In this lesson,
we're going to focus
on the different types of social engineering attacks,
including phishing,
tailgating,
piggybacking,
shoulder surfing,
eavesdropping,
and dumpster diving.
Now, before we get into the specific attacks,
let's define social engineering.
Social engineering is any attempt to manipulate users
into revealing confidential information
or performing other actions
that are detrimental to that user
or the security of our systems.
Social engineering is always focused on the human element
and trying to find a way
to bypass our systems technical controls
by simply hacking the human
instead of hacking the technology.
For example, if I wanted to break into your wireless network
and I found that you had implemented a long, strong password
for your WPA2-AES encrypted network,
it could take me years upon years
to brute force that password.
But if I instead figure out a way to trick you or your users
into sharing that password with me,
I might be able to access the network by the end of the day.
That's the idea of social engineering.
In most of our networks,
the weakest link in our security
is our end users and our employees.
This is why conducting good end user cybersecurity training
is so important to the security of your organization.
So, let's take a look at a few social engineering attacks.
The first one we have is phishing.
A phishing attack occurs
when an attacker sends an email
in an attempt to get a user to click a link.
For example, if an attacker is going to send an email
claiming there from PayPal
and asking you to confirm your account information,
this is a prime example of a phishing attack.
In this example, the attacker may include PayPal's logo,
the same format that PayPal uses in their emails normally,
and other things that make it appear legitimate.
But if you or your users click on that link,
it would instead take you to a PayPal login page
hosted on the attacker site
where they're going to try to get you to log in
by entering your username and your password,
and now, they have your account details
and can steal any money you may have in your account.
Now, how many people do you think fall for this?
Well, you'd actually be really surprised
because the answer is a lot of people.
In phishing attempts
that I've done as part of a penetration test,
I've personally seen response rates
as high as 60% or 70% of users
clicking the links inside those emails.
Even when I include things like bad grammar,
poor spelling,
improper logos,
and other things like that,
users still end up clicking the links
at a rate about 30% to 40%.
This means phishing works really well for an attacker
and it's really hard for us to prevent.
Now, phishing is a bad thing.
And the best thing you can do to prevent it
is really train all of your end users
and make them aware of it.
Now, phishing itself takes one of three forms.
This is either known as phishing,
spear phishing,
or whaling phish.
In phishing,
this is the most broad type of these three.
In a phishing campaign,
an attacker isn't really targeting
any particular person or group,
but instead sends out emails.
They're likely to capture the most people.
For example, the PayPal phishing email I mentioned earlier
is a great form of phishing
because there's over 377 million users of PayPal.
So, if I just sent out that email
to every email address I had,
most likely,
a lot of those people are going to have PayPal accounts
and they'll possibly click the links in my email.
Spearfishing, on the other hand, is more targeted.
For example,
let's pretend that you are a member of a small local bank
called DT Savings and Loan.
Now, unfortunately, DT Savings and Loan
had a data breach last year,
and that resulted in all the names and emails
of all their account holders
being downloaded by that attacker.
That list is now on the dark web.
Now, an enterprising young hacker
decides to craft a spear phishing email
that targets a hundred of the users on that list.
In that email they create,
they pretend to be from DT Savings and Loan,
and they only send this email to people they know
have accounts at DT Savings and Loan.
You see the difference?
Instead of trying to send the email to a million people
and hoping some of them have a PayPal account,
instead, we are now targeting people we know
have a banking relationship
with DT Savings and Load.
The final type of phishing we have is known as whaling.
Whaling is like spearfishing,
but it's focused on key executives within an organization,
such as your CEO, COO, CFO, CIO,
and many other key leaders, executives, and managers
within your company.
Now, the second type of social engineering attack we have
is known as tailgating.
Tailgating is going to occur
when an attacker attempts to enter a secure portion
of the organization's building
by following an authorized person
into that area
without their knowledge or consent.
For example,
if I just went up to the server room door
and I swiped my access badge
and I entered my pin,
the door would beep and unlock
and I can walk in
because I'm part of the authorized personnel list.
Now, as I open the door and walk through,
but before the door shuts behind me,
somebody could sneak in
and get in there without my knowledge.
That would be tailgating.
For this reason,
you should always train your employees
to pull the door shut behind them
and not simply walk away
in hopes that force of gravity
is going to shut the door for them.
Now, the other side of this is known as piggybacking.
This is something that is similar to tailgating,
but it occurs with the employee's knowledge or consent.
Now, piggybacking might occur
when an attacker walks up to a secure area
carrying a bunch of boxes,
and they ask somebody to nicely open the door for them
because their hands are full.
If the employee, trying to be nice,
opens the door and lets the attacker walk into the building,
this is known as piggybacking
because two people are entering on one swipe
of the employee's access card.
The next social engineering attack we have to talk about
is known as shoulder surfing.
Now, shoulder surfing occurs
when attacker comes up behind an employee
and tries to use direct observation
to obtain authentication information.
For example, you're sitting at your desk
and you're logging into your computer in the morning.
If I were to walk up near you
and look over your should as you typed in your password,
I might see your fingers start going
P-A-S-S-W-O-R-D, password.
Now, I know what your password is.
Now, this is the idea of shoulder surfing
because I'd looked at your hands as you were doing it.
Now, usually it won't be as obvious
as me standing right behind you
and looking over your shoulder,
but it can take a lot of different forms.
Maybe I work at the desk next to yours
and I glance over your computer screen
and I see your bank balance or your credit card number
or something like that.
Any kind of information that someone's able to see
that they're not really authorized to see
could be gained using shoulder surfing.
In the same way,
I can use my eyes to conduct shoulder surfing.
I can also use my ears to conduct eavesdropping.
Now, maybe I'm going to stand around
while you're talking with your boss,
and I overhear you telling him some information
about the projections
from next quarter's profits.
By listening to your conversation
and doing that direct observation with my ears,
I'm now able to listen in on that conversation
and get the information that I might want to get.
The final method of social engineering we have
is known as dumpster diving.
Now, dumpster diving occurs
when an attacker actually scavenges
for personal or confidential information
inside the garbage or recycling containers.
Yes, I know it sounds dirty.
But guess what?
This works really well.
And so, hackers are willing to do it
because they will find some really great information
inside those dumpsters.
If the attacker needs to break into an organization,
they're first going to look through your trash for clues.
For example, maybe, I can perform dumpster diving
against an organization
before I do a pen test.
And from there, I can find a phone list.
Now, I have people's names and their positions
and their phone numbers,
and maybe even their emails.
All of this is great information for me to use.
So, how do you prevent an attacker
from gaining access to your information
using dumpster diving?
Well, you either need to shred your paperwork
prior to throwing it away
using a crosscut shredder,
or you need to use a locked trash can
that only your organization
and the waste management company
have access to.