering is a non-technical way for a criminal to collect information on a target. It is an art of gaining entrée to buildings, systems, or data by exploiting human psychology instead of breaking in or using technical hacking techniques.

For example, instead of finding software vulnerability, a social engineer might call an employee and act as an IT support person, trying to dodge the employee into exposing his password.  A social engineer usually manipulates people into breaking standard security rules and best practices to gain access to systems, networks, and physical locations or for financial gain.

Social engineers often use the People’s willingness but also victimize people on their weaknesses. For example, an attacker calls to authorize an employee with an urgent problem that requires immediate network access. Using name-dropping techniques, the attacker can request the employee’s pride and raise authority. These are some types of social engineering attacks:

Type of Social Engineering

Pretexting

When an attacker calls someone and lies to them to gain access to confidential data, for example, it involves an attacker who pretends to get personal or financial data to confirm the recipient’s identity.

Quid pro quo

When a social engineer requests personal information from a party in exchange for something, it is a quid pro quo. For example, a hacker calls random numbers within an organization and pretends to be calling back from tech support. Ultimately, the attacker will find someone with a real issue who they will then pretend to help. The attacker finds the target, target information, and password through this.

Baiting

When an attacker leaves a device infected with malware, such as a USB drive, Then someone finds the USB, finder then picks up the device and loads it onto a computer, accidentally installing the malware.

Water-holding

When a criminal attempts to compromise a specific group of people by infecting websites with malware that targets users accessing the website.

Diversion theft

The social engineers trick a delivery or courier company into going to the wrong pickup or drop-off place, thus intercepting the transaction.

Honey trap

The social engineer has shown himself as an attractive person who interacts with a person online, fakes an online relationship, and gathers sensitive information through that relationship.

Tailgating Piggybacking

Tailgating is also known as piggybacking. Piggybacking is a physical security breach where an unauthorized person follows an authorized person to enter a secured premises.

Rogue

Rogue security software is a type of malware that tricks targets into paying for the fake removal of malware.

Phishing, Spear Phishing, Vishing, and Scareware – we have already discussed these types.

Social Engineering Tactics

There are several tactics in social engineering tactics, including:

• Intimidation– The secretary of a senior official receives a call stating that her/his boss is about to give an important presentation, but the required file is corrupt. The cybercriminals ask for the file to be sent to them via email or other mail.
• Consensus– Criminals create a site with fake testimonials promoting a product, indicating it is safe.
• Scarcity and Urgency – Criminals usually offer a limited opportunities, and People will take action when they think there is a limited quantity or a limited time and become victims
• Familiarity/Liking– People to do what another person asks if the victims like that person.
• Trust– Criminals build a relationship with a victim. For example, as a security expert criminal calls the victim offering advice and help. While helping, the criminals get important information from the victim’s computer.