Blogs

Social engineering is the psychological manipulation of people in the hopes of gaining access to confidential information or systems. It is a form of confidence trick for the purpose of information gathering, fraud, or system access. The attacks used in social engineering can be used to steal employees’ confidential information or data, and the most common type of social engineering happens over either phone or email. Other examples of social engineering attacks include criminals posing as service workers or technicians, so they go unnoticed when access the physical site of a business. Social Engineering Principles The main methods that cyber criminals use to perpetrate social engineering have existed for a long time. They are based on fundamental psychological principles about human behavior – attackers use these principles to gain access to sensitive data or information. Reciprocity: People tend to return a favor. For example, if an attacker is in some way generous or thoughtful, the victim may feel compelled to provide special access or otherwise bend critical rules. Commitment: When someone commits, either orally or in writing, to do something, they become more willing to honor their commitment because they then take it as a personal responsibility to fulfill. For example, on auction sites, people will get trapped into bidding higher than they may have initially intended because they wish to ‘win’ the item in question, regardless of how much the item is actually worth. Social proof: People will do things that they see other people are doing. For example, a software product endorsed by a celebrity will have a greater sense of value to people, regardless of its quality, because of the endorsement. Authority: People will tend to obey authority figures, even if they are asked to perform objectionable acts. In a social engineering attack, this may lead an employee of a targeted organization to provide information to a caller pretending to be a law enforcement official. Liking: People are easily persuaded by other people that they like. Simply being pleasant and friendly is often enough to allow special access to an attacker. Main Forms of Social Engineering Cybercriminals use social engineering to effectively administer a number of cyber attacks: Phishing: A technique of obtaining private information through manipulative means. Typically, the phisher will send an email that appears to come from a legitimate business requesting authentication of information and warning the victim of complications should it not be provided. That threat leads the victim to reveal sensitive information. Water holing: A targeted social engineering strategy that capitalizes on the trust users have in websites they regularly visit. The victim feels safe doing things they would not do in a different situation. The attacker then readies a trap for the victim at the trusted location. Quid pro quo: An attacker contacts random people at a company, claiming to be calling for a legitimate reason. This person will eventually find someone with a real problem, who is grateful for the proactive help. They will then attempt to get sensitive information from the victim while assisting with their problem. Social Engineering Defenses There are a number of defenses available to companies that will help protect against major social engineering attempts on their employees: Establishing a standard trust framework: Establishing a strong framework of trust on an employee/personnel level by training personnel on how sensitive information should be handled. Scrutinizing information: Identifying which information is sensitive and evaluating its exposure to social engineering and breakdowns in security systems. Following Security Protocols: Establishing security protocols, policies, and procedures for handling sensitive information. Training Employees: Training employees in security protocols relevant to their position. Periodic Testing: Developing a framework is important, but it is just as important that the employees are tested to make sure that they are absorbing the information. Running tests to see how employees react to controlled social engineering experiments can help adjust training and discussions in the right direction. Why Social Engineering is Important   The human systems set up around technology are consistently the weakest link in the security chain. Attention to detail when establishing training and security infrastructure can help to protect businesses from cyber attacks and their related fallout.

What is a phishing attack Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information. An attack can have devastating results. For individuals, this includes unauthorized purchases, the stealing of funds, or identify theft. Moreover, phishing is often used to gain a foothold in corporate or governmental networks as a part of a larger attack, such as an advanced persistent threat (APT) event. In this latter scenario, employees are compromised in order to bypass security perimeters, distribute malware inside a closed environment, or gain privileged access to secured data. An organization succumbing to such an attack typically sustains severe financial losses in addition to declining market share, reputation, and consumer trust. Depending on scope, a phishing attempt might escalate into a security incident from which a business will have a difficult time recovering. Phishing attack examples The following illustrates a common phishing scam attempt: A spoofed email ostensibly from myuniversity.edu is mass-distributed to as many faculty members as possible. The email claims that the user’s password is about to expire. Instructions are given to go to myuniversity.edu/renewal to renew their password within 24 hours. Several things can occur by clicking the link. For example: The user is redirected to myuniversity.edurenewal.com, a bogus page appearing exactly like the real renewal page, where both new and existing passwords are requested. The attacker, monitoring the page, hijacks the original password to gain access to secured areas on the university network. The user is sent to the actual password renewal page. However, while being redirected, a malicious script activates in the background to hijack the user’s session cookie. This results in a reflected XSS attack, giving the perpetrator privileged access to the university network. Phishing techniques Email phishing scams Email phishing is a numbers game. An attacker sending out thousands of fraudulent messages can net significant information and sums of money, even if only a small percentage of recipients fall for the scam. As seen above, there are some techniques attackers use to increase their success rates. For one, they will go to great lengths in designing phishing messages to mimic actual emails from a spoofed organization. Using the same phrasing, typefaces, logos, and signatures makes the messages appear legitimate. In addition, attackers will usually try to push users into action by creating a sense of urgency. For example, as previously shown, an email could threaten account expiration and place the recipient on a timer. Applying such pressure causes the user to be less diligent and more prone to error. Lastly, links inside messages resemble their legitimate counterparts, but typically have a misspelled domain name or extra subdomains. In the above example, the myuniversity.edu/renewal URL was changed to myuniversity.edurenewal.com. Similarities between the two addresses offer the impression of a secure link, making the recipient less aware that an attack is taking place. Spear phishing Spear phishing targets a specific person or enterprise, as opposed to random application users. It’s a more in-depth version of phishing that requires special knowledge about an organization, including its power structure. An attack might play out as follows: A perpetrator researches names of employees within an organization’s marketing department and gains access to the latest project invoices. Posing as the marketing director, the attacker emails a departmental project manager (PM) using a subject line that reads, Updated invoice for Q3 campaigns. The text, style, and included logo duplicate the organization’s standard email template. A link in the email redirects to a password-protected internal document, which is in actuality a spoofed version of a stolen invoice. The PM is requested to log in to view the document. The attacker steals his credentials, gaining full access to sensitive areas within the organization’s network. By providing an attacker with valid login credentials, spear phishing is an effective method for executing the first stage of an APT. How to prevent phishing Phishing attack protection requires steps be taken by both users and enterprises. For users, vigilance is key. A spoofed message often contains subtle mistakes that expose its true identity. These can include spelling mistakes or changes to domain names, as seen in the earlier URL example. Users should also stop and think about why they’re even receiving such an email. For enterprises, a number of steps can be taken to mitigate both phishing and spear phishing attacks: Two-factor authentication (2FA) is the most effective method for countering phishing attacks, as it adds an extra verification layer when logging in to sensitive applications. 2FA relies on users having two things: something they know, such as a password and user name, and something they have, such as their smartphones. Even when employees are compromised, 2FA prevents the use of their compromised credentials, since these alone are insufficient to gain entry. In addition to using 2FA, organizations should enforce strict password management policies. For example, employees should be required to frequently change their passwords and to not be allowed to reuse a password for multiple applications. Educational campaigns can also help diminish the threat of phishing attacks by enforcing secure practices, such as not clicking on external email links. Phishing protection from Imperva Imperva offers a combination of access management and web application security solutions to counter phishing attempts: Imperva Login Protect lets you deploy 2FA protection for URL addresses in your website or web application. This includes addresses having URL parameters or AJAX pages, where 2FA protection is normally harder to implement. The solution can be deployed in seconds with just a few clicks of a mouse. It doesn’t require any hardware or software installation and enables easy management of user roles and privileges directly from your Imperva dashboard. Working within the cloud, Imperva Web Application Firewall (WAF) blocks malicious requests at the edge of