Site icon Information Technology Media

what is Social Engineering

Social Engineering

Social Engineering

Social Engineering: Attacks against consumers and organizations over the internet are becoming increasingly common. it is the term for these sorts of negative behaviours, which harm people’s and organizations’ personal information and privacy. Fortunately, there are counter-measures to social engineering, just as counter-measures to assaults. In this context, we’ll look at all there is to know about cyber-attacks and how a typical organization or user might defend themselves.

what is Social Engineering?

Social engineering is a manipulation technique done by hackers that seek to trick users into exposing private or sensitive information such as passwords, bank accounts or allowing hidden downloads of malware to take control of the computer.

Cybercriminals take advantage of users’ ignorance or carelessness to bribe or steal. In the first case, by interrupting or corrupting data to cause damage or inconvenience, and in the second case, to obtain something in return such as money, access, or information.

Eight types of Social Engineering

Unfortunately for companies and users, many types of social engineering can be applied, all with the same intention: to cause harm and get something in return. The most common are the following:

1. Phishing or Identity Theft

Phishing is one of the most common social engineering attacks. It consists of cybercriminals posing as trusted brands, banks, or institutions to try to manipulate users into providing information such as logins, passwords, or downloading malicious or extortion software. . Among its variants are:

Phishing fisherman is the use of fake customer service accounts on social networks.

Spear phishing is phishing attacks targeting specific companies or users.

Whaling does not target average users; instead, it seeks to trick high-level business executives like CEOs or CFOs.

This attack usually occurs by receiving fraudulent emails claiming to be a trusted source; with this, they seek to obtain confidential data such as full name, date of birth, or account number to verify the user’s identity. Given the ignorance or carelessness of people, these cybercriminals can steal private data.

2. Vishing and Smishing

Unlike phishing, which is an attack carried out directly by email, these types of social engineering use voice and text to try to steal information.

In the case of vishing, the cybercriminal attempts to trick the user into revealing sensitive information or giving them access to their computer or another device over the phone. In this attack, the scammer scares, intimidates, or threatens the victim to get what they want. It is a prevalent type of attack, which, for example, in Mexico, has had an increase of 5%, and the most affected are usually older adults.

3. Diversion Theft

This type of social engineering targets delivery people or couriers to travel to the wrong destination and deliver the package to the bad person. This attack is made cyber-wise by stealing sensitive data and tricking the victim into sending or sharing someone else’s information (as directed by the scammer).

4. Pretext

This is a social engineering technique where the attacker creates a false scenario, where the victim feels compelled to cooperate under pretences (hence its name). For example, a scammer may pose as a police officer, auditor, or a high-ranking person in a company to intimidate another person into sharing the requested confidential information.

5. Baiting

Baiting is also a prevalent type of social engineering, through which they get victims to provide confidential information in exchange for a gift. For example, a user might check her email and see that. She has a message promising her a free item or a discount card. In exchange for answering a simple survey or filling out a form.

When the user accepts, he is usually redirected to a fake website. Where he must provide his email and password, and under this trick, he gives his confidential information. The cybercriminal then makes use of this data to send some malicious software.

6. It’s a win-win Situation

Something for Something, the fraudster impersonates a firm employee to acquire access from the inside.

For example, an attacker can pose as an IT technician and call company extensions for support. He tries until he finds someone who is in a situation where he needs help; he is attentive and asks the employee for his access so he can fix his problem.

7. Honey Trap or Honey Trap

This attack uses the feelings and emotions of the victims, as its objective is to start a romantic relationship. And then persuade people to share confidential information or pay large sums of money.

8. Watering hole

In this type of social engineering, the cybercriminal knows which websites their targets usually visit to infect them later. Thus, when the user logs in or provides their access data. They can capture them to violate your network or install a Trojan horse virus to access your network.

Also Read: Secure Apps: The Significance of Application Security

Determining the Value of Bitcoin: 5 Factors to Consider

Exit mobile version