Dr. Erdal Ozkaya
Search
  • Home
  • About Me
  • Home
  • About Me
  • Home
  • Cybersecurity, Free Events, Feedback, Awards
  • Be aware Social Engineering – 2007

Be aware Social Engineering – 2007

Be aware: Social Engineering
Erdal2021-07-14T20:09:06-04:00

Be aware Social Engineering

Great night with great people who were interested to learn about Social Engineering.

Lots of Demos, lots of fun…

Thank you for attending and thank you for the great present .

As promised I will keep in touch via my Better Together User group.

And a special thanks for the sponsors , with your support everything is much easier.

Social Engineering attack on stage Erdal
Social Engineering attack on stage Erdal

A life social engineering demo, yes the speaker can grab an empty chair and starts to talk about YOU, with the information which was collected from the internet.

I highly recommend to take Social Engineering serious.

What is Social Engineering

Table of Contents

      • What is Social Engineering
        • Staying safe from social engineering attacks
  • What Is Social Engineering? The Human Element in the Technology Scam
    • Social Engineering Defined
    • How Does Social Engineering Work?
    • History of Social Engineering
      • Target Data Breach
      • Yahoo Security Breaches
      • CIA Attack
    • Types of Social Engineering
    • How to Prevent and Protect Against Social Engineering
    • What’s the Difference Between Ransomware vs. Malware vs. Social Engineering vs. Phishing?

Social Engineering is, involving clever manipulation of the natural human tendencies of trust to obtain information to help facilitate fraud, network intrusion, industrial espionage, and identity theft or network/system disruption. I do like also the definition from Bruce Schneier: “Amateurs Hack Systems, Professional hack People”

To gain the trust of the people Social Engineers trick their victims with different tactics like:

–         Pretending to be someone important

–         Appearing to be “just like ‘you’”

–         Trying to convince You to share confidential information

Staying safe from social engineering attacks

Although social engineering attacks can seem terrifying, as explained throughout the book, the effects of these attacks can be significantly mitigated if appropriate measures are taken.

Social engineers are clever, methodical and patient. They often start by building a rapport with more accessible people in an organization – like an administrative assistant or a guard at the gate to get information about their ultimate target, who may be as many as ten steps higher up on the corporate food chain.

The criminal may begin by gathering personal nuggets about team members, as well as other “social cues” to build trust or even successfully masquerade as an employee. Some of their strategies are incredibly simple and insidious:

What Is Social Engineering? The Human Element in the Technology Scam

Be aware Social Engineering
Be aware Social Engineering

It’s often noted that humans are the weakest link when it comes to cybersecurity. To exploit that vulnerability, many hackers engage in social engineering to support their cyberattack efforts and obtain valuable information. Social engineers target humans, rather than technology, to gather useful intel.

Hollywood frequently glorifies the savvy con man for his ability to charm and disarm. In the movie “Catch Me If You Can,” Leonardo DiCaprio portrays a young Frank Abegnale, a notorious con man, who impersonated airline personnel, a lawyer and various other roles to commit check forgery and fraud. Abegnale later used his talents to become a security consultant.

Social engineering brings the con into the digital age. Instead of using personal interactions to build rapport and charm users into certain actions, social engineering leverages a lack of awareness around digital tools and the willingness to share on digital platforms. The end result is the same: psychological manipulation that leads to handing over sensitive info.

Social Engineering Defined

The term social engineering refers to methods employed by hackers to gain the trust of an end user so that the hacker can obtain information that can be used to access data or systems. Social engineering typically involves impersonating representatives of legitimate organizations to manipulate people into supplying information such as passwords or personal details.

Social engineering can involve phone calls, emails or texts. Sometimes referred to as “human hackers,” social engineers employ a variety of methods to convince users to divulge information, often masquerading as tech support or bank employees.

How Does Social Engineering Work?

Hackers develop different tactics to support their social engineering pursuits. Most social engineering attacks follow this path:

  1. Research the target. The purpose of social engineering is to convince a user that you represent a trusted institution. Social engineers will often attempt to develop a rapport by offering easily obtainable details, such as birthdate or phone number, as evidence of their legitimacy. Much of this information is publicly available, and social engineers typically scout social media to gather this type of vulnerable data.
  2. Make contact with the target. The attacker makes contact directly with the target. Social engineers use the information they’ve gathered to validate their fake identity. The target is then asked to provide sensitive information the hacker can exploit.
  3. Attack. Using the details they have covertly obtained, social engineers launch their attack. This could involve accessing systems using acquired passwords, performing a classic case of stolen identity or putting the information to use for personal or political gain.

History of Social Engineering

Social engineering is a practice that is as old as time. As long as there has been coveted information, there have been people seeking to exploit it.

The term social engineering was first used by Dutch industrialist J.C. Van Marken in 1894. Van Marken suggested that specialists were needed to attend to human challenges in addition to technical ones. In 1911, Edward L. Earp wrote Social Engineer as a way to encourage people to handle social relations similarly to how they approach machineries.

In modern times, social engineering has come to reference the practice of deceiving people to obtain valuable information, which is often followed up by a cyberattack.

Here are some of the most famous cybersecurity social engineering examples.

Target Data Breach

In 2013, more than 110 million customers fell victim to a social engineering attack on Target. Social engineering techniques were used on an HVAC company that had remote access to Target’s network. The HVAC company was then compromised with malware, which in turn infected Target’s systems. The attack resulted in the loss of emails, names, addresses, phone numbers and credit and debit card information.

Yahoo Security Breaches

In 2013 and 2014, two attacks compromised Yahoo email-user information. The second attack was accomplished via a spear-phishing campaign targeted to a Yahoo engineer. The individual took the bait, giving hackers access to names, email addresses, phone numbers, dates of birth and passwords. This attack also gave hackers the ability to access user accounts without passwords.

CIA Attack

A 15-year-old was able to take control of the secure emails of John Brennan, the director of the CIA. Kane Gamble used social engineering to convince Verizon to provide personal details about Brennan, which he later used to impersonate the CIA director. Gamble was able to access Brennan’s email by changing security questions and passwords with gathered intel, allowing the 15-year-old to view sensitive military information.

Types of Social Engineering

Social engineering is a general term that refers to a broad range of manipulation tactics used by hackers to acquire information.

  • Baiting: Baiting is a social engineering attack where the attacker entices the user with a free item to lure them into clicking on a link. This may come in the form of a free music or movie download lined up with the user’s interests. When the unsuspecting user clicks the link, they become infected with malware.
  • Phishing: Phishing is a type of social engineering attack that uses email, phone or text to entice a user to click on a malicious link. The communication appears to be from a legitimate source connected to the user. When the user selects the ill-intentioned link, the user’s device or system becomes infected with malware and data is often compromised.
  • Pretexting: This tactic is one more commonly associated with the term social engineering. With pretexting, an individual impersonates a representative from a trusted organization with the goal of acquiring sensitive information. This social engineering technique relies heavily on gathering research before initiating contact with the target.
  • Quid Pro Quo: The quid pro quo attack is a variation of baiting. Often known as the “something for something” social engineering technique, the quid pro quo attack involves promising a service or benefit for complying with the request of an attacker. For example, a social engineer may promise a free software upgrade to entice a user to download what is actually malware to their system.
  • Reverse Social Engineering: In this kind of social engineering scheme, the attacker convinces a target that they have a problem or issue and then positions themselves with a solution. The target then initiates contact with the social engineer believing that they are able to solve their problem.
  • Tailgating: This social engineering tactic is a physical attack. With tailgating, a hacker gains access to restricted areas of a building by following an approved employee into the building and piggybacking on their credentials. In these cases, the social engineer often pretends to be an employee or even a delivery person.
  • Whaling and Spear Phishing: These attacks are a variation of phishing and, because they target a specific individual, they require a significant amount of research. In whaling attacks, these individuals are high-profile people, often executives or the C-suite.

How to Prevent and Protect Against Social Engineering

The best form of prevention against social engineering attacks is end-user training. Teaching your employees how to recognize social engineering tactics and avoid them is of the utmost importance.

Here are some points to help support your training efforts.

  • Research any suspicious calls, emails or texts.
  • Open attachments only from trusted sources.
  • Immediately delete any emails or texts asking for passwords or personally identifiable information (PII), such as social security numbers or financial information.
  • Don’t open any emails promising prizes or notification of winnings.
  • Download software only from approved sources.
  • Be wary of urgent requests or solicitations for help.
  • Make sure you have spam filters and antivirus software on your device.
  • When in doubt, contact IT to confirm any technology-related requests.

What’s the Difference Between Ransomware vs. Malware vs. Social Engineering vs. Phishing?

Ransomware, malware, social engineering and phishing all encompass different forms of ill-intentioned cyberattacks.

  • Malware is a general term formed by the words “malicious” and “software” that describes different types of software intended to compromise systems, obtain sensitive data or gain unsanctioned access to a network.
  • Ransomware is a category of malware where attackers use various methods to encrypt your data, making it inaccessible, or bar you from entry to a particular system or device. Attackers then demand a ransom in exchange for reinstating your access.
  • Social Engineering, by contrast, is a method used to extract sensitive details by way of human manipulation. With social engineering, hackers connect with users while pretending to represent a legitimate organization and seek to ascertain critical information such as account numbers or passwords.
  • Phishing is a form of social engineering that involves email, phone, text or illegitimate websites. In both instances, the collected information is used to access protected accounts or data.

While our guide acts as an introduction into the threats posed by social engineering, this is by no means an exhaustive list. Social engineering and the cybersecurity world change on a daily basis, and attacks are becoming increasingly sophisticated. The best way to combat cyberattacks is to stay informed about the latest attacks.

 

Read more about Cybersecurity.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


Related Posts

Secrets of Windows

Recommend web sites for IT Security Pros : Free 2 learn

  Since I am delivering many FREE online classes, I started to receive if not hundreds, tens of emails... read more
Erdal Ozkaya

Cloud Alliance Cybersecurity Interview – watch 4 free

Cloud Alliance Cybersecurity Interview with Dr Ozkaya In this interview we talked all about The Cloud, Cybersecurity and tip and tricks... read more
Future of AI in Cyber Security Dr erdal Ozkaya

Future of AI in Cyber Security Free Video 2020

Future of AI in Cyber Security amidst COVID 19 | Discussion Panel Watch here : https://youtu.be/E-iuf6w3f0w   DR. ERDAL OZKAYA - Managing Director/ Head... read more
Turkish Standard Organization Erdal Ozkaya

Turkish Standard Organization – Award 2017

Turkish Standard Organization It was a great Cybersecurity event at the Turkish Standard Organization (TSE). I would like to thank one... read more
Security Exploit

New Windows 10 Security Exploit Can Read All Your Files – What You Need To Know

New Windows 10 Security Exploit A security researcher with a history of releasing zero-day exploits for the Windows operating system has... read more
Hacker Tools for Ethical Hackers by Erdal Ozkaya

Hacker Tools for Ethical Hackers to Protect Windows Clients

Hacker Tools for Ethical Hackers to Protect Windows Clients If you want to really protect your Windows environment, then you should... read more
Top 10 Best Book For Cyber Security Reviews

Top 10 Best Book For Cyber Security

Top 10 Best Book For Cyber Security The Sawfinder team studied on 46978 reviews available online for Book For Cyber Security,... read more
CYBERSECURITY SUMMIT BANGLADESH

CYBERSECURITY SUMMIT BANGLADESH -2021 – Free to join

CYBERSECURITY SUMMIT BANGLADESH Cyber Security Summit is the nation’s most innovative cyber security-technology event in Bangladesh, offering unique educational, collaborative, and... read more
Expert Speaker Dr Erdal Ozkaya

Supply Chain Cybersecurity Summit 2021

Supply Chain Cybersecurity Summit 2021 I am happy to announce that I will be one of the expert speakers at the... read more
From the Battlefield to Boardroom

IBM and Economic Times DataCon 2020 -Opportunity to join free

IBM and Economic Times I am happy to announce that I will be speaking in the Data Con Virtual Data Summit... read more

Categories

  • About Dr Erdal Ozkaya (298)
    • Awards (96)
    • Erdal in the news (118)
    • Feedback (90)
    • My Books (54)
    • Who is Dr Erdal Ozkaya ? (2)
  • Announcemets (302)
  • Artificial Intelligence AI (10)
  • Certification (52)
  • Cloud Computing (72)
  • Cybersecurity (322)
  • Cybersecurity Leadership (52)
  • Financial Sector (31)
  • Forensics (17)
  • Free Events (156)
  • General (133)
  • How to …? (63)
  • ISO 2700x (12)
  • News (38)
  • Reviews (77)
    • Book Reviews (33)
    • Free E-Books (13)
    • Hardware Review (9)
    • Security Review / Reports (10)
    • Software Review (8)
  • Video Tutorials (101)
  • What is new? (27)
  • Windows (30)

Recent Comments

  • Erdal on Free EDR Certification Training
  • SANDEEP SHRIVASTAV on Free EDR Certification Training
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Erdal on Siber Güvenlik Saldiri ve Savunma Stratejileri – NEW B00K

Archives

Dr. Erdal Ozkaya © Copyright 2023. All Rights Reserved.