Social engineering: definition and examples of attacks 

Social engineering in cybersecurity focuses on manipulating, influencing or tricking people into revealing sensitive information through different tactics. 

The aim of this cyberattack is to compromise digital security by deceiving people with elaborate persuasive techniques that play on their trust, curiosity or fear, depending on the method used.

In this article, you will discover the definition of social engineering, some examples of how its attacks work, as well as useful recommendations so that you can protect yourself.

Definition of social engineering

Social engineering is a fraud in which criminals psychologically manipulate people into revealing confidential information or performing actions that compromise the security and integrity of their data.

The objective is always the theft of access credentials to networks, systems, infrastructures, or the appropriation of sensitive information.

Since it is not an attack on infrastructures to detect technical vulnerabilities, some people do not consider it a cyberattack in the strict sense of the term, even more so when this type of fraud can be carried out digitally, but also physically.

However, by compromising digital security, it can be considered as such, since it is, moreover, in the digital environment where they are thriving with increasing creativity.

What social engineering works

Social engineering uses different methods of persuasion to deceive its victims and obtain personal data, or financial, administrative or sensitive information.

Here are some of the most common tactics:

• Impersonating trusted brands or authoritative government agencies in emails, cell phone messages, online notifications, etc.
• Impersonating a friend or family member of the victim through social networks or other channels and requesting participation in surveys or sending links to fake websites or virus attachments.
• Creating a sense of urgency in the victim so that by acting in haste they do not take the necessary protective measures.
• Appealing to people’s greed, who fall for the lure of supposed millionaires or people in trouble who offer them money or any kind of benefit in exchange for a favor.

6 types of social engineering attack and examples

The modus operandi of cybercriminals is becoming more and more elaborate, so it is necessary to know some of the types of social engineering attack they use, which we will reveal in the following sections.

Phishing

Phishing uses people’s trust in brands, entities, organizations or other people.

An example of this is when a cybercriminal sends you an email pretending to be your bank. It asks you to click on a fraudulent link that takes you to a web page that looks like your bank’s, and where you are asked to enter your credit card details with any kind of excuse.

When the message is sent by SMS it is known as smishing, and if a voice message is used it is called vishing. When the attacks are personalized, being the victim a person or a specific company, they are known as spear phishing.

Baiting

This consists of sending you an offer of a product or service for a limited time or free software with the intention of installing malware on your computer or stealing your personal data.

A recurring scam is to leave an infected USB flash drive within reach of people who, when they insert it into their computer, activate it.

Pretexting

In pretexting, the offender creates a story based on elaborate lies to deceive his victim and obtain sensitive information from him.

The attacker makes his target believe that he urgently needs certain information from the victim to perform a critical task.

For example, he may impersonate a company’s IT service technician and ask an employee for his credentials to check the security of the system.

Quid pro quo

As the name suggests, the cybercriminal offers a service or product in exchange for some kind of information.

This is the case when a criminal impersonates an Internet provider to offer an improvement in data transmission speed, for which he will need the person’s access to a personal or professional network.

Scareware

This is where fear comes into play. The attacker displays fake virus alerts to provoke the victim to download malicious software.

It can happen when a pop-up alert is activated on your terminal warning you of a virus and urging you to download an antivirus to fight it. In reality, it is a program that steals or encrypts all kinds of information.

Watering hole attack

It focuses on deceiving a group of people who frequently visit a web page of services or product sales.

The name refers to the predators that lurk in the watering holes of their victims, to give you an idea.

How can you protect yourself from social engineering?

While it is true that you will never be 100% safe from a social engineering cyberattack, it is equally true that you can protect yourself by incorporating the following recommendations into your digital hygiene:

• Verify the legitimacy of all requests for sensitive information. According to the Federal Emergency Management Agency (FEMA), this simple measure can prevent you from falling victim to a social engineering attack.
• Familiarize yourself with the most common social engineering tactics to recognize them and avoid falling for their ploys. In this regard, it is essential to train children and employees on what actions to avoid in order to protect themselves.
• Minimize the amount of sensitive information and personal data published, especially on social networks or untrusted platforms and applications.
• Establish hierarchical access to information, with access controls adapted to each level of user who must access any type of program or virtual space owned by you. For example, this could be the case for a cloud infrastructure, billing software, etc.
• Use access control policies such as multifactor authentication. This involves adding at least two methods to certify your identity on any platform with which you exchange personal data or sensitive information.

At Smowltech we are very aware of the importance of security in your project, that’s why our proctoring plans provide innovative and effective tools to protect the integrity of information and users privacy.

Ask for a free demo so we can show you all the solutions we can offer you.