Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery for information gathering or computer system access and in most cases the attacker never comes face-to-face with the victim.
All social engineering techniques are based on flaws in human logic known as cognitive biases. These bias flaws are used in various combinations to create attack techniques, some of which are listed here:
Pretexting
Pretexting is the act of creating and using an invented scenario (the pretext) to persuade a target to release information or perform an action and is typically done over the telephone. It's more than a simple lie as it most often involves some prior research or set up and the use of pieces of known information (e.g., for impersonation: date of birth, Social Security Number, last bill amount) to establish legitimacy in the mind of the target.
This technique is often used to trick a business into disclosing customer information, and is used by private investigators to obtain telephone records, utility records, banking records and other information directly from junior company service representatives. The information can then be used to establish even greater legitimacy under tougher questioning with a manager (e.g., to make account changes, get specific balances, etc).
As most U.S. companies still authenticate a client by asking only for a Social Security Number, date of birth, or mother's maiden name, the method is effective in many situations and will likely continue to be a security problem in the future.
Pretexting can also be used to impersonate co-workers, police, bank, tax authorities or insurance investigators - or any other individual who could have perceived authority or right-to-know in the mind of the target. The pretexter must simply prepare answers to questions that might be asked by the target. In some cases all that is needed is a voice of the right gender, an earnest tone and an ability to think on one's feet.
Voice over IP programs are starting to become a standard in pretexting, as the absence of a traceable number makes the pretexter less vulnerable to being caught.
Phishing
Phishing is a technique of fraudulently obtaining private information. Typically, the phisher sends an email that appears to come from a legitimate business - a bank, or credit card company - requesting "verification" of information and warning of some dire consequence if it is not done. The letter usually contains a link to a fraudulent web page that looks legitimate - with company logos and content - and has a form requesting everything from a home address to an ATM card's PIN.
IVR/phone phishing
This technique uses a rogue Interactive voice response (IVR) system to recreate a legitimate sounding copy of a bank or other institution's IVR system. The victim is prompted (typically via a phishing email) to call in to the "bank" (via a provided toll free number) and verify information. A typical system will continually reject logins ensuring the victim enters PINs or passwords multiple times. More advanced systems will even transfer the victim to the attacker posing as a customer service agent for further questioning.
Trojan horse/gimmes
Gimmes take advantage of curiosity or greed to deliver malware. Also known as a Trojan Horse, gimmes can arrive as an email attachment promising anything from a "cool" or "sexy" screen saver, an important anti-virus or system upgrade, or even the latest dirt on an employee. The recipient is expected to give in to the need to see the program and open the attachment. In addition, many users will blindly click on any attachments they receive that seem even mildly legitimate.
Road apple
A road apple is a real-world variation of a Trojan Horse that uses physical media and relies on the curiosity of the victim. The attacker leaves a malware infected floppy disc , CD ROM or USB flash drive in a location sure to be found (bathroom, elevator, sidewalk), gives it a legitimate looking and curiosity piquing label, and simply waits.
For example: An attacker might create a disk featuring a corporate logo , readily available off the target's web site, and write "Executive Salary Summary Q1 2007" on the front. The attacker would then leave the disk on the floor of an elevator or somewhere in the lobby of the target company.
An unknowing employee might find it and subsequently insert the disk into a computer to satisfy their curiosity, or a good samaritan might find it and turn it in to the company.
In either case as a consequence of merely inserting the disk to see the contents, the user would unknowingly install malware on their computer, likely giving an attacker unfettered access to the target company's internal computer network .
This method often uses "Autorun" systems so the user's computer is compromised the second the media is inserted.
Note that the term 'Road Apple' has been re purposed from an older use meaning horse manure.
Quid pro quo
Something for something:
- An attacker calls random numbers at a company claiming to be calling back from technical support. Eventually they will hit someone with a legitimate problem, grateful that someone is calling back to help them. The attacker will "help" solve the problem and in the process have the user type commands that give the attacker access and/or launch malware .
- In a 2003 information security survey, 90% of office workers outside of their building gave away what they claimed was their password in answer to a survey question in exchange for a cheap pen.
