Welcome back.
In this section, we're going to learn about social engineering, this is one of the most powerful tools
for breaking into any computer system or network, and it's one of the most important techniques you
need to be able to understand to block these kinds of attacks, whether this is coming from a computer
hacker, from an attacker on the outside or on the inside of your organization, whether it's coming
from a con artist out in real life or a predator, either online or in the real world, you need to
understand these types of techniques that social engineering attackers use so that you can keep yourself
safe, both online and in the real world.
The number one type of online social engineering attack, both because it's the most prevalent and because
it's one of the most successful, is called phishing.
This is phishing with a I say J.A.G. It's the number one attack because it's so easy to do to so many
people.
If you've ever gotten a phishing email before, it looks like it comes from someone official like your
bank, your employer, your school, your family member or friend.
And it looks like an email asking you to log in and check out an account activity or to check in to
help a friend out who's someplace else traveling in the world, for example.
So it looks like it's coming to you from someone that you recognize, someone that you do business with
your eBay or your PayPal account.
But when it comes to phishing, they're just trying to get your credentials, your username and your
password to hack into your account.
And unfortunately, phishing is number one, because it's so effective, everybody, that this isn't
just something that people do because they're dumb.
It's because we all get distracted.
We all get we are all susceptible to the same types of social engineering techniques.
That's why it's really important to understand how this happens.
Well, phishing is just sending an email and trying to get you to click through a link or to give up
your information.
But it's based on some other social engineering techniques.
And these all work together in a really effective attack.
Pretexting is the first of those.
Pretexting is pretending to be someone you're not or setting up a false pretext, a false situation.
So you say you're calling from corporate or you're calling from computer support.
You say that this you're this is an email from a friend who's in trouble.
They're traveling someplace and they need some money.
They weren't able to pay their hotel bill or they got arrested and they need access to a lawyer.
There are lots of pretexts that people use, both online and in the real world.
A predator might say, I'm a friend of your dad's, I'm a friend of your mom's.
You have to understand and you have to talk with your kids.
You have to talk with your family members about social engineering, both online and in the real world.
In a chat room, some would say that they are in your class or they're also in the same grade as you
or they work for the same company or in the same kind of job.
Pretexting just means using some false information or made up information to try to make a connection
with the user.
You'll see that in phishing emails.
You will also see that in other online and real world attacks, beating a great example is someone leaves
a USB drive out in the parking lot of your company.
And natural thing for people to do, unfortunately, is pick up that USB drive and plug it in to see
who it might be along, to see what might be on it.
Unfortunately, if they put malware on there, it may have just attacked your network from the inside
unintentionally.
You didn't know you were doing anything wrong.
But this is something important to train employees about and train your family about as well.
Don't just pick up a USB drive or accept a free download or free software.
Sometimes that clip can take you to a website that is compromised.
Quid pro quo is a common social engineering technique that means you'll get a little something if you
do something for me.
The Nigerian prince email scams are terrific and terrible example of this.
If you will help us get this money out of the country, then we will send you a portion of it or we'll
let you keep a portion of it.
Or it could be just something as simple as, hey, if you'll do this for me, I'll send you this information
or I'll give you some money.
Quid pro quo is what makes these types of attacks.
Just means this for that.
Something for something else.
Another common attack is tailgating in this can happen both online and in the real world, the most
common way that tailgating is used is you stand outside a building with some employees, maybe in a
smoke break area, and then when they go in back into work, after you struck up a few conversations,
you just follow one of them in or you come in holding a package in your hands and you wait until someone
comes to the door, you walk in right behind them and it allows you to gain access to a building.
You've seen this in movies and in television crime shows before.
Tailgating is a real thing in real life.
It can give someone access to the computers in your network, your physical premises.
And as we saw back in the very first section, physical access can mean total access.
If someone can touch your computer, they may be able to own your computer and your network.
This next to last example I'm going to give you this thing is just a voice form of phishing.
So someone makes a phone call and pretends to be someone that they're not a company it support.
You'll also see this as smooshing SMS phishing.
That's where someone sends you a simple message service or text message, pretending to be your bank,
pretending to be your employer, pretending to be an attorney, pretending to be the IRS.
They'll leave you messages or they'll call you up on the phone and they can even fake the the caller
ID number on your telephone and make you believe that it really is a call from one 800 and some government
agency.
You have to be very careful not to give out any information.
Remember, the IRS does not call most law enforcement agencies don't make phone calls.
They either send certified mail if it's the IRS or they will come in person if it's law enforcement.
The last example is the one we're actually going to work through in this section.
We are going to create a phishing attack, but not just a phishing attack, a spear phishing attack.
We're going to customize a fake phishing email for a particular individual or group of individuals.
Spearfishing is where you use some special information about the person to try to get a particular individuals
information.
Sometimes we call this whale phishing when we're going for the top person in an organization.
A great example, a sad example of spearfishing was when the Democratic National Convention was hacked
and the United States during the 2016 election cycle.
There were just a couple of key administrative accounts, key users who fell for a well, not simple,
but relatively sophisticated phishing attack like we're going to see how to build.
And they, unfortunately, unwittingly gave access to outside attackers.
So fishing and spearfishing are real techniques, all of these are real things we need to know about,
talk about with our families, with our employees and understand better so that we can avoid falling
for the social engineering types of attacks.
Usually they'll come with some sense of urgency.
So someone will work in the pretext that you have to help me with this tomorrow.
You need to do this before the end of the day.
Somebody hacked into your account.
You need to take care of it right away.
You've got to be able to understand these techniques so that you can recognize the signs of a phishing
attack and avoid the impact.
We'll see how to do that in this entire section.