1. Social Engineering
Charniece Craven
COSC 316

2. Outline What is social engineering? Common goals of social engineers
Techniques
What to do if you have become a victim of social engineering
How to avoid being socially engineered

3. Social Engineering
The psychological manipulation of “bugs in the human hardware”.
False motive; individual lies to gain unauthorized data
Attacks that take advantage of flawed human judgment by convincing the victim to take actions that are counter to security policies.
Although technology can provide many protections, it is very hard to protect against human misjudgment
Manipulates the victims trust to make breaking in their system easier

4. Goals of social engineers
3 common goals that many social engineers want to achieve are:
Gathering information to guess the password(s) of the victim
Identity theft- the thief impersonates the victim sufficiently well to engage in large financial transactions (i.e. taking out large loans or making expensive purchases in the name of the victim)
Credit card number theft- the thief learns the credit card number, card owner’s name, expiration date, and three-digit card verification number in order to make purchases until the stolen card is invalidated

5. Techniques
The various social engineering techniques are based on specific attributes of cognitive biases and are exploit in various combinations. The most common forms of social engineering are:
Pretexting
Phishing
Spear phishing
Baiting
Tailgating
Spam
Hoaxes
Shoulder surfing
Impersonation

6. Pretexting
Usually involves some prior research of the victim and uses the information for impersonation
Individual pretends to need information in order to confirm the identity of the person they are talking to in hopes of forming trust
Ask a sequence of questions strategically to gain significant individual identifiers (i.e., Social Security Number, Date of Birth, Account Number, etc.)

7. Phishing
Usually carried out by authentic looking , instant messaging, or website
Appeal broadly to many people in order to trick as many people as possible
Sending an to a user falsely claiming to be an legitimate company in order to scam an individual into submitting confidential information that may be used for identity theft
Looking for vulnerable users and tricking them into thinking they are getting something that they are not

8. Spear phishing
Similar to fishing; uses an or website to trick you
Different from phishing because the comes from someone who appears to be apart of your organization
Aimed at specific individual or group of people and often contains personal details in order to appear more believable
Contains specific details that only a trusted person is likely to know

9. Baiting
Similar to a real-world Trojan Horse; virus is disguised to be legitimate data
Uses physical media and relies on the curiosity or greed of the victim
the social engineer leaves a legitimate looking CD or flash drive infected with malware in hopes that the person uses the device

10. Tailgating Also known as piggybacking
When someone who is not authorized gains entry to a restricted area by following closely behind someone who is authorized
People often hold the door for someone without knowing whom the individual is or asking where they are going

11. Spam Unwanted commercial e-mail
Sending useless information and viruses out in hopes to get a response
If a response is obtained useless information and viruses continue to be sent out

12. Hoaxes Malicious deception
Deception: an act intended to trick people into believing something is real when it is not (Bing Dictionary)
A knowingly fabricated misrepresentation told in order to hide the truth
Try to persuade the victim to damage their own system

13. Shoulder Surfing Direct observation technique
Looking over someone's shoulder to get sensitive information
Very effective in crowded places

14. Impersonation Can occur in person, over the phone or on-line
Pretending to be someone that you are likely to trust
Manipulates our natural thoughts to trust that people are who they say they are

15. What to do if you’ve been socially engineered
Report it to the appropriate personnel within the organization (i.e. network administrators)
Constantly check for suspicious or unusual activity (i.e. unexplainable charges to an account)
Change all password and usernames if possible
Close any accounts that may have been compromised.

16. Avoiding Social Engineering Attacks
Do not disclose personal information
Be suspicious of unsolicited phone calls, visits, s, etc.
Pay attention to the URL of websites
NEVER share your password

17. Resources