Social engineering tactics are some of the most effective for hackers. Here’s a brief description of what they are, and what you can do to protect yourself and your business. We will run through the basics of phishing, watering hole, whaling, pretexting, baiting and quid pro quo attacks, and tailgating.
Phishing attacks are still the predominate form of social engineering hacks. Email and social media sites, including instant, direct and SMS messaging, are used to gather personal information, or into getting the victim to visit a malicious site.
Some common characteristics of phishing:
*Emails often appear to come from someone you know or have done business with. The email address may be just one letter off from a correct one. Images, logos and text may have been copied from legitimate sites to make it appear more convincing. Be aware, especially if anything is unusual like a money wire or poor grammar.
*There may be a sense of urgency to the email. Don’t be pressured into giving out personal information due to this.
*Don’t click on a link until you are certain it is a legitimate email. Many links appear very similar to actual websites, but be cautious. Double check the web address, and hover your mouse to see what the address actually is linked to, but don’t click yet.
A Watering Hole attack targets a specific organization where malware is installed on one or more websites that the users in the organization frequently visit. In turn, the malware is released back into the systems of the organization.
*This is a fairly common method used by state-sponsored hackers and in cyber espionage.
*These require prior research by the hacker on the victim’s web-use habits.
*Typical targets are employees of large companies, governments, and even non-profits and humanitarian groups.
*It is important to use two-factor authentication.
*Consider using a Virtual Machine.
*Be aware of the risks and keep virus protection up to date.
Pretexting is a social engineering hack where the bad actor creates a false identity in order to obtain privileged information. The hacker builds trust with the intended victim, and manipulates them into giving information. Sometimes, they will impersonate an IT person to gather information that allows them into the computer. Don’t give out confidential information such as passwords to anyone before you have verified their identity.
Baiting is when the hacker tries to convince the target that s/he has something to gain in this exchange. It’s a classic ‘trojan horse.’ Infected USB drives are left in public places, or in parking lots of targeted businesses. The hope is that an unsuspecting person will take to their computer. Or, an online version is a link on the web that promises something the user may want.
A Quid Pro Quo Attack is similar to baiting and pretexting. This is when someone poses as an IT technician, who wants to help you with your pc troubles, “troubles” you may not have even known you had—because you don’t. These can appear as pop-ups on your machine stating that you need to call a number to fix a problem. Sometimes they pose as employees of well-known tech companies. Know that companies will not contact you via a pop up or phone call to solve a pc problem.
Tailgating, also known as ‘piggybacking,’ is when an attacker uses others to get access to an otherwise restricted area. Perhaps s/he simply walks in a building behind an authorized person. These hackers are also known to dress as a delivery driver, and loaded with boxes, waits for an employee to open the door. Now, s/he is inside and hopes to access a restricted area.
Contact us today for more information on training your employees and protecting your business from social engineering.