Social Engineering
Unit 3: Threat Actors and Vectors. Lesson 12 of 54 in SecPlus Academy.
The easiest way through a firewall is to ask an employee to open it. Social engineering attacks people rather than systems, using authority, urgency, fear, familiarity, and trust. The exam names each technique and expects you to recognize it from a short story.
Message attacks
- Phishing: a fraudulent email that looks legitimate, aiming to steal credentials or deliver malware.
- Spear phishing: phishing aimed at a specific person, using details about them. Whaling: aimed at an executive.
- Smishing: phishing by text message. Vishing: by voice call, often with a spoofed caller ID.
- Business email compromise: the attacker uses a real or convincingly faked business account to redirect a payment or change bank details. Losses are large because the request looks routine.
Pretending
- Pretexting: an invented story that justifies the request: "I am from IT and need your password to fix your account."
- Impersonation: posing as a specific person, such as the CEO or a technician.
- Brand impersonation: posing as a known company, in email, on fake websites, or in ads.
- Typosquatting: registering look-alike domains such as examp1e.com to catch typos and host fakes.
- Watering hole: compromise a website the targets already visit, and wait.
Influence campaigns
- Misinformation: false information spread by people who believe it.
- Disinformation: false information spread deliberately to deceive.
Both are used to shape opinion, damage reputations, or distract during an attack.
In person
- Tailgating: following an authorized person through a secured door.
- Shoulder surfing: watching a screen or keypad.
- Dumpster diving: retrieving information from trash.
Why they work, and the defenses
Attackers press urgency ("today or the account closes"), authority ("this is the director"), familiarity ("we met at the conference"), and fear. Defenses are procedural: verify requests through a second channel, require callbacks for payment changes, train people to slow down, report attempts, and never bypass a process because someone sounds important.
Social Engineering, explained slowly
Hacking the human
A firewall enforces its rules every time. A person can be talked out of theirs. Social engineering is the collection of techniques for doing that, and the exam expects you to name the technique from a two-sentence story. Every technique presses one of a few buttons: authority (the boss said so), urgency (right now or else), fear (your account will be closed), familiarity (we met last week), or trust (this looks exactly like the real thing).
The message family
Phishing email pretending to be legitimate; steals credentials or delivers malware Spear phishing phishing aimed at a specific person, using details about them Whaling spear phishing aimed at an executive Smishing phishing by SMS text message Vishing phishing by voice call, often with a spoofed caller ID Business email a real or convincing business account asks for a payment or bank-detail change compromise (BEC) the request looks routine, so it is approved
BEC deserves attention because it causes the largest losses. No malware, no link, just an email that appears to come from the CFO: "Please update the vendor's bank account to this new number before the payment run." The defense is not a filter. It is a procedure: any change to payment details is verified by a phone call to a known number, never by replying to the email.
The pretending family
- Pretexting: the attacker invents a plausible story that makes the request reasonable. "This is the help desk; we are migrating mailboxes tonight and need your password to move yours."
- Impersonation: acting as a specific person, in person, by phone, or by email. The fake technician in a branded shirt. The "CEO" on a text message.
- Brand impersonation: acting as a known company. Fake login pages, fake support numbers, fake invoices with the right logo.
- Typosquatting: registering domains one keystroke from the real one: rnicrosoft.com, examp1e.com. Used for fake sites and for email that survives a glance.
- Watering hole: instead of attacking the target directly, compromise a website the target's staff already visit, such as an industry news site, and wait for them to arrive.
The influence family
- Misinformation: false content spread by people who believe it is true.
- Disinformation: false content created and spread deliberately.
Both appear in campaigns that shape opinion, damage a company's reputation, or create confusion during an actual attack.
The in-person family
- Tailgating: following someone through a secured door. Also called piggybacking when the employee knowingly holds the door.
- Shoulder surfing: reading a screen, keypad, or badge over someone's shoulder, in the office or on a train.
- Dumpster diving: pulling org charts, invoices, and sticky notes with passwords out of the trash.
Defenses are procedures, not products
Attack Defense that works BEC out-of-band verification for payment changes; separation of duties Phishing training, reporting button, email authentication (SPF, DKIM, DMARC), MFA Pretexting never give credentials to a caller; help desks never ask for passwords Tailgating access control vestibule, badge for every person, challenge strangers Shoulder surfing privacy screens, awareness Dumpster diving shredding, secure disposal Typosquatting register look-alike domains, browser warnings, training
How the exam asks it
- "An email from the CEO asks accounting to wire funds urgently to a new account." BEC; verify by phone.
- "A caller claims to be from IT and asks for the user's password to fix an issue." Pretexting.
- "Employees visiting an industry forum were infected." Watering hole.
- "A domain similar to the company's is hosting a fake login page." Typosquatting.
- "Someone in a delivery uniform walked in behind an employee." Tailgating.
What to memorize
- Phishing email, smishing text, vishing voice, spear phishing targeted, whaling executives, BEC payments.
- Pretexting is the story, impersonation is the role, brand impersonation is the company, typosquatting is the domain, watering hole is the poisoned site.
- Misinformation believed, disinformation deliberate.