Social engineering attacks: An explainer

What is social engineering?

Social engineering is a form of cyberattack with techniques that manipulate users into making security mistakes or giving away sensitive information. This technique leverages and manipulates human psychology, emotions, and trust to carry out malicious activities.

Social engineering attack vectors can be lethal enough to cause IT compromises, leading to a large scale business disruption with huge financial losses. Some notable social engineering events include Google and Facebook's $100 million email scam in 2019, Microsoft 365's phishing scam in 2021 and Russia's infamous spear phishing attempts on Ukranian government bodies in 2022.

The threat modeling framework, MITRE ATT&CK, provides a broad category of tactics and techniques that are widely employed by adversaries to launch cyberattacks.

Phishing is one attack technique that exploits the natural tendencies of human behavior, relying on human instincts to perform cyber hacking, and belongs to the broader bracket of social engineering tactics.

How is social engineering done?

An organization could be targeted by over 700 social engineering attacks each year. However, finding the weak links in targets might require research to achieve a successful conduct.

Normally, any social engineering attack aims to follow a basic four-phase execution cycle.

Types of social engineering attacks

Here are some common types of social engineering attacks:

 

• Phishing
• Scareware
• Pretexting
• Shoulder surfing

Phishing:

Phishing is a prevalent social engineering attack where users are tricked into giving out sensitive information, such as login credentials, credit card numbers, or other personal data by introducing a sense of fear or urgency. The attacker generally produces a phony email or website that mimics a real one to gain the victim's trust.

An example of an email phishing is given below. Once the user clicks the link below, a malware might be introduced in the system that will work as per the requirement.

Scareware:

Scareware is a type of malicious software designed to intimidate or scare the user into completing specific actions. Often masquerading as legitimate antivirus software, it falsely alerts users to non-existent threats on their computers, such as viruses or malware. These alerts often appear as pop-ups or notifications that scare the victim into believing that their computer is under attack by a virus, spyware, or other type of malware.

Once they perform the intended action, the scareware gets installed in the victim's system, which can cause various issues, including computer slowdown, data theft, or continuous pop-up of deceptive messages and alerts, thereby compromising system security and user privacy.

Pretexting:

In this technique, the attacker impersonates a credible authority with a believable pretext in the organization to trick the victim to provide sensitive information.

It can be carried out over phone, text, or in person where the attacker manipulates the victim by using a credible story for the victim to believe.

Shoulder surfing:

In this type of social engineering act, the attacker simply surfs over the victim's shoulder to gain sensitive information like passwords, date of birth, and an ATM pin.

Shoulder surfing attacks are usually carried out in crowded public spaces where the attackers can easily blend in with the crowd to surf through your system without drawing attention.

How can you protect yourself from social engineering?

Since social engineering attacks leverage basic human qualities, it can be difficult to predict or detect them beforehand. But there are some necessary proactive steps you can take to best avoid these attacks that contribute to almost 95% of all the successful enterprise network attacks.

How can Log360, a SIEM, help with social engineering attacks?

• User Entity Behavior Analysis (UEBA): Log360's UEBA module uses ML to analyze user behavior patterns and identify anomalies. This can flag activities like sudden changes in access patterns or attempts to access unusual resources, which could be potential IOCs of a socially engineered attack.
• Threat intelligence and correlation

  Log360 is integrated with open source threat intelligence feeds like STIX/TAXI, providing context about known phishing domains, malicious IP addresses, and stolen credentials. It can also correlate this information with user activity to detect suspicious attempts, if the attacker uses novel social engineering techniques.

• Alerting and notification Log360 can send real-time alerts and notifications for suspicious activities, enabling you to respond quickly to potential attacks. You can also set up custom alerts based on specific criteria to focus on social engineering tactics.